@raybase/core 0.0.2 → 0.3.3

package/dist/do.js

@@ -0,0 +1,4526 @@
+import { DurableObject } from "cloudflare:workers";
+import { withHostUserRoleCeiling } from "./host-user.js";
+import { appNowIso, devTimeTravelStateKey, hydrateAppClock, toRealMs, wallNowIso, wallNowMs } from "./clock.js";
+import { agentFollowUpAlarmWork, dispatchDueAgentFollowUps, listUnhandledLapsedAgentFollowUps } from "./agent-follow-up-store.js";
+import { syncDueAgentSkillSources } from "./agent-skill-import.js";
+import { claimDueAgentSchedules } from "./agent.js";
+import { claimDueAgentWakes } from "./agent-wakes.js";
+import { batchChildIdempotencyKey, batchContinuationIdempotencyKey, nextCronRun } from "./jobs.js";
+import { normalizeStoredAdminRole } from "./admin-role.js";
+import { auditArchiveObjectKey, isoToSqliteTimestamp, serializeAuditArchiveRows, sha256Hex, validateAuditArchiveWindow } from "./audit-archive.js";
+import { raybaseApplicationSystemTableSql, raybaseSystemTableSql } from "./auth-schema.js";
+import { RaybaseDataReadDeniedError } from "./data-client.js";
+import { backupDatabaseProtocolLimits, raybaseBackupRestoreJournalTableName, raybaseBackupRestoreSchemasTableName, raybaseBackupRestoreSessionsTableName, raybaseBackupStateTableName } from "./db.js";
+import { RaybaseBackupError } from "./backup-crypto.js";
+import { backupFormatLimits, encodeBackupLogicalRecord } from "./backup-format.js";
+import { raybaseImportSystemTableSql } from "./imports.js";
+import { classifyReadPolicy } from "./policies.js";
+import { mergeRaybaseRuntimeClaims } from "./platform.js";
+import { assertRealtimeListOptions, projectChangeForSubscriber } from "./realtime.js";
+import { isRaybaseSearchInternalTable, raybaseSearchSchemaSql } from "./search.js";
+import { createTableSql } from "./schema.js";
+import { randomId } from "./sql.js";
+const realtimeSchemaKey = "raybase:realtime:schema";
+const agentAlarmClaimsKey = "raybase:agent-alarm:claims";
+const realtimeConfigKey = "raybase:realtime:config";
+const realtimeAuthKey = "raybase:realtime:auth";
+const realtimeSweepMs = 60_000;
+const followUpLapseRetryMs = 60_000;
+const followUpOutstandingRetryMs = 60_000;
+const followUpSafetySweepMs = 5 * 60_000;
+const backupStateTable = raybaseBackupStateTableName;
+const backupRestoreJournalTable = raybaseBackupRestoreJournalTableName;
+const backupRestoreSchemasTable = raybaseBackupRestoreSchemasTableName;
+const backupRestoreSessionsTable = raybaseBackupRestoreSessionsTableName;
+const backupOperationalTables = new Set([
+    backupStateTable,
+    backupRestoreJournalTable,
+    backupRestoreSchemasTable,
+    backupRestoreSessionsTable
+]);
+const sha256HexPattern = /^[0-9a-f]{64}$/;
+const backupOperationIdPattern = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+function splitSqlStatements(sql) {
+    // Drizzle migration files separate statements with an explicit marker, which
+    // is the only safe way to split SQL that may contain ";" inside literals or
+    // trigger bodies. Legacy full-schema bundles have no marker and contain only
+    // generated CREATE TABLE statements, so the ";" split stays correct there.
+    const statements = sql.includes("--> statement-breakpoint") ? sql.split(/-->\s*statement-breakpoint/) : sql.split(";");
+    return statements
+        .map((statement) => statement.replace(/;\s*$/, "").trim())
+        .filter(Boolean);
+}
+function sqlIdentifier(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+function backupError(code, message) {
+    throw new RaybaseBackupError(code, message);
+}
+function validateBackupOperationId(value, label = "Backup operation id") {
+    if (!backupOperationIdPattern.test(value)) {
+        backupError("BACKUP_LIMIT_EXCEEDED", `${label} is invalid`);
+    }
+    return value;
+}
+function validateBackupDigest(value, label) {
+    if (!sha256HexPattern.test(value)) {
+        backupError("BACKUP_ARCHIVE_CORRUPT", `${label} must be a lowercase SHA-256 digest`);
+    }
+    return value;
+}
+function backupNonNegativeInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        backupError("BACKUP_LIMIT_EXCEEDED", `${label} must be a non-negative safe integer`);
+    }
+    return value;
+}
+function backupLogicalValue(value) {
+    if (value === null)
+        return { type: "null" };
+    if (typeof value === "string") {
+        if (new TextEncoder().encode(value).byteLength > backupFormatLimits.textValueBytes) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "SQLite text value exceeds the logical backup limit");
+        }
+        return { type: "text", value };
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "SQLite numeric value is not finite");
+        }
+        if (Number.isInteger(value)) {
+            if (!Number.isSafeInteger(value)) {
+                backupError("BACKUP_LIMIT_EXCEEDED", "SQLite integer cannot be represented exactly by the Workers SQL API");
+            }
+            return { type: "integer", value: BigInt(value) };
+        }
+        return { type: "real", value };
+    }
+    const bytes = new Uint8Array(value.slice(0));
+    if (bytes.byteLength > backupFormatLimits.blobValueBytes) {
+        backupError("BACKUP_LIMIT_EXCEEDED", "SQLite BLOB exceeds the logical backup limit");
+    }
+    return { type: "blob", value: bytes };
+}
+function logicalValueBinding(value) {
+    switch (value.type) {
+        case "null":
+            return null;
+        case "text":
+        case "real":
+            return value.value;
+        case "integer": {
+            const number = Number(value.value);
+            if (!Number.isSafeInteger(number) || BigInt(number) !== value.value) {
+                backupError("BACKUP_LIMIT_EXCEEDED", "Restore integer cannot be represented exactly by the Workers SQL API");
+            }
+            return number;
+        }
+        case "blob":
+            return value.value.slice().buffer;
+    }
+}
+function concatBackupBytes(chunks) {
+    const length = chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+    const output = new Uint8Array(length);
+    let offset = 0;
+    for (const chunk of chunks) {
+        output.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return output;
+}
+function restoreStatusFromRow(row) {
+    if (!row || row.phase === "completed") {
+        return {
+            active: false,
+            operationId: row?.operationId ?? null,
+            phase: row?.phase ?? null,
+            undoBookmark: row?.undoBookmark ?? null,
+            sourceSha256: row?.sourceSha256 ?? null,
+            nextBatchIndex: Number(row?.nextBatchIndex ?? 0),
+            recordCount: Number(row?.recordCount ?? 0),
+            rowCount: Number(row?.rowCount ?? 0),
+            tableCount: Number(row?.tableCount ?? 0),
+            currentTableId: row?.currentTableId ?? null,
+            error: row?.error ?? null
+        };
+    }
+    return {
+        active: true,
+        operationId: row.operationId,
+        phase: row.phase,
+        undoBookmark: row.undoBookmark,
+        sourceSha256: row.sourceSha256,
+        nextBatchIndex: Number(row.nextBatchIndex),
+        recordCount: Number(row.recordCount),
+        rowCount: Number(row.rowCount),
+        tableCount: Number(row.tableCount),
+        currentTableId: row.currentTableId,
+        error: row.error
+    };
+}
+/**
+ * Tokenize only the SQLite syntax needed to identify a statement boundary.
+ * Quoted literals/identifiers and comments are consumed as lexical units, so
+ * their semicolons never become framing. Trigger-body semicolons are handled
+ * separately by isSingleSqliteCreateStatement.
+ */
+function sqliteStatementFramingTokens(sql) {
+    const tokens = [];
+    let index = 0;
+    while (index < sql.length) {
+        const char = sql[index];
+        const next = sql[index + 1];
+        if (/\s/.test(char)) {
+            index += 1;
+            continue;
+        }
+        if (char === "-" && next === "-") {
+            index += 2;
+            while (index < sql.length && sql[index] !== "\n" && sql[index] !== "\r")
+                index += 1;
+            continue;
+        }
+        if (char === "/" && next === "*") {
+            const end = sql.indexOf("*/", index + 2);
+            if (end < 0)
+                return null;
+            index = end + 2;
+            continue;
+        }
+        if (char === "'" || char === '"' || char === "`") {
+            const quote = char;
+            index += 1;
+            let closed = false;
+            while (index < sql.length) {
+                if (sql[index] !== quote) {
+                    index += 1;
+                    continue;
+                }
+                if (sql[index + 1] === quote) {
+                    index += 2;
+                    continue;
+                }
+                index += 1;
+                closed = true;
+                break;
+            }
+            if (!closed)
+                return null;
+            tokens.push({ kind: "content" });
+            continue;
+        }
+        if (char === "[") {
+            const end = sql.indexOf("]", index + 1);
+            if (end < 0)
+                return null;
+            index = end + 1;
+            tokens.push({ kind: "content" });
+            continue;
+        }
+        if (char === ";") {
+            tokens.push({ kind: "semicolon" });
+            index += 1;
+            continue;
+        }
+        if (/[A-Za-z_]/.test(char)) {
+            const start = index;
+            index += 1;
+            while (index < sql.length && /[A-Za-z0-9_$]/.test(sql[index]))
+                index += 1;
+            tokens.push({ kind: "word", value: sql.slice(start, index).toUpperCase() });
+            continue;
+        }
+        tokens.push({ kind: "content" });
+        index += 1;
+    }
+    return tokens;
+}
+function isSingleSqliteCreateStatement(sql) {
+    const tokens = sqliteStatementFramingTokens(sql);
+    if (!tokens)
+        return false;
+    const trigger = /^CREATE\s+(?:UNIQUE\s+)?TRIGGER\b/i.test(sql);
+    if (!trigger) {
+        const terminator = tokens.findIndex((token) => token.kind === "semicolon");
+        return terminator < 0 || terminator === tokens.length - 1;
+    }
+    let bodyStarted = false;
+    let caseDepth = 0;
+    let bodyEnded = false;
+    let terminatorSeen = false;
+    for (const token of tokens) {
+        if (!bodyStarted) {
+            if (token.kind === "semicolon")
+                return false;
+            if (token.kind === "word" && token.value === "BEGIN")
+                bodyStarted = true;
+            continue;
+        }
+        if (!bodyEnded) {
+            if (token.kind === "word" && token.value === "CASE") {
+                caseDepth += 1;
+            }
+            else if (token.kind === "word" && token.value === "END") {
+                if (caseDepth > 0)
+                    caseDepth -= 1;
+                else
+                    bodyEnded = true;
+            }
+            continue;
+        }
+        if (token.kind !== "semicolon" || terminatorSeen)
+            return false;
+        terminatorSeen = true;
+    }
+    return bodyStarted && bodyEnded;
+}
+function validateRestoreDdl(sql) {
+    const trimmed = sql.trim();
+    if (!/^CREATE\s+(?:UNIQUE\s+)?(?:TABLE|INDEX|TRIGGER|VIEW)\b/i.test(trimmed)) {
+        backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore DDL must be a CREATE statement");
+    }
+    const lowered = trimmed.toLowerCase();
+    for (const tableName of backupOperationalTables) {
+        if (lowered.includes(tableName.toLowerCase())) {
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore DDL targets Core backup-maintenance state");
+        }
+    }
+    if (trimmed.includes("--> statement-breakpoint") || trimmed.includes("\0")) {
+        backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore DDL contains unsupported statement framing");
+    }
+    if (!isSingleSqliteCreateStatement(trimmed)) {
+        backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore DDL contains more than one statement");
+    }
+}
+function systemIndexColumns(index) {
+    return Array.isArray(index) ? index : index.columns;
+}
+function systemIndexName(table, index) {
+    if (!Array.isArray(index) && index.name)
+        return index.name;
+    return `${table.name}_${systemIndexColumns(index).join("_")}_idx`;
+}
+function systemTableStatements(table) {
+    return [
+        createTableSql(table).replace(/;\s*$/, ""),
+        ...table.indexes.map((index) => {
+            const unique = !Array.isArray(index) && index.unique ? "UNIQUE " : "";
+            const where = !Array.isArray(index) && index.where ? ` WHERE ${index.where}` : "";
+            return `CREATE ${unique}INDEX IF NOT EXISTS ${sqlIdentifier(systemIndexName(table, index))} ON ${sqlIdentifier(table.name)} (${systemIndexColumns(index).map(sqlIdentifier).join(", ")})${where}`;
+        })
+    ];
+}
+function sqlLiteral(value) {
+    if (value === null || value === undefined)
+        return "NULL";
+    if (typeof value === "number")
+        return Number.isFinite(value) ? String(value) : "NULL";
+    if (typeof value === "boolean")
+        return value ? "1" : "0";
+    if (value instanceof ArrayBuffer) {
+        return `X'${Array.from(new Uint8Array(value))
+            .map((byte) => byte.toString(16).padStart(2, "0"))
+            .join("")}'`;
+    }
+    return `'${String(value).replace(/'/g, "''")}'`;
+}
+const statementSeparator = ";\n--> statement-breakpoint\n";
+const jobSchemaSql = `
+CREATE TABLE IF NOT EXISTS "_job_runs" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "jobName" TEXT NOT NULL,
+  "status" TEXT NOT NULL,
+  "inputJson" TEXT NOT NULL,
+  "inputHash" TEXT,
+  "idempotencyKey" TEXT,
+  "actorKind" TEXT NOT NULL,
+  "actorId" TEXT,
+  "runAsKind" TEXT NOT NULL,
+  "runAsId" TEXT,
+  "attempt" INTEGER NOT NULL DEFAULT 0,
+  "maxAttempts" INTEGER NOT NULL DEFAULT 1,
+  "queueMessageId" TEXT,
+  "workflowInstanceId" TEXT,
+  "leaseOwner" TEXT,
+  "leaseExpiresAt" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "availableAt" TEXT NOT NULL,
+  "startedAt" TEXT,
+  "endedAt" TEXT,
+  "expiresAt" TEXT,
+  "progressJson" TEXT,
+  "resultJson" TEXT,
+  "errorJson" TEXT,
+  "artifactJson" TEXT,
+  "createdBy" TEXT,
+  "retryOfRunId" TEXT,
+  "scheduleKey" TEXT,
+  "scheduleGeneration" INTEGER,
+  "scheduleBookedAt" TEXT,
+  "concurrencyKey" TEXT,
+  "rateLimitKey" TEXT,
+  "deferrals" INTEGER NOT NULL DEFAULT 0,
+  "deferredAt" TEXT,
+  "deferredReason" TEXT,
+  "wokenAt" TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_job_runs_idempotency_idx"
+  ON "_job_runs" ("jobName", "idempotencyKey")
+  WHERE "idempotencyKey" IS NOT NULL;
+CREATE INDEX IF NOT EXISTS "_job_runs_status_available_idx" ON "_job_runs" ("status", "availableAt");
+CREATE INDEX IF NOT EXISTS "_job_runs_status_ended_idx" ON "_job_runs" ("status", "endedAt");
+CREATE INDEX IF NOT EXISTS "_job_runs_created_idx" ON "_job_runs" ("createdAt");
+CREATE INDEX IF NOT EXISTS "_job_runs_actor_idx" ON "_job_runs" ("actorKind", "actorId", "createdAt");
+
+CREATE TABLE IF NOT EXISTS "_job_events" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "runId" TEXT NOT NULL,
+  "type" TEXT NOT NULL,
+  "level" TEXT NOT NULL,
+  "message" TEXT,
+  "dataJson" TEXT,
+  "createdAt" TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS "_job_events_run_created_idx" ON "_job_events" ("runId", "createdAt");
+CREATE INDEX IF NOT EXISTS "_job_events_created_idx" ON "_job_events" ("createdAt");
+
+CREATE TABLE IF NOT EXISTS "_job_schedules" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "jobName" TEXT NOT NULL,
+  "key" TEXT NOT NULL,
+  "kind" TEXT NOT NULL,
+  "status" TEXT NOT NULL,
+  "inputJson" TEXT NOT NULL,
+  "cron" TEXT,
+  "timezone" TEXT,
+  "enabled" INTEGER NOT NULL DEFAULT 1,
+  "nextRunAt" TEXT,
+  "bookedAt" TEXT,
+  "generation" INTEGER NOT NULL DEFAULT 1,
+  "dispatchAttempts" INTEGER NOT NULL DEFAULT 0,
+  "dispatchLeaseExpiresAt" TEXT,
+  "lastDispatchAt" TEXT,
+  "lastDispatchError" TEXT,
+  "suspendedAt" TEXT,
+  "cancelledAt" TEXT,
+  "cancellationReason" TEXT,
+  "lastRunAt" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  "createdBy" TEXT,
+  "service" TEXT,
+  "actorKind" TEXT,
+  "actorId" TEXT
+);
+
+CREATE TABLE IF NOT EXISTS "_job_claim_limits" (
+  "jobName" TEXT PRIMARY KEY NOT NULL,
+  "max" INTEGER,
+  "perKeyMax" INTEGER,
+  "updatedAt" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "_job_rate_buckets" (
+  "key" TEXT PRIMARY KEY NOT NULL,
+  "tokens" REAL NOT NULL,
+  "refilledAt" TEXT NOT NULL,
+  "fullAt" TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS "_job_stats_daily" (
+  "day" TEXT NOT NULL,
+  "jobName" TEXT NOT NULL,
+  "status" TEXT NOT NULL,
+  "count" INTEGER NOT NULL,
+  "totalDurationMs" INTEGER,
+  PRIMARY KEY ("day", "jobName", "status")
+);
+
+CREATE TABLE IF NOT EXISTS "_job_batches" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "name" TEXT NOT NULL,
+  "key" TEXT NOT NULL,
+  "status" TEXT NOT NULL,
+  "onCompleteJson" TEXT NOT NULL,
+  "onFailureJson" TEXT,
+  "total" INTEGER NOT NULL DEFAULT 0,
+  "pending" INTEGER NOT NULL DEFAULT 0,
+  "succeeded" INTEGER NOT NULL DEFAULT 0,
+  "failed" INTEGER NOT NULL DEFAULT 0,
+  "cancelled" INTEGER NOT NULL DEFAULT 0,
+  "denied" INTEGER NOT NULL DEFAULT 0,
+  "expired" INTEGER NOT NULL DEFAULT 0,
+  "continuationRunId" TEXT,
+  "continuationJob" TEXT,
+  "continuationDispatchedAt" TEXT,
+  "lastDispatchError" TEXT,
+  "cancelledAt" TEXT,
+  "cancellationReason" TEXT,
+  "createdAt" TEXT NOT NULL,
+  "updatedAt" TEXT NOT NULL,
+  "sealedAt" TEXT,
+  "completedAt" TEXT,
+  "finishedAt" TEXT,
+  "expiresAt" TEXT,
+  "createdBy" TEXT,
+  "actorKind" TEXT NOT NULL,
+  "actorId" TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS "_job_batches_key_idx" ON "_job_batches" ("key");
+CREATE INDEX IF NOT EXISTS "_job_batches_status_created_idx" ON "_job_batches" ("status", "createdAt");
+CREATE INDEX IF NOT EXISTS "_job_batches_dispatch_idx" ON "_job_batches" ("status", "continuationDispatchedAt");
+CREATE INDEX IF NOT EXISTS "_job_batches_expires_idx" ON "_job_batches" ("expiresAt");
+`;
+const terminalJobStatuses = new Set(["succeeded", "failed", "denied", "cancelled", "expired"]);
+const maxJobScheduleDispatchAttempts = 5;
+const defaultCompactionBatchSize = 100;
+const defaultFailedRetentionMs = 60 * 24 * 60 * 60 * 1000;
+const defaultCompactionDelayMs = 10 * 60 * 1000;
+const defaultAuditArchiveLimitBytes = 8 * 1024 * 1024;
+const aiBudgetSchemaSql = `
+CREATE TABLE IF NOT EXISTS "_ai_budget_windows" (
+  "id" TEXT PRIMARY KEY NOT NULL,
+  "scope" TEXT NOT NULL,
+  "scopeId" TEXT NOT NULL,
+  "windowStart" TEXT NOT NULL,
+  "windowEnd" TEXT NOT NULL,
+  "requestCount" INTEGER NOT NULL,
+  "estimatedOutputTokens" INTEGER NOT NULL,
+  "estimatedNeurons" INTEGER,
+  "updatedAt" TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "_ai_budget_windows_scope_scopeId_windowStart_idx"
+  ON "_ai_budget_windows" ("scope", "scopeId", "windowStart");
+CREATE INDEX IF NOT EXISTS "_ai_budget_windows_windowEnd_idx" ON "_ai_budget_windows" ("windowEnd");
+`;
+function archiveMetadataFromManifest(row) {
+    return {
+        windowStart: row.windowStart,
+        windowEnd: row.windowEnd,
+        objectKey: row.objectKey,
+        rowCount: Number(row.rowCount),
+        firstCreatedAt: row.firstCreatedAt,
+        lastCreatedAt: row.lastCreatedAt,
+        sha256: row.sha256
+    };
+}
+function assertArchiveMetadataMatches(actual, expected) {
+    const fields = [
+        "windowStart",
+        "windowEnd",
+        "objectKey",
+        "rowCount",
+        "firstCreatedAt",
+        "lastCreatedAt",
+        "sha256"
+    ];
+    for (const field of fields) {
+        if (actual[field] !== expected[field]) {
+            throw new Error(`Audit archive manifest mismatch for ${field}`);
+        }
+    }
+}
+function assertConfirmInput(input) {
+    validateAuditArchiveWindow(input);
+    if (input.objectKey !== auditArchiveObjectKey(input.windowStart)) {
+        throw new Error("Audit archive objectKey does not match the window");
+    }
+    if (!Number.isInteger(input.rowCount) || input.rowCount <= 0) {
+        throw new Error("Audit archive rowCount must be a positive integer");
+    }
+    if (!input.firstCreatedAt || !input.lastCreatedAt) {
+        throw new Error("Audit archive firstCreatedAt and lastCreatedAt are required for non-empty archives");
+    }
+    if (!/^[0-9a-f]{64}$/.test(input.sha256)) {
+        throw new Error("Audit archive sha256 must be a hex SHA-256 digest");
+    }
+    return {
+        windowStart: input.windowStart,
+        windowEnd: input.windowEnd,
+        objectKey: input.objectKey,
+        rowCount: input.rowCount,
+        firstCreatedAt: input.firstCreatedAt,
+        lastCreatedAt: input.lastCreatedAt,
+        sha256: input.sha256
+    };
+}
+function dependencyOrder(tables) {
+    const pending = new Map(tables.map((table) => [table.name, table]));
+    const ordered = [];
+    while (pending.size) {
+        const ready = [...pending.values()].filter((table) => table.references.every((name) => !pending.has(name)));
+        const batch = ready.length ? ready : [pending.values().next().value];
+        for (const table of batch.sort((left, right) => left.name.localeCompare(right.name))) {
+            ordered.push(table);
+            pending.delete(table.name);
+        }
+    }
+    return ordered;
+}
+function rowToJobRun(row) {
+    if (!row)
+        return null;
+    return {
+        id: String(row.id),
+        jobName: String(row.jobName),
+        status: String(row.status),
+        inputJson: String(row.inputJson),
+        inputHash: row.inputHash === null ? null : String(row.inputHash),
+        idempotencyKey: row.idempotencyKey === null ? null : String(row.idempotencyKey),
+        actorKind: String(row.actorKind),
+        actorId: row.actorId === null ? null : String(row.actorId),
+        runAsKind: String(row.runAsKind),
+        runAsId: row.runAsId === null ? null : String(row.runAsId),
+        attempt: Number(row.attempt ?? 0),
+        maxAttempts: Number(row.maxAttempts ?? 1),
+        queueMessageId: row.queueMessageId === null ? null : String(row.queueMessageId),
+        workflowInstanceId: row.workflowInstanceId === null ? null : String(row.workflowInstanceId),
+        leaseOwner: row.leaseOwner === null ? null : String(row.leaseOwner),
+        leaseExpiresAt: row.leaseExpiresAt === null ? null : String(row.leaseExpiresAt),
+        createdAt: String(row.createdAt),
+        availableAt: String(row.availableAt),
+        startedAt: row.startedAt === null ? null : String(row.startedAt),
+        endedAt: row.endedAt === null ? null : String(row.endedAt),
+        expiresAt: row.expiresAt === null ? null : String(row.expiresAt),
+        progressJson: row.progressJson === null ? null : String(row.progressJson),
+        resultJson: row.resultJson === null ? null : String(row.resultJson),
+        errorJson: row.errorJson === null ? null : String(row.errorJson),
+        artifactJson: row.artifactJson === null ? null : String(row.artifactJson),
+        createdBy: row.createdBy === null ? null : String(row.createdBy),
+        retryOfRunId: row.retryOfRunId === null ? null : String(row.retryOfRunId),
+        scheduleKey: row.scheduleKey == null ? null : String(row.scheduleKey),
+        scheduleGeneration: row.scheduleGeneration == null ? null : Number(row.scheduleGeneration),
+        scheduleBookedAt: row.scheduleBookedAt == null ? null : String(row.scheduleBookedAt),
+        batchId: row.batchId == null ? null : String(row.batchId),
+        batchSeq: row.batchSeq == null ? null : Number(row.batchSeq),
+        continuationOfBatchId: row.continuationOfBatchId == null ? null : String(row.continuationOfBatchId),
+        concurrencyKey: row.concurrencyKey == null ? null : String(row.concurrencyKey),
+        rateLimitKey: row.rateLimitKey == null ? null : String(row.rateLimitKey),
+        deferrals: Number(row.deferrals ?? 0),
+        deferredAt: row.deferredAt == null ? null : String(row.deferredAt),
+        deferredReason: row.deferredReason == null ? null : String(row.deferredReason),
+        wokenAt: row.wokenAt == null ? null : String(row.wokenAt)
+    };
+}
+function nullableString(value) {
+    return value == null ? null : String(value);
+}
+function batchContinuationFromJson(json) {
+    if (json == null)
+        return null;
+    const template = JSON.parse(String(json));
+    return { job: template.jobName, input: JSON.parse(template.inputJson) };
+}
+// Two batch creations with one key define the same batch when they name the
+// same continuation jobs with the same input; who created it does not matter.
+function sameContinuation(stored, next) {
+    if (stored == null || next == null)
+        return stored == null && next == null;
+    const left = JSON.parse(String(stored));
+    const right = JSON.parse(next);
+    return left.jobName === right.jobName && left.inputJson === right.inputJson;
+}
+function rowToJobBatch(row) {
+    return {
+        id: String(row.id),
+        name: String(row.name),
+        key: String(row.key),
+        status: String(row.status),
+        counts: {
+            total: Number(row.total ?? 0),
+            pending: Number(row.pending ?? 0),
+            succeeded: Number(row.succeeded ?? 0),
+            failed: Number(row.failed ?? 0),
+            cancelled: Number(row.cancelled ?? 0),
+            denied: Number(row.denied ?? 0),
+            expired: Number(row.expired ?? 0)
+        },
+        onComplete: batchContinuationFromJson(row.onCompleteJson),
+        onFailure: batchContinuationFromJson(row.onFailureJson),
+        continuationRunId: nullableString(row.continuationRunId),
+        continuationJob: nullableString(row.continuationJob),
+        continuationDispatchedAt: nullableString(row.continuationDispatchedAt),
+        lastDispatchError: nullableString(row.lastDispatchError),
+        cancelledAt: nullableString(row.cancelledAt),
+        cancellationReason: nullableString(row.cancellationReason),
+        createdAt: String(row.createdAt),
+        updatedAt: String(row.updatedAt),
+        sealedAt: nullableString(row.sealedAt),
+        completedAt: nullableString(row.completedAt),
+        finishedAt: nullableString(row.finishedAt),
+        expiresAt: nullableString(row.expiresAt),
+        createdBy: nullableString(row.createdBy),
+        actorKind: String(row.actorKind),
+        actorId: nullableString(row.actorId)
+    };
+}
+function parseStoredJson(value) {
+    if (value == null)
+        return null;
+    try {
+        return JSON.parse(String(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+function rowToJobBatchChild(row, batchId) {
+    const scope = batchChildIdempotencyKey(batchId, "");
+    const key = row.idempotencyKey == null ? null : String(row.idempotencyKey);
+    return {
+        runId: String(row.id),
+        seq: Number(row.batchSeq),
+        jobName: String(row.jobName),
+        status: String(row.status),
+        idempotencyKey: key?.startsWith(scope) ? key.slice(scope.length) : key,
+        attempt: Number(row.attempt ?? 0),
+        input: parseStoredJson(row.inputJson),
+        result: parseStoredJson(row.resultJson),
+        error: parseStoredJson(row.errorJson),
+        createdAt: String(row.createdAt),
+        endedAt: nullableString(row.endedAt)
+    };
+}
+const batchCountColumns = {
+    succeeded: "succeeded",
+    failed: "failed",
+    cancelled: "cancelled",
+    denied: "denied",
+    expired: "expired"
+};
+/** How long a woken run holds the slot that woke it while its message is in flight. */
+const jobWakeReservationMs = 30_000;
+/** How often the alarm looks for parked runs that a lost or failed wake left waiting. */
+const jobWakeSweepMs = 60_000;
+const jobWakeRetryMs = 10_000;
+const parkedDeferralReasons = `('concurrency', 'concurrency-key')`;
+function jobSlotPools(runs) {
+    return {
+        jobNames: [...new Set(runs.map((run) => run.jobName))],
+        keys: [...new Set(runs.map((run) => run.concurrencyKey).filter((key) => key !== null))]
+    };
+}
+function jobDeferralMessage(jobName, deferral) {
+    if (deferral.reason === "concurrency") {
+        return `Waiting for a concurrency slot: ${deferral.inFlight} of ${deferral.limit} ${jobName} runs in flight`;
+    }
+    if (deferral.reason === "concurrency-key") {
+        return `Waiting for a concurrency slot: ${deferral.inFlight} of ${deferral.limit} runs in flight for key ${deferral.key}`;
+    }
+    const seconds = Math.max(1, Math.ceil((deferral.retryAfterMs ?? 0) / 1000));
+    return `Waiting for rate limit ${deferral.key ? `key ${deferral.key}` : jobName}: next start in ${seconds}s`;
+}
+function rowToJobSchedule(row) {
+    return {
+        id: String(row.id),
+        jobName: String(row.jobName),
+        key: String(row.key),
+        kind: String(row.kind),
+        status: String(row.status),
+        inputJson: String(row.inputJson),
+        cron: row.cron === null ? null : String(row.cron),
+        timezone: row.timezone === null ? null : String(row.timezone),
+        bookedAt: row.bookedAt === null ? null : String(row.bookedAt),
+        generation: Number(row.generation ?? 1),
+        dispatchAttempts: Number(row.dispatchAttempts ?? 0),
+        dispatchLeaseExpiresAt: row.dispatchLeaseExpiresAt === null ? null : String(row.dispatchLeaseExpiresAt),
+        lastDispatchAt: row.lastDispatchAt === null ? null : String(row.lastDispatchAt),
+        lastDispatchError: row.lastDispatchError === null ? null : String(row.lastDispatchError),
+        suspendedAt: row.suspendedAt === null ? null : String(row.suspendedAt),
+        cancelledAt: row.cancelledAt === null ? null : String(row.cancelledAt),
+        cancellationReason: row.cancellationReason === null ? null : String(row.cancellationReason),
+        lastRunAt: row.lastRunAt === null ? null : String(row.lastRunAt),
+        createdAt: String(row.createdAt),
+        updatedAt: String(row.updatedAt),
+        createdBy: row.createdBy === null ? null : String(row.createdBy),
+        service: row.service === null ? null : String(row.service),
+        actorKind: (row.actorKind == null
+            ? row.createdBy == null ? "service" : "user"
+            : String(row.actorKind)),
+        actorId: row.actorId == null
+            ? row.createdBy == null ? row.service == null ? null : String(row.service) : String(row.createdBy)
+            : String(row.actorId)
+    };
+}
+function sqliteChanges(storage) {
+    const row = storage.sql.exec(`SELECT changes() AS "changes"`).toArray()[0];
+    return Number(row?.changes ?? 0);
+}
+export class RaybaseDatabaseObject extends DurableObject {
+    initialized = false;
+    ensuredSchemaBundles = new Set();
+    realtimeSchema = null;
+    realtimeConfig = null;
+    realtimeAuth = {};
+    runtimeOptions() {
+        return {};
+    }
+    ensureBackupProtocolSchemaSync() {
+        this.ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS ${sqlIdentifier(backupStateTable)} (
+        "id" INTEGER PRIMARY KEY NOT NULL CHECK ("id" = 1),
+        "epoch" TEXT NOT NULL,
+        "generation" INTEGER NOT NULL DEFAULT 0,
+        "gateKind" TEXT,
+        "gateOperationId" TEXT
+      )`);
+        this.ctx.storage.sql.exec(`INSERT OR IGNORE INTO ${sqlIdentifier(backupStateTable)}
+       ("id", "epoch", "generation", "gateKind", "gateOperationId")
+       VALUES (1, ?, 0, NULL, NULL)`, crypto.randomUUID());
+        this.ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS ${sqlIdentifier(backupRestoreJournalTable)} (
+        "operationId" TEXT PRIMARY KEY NOT NULL,
+        "sourceSha256" TEXT NOT NULL,
+        "archiveId" TEXT NOT NULL,
+        "targetId" TEXT NOT NULL,
+        "undoBookmark" TEXT NOT NULL,
+        "phase" TEXT NOT NULL,
+        "expectedRecordCount" INTEGER NOT NULL,
+        "expectedRowCount" INTEGER NOT NULL,
+        "expectedTableCount" INTEGER NOT NULL,
+        "plaintextSha256" TEXT NOT NULL,
+        "nextBatchIndex" INTEGER NOT NULL DEFAULT 0,
+        "lastBatchSha256" TEXT,
+        "recordCount" INTEGER NOT NULL DEFAULT 0,
+        "rowCount" INTEGER NOT NULL DEFAULT 0,
+        "tableCount" INTEGER NOT NULL DEFAULT 0,
+        "currentTableId" TEXT,
+        "schemaReplaced" INTEGER NOT NULL DEFAULT 0,
+        "metadataSeen" INTEGER NOT NULL DEFAULT 0,
+        "logicalEndSeen" INTEGER NOT NULL DEFAULT 0,
+        "error" TEXT,
+        "createdAt" TEXT NOT NULL,
+        "updatedAt" TEXT NOT NULL
+      )`);
+        this.ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS ${sqlIdentifier(backupRestoreSchemasTable)} (
+        "operationId" TEXT NOT NULL,
+        "tableId" TEXT NOT NULL,
+        "tableName" TEXT NOT NULL,
+        "columnsJson" TEXT NOT NULL,
+        "insertSql" TEXT NOT NULL,
+        PRIMARY KEY ("operationId", "tableId")
+      )`);
+        this.ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS ${sqlIdentifier(backupRestoreSessionsTable)} (
+        "operationId" TEXT NOT NULL,
+        "sessionId" TEXT NOT NULL,
+        "sessionToken" TEXT NOT NULL,
+        "expiresAt" INTEGER NOT NULL,
+        "userId" TEXT NOT NULL,
+        "email" TEXT NOT NULL,
+        "name" TEXT NOT NULL,
+        "emailVerified" INTEGER NOT NULL,
+        "operatorRole" TEXT NOT NULL,
+        "appRoles" TEXT,
+        "banned" INTEGER,
+        PRIMARY KEY ("operationId", "sessionToken")
+      )`);
+    }
+    backupMutationStateSync() {
+        this.ensureBackupProtocolSchemaSync();
+        const row = this.ctx.storage.sql
+            .exec(`SELECT "epoch", "generation", "gateKind", "gateOperationId"
+         FROM ${sqlIdentifier(backupStateTable)} WHERE "id" = 1`)
+            .toArray()[0];
+        if (!row)
+            throw new Error("Core backup mutation state is missing");
+        return {
+            epoch: String(row.epoch),
+            generation: Number(row.generation),
+            gateKind: row.gateKind,
+            gateOperationId: row.gateOperationId
+        };
+    }
+    backupMutationMarkerSync() {
+        const totalChanges = this.ctx.storage.sql
+            .exec(`SELECT total_changes() AS "totalChanges"`)
+            .toArray()[0]?.totalChanges;
+        const schemaVersion = JSON.stringify(this.ctx.storage.sql
+            .exec(`SELECT "type", "name", "sql" FROM "sqlite_master"
+           WHERE "name" NOT LIKE 'sqlite_%'
+           ORDER BY "type", "name"`)
+            .toArray());
+        return {
+            totalChanges: Number(totalChanges ?? 0),
+            schemaVersion,
+            applicationId: 0,
+            userVersion: 0
+        };
+    }
+    backupMutationMarkerChanged(left, right) {
+        return (left.totalChanges !== right.totalChanges ||
+            left.schemaVersion !== right.schemaVersion ||
+            left.applicationId !== right.applicationId ||
+            left.userVersion !== right.userVersion);
+    }
+    assertMutationAllowedSync(allowed) {
+        const state = this.backupMutationStateSync();
+        if (!state.gateKind)
+            return;
+        if (allowed &&
+            state.gateKind === allowed.kind &&
+            state.gateOperationId === allowed.operationId) {
+            return;
+        }
+        throw new RaybaseBackupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", state.gateKind === "restore"
+            ? "Database restore maintenance is active"
+            : "Database writes are temporarily gated for a consistent backup");
+    }
+    assertReadableSync() {
+        const state = this.backupMutationStateSync();
+        if (state.gateKind === "restore") {
+            throw new RaybaseBackupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Database restore maintenance is active");
+        }
+    }
+    mutateSync(callback, allowed) {
+        let result;
+        this.ctx.storage.transactionSync(() => {
+            this.ensureBackupProtocolSchemaSync();
+            this.assertMutationAllowedSync(allowed);
+            const before = this.backupMutationMarkerSync();
+            result = callback();
+            const after = this.backupMutationMarkerSync();
+            if (this.backupMutationMarkerChanged(before, after)) {
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+           SET "generation" = "generation" + 1 WHERE "id" = 1`);
+            }
+        });
+        return result;
+    }
+    assertPublicSqlDoesNotTargetBackupState(sql) {
+        const lowered = sql.toLowerCase();
+        for (const tableName of backupOperationalTables) {
+            if (lowered.includes(tableName.toLowerCase())) {
+                throw new Error("Core backup-maintenance tables are not available through public SQL execution");
+            }
+        }
+    }
+    publicRowsSync(sql, params) {
+        let rows;
+        this.ctx.storage.transactionSync(() => {
+            this.ensureBackupProtocolSchemaSync();
+            const before = this.backupMutationMarkerSync();
+            rows = this.ctx.storage.sql.exec(sql, ...params).toArray();
+            const after = this.backupMutationMarkerSync();
+            if (this.backupMutationMarkerChanged(before, after)) {
+                // all()/first() historically support statements with RETURNING. Delay
+                // the gate check until SQLite proves the statement mutated state: a
+                // blocked mutation then rolls back with this transaction, while actual
+                // reads remain available during an operator-selected snapshot gate.
+                this.assertMutationAllowedSync();
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+           SET "generation" = "generation" + 1 WHERE "id" = 1`);
+            }
+        });
+        return rows;
+    }
+    trustedReadRowsSync(sql, params) {
+        return this.ctx.storage.sql.exec(sql, ...params).toArray();
+    }
+    backupSchemaObjectsSync() {
+        return this.ctx.storage.sql
+            .exec(`SELECT "type", "name", "tbl_name" AS "tableName", "sql"
+         FROM "sqlite_master"
+         WHERE "type" IN ('table', 'index', 'trigger', 'view')
+           AND "name" NOT LIKE 'sqlite_%'
+           AND "name" NOT LIKE '_cf_%'
+           AND "sql" IS NOT NULL
+         ORDER BY CASE "type"
+           WHEN 'table' THEN 0
+           WHEN 'index' THEN 1
+           WHEN 'trigger' THEN 2
+           ELSE 3
+         END, "name"`)
+            .toArray()
+            .filter((object) => (!backupOperationalTables.has(object.name) &&
+            !backupOperationalTables.has(object.tableName) &&
+            object.name !== "_changes" &&
+            object.tableName !== "_changes" &&
+            !isRaybaseSearchInternalTable(object.name) &&
+            !isRaybaseSearchInternalTable(object.tableName)))
+            .map((object) => ({
+            type: String(object.type),
+            name: String(object.name),
+            tableName: String(object.tableName),
+            sql: String(object.sql)
+        }));
+    }
+    async backupSnapshotPlan() {
+        const state = this.backupMutationStateSync();
+        if (state.gateKind === "restore") {
+            backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Database restore maintenance is active");
+        }
+        const objects = this.backupSchemaObjectsSync();
+        const rawTables = objects
+            .filter((object) => object.type === "table")
+            .map((object) => ({
+            name: object.name,
+            sql: object.sql,
+            references: this.ctx.storage.sql
+                .exec(`PRAGMA foreign_key_list(${sqlIdentifier(object.name)})`)
+                .toArray()
+                .map((foreignKey) => String(foreignKey.table))
+        }));
+        if (rawTables.length > backupDatabaseProtocolLimits.maximumTables) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Database has too many tables for a logical backup");
+        }
+        const ordered = dependencyOrder(rawTables);
+        const tables = ordered.map((table, index) => {
+            if (/^CREATE\s+VIRTUAL\s+TABLE\b/i.test(table.sql)) {
+                backupError("BACKUP_LIMIT_EXCEEDED", `Virtual table ${table.name} is not supported by format-2 logical snapshots`);
+            }
+            const columnRows = this.ctx.storage.sql
+                .exec(`PRAGMA table_xinfo(${sqlIdentifier(table.name)})`)
+                .toArray();
+            const insertable = columnRows.filter((column) => Number(column.hidden ?? 0) === 0);
+            if (!insertable.length || insertable.length > backupFormatLimits.columnsPerTable) {
+                backupError("BACKUP_LIMIT_EXCEEDED", `Table ${table.name} has an unsupported column layout`);
+            }
+            const columns = insertable.map((column) => ({
+                name: String(column.name),
+                ...(column.type ? { declaredType: String(column.type) } : {})
+            }));
+            const names = new Set(columnRows.map((column) => String(column.name).toLowerCase()));
+            let pageAlias = "__raybase_page_key";
+            while (names.has(pageAlias.toLowerCase()))
+                pageAlias += "_";
+            const withoutRowid = /\bWITHOUT\s+ROWID\b/i.test(table.sql);
+            let pagination;
+            let paginationSqlColumns;
+            if (withoutRowid) {
+                const primaryKey = columnRows
+                    .filter((column) => Number(column.pk) > 0)
+                    .sort((left, right) => Number(left.pk) - Number(right.pk))
+                    .map((column) => String(column.name));
+                if (!primaryKey.length) {
+                    backupError("BACKUP_LIMIT_EXCEEDED", `WITHOUT ROWID table ${table.name} has no usable primary key`);
+                }
+                pagination = { kind: "primary-key", columns: primaryKey };
+                paginationSqlColumns = primaryKey;
+            }
+            else {
+                const rowidColumn = ["_rowid_", "rowid", "oid"].find((name) => !names.has(name));
+                if (!rowidColumn) {
+                    backupError("BACKUP_LIMIT_EXCEEDED", `Table ${table.name} shadows every SQLite rowid name`);
+                }
+                pagination = { kind: "rowid", column: rowidColumn };
+                paginationSqlColumns = [rowidColumn];
+            }
+            return {
+                tableId: `table-${index + 1}`,
+                tableName: table.name,
+                createSql: table.sql,
+                columns,
+                insertSql: `INSERT INTO ${sqlIdentifier(table.name)} (${columns.map((column) => sqlIdentifier(column.name)).join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`,
+                pagination,
+                paginationSqlColumns,
+                pageAlias,
+                references: table.references
+            };
+        });
+        const secondaryDdl = objects
+            .filter((object) => object.type !== "table")
+            .map((object) => object.sql);
+        // Cloudflare SqlStorage intentionally rejects application_id/user_version
+        // PRAGMAs. Format 2 keeps the optional fields deterministic at zero rather
+        // than bypassing the supported Durable Object SQL surface.
+        const applicationId = 0;
+        const userVersion = 0;
+        const fingerprintInput = JSON.stringify({
+            applicationId,
+            userVersion,
+            objects: objects.map(({ type, name, tableName, sql }) => ({ type, name, tableName, sql }))
+        });
+        const schemaFingerprint = await sha256Hex(fingerprintInput);
+        return {
+            epoch: state.epoch,
+            generation: state.generation,
+            databaseBytes: this.ctx.storage.sql.databaseSize,
+            applicationId,
+            userVersion,
+            schemaFingerprint,
+            tables,
+            secondaryDdl
+        };
+    }
+    assertSnapshotMatches(plan, expected) {
+        validateBackupOperationId(expected.operationId);
+        if (plan.epoch !== expected.epoch ||
+            plan.generation !== expected.generation ||
+            plan.schemaFingerprint !== expected.schemaFingerprint) {
+            backupError("BACKUP_SNAPSHOT_INCONSISTENT", "Database generation or schema changed during the logical snapshot");
+        }
+        const state = this.backupMutationStateSync();
+        if (state.gateKind === "snapshot" &&
+            state.gateOperationId !== expected.operationId) {
+            backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "A different write-gated backup operation is active");
+        }
+    }
+    snapshotMetadataRecord(plan) {
+        return {
+            kind: "database-metadata",
+            applicationId: plan.applicationId,
+            userVersion: plan.userVersion,
+            schemaFingerprint: plan.schemaFingerprint,
+            metadata: {
+                snapshotEpoch: plan.epoch,
+                snapshotGeneration: plan.generation
+            }
+        };
+    }
+    snapshotTableSchemaRecord(table) {
+        return {
+            kind: "table-schema",
+            tableId: table.tableId,
+            tableName: table.tableName,
+            columns: table.columns,
+            insertSql: table.insertSql,
+            pagination: table.pagination
+        };
+    }
+    snapshotRowsSync(table, after, limit) {
+        const selectedColumns = table.columns.map((column) => sqlIdentifier(column.name));
+        const bindings = [];
+        let where = "";
+        let order;
+        if (table.pagination.kind === "rowid") {
+            selectedColumns.push(`${sqlIdentifier(table.paginationSqlColumns[0])} AS ${sqlIdentifier(table.pageAlias)}`);
+            order = sqlIdentifier(table.paginationSqlColumns[0]);
+            if (after) {
+                if (after.length !== 1) {
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Rowid snapshot cursor has the wrong key width");
+                }
+                where = ` WHERE ${sqlIdentifier(table.paginationSqlColumns[0])} > ?`;
+                bindings.push(logicalValueBinding(after[0]));
+            }
+        }
+        else {
+            order = table.paginationSqlColumns.map(sqlIdentifier).join(", ");
+            if (after) {
+                if (after.length !== table.paginationSqlColumns.length) {
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Primary-key snapshot cursor has the wrong key width");
+                }
+                where = ` WHERE (${table.paginationSqlColumns.map(sqlIdentifier).join(", ")}) > (${after.map(() => "?").join(", ")})`;
+                bindings.push(...after.map(logicalValueBinding));
+            }
+        }
+        const rows = this.ctx.storage.sql
+            .exec(`SELECT ${selectedColumns.join(", ")}
+         FROM ${sqlIdentifier(table.tableName)}${where}
+         ORDER BY ${order}
+         LIMIT ?`, ...bindings, limit)
+            .toArray();
+        return rows.map((row) => {
+            const values = table.columns.map((column) => backupLogicalValue(row[column.name] ?? null));
+            const key = table.pagination.kind === "rowid"
+                ? [backupLogicalValue(row[table.pageAlias] ?? null)]
+                : table.paginationSqlColumns.map((column) => backupLogicalValue(row[column] ?? null));
+            if (key.some((value) => value.type === "null")) {
+                backupError("BACKUP_SNAPSHOT_INCONSISTENT", `Table ${table.tableName} produced a null pagination key`);
+            }
+            return {
+                record: { kind: "row", tableId: table.tableId, values },
+                key
+            };
+        });
+    }
+    backupRestoreJournalSync(operationId) {
+        const where = operationId ? `WHERE "operationId" = ?` : `WHERE "phase" != 'completed'`;
+        return this.ctx.storage.sql
+            .exec(`SELECT * FROM ${sqlIdentifier(backupRestoreJournalTable)}
+         ${where}
+         ORDER BY "createdAt" DESC LIMIT 1`, ...(operationId ? [operationId] : []))
+            .toArray()[0];
+    }
+    replaceRestorableSchemaSync() {
+        const rawTables = this.ctx.storage.sql
+            .exec(`SELECT "name" FROM "sqlite_master"
+         WHERE "type" = 'table'
+           AND "name" NOT LIKE 'sqlite_%'
+           AND "name" NOT LIKE '_cf_%'`)
+            .toArray()
+            .filter((table) => (!backupOperationalTables.has(table.name) &&
+            !isRaybaseSearchInternalTable(table.name)));
+        const tableNames = new Set(rawTables.map((table) => table.name));
+        const tables = dependencyOrder(rawTables.map((table) => ({
+            ...table,
+            sql: "",
+            references: this.ctx.storage.sql
+                .exec(`PRAGMA foreign_key_list(${sqlIdentifier(table.name)})`)
+                .toArray()
+                .map((foreignKey) => String(foreignKey.table))
+                .filter((name) => tableNames.has(name))
+        })));
+        for (const table of [...tables].reverse()) {
+            this.ctx.storage.sql.exec(`DROP TABLE IF EXISTS ${sqlIdentifier(table.name)}`);
+        }
+    }
+    applyRestoreRecordSync(journal, record) {
+        if (journal.logicalEndSeen) {
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore batch contains records after its end");
+        }
+        if (record.kind === "logical-end") {
+            if (journal.currentTableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore ended before the current table closed");
+            }
+            if (record.recordCount !== journal.recordCount ||
+                record.rowCount !== journal.rowCount ||
+                record.tableCount !== journal.tableCount ||
+                record.plaintextSha256 !== journal.plaintextSha256 ||
+                record.recordCount !== journal.expectedRecordCount ||
+                record.rowCount !== journal.expectedRowCount ||
+                record.tableCount !== journal.expectedTableCount) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore end totals or digest do not match pass 1");
+            }
+            journal.logicalEndSeen = 1;
+            return;
+        }
+        if (!journal.metadataSeen && record.kind !== "database-metadata") {
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore metadata must be the first record");
+        }
+        if (record.kind === "database-metadata") {
+            if (journal.metadataSeen || journal.recordCount !== 0) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore contains duplicate database metadata");
+            }
+            journal.metadataSeen = 1;
+        }
+        else if (record.kind === "table-schema") {
+            if (journal.currentTableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore schema appeared inside table rows");
+            }
+            if (backupOperationalTables.has(record.tableName) ||
+                isRaybaseSearchInternalTable(record.tableName)) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore targets a Core operational table");
+            }
+            const expectedInsert = `INSERT INTO ${sqlIdentifier(record.tableName)} (${record.columns.map((column) => sqlIdentifier(column.name)).join(", ")}) VALUES (${record.columns.map(() => "?").join(", ")})`;
+            if (record.insertSql !== expectedInsert) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Logical restore insert statement for ${record.tableName} is not canonical`);
+            }
+            this.ctx.storage.sql.exec(`INSERT INTO ${sqlIdentifier(backupRestoreSchemasTable)}
+         ("operationId", "tableId", "tableName", "columnsJson", "insertSql")
+         VALUES (?, ?, ?, ?, ?)`, journal.operationId, record.tableId, record.tableName, JSON.stringify(record.columns), record.insertSql);
+        }
+        else if (record.kind === "ddl") {
+            if (journal.currentTableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore DDL appeared inside table rows");
+            }
+            validateRestoreDdl(record.sql);
+            this.ctx.storage.sql.exec(record.sql);
+        }
+        else if (record.kind === "table-start") {
+            if (journal.currentTableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Logical restore contains nested table starts");
+            }
+            const schema = this.ctx.storage.sql
+                .exec(`SELECT "tableId" FROM ${sqlIdentifier(backupRestoreSchemasTable)}
+           WHERE "operationId" = ? AND "tableId" = ?`, journal.operationId, record.tableId)
+                .toArray()[0];
+            if (!schema)
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Restore table ${record.tableId} has no schema`);
+            journal.currentTableId = record.tableId;
+        }
+        else if (record.kind === "row") {
+            if (journal.currentTableId !== record.tableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Restore row for ${record.tableId} is outside its table boundary`);
+            }
+            const schema = this.ctx.storage.sql
+                .exec(`SELECT "columnsJson", "insertSql"
+           FROM ${sqlIdentifier(backupRestoreSchemasTable)}
+           WHERE "operationId" = ? AND "tableId" = ?`, journal.operationId, record.tableId)
+                .toArray()[0];
+            if (!schema)
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Restore row for ${record.tableId} has no schema`);
+            const columns = JSON.parse(schema.columnsJson);
+            if (record.values.length !== columns.length) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Restore row for ${record.tableId} has the wrong value count`);
+            }
+            this.ctx.storage.sql.exec(schema.insertSql, ...record.values.map(logicalValueBinding));
+            journal.rowCount += 1;
+        }
+        else if (record.kind === "table-end") {
+            if (journal.currentTableId !== record.tableId) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", `Restore table end for ${record.tableId} is out of order`);
+            }
+            journal.currentTableId = null;
+            journal.tableCount += 1;
+        }
+        else {
+            backupError("BACKUP_RECORD_VERSION_UNSUPPORTED", "Logical restore record kind is unsupported");
+        }
+        journal.recordCount += 1;
+    }
+    columnExists(tableName, columnName) {
+        return this.ctx.storage.sql
+            .exec(`PRAGMA table_info(${sqlLiteral(tableName)})`)
+            .toArray()
+            .some((row) => row.name === columnName);
+    }
+    tableExists(tableName) {
+        return Boolean(this.ctx.storage.sql
+            .exec(`SELECT "name" FROM "sqlite_master" WHERE "type" = 'table' AND "name" = ?`, tableName)
+            .toArray()[0]);
+    }
+    renameColumnIfPresent(tableName, oldColumn, newColumn) {
+        if (!this.tableExists(tableName))
+            return;
+        const hasOld = this.columnExists(tableName, oldColumn);
+        const hasNew = this.columnExists(tableName, newColumn);
+        if (hasOld && !hasNew) {
+            this.ctx.storage.sql.exec(`ALTER TABLE ${sqlIdentifier(tableName)} RENAME COLUMN ${sqlIdentifier(oldColumn)} TO ${sqlIdentifier(newColumn)}`);
+            return;
+        }
+        if (hasOld && hasNew) {
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(tableName)}
+         SET ${sqlIdentifier(newColumn)} = ${sqlIdentifier(oldColumn)}
+         WHERE ${sqlIdentifier(newColumn)} IS NULL
+           AND ${sqlIdentifier(oldColumn)} IS NOT NULL`);
+        }
+    }
+    ensureAgentAiColumns() {
+        this.renameColumnIfPresent("_ai_usage_events", "assistant", "agent");
+        this.renameColumnIfPresent("_ai_action_events", "assistant", "agent");
+    }
+    ensureAiUsageEventsTable(table) {
+        if (!table || !this.tableExists(table.name))
+            return;
+        const columns = this.ctx.storage.sql
+            .exec(`PRAGMA table_info(${sqlLiteral(table.name)})`)
+            .toArray();
+        const byName = new Map(columns.map((column) => [column.name, column]));
+        const userId = byName.get("userId");
+        const needsRebuild = userId?.notnull === 1
+            || byName.has("assistant")
+            || Object.keys(table.columns).some((columnName) => !byName.has(columnName));
+        if (!needsRebuild)
+            return;
+        const replacementName = `${table.name}__raybase_upgrade`;
+        if (this.tableExists(replacementName)) {
+            throw new Error(`Cannot upgrade ${table.name}: temporary table ${replacementName} already exists`);
+        }
+        this.ctx.storage.sql.exec(createTableSql({ ...table, name: replacementName }));
+        const targetColumns = Object.keys(table.columns);
+        const sourceExpressions = targetColumns.map((columnName) => {
+            if (byName.has(columnName))
+                return sqlIdentifier(columnName);
+            const definition = table.columns[columnName];
+            if (definition.required || definition.primaryKey) {
+                throw new Error(`Cannot upgrade ${table.name}: required legacy column ${columnName} is missing`);
+            }
+            return "NULL";
+        });
+        this.ctx.storage.sql.exec(`INSERT INTO ${sqlIdentifier(replacementName)} (${targetColumns.map(sqlIdentifier).join(", ")})
+       SELECT ${sourceExpressions.join(", ")} FROM ${sqlIdentifier(table.name)}`);
+        this.ctx.storage.sql.exec(`DROP TABLE ${sqlIdentifier(table.name)}`);
+        this.ctx.storage.sql.exec(`ALTER TABLE ${sqlIdentifier(replacementName)} RENAME TO ${sqlIdentifier(table.name)}`);
+    }
+    ensureJournal() {
+        this.ctx.storage.sql.exec(`CREATE TABLE IF NOT EXISTS "_do_migrations" (
+        "name" TEXT PRIMARY KEY NOT NULL,
+        "checksum" TEXT NOT NULL,
+        "appliedAt" TEXT NOT NULL
+      )`);
+    }
+    ensureControlSchema() {
+        this.ctx.storage.sql.exec("PRAGMA foreign_keys=ON");
+        this.ensureAgentAiColumns();
+        for (const statement of splitSqlStatements(`${raybaseSystemTableSql}\n${raybaseImportSystemTableSql}\n${raybaseSearchSchemaSql}`)) {
+            this.ctx.storage.sql.exec(statement);
+        }
+        if (!this.columnExists("_auth_users", "operatorRole")) {
+            this.ctx.storage.sql.exec(`ALTER TABLE "_auth_users" ADD COLUMN "operatorRole" TEXT`);
+        }
+        if (!this.columnExists("_invites", "note")) {
+            this.ctx.storage.sql.exec(`ALTER TABLE "_invites" ADD COLUMN "note" TEXT`);
+        }
+        if (!this.columnExists("_audit", "actorKind")) {
+            this.ctx.storage.sql.exec(`ALTER TABLE "_audit" ADD COLUMN "actorKind" TEXT`);
+        }
+        if (!this.columnExists("_audit", "runAsKind")) {
+            this.ctx.storage.sql.exec(`ALTER TABLE "_audit" ADD COLUMN "runAsKind" TEXT`);
+        }
+        if (!this.columnExists("_audit", "runAsId")) {
+            this.ctx.storage.sql.exec(`ALTER TABLE "_audit" ADD COLUMN "runAsId" TEXT`);
+        }
+        this.ensureAgentRunHeartbeatColumn();
+    }
+    /**
+     * The liveness mark a running turn touches per model step (2026-08-25).
+     *
+     * System tables are created with IF NOT EXISTS, so an existing `_agent_runs`
+     * never gains a column on its own. Nullable and coalesced to `startedAt` at
+     * every reader, so a database that has not been through this yet behaves
+     * exactly as it did before.
+     */
+    ensureAgentRunHeartbeatColumn() {
+        if (!this.tableExists("_agent_runs"))
+            return;
+        if (this.columnExists("_agent_runs", "heartbeatAt"))
+            return;
+        this.ctx.storage.sql.exec(`ALTER TABLE "_agent_runs" ADD COLUMN "heartbeatAt" TEXT`);
+    }
+    ensureApplicationSchema(systemTables = []) {
+        this.ctx.storage.sql.exec("PRAGMA foreign_keys=ON");
+        for (const statement of splitSqlStatements(`${raybaseApplicationSystemTableSql}\n${raybaseImportSystemTableSql}\n${raybaseSearchSchemaSql}`)) {
+            this.ctx.storage.sql.exec(statement);
+        }
+        this.ensureAgentAiColumns();
+        this.ensureAiUsageEventsTable(systemTables.find((table) => table.name === "_ai_usage_events"));
+        this.ensureAgentRunHeartbeatColumn();
+        const seen = new Set();
+        for (const table of systemTables) {
+            if (seen.has(table.name))
+                continue;
+            seen.add(table.name);
+            for (const statement of systemTableStatements(table)) {
+                this.ctx.storage.sql.exec(statement);
+            }
+        }
+    }
+    async ensureRealtimeState() {
+        if (!this.realtimeSchema)
+            this.realtimeSchema = (await this.ctx.storage.get(realtimeSchemaKey)) ?? null;
+        if (!this.realtimeConfig)
+            this.realtimeConfig = (await this.ctx.storage.get(realtimeConfigKey)) ?? null;
+        this.realtimeAuth = (await this.ctx.storage.get(realtimeAuthKey)) ?? this.realtimeAuth;
+    }
+    attachment(ws) {
+        try {
+            const value = ws.deserializeAttachment();
+            if (value && typeof value === "object" && value.v === 1)
+                return value;
+        }
+        catch {
+            return null;
+        }
+        return null;
+    }
+    saveAttachment(ws, attachment) {
+        ws.serializeAttachment(attachment);
+    }
+    send(ws, message) {
+        const limit = this.realtimeConfig?.limits.maxBufferedAmount ?? 1024 * 1024;
+        if (ws.bufferedAmount > limit) {
+            const attachment = this.attachment(ws);
+            for (const subscription of Object.values(attachment?.subscriptions ?? {})) {
+                ws.send(JSON.stringify({ v: 1, type: "resync", subscriptionId: subscription.id, reason: "gap" }));
+            }
+            return false;
+        }
+        ws.send(JSON.stringify(message));
+        return true;
+    }
+    sendError(ws, ref, code, message) {
+        this.send(ws, { v: 1, ref, type: "error", code, message });
+    }
+    sendStatus(ws, ref, status) {
+        this.send(ws, status.ref ? status : { ...status, ref });
+    }
+    parseState(state, maxBytes) {
+        const encoded = JSON.stringify(state ?? {});
+        if (new TextEncoder().encode(encoded).byteLength > maxBytes) {
+            throw new Error("Presence state is too large");
+        }
+        if (state && typeof state === "object" && !Array.isArray(state)) {
+            const forbidden = ["id", "name", "email", "role", "roles", "appRoles", "user", "connectionId", "joinedAt", "updatedAt"];
+            for (const key of forbidden) {
+                if (Object.prototype.hasOwnProperty.call(state, key)) {
+                    throw new Error(`Presence state cannot set identity field ${key}`);
+                }
+            }
+        }
+        return state ?? {};
+    }
+    parseRoles(value) {
+        if (Array.isArray(value))
+            return Array.from(new Set(["user", ...value.map(String).filter(Boolean)]));
+        if (typeof value === "string" && value.trim()) {
+            try {
+                const parsed = JSON.parse(value);
+                if (Array.isArray(parsed))
+                    return Array.from(new Set(["user", ...parsed.map(String).filter(Boolean)]));
+            }
+            catch {
+                return Array.from(new Set(["user", ...value.split(",").map((role) => role.trim()).filter(Boolean)]));
+            }
+            return Array.from(new Set(["user", value]));
+        }
+        return ["user"];
+    }
+    expiresAtMs(value) {
+        if (typeof value === "number")
+            return value;
+        const numeric = Number(value);
+        if (Number.isFinite(numeric) && numeric > 0)
+            return numeric;
+        const parsed = new Date(value).getTime();
+        return Number.isFinite(parsed) ? parsed : 0;
+    }
+    async revalidate(attachment) {
+        const runtime = this.runtimeOptions();
+        if (runtime.revalidateRealtimeSession) {
+            return runtime.revalidateRealtimeSession({
+                sessionToken: attachment.sessionToken,
+                sessionId: attachment.sessionId,
+                scopeId: attachment.user.organizationId ?? null,
+                user: attachment.user
+            }, this.env);
+        }
+        await this.ensureSchema({ migrations: [] });
+        if (!attachment.sessionToken && !attachment.sessionId)
+            return null;
+        const row = this.ctx.storage.sql
+            .exec(`SELECT s."id" AS "sessionId", s."token" AS "sessionToken", s."expiresAt", u."id" AS "userId",
+                u."email", u."name", u."operatorRole", u."appRoles", u."banned"
+         FROM "_auth_sessions" s INNER JOIN "_auth_users" u ON u."id" = s."userId"
+         WHERE ${attachment.sessionToken ? 's."token" = ?' : 's."id" = ?'}
+         LIMIT 1`, attachment.sessionToken ?? attachment.sessionId ?? "")
+            .toArray()[0];
+        if (!row || this.expiresAtMs(row.expiresAt) <= Date.now() || Boolean(row.banned))
+            return null;
+        const operatorRole = normalizeStoredAdminRole(row.operatorRole);
+        return withHostUserRoleCeiling({
+            id: row.userId,
+            email: row.email,
+            name: row.name,
+            operatorRole,
+            appRoles: this.parseRoles(row.appRoles),
+            disabled: false
+        });
+    }
+    tableFor(name) {
+        const schema = this.realtimeSchema;
+        if (!schema)
+            return null;
+        return Object.values(schema.tables).find((table) => table.name === name) ?? schema.tables[name] ?? null;
+    }
+    parseChangeRow(row) {
+        return {
+            seq: Number(row.seq),
+            tableName: row.tableName,
+            op: row.op,
+            rowId: row.rowId,
+            oldRow: row.oldRow ? JSON.parse(row.oldRow) : null,
+            newRow: row.newRow ? JSON.parse(row.newRow) : null,
+            actorId: row.actorId,
+            adminOverride: Boolean(row.adminOverride),
+            createdAt: row.createdAt
+        };
+    }
+    async deliverChange(ws, attachment, subscription, change) {
+        const table = this.tableFor(change.tableName);
+        if (!table || table.name !== subscription.table)
+            return;
+        const event = projectChangeForSubscriber({
+            table,
+            subscriber: { user: attachment.user, adminOverride: false },
+            op: change.op,
+            seq: change.seq,
+            oldRow: change.oldRow ?? null,
+            newRow: change.newRow ?? null,
+            options: subscription.options,
+            events: subscription.events
+        });
+        if (!event)
+            return;
+        if (this.send(ws, { v: 1, type: "change", subscriptionId: subscription.id, event })) {
+            subscription.lastSeq = Math.max(subscription.lastSeq ?? 0, change.seq);
+            attachment.lastSeq = Math.max(attachment.lastSeq ?? 0, change.seq);
+            this.saveAttachment(ws, attachment);
+        }
+    }
+    async replay(ws, attachment, subscription, sinceSeq) {
+        if (!sinceSeq)
+            return;
+        const config = this.realtimeConfig;
+        if (!config)
+            return;
+        const stats = this.ctx.storage.sql
+            .exec(`SELECT MIN("seq") AS "minSeq", MAX("seq") AS "maxSeq" FROM "_changes" WHERE "tableName" = ?`, subscription.table)
+            .toArray()[0];
+        const minSeq = stats?.minSeq === null || stats?.minSeq === undefined ? null : Number(stats.minSeq);
+        const maxSeq = stats?.maxSeq === null || stats?.maxSeq === undefined ? null : Number(stats.maxSeq);
+        if (!maxSeq || maxSeq <= sinceSeq)
+            return;
+        if (minSeq !== null && minSeq > sinceSeq + 1) {
+            this.send(ws, { v: 1, type: "resync", subscriptionId: subscription.id, reason: "retention-expired", sinceSeq, latestSeq: maxSeq });
+            return;
+        }
+        const rows = this.ctx.storage.sql
+            .exec(`SELECT "seq", "tableName", "op", "rowId", "oldRow", "newRow", "actorId", "adminOverride", "createdAt"
+         FROM "_changes"
+         WHERE "tableName" = ? AND "seq" > ?
+         ORDER BY "seq" ASC
+         LIMIT ?`, subscription.table, sinceSeq, config.limits.maxReplayChanges + 1)
+            .toArray();
+        if (rows.length > config.limits.maxReplayChanges) {
+            this.send(ws, { v: 1, type: "resync", subscriptionId: subscription.id, reason: "gap", sinceSeq, latestSeq: maxSeq });
+            return;
+        }
+        for (const row of rows) {
+            await this.deliverChange(ws, attachment, subscription, this.parseChangeRow(row));
+        }
+    }
+    presenceMember(attachment, room) {
+        const entry = attachment.presenceRooms[room];
+        return {
+            connectionId: attachment.connectionId,
+            user: {
+                id: attachment.user.id,
+                name: attachment.user.name,
+                email: attachment.user.email,
+                appRoles: attachment.user.appRoles?.map(String) ?? ["user"]
+            },
+            state: entry?.state ?? {},
+            joinedAt: entry?.joinedAt ?? new Date().toISOString(),
+            updatedAt: entry?.updatedAt ?? new Date().toISOString()
+        };
+    }
+    roomMembers(room) {
+        return this.ctx
+            .getWebSockets()
+            .map((ws) => this.attachment(ws))
+            .filter((attachment) => Boolean(attachment?.presenceRooms[room]))
+            .map((attachment) => this.presenceMember(attachment, room));
+    }
+    broadcastPresence(room, message) {
+        for (const ws of this.ctx.getWebSockets()) {
+            const attachment = this.attachment(ws);
+            if (!attachment?.presenceRooms[room])
+                continue;
+            this.send(ws, { v: 1, room, ...message });
+        }
+    }
+    async fanout(change) {
+        await this.ensureRealtimeState();
+        for (const ws of this.ctx.getWebSockets()) {
+            const attachment = this.attachment(ws);
+            if (!attachment) {
+                ws.close(1011, "Missing realtime attachment");
+                continue;
+            }
+            const user = await this.revalidate(attachment);
+            if (!user) {
+                ws.close(4001, "Session is no longer valid");
+                continue;
+            }
+            attachment.user = user;
+            const subscriptions = Object.values(attachment.subscriptions).filter((subscription) => subscription.table === change.tableName);
+            for (const subscription of subscriptions) {
+                try {
+                    await this.deliverChange(ws, attachment, subscription, change);
+                }
+                catch (error) {
+                    if (!(error instanceof RaybaseDataReadDeniedError))
+                        throw error;
+                    this.sendError(ws, undefined, error.code, error.message);
+                    delete attachment.subscriptions[subscription.id];
+                    this.saveAttachment(ws, attachment);
+                }
+            }
+        }
+    }
+    async fanoutNotification(input) {
+        await this.ensureRealtimeState();
+        for (const ws of this.ctx.getWebSockets()) {
+            const attachment = this.attachment(ws);
+            if (!attachment?.notificationSubscription)
+                continue;
+            const user = await this.revalidate(attachment);
+            if (!user) {
+                ws.close(4001, "Session is no longer valid");
+                continue;
+            }
+            attachment.user = user;
+            if (attachment.notificationSubscription.subjectId !== input.subjectId)
+                continue;
+            if (input.seq <= attachment.notificationSubscription.lastSeq)
+                continue;
+            if (this.send(ws, { v: 1, type: "notification", seq: input.seq, event: input.event, item: input.item }) &&
+                this.send(ws, { v: 1, type: "notifications.count", unread: input.unread, seq: input.seq })) {
+                attachment.notificationSubscription.lastSeq = input.seq;
+                this.saveAttachment(ws, attachment);
+            }
+        }
+    }
+    async pruneChanges(config) {
+        const cutoff = new Date(Date.now() - config.retention.maxAgeSeconds * 1000).toISOString();
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(`DELETE FROM "_changes" WHERE "createdAt" < ?`, cutoff);
+            this.ctx.storage.sql.exec(`DELETE FROM "_changes"
+         WHERE "seq" NOT IN (
+           SELECT "seq" FROM "_changes" ORDER BY "seq" DESC LIMIT ?
+         )`, config.retention.maxChanges);
+        });
+        await this.ctx.storage.setAlarm(Date.now() + realtimeSweepMs);
+    }
+    async ensureSchema(bundle) {
+        const startedAt = Date.now();
+        const cacheKey = JSON.stringify({
+            migrations: bundle.migrations.map(({ name, checksum }) => ({ name, checksum })),
+            systemTables: (bundle.systemTables ?? []).map((table) => ({
+                name: table.name,
+                columns: table.columns,
+                indexes: table.indexes
+            }))
+        });
+        if (this.ensuredSchemaBundles.has(cacheKey)) {
+            return { applied: [], cached: true, durationMs: Date.now() - startedAt };
+        }
+        const applied = [];
+        // A throw inside blockConcurrencyWhile resets the whole object. A bad
+        // bundle (checksum mismatch, broken SQL) must fail the caller loudly, but
+        // it is a deploy problem, not storage corruption — transactionSync already
+        // rolled back — so the failure is carried out and thrown after the gate.
+        let failure = null;
+        await this.ctx.blockConcurrencyWhile(async () => {
+            try {
+                this.ctx.storage.transactionSync(() => {
+                    this.ensureBackupProtocolSchemaSync();
+                    const before = this.backupMutationMarkerSync();
+                    this.ensureJournal();
+                    if (this.runtimeOptions().schemaMode === "application") {
+                        this.ensureApplicationSchema(bundle.systemTables);
+                    }
+                    else {
+                        this.ensureControlSchema();
+                        this.ensureApplicationSchema(bundle.systemTables);
+                    }
+                    for (const migration of bundle.migrations) {
+                        const existing = this.ctx.storage.sql.exec(`SELECT "checksum" FROM "_do_migrations" WHERE "name" = ?`, migration.name).toArray()[0];
+                        if (existing) {
+                            if (existing.checksum !== migration.checksum) {
+                                throw new Error(`Durable Object migration checksum mismatch for ${migration.name}`);
+                            }
+                            continue;
+                        }
+                        for (const statement of splitSqlStatements(migration.sql)) {
+                            this.ctx.storage.sql.exec(statement);
+                        }
+                        this.ctx.storage.sql.exec(`INSERT INTO "_do_migrations" ("name", "checksum", "appliedAt") VALUES (?, ?, ?)`, migration.name, migration.checksum, new Date().toISOString());
+                        applied.push(migration.name);
+                    }
+                    const after = this.backupMutationMarkerSync();
+                    if (this.backupMutationMarkerChanged(before, after)) {
+                        this.assertMutationAllowedSync();
+                        this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+               SET "generation" = "generation" + 1 WHERE "id" = 1`);
+                    }
+                });
+                if (!this.initialized) {
+                    await this.ctx.storage.put({
+                        createdAt: (await this.ctx.storage.get("createdAt")) ?? new Date().toISOString()
+                    });
+                    this.initialized = true;
+                }
+                this.ensuredSchemaBundles.add(cacheKey);
+            }
+            catch (error) {
+                failure = error;
+            }
+        });
+        if (failure)
+            throw failure instanceof Error ? failure : new Error(String(failure));
+        return { applied, cached: false, durationMs: Date.now() - startedAt };
+    }
+    ensureJobsSchemaSync() {
+        for (const statement of splitSqlStatements(jobSchemaSql)) {
+            this.ctx.storage.sql.exec(statement);
+        }
+        const addColumn = (table, column, ddl) => {
+            if (!this.columnExists(table, column))
+                this.ctx.storage.sql.exec(`ALTER TABLE ${sqlIdentifier(table)} ADD COLUMN ${ddl}`);
+        };
+        addColumn("_job_runs", "scheduleKey", '"scheduleKey" TEXT');
+        addColumn("_job_runs", "scheduleGeneration", '"scheduleGeneration" INTEGER');
+        addColumn("_job_runs", "scheduleBookedAt", '"scheduleBookedAt" TEXT');
+        addColumn("_job_runs", "batchId", '"batchId" TEXT');
+        addColumn("_job_runs", "batchSeq", '"batchSeq" INTEGER');
+        addColumn("_job_runs", "continuationOfBatchId", '"continuationOfBatchId" TEXT');
+        addColumn("_job_runs", "concurrencyKey", '"concurrencyKey" TEXT');
+        addColumn("_job_runs", "rateLimitKey", '"rateLimitKey" TEXT');
+        addColumn("_job_runs", "deferrals", '"deferrals" INTEGER NOT NULL DEFAULT 0');
+        addColumn("_job_runs", "deferredAt", '"deferredAt" TEXT');
+        addColumn("_job_runs", "deferredReason", '"deferredReason" TEXT');
+        addColumn("_job_runs", "wokenAt", '"wokenAt" TEXT');
+        addColumn("_job_schedules", "key", '"key" TEXT');
+        addColumn("_job_schedules", "kind", '"kind" TEXT');
+        addColumn("_job_schedules", "status", '"status" TEXT');
+        addColumn("_job_schedules", "bookedAt", '"bookedAt" TEXT');
+        addColumn("_job_schedules", "generation", '"generation" INTEGER NOT NULL DEFAULT 1');
+        addColumn("_job_schedules", "dispatchAttempts", '"dispatchAttempts" INTEGER NOT NULL DEFAULT 0');
+        addColumn("_job_schedules", "dispatchLeaseExpiresAt", '"dispatchLeaseExpiresAt" TEXT');
+        addColumn("_job_schedules", "lastDispatchAt", '"lastDispatchAt" TEXT');
+        addColumn("_job_schedules", "lastDispatchError", '"lastDispatchError" TEXT');
+        addColumn("_job_schedules", "suspendedAt", '"suspendedAt" TEXT');
+        addColumn("_job_schedules", "cancelledAt", '"cancelledAt" TEXT');
+        addColumn("_job_schedules", "cancellationReason", '"cancellationReason" TEXT');
+        addColumn("_job_schedules", "actorKind", '"actorKind" TEXT');
+        addColumn("_job_schedules", "actorId", '"actorId" TEXT');
+        this.ctx.storage.sql.exec(`UPDATE "_job_schedules"
+       SET "key" = COALESCE("key", 'raybase:declared:' || "jobName"),
+           "kind" = COALESCE("kind", CASE WHEN "cron" IS NULL THEN 'once' ELSE 'cron' END),
+           "status" = COALESCE("status", CASE WHEN COALESCE("enabled", 1) = 1 THEN 'pending' ELSE 'suspended' END),
+           "bookedAt" = COALESCE("bookedAt", "nextRunAt"),
+           "generation" = COALESCE("generation", 1),
+           "dispatchAttempts" = COALESCE("dispatchAttempts", 0),
+           "actorKind" = COALESCE("actorKind", CASE WHEN "createdBy" IS NULL THEN 'service' ELSE 'user' END),
+           "actorId" = COALESCE("actorId", "createdBy", "service")`);
+        this.ctx.storage.sql.exec(`CREATE UNIQUE INDEX IF NOT EXISTS "_job_schedules_key_idx" ON "_job_schedules" ("key")`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_schedules_status_booked_idx" ON "_job_schedules" ("status", "bookedAt")`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_schedules_job_idx" ON "_job_schedules" ("jobName")`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_schedules_lease_idx" ON "_job_schedules" ("dispatchLeaseExpiresAt")`);
+        this.ctx.storage.sql.exec(`CREATE UNIQUE INDEX IF NOT EXISTS "_job_runs_schedule_generation_idx"
+       ON "_job_runs" ("scheduleKey", "scheduleGeneration")
+       WHERE "scheduleKey" IS NOT NULL AND "scheduleGeneration" IS NOT NULL`);
+        this.ctx.storage.sql.exec(`CREATE UNIQUE INDEX IF NOT EXISTS "_job_runs_batch_seq_idx"
+       ON "_job_runs" ("batchId", "batchSeq")
+       WHERE "batchId" IS NOT NULL`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_runs_continuation_idx"
+       ON "_job_runs" ("continuationOfBatchId")
+       WHERE "continuationOfBatchId" IS NOT NULL`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_runs_concurrency_key_idx"
+       ON "_job_runs" ("concurrencyKey", "status")
+       WHERE "concurrencyKey" IS NOT NULL`);
+        this.ctx.storage.sql.exec(`CREATE INDEX IF NOT EXISTS "_job_runs_job_status_idx" ON "_job_runs" ("jobName", "status")`);
+    }
+    ensureAiBudgetSchemaSync() {
+        for (const statement of splitSqlStatements(aiBudgetSchemaSql)) {
+            this.ctx.storage.sql.exec(statement);
+        }
+    }
+    async claimAiBudget(input) {
+        await this.ensureSchema({ migrations: [] });
+        const now = input.now || new Date().toISOString();
+        const windowStart = `${now.slice(0, 10)}T00:00:00.000Z`;
+        const windowEnd = new Date(new Date(windowStart).getTime() + 24 * 60 * 60 * 1000).toISOString();
+        const requestCount = Math.max(0, Math.trunc(input.requestCount || 0));
+        const outputTokens = Math.max(0, Math.trunc(input.estimatedOutputTokens || 0));
+        const neurons = input.estimatedNeurons == null ? null : Math.max(0, Math.trunc(input.estimatedNeurons));
+        const principalKind = input.principalKind;
+        const checks = [
+            { scope: "app", scopeId: input.appScopeId || "app", requestLimit: input.perAppDailyRequests, outputLimit: null }
+        ];
+        if (principalKind === "public") {
+            checks.push({
+                scope: "public",
+                scopeId: input.publicScopeId || input.userId || "public",
+                requestLimit: input.perPublicDailyRequests,
+                outputLimit: input.perPublicDailyOutputTokens
+            });
+        }
+        else if (principalKind === "user") {
+            const userId = input.userId;
+            if (!userId)
+                throw new Error("AI budget claim requires userId for user principals");
+            checks.push({ scope: "user", scopeId: userId, requestLimit: input.perUserDailyRequests, outputLimit: input.perUserDailyOutputTokens });
+        }
+        let result = { ok: true, windowStart, windowEnd };
+        this.mutateSync(() => {
+            this.ensureAiBudgetSchemaSync();
+            const rows = new Map();
+            for (const check of checks) {
+                const row = this.ctx.storage.sql
+                    .exec(`SELECT * FROM "_ai_budget_windows" WHERE "scope" = ? AND "scopeId" = ? AND "windowStart" = ? LIMIT 1`, check.scope, check.scopeId, windowStart)
+                    .toArray()[0] ?? null;
+                rows.set(`${check.scope}:${check.scopeId}`, row);
+                const currentRequests = Number(row?.requestCount ?? 0);
+                const currentOutputTokens = Number(row?.estimatedOutputTokens ?? 0);
+                if (check.requestLimit != null && check.requestLimit >= 0 && currentRequests + requestCount > check.requestLimit) {
+                    result = { ok: false, scope: check.scope, reason: "daily request limit reached", limit: check.requestLimit, current: currentRequests };
+                    return;
+                }
+                if (check.outputLimit != null && check.outputLimit >= 0 && currentOutputTokens + outputTokens > check.outputLimit) {
+                    result = { ok: false, scope: check.scope, reason: "daily output token limit reached", limit: check.outputLimit, current: currentOutputTokens };
+                    return;
+                }
+            }
+            for (const check of checks) {
+                const row = rows.get(`${check.scope}:${check.scopeId}`) ?? null;
+                if (row) {
+                    this.ctx.storage.sql.exec(`UPDATE "_ai_budget_windows"
+             SET "requestCount" = "requestCount" + ?,
+                 "estimatedOutputTokens" = "estimatedOutputTokens" + ?,
+                 "estimatedNeurons" = COALESCE("estimatedNeurons", 0) + COALESCE(?, 0),
+                 "updatedAt" = ?
+             WHERE "id" = ?`, requestCount, outputTokens, neurons, now, row.id);
+                }
+                else {
+                    this.ctx.storage.sql.exec(`INSERT INTO "_ai_budget_windows"
+             ("id", "scope", "scopeId", "windowStart", "windowEnd", "requestCount", "estimatedOutputTokens", "estimatedNeurons", "updatedAt")
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, `ai_budget_${crypto.randomUUID().replace(/-/g, "")}`, check.scope, check.scopeId, windowStart, windowEnd, requestCount, outputTokens, neurons, now);
+                }
+            }
+        });
+        return result;
+    }
+    async ensureJobsSchema() {
+        await this.ensureSchema({ migrations: [] });
+        await this.ctx.blockConcurrencyWhile(async () => {
+            this.mutateSync(() => {
+                this.ensureJobsSchemaSync();
+            });
+        });
+        return { ok: true };
+    }
+    getJobRun(runId) {
+        return rowToJobRun(this.ctx.storage.sql.exec(`SELECT * FROM "_job_runs" WHERE "id" = ?`, runId).toArray()[0]);
+    }
+    async hydrateClock(force = false) {
+        await hydrateAppClock({
+            local: this.env.RAYBASE_ENV === "local",
+            force,
+            readState: async () => {
+                const row = this.ctx.storage.sql
+                    .exec(`SELECT "value" FROM "_state" WHERE "key" = ?`, devTimeTravelStateKey)
+                    .toArray()[0];
+                if (!row?.value)
+                    return null;
+                try {
+                    return JSON.parse(row.value);
+                }
+                catch {
+                    return null;
+                }
+            }
+        });
+    }
+    async scheduleRealAlarm(realMs = wallNowMs() + defaultCompactionDelayMs) {
+        if (!Number.isFinite(realMs))
+            return;
+        const storage = this.ctx.storage;
+        if (!storage.setAlarm)
+            return;
+        const current = storage.getAlarm ? await storage.getAlarm() : null;
+        if (current === null || current > realMs)
+            await storage.setAlarm(new Date(Math.max(wallNowMs() + 1000, realMs)));
+    }
+    async scheduleVirtualAlarm(targetIso) {
+        if (!targetIso) {
+            await this.scheduleRealAlarm();
+            return;
+        }
+        await this.hydrateClock();
+        const virtualMs = Date.parse(targetIso);
+        if (!Number.isFinite(virtualMs))
+            return;
+        await this.scheduleRealAlarm(toRealMs(virtualMs));
+    }
+    async armAgentAlarm(targetIso, claims) {
+        if (claims && Object.keys(claims).length > 0) {
+            await this.ctx.storage.put(agentAlarmClaimsKey, claims);
+        }
+        await this.hydrateClock(true);
+        await this.scheduleVirtualAlarm(targetIso);
+        return { ok: true };
+    }
+    agentFollowUpExecutor() {
+        return {
+            all: async (sql, params = []) => {
+                this.assertReadableSync();
+                return this.trustedReadRowsSync(sql, params);
+            },
+            first: async (sql, params = []) => {
+                this.assertReadableSync();
+                return this.trustedReadRowsSync(sql, params)[0] ?? null;
+            },
+            run: async (sql, params = []) => {
+                this.mutateSync(() => {
+                    this.ctx.storage.sql.exec(sql, ...params);
+                });
+            },
+            runTransaction: async (statements) => {
+                this.mutateSync(() => {
+                    for (const statement of statements) {
+                        this.ctx.storage.sql.exec(statement.sql, ...(statement.params ?? []));
+                    }
+                });
+            }
+        };
+    }
+    async runAgentFollowUpAlarm(appNow, wallNow) {
+        if (!this.tableExists("_agent_follow_ups"))
+            return;
+        const control = this.agentFollowUpExecutor();
+        const queue = this.env.RAYBASE_JOBS;
+        const claims = (await this.ctx.storage.get(agentAlarmClaimsKey))
+            ?? {};
+        const newlyLapsed = new Set();
+        let dispatchFailed = false;
+        if (queue) {
+            try {
+                const outcomes = await dispatchDueAgentFollowUps({
+                    control,
+                    send: async (message) => {
+                        await queue.send(mergeRaybaseRuntimeClaims(message, claims));
+                    },
+                    now: appNow,
+                    wallNow,
+                    limit: 100,
+                    claimedBy: "alarm"
+                });
+                for (const outcome of outcomes) {
+                    if (outcome.type === "lapsed")
+                        newlyLapsed.add(outcome.row.id);
+                }
+                for (const row of await listUnhandledLapsedAgentFollowUps(control, { limit: 100 })) {
+                    if (newlyLapsed.has(row.id))
+                        continue;
+                    await queue.send(mergeRaybaseRuntimeClaims({
+                        kind: "raybase.agent.follow_up.lapse",
+                        version: 1,
+                        followUpId: row.id,
+                        agentName: row.agentName,
+                        claimedBy: "alarm",
+                        lapsedAt: row.settledAt ?? row.updatedAt
+                    }, claims));
+                }
+            }
+            catch (error) {
+                dispatchFailed = true;
+                console.warn("Raybase Agent follow-up alarm dispatch failed.", error);
+            }
+        }
+        try {
+            const work = await agentFollowUpAlarmWork(control);
+            if (!work.nextDueAt && !work.hasUnhandledLapse && !work.hasOutstandingDispatch)
+                return;
+            const wallNowMsValue = Date.parse(wallNow);
+            const appNowMsValue = Date.parse(appNow);
+            const nextDueMs = work.nextDueAt ? Date.parse(work.nextDueAt) : Number.POSITIVE_INFINITY;
+            const retryPastDue = (!queue || dispatchFailed) && nextDueMs < appNowMsValue;
+            const targets = [
+                retryPastDue ? wallNowMsValue + followUpOutstandingRetryMs : toRealMs(nextDueMs),
+                work.hasUnhandledLapse ? wallNowMsValue + followUpLapseRetryMs : Number.POSITIVE_INFINITY,
+                work.hasOutstandingDispatch ? wallNowMsValue + followUpOutstandingRetryMs : Number.POSITIVE_INFINITY,
+                wallNowMsValue + followUpSafetySweepMs
+            ].filter(Number.isFinite);
+            await this.scheduleRealAlarm(Math.min(...targets));
+        }
+        catch (error) {
+            console.warn("Raybase Agent follow-up alarm re-arm failed.", error);
+        }
+    }
+    async runJobScheduleAlarm(appNow, wallNow) {
+        if (!this.tableExists("_job_schedules"))
+            return;
+        const queue = this.env.RAYBASE_JOBS;
+        const claims = (await this.ctx.storage.get(agentAlarmClaimsKey)) ?? {};
+        const leaseExpiresAt = new Date(Date.parse(wallNow) + 2 * 60_000).toISOString();
+        const claimed = await this.claimDueJobSchedules({ now: appNow, wallNow, leaseExpiresAt, limit: 100 });
+        for (const schedule of claimed.schedules) {
+            if (!schedule.bookedAt)
+                continue;
+            if (!queue) {
+                const retryAt = new Date(Date.parse(wallNow) + 10_000).toISOString();
+                this.mutateSync(() => {
+                    this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "dispatchLeaseExpiresAt" = ?, "lastDispatchError" = ?, "updatedAt" = ? WHERE "id" = ? AND "generation" = ?`, retryAt, "RAYBASE_JOBS queue binding is missing", appNow, schedule.id, schedule.generation);
+                });
+                await this.scheduleRealAlarm(Date.parse(retryAt));
+                continue;
+            }
+            try {
+                await queue.send(mergeRaybaseRuntimeClaims({
+                    kind: "raybase.job.schedule",
+                    version: 1,
+                    scheduleId: schedule.id,
+                    key: schedule.key,
+                    jobName: schedule.jobName,
+                    generation: schedule.generation,
+                    bookedAt: schedule.bookedAt,
+                    inputJson: schedule.inputJson,
+                    service: schedule.service ?? "scheduler",
+                    actorKind: schedule.actorKind,
+                    actorId: schedule.actorId
+                }, claims));
+            }
+            catch (error) {
+                const retryAt = new Date(Date.parse(wallNow) + 10_000).toISOString();
+                this.mutateSync(() => {
+                    this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "dispatchLeaseExpiresAt" = ?, "lastDispatchError" = ?, "updatedAt" = ? WHERE "id" = ? AND "generation" = ?`, retryAt, error instanceof Error ? error.message : String(error), appNow, schedule.id, schedule.generation);
+                });
+                await this.scheduleRealAlarm(Date.parse(retryAt));
+            }
+        }
+        const state = await this.schedulerState();
+        if (state.nextJobScheduleAt)
+            await this.scheduleVirtualAlarm(state.nextJobScheduleAt);
+    }
+    async runAgentTimerAlarm(appNow, wallNow) {
+        const hasWakes = this.tableExists("_agent_wakes");
+        const hasSchedules = this.tableExists("_agent_schedules");
+        if (!hasWakes && !hasSchedules)
+            return;
+        const addOptionalColumn = (table, column, ddl) => {
+            if (this.tableExists(table) && !this.columnExists(table, column)) {
+                this.ctx.storage.sql.exec(`ALTER TABLE ${sqlIdentifier(table)} ADD COLUMN ${ddl}`);
+            }
+        };
+        for (const table of ["_agent_wakes", "_agent_schedules"]) {
+            addOptionalColumn(table, "dispatchGeneration", '"dispatchGeneration" INTEGER');
+            addOptionalColumn(table, "dispatchAttempts", '"dispatchAttempts" INTEGER');
+            addOptionalColumn(table, "dispatchLeaseExpiresAt", '"dispatchLeaseExpiresAt" TEXT');
+            addOptionalColumn(table, "lastDispatchAt", '"lastDispatchAt" TEXT');
+            addOptionalColumn(table, "lastDispatchError", '"lastDispatchError" TEXT');
+        }
+        const control = this.agentFollowUpExecutor();
+        const queue = this.env.RAYBASE_JOBS;
+        const claims = (await this.ctx.storage.get(agentAlarmClaimsKey)) ?? {};
+        const leaseExpiresAt = new Date(Date.parse(wallNow) + 60_000).toISOString();
+        const wakes = hasWakes ? await claimDueAgentWakes(control, { now: appNow, wallNow, leaseExpiresAt, limit: 100 }) : [];
+        const schedules = hasSchedules ? await claimDueAgentSchedules(control, { now: appNow, wallNow, leaseExpiresAt, limit: 100 }) : [];
+        let dispatchFailed = false;
+        for (const wake of wakes) {
+            try {
+                if (!queue)
+                    throw new Error("RAYBASE_JOBS queue binding is missing");
+                await queue.send(mergeRaybaseRuntimeClaims({
+                    kind: "raybase.agent.wake",
+                    version: 1,
+                    wakeId: wake.id,
+                    agentName: wake.agentName,
+                    generation: wake.generation,
+                    runAt: wake.runAt,
+                    claimedBy: "alarm",
+                    claimedAt: wallNow
+                }, claims));
+            }
+            catch (error) {
+                dispatchFailed = true;
+                this.ctx.storage.sql.exec(`UPDATE "_agent_wakes" SET "dispatchLeaseExpiresAt" = NULL, "lastDispatchError" = ?, "updatedAt" = ?
+           WHERE "id" = ? AND COALESCE("dispatchGeneration", 1) = ?`, error instanceof Error ? error.message : String(error), appNow, wake.id, wake.generation);
+            }
+        }
+        for (const schedule of schedules) {
+            try {
+                if (!queue)
+                    throw new Error("RAYBASE_JOBS queue binding is missing");
+                await queue.send(mergeRaybaseRuntimeClaims({
+                    kind: "raybase.agent.schedule",
+                    version: 1,
+                    scheduleId: schedule.id,
+                    agentName: schedule.agentName,
+                    generation: schedule.generation,
+                    bookedAt: schedule.bookedAt,
+                    claimedBy: "alarm",
+                    claimedAt: wallNow
+                }, claims));
+            }
+            catch (error) {
+                dispatchFailed = true;
+                this.ctx.storage.sql.exec(`UPDATE "_agent_schedules" SET "dispatchLeaseExpiresAt" = NULL, "lastDispatchError" = ?, "updatedAt" = ?
+           WHERE "id" = ? AND "nextRunAt" = ? AND COALESCE("dispatchGeneration", 1) = ?`, error instanceof Error ? error.message : String(error), appNow, schedule.id, schedule.bookedAt, schedule.generation);
+            }
+        }
+        const virtualTargets = [];
+        const realTargets = [];
+        if (hasWakes) {
+            const row = this.ctx.storage.sql.exec(`SELECT MIN(CASE WHEN "dispatchLeaseExpiresAt" IS NULL THEN "runAt" END) AS "virtualTarget",
+         MIN("dispatchLeaseExpiresAt") AS "realTarget" FROM "_agent_wakes" WHERE "status" = 'pending'`).toArray()[0];
+            if (row?.virtualTarget)
+                virtualTargets.push(row.virtualTarget);
+            if (row?.realTarget)
+                realTargets.push(row.realTarget);
+        }
+        if (hasSchedules) {
+            const row = this.ctx.storage.sql.exec(`SELECT MIN(CASE WHEN "dispatchLeaseExpiresAt" IS NULL THEN "nextRunAt" END) AS "virtualTarget",
+         MIN("dispatchLeaseExpiresAt") AS "realTarget" FROM "_agent_schedules"
+         WHERE (("enabledOverride" IS NULL AND "enabled" = 1) OR "enabledOverride" = 1) AND "nextRunAt" IS NOT NULL`).toArray()[0];
+            if (row?.virtualTarget)
+                virtualTargets.push(row.virtualTarget);
+            if (row?.realTarget)
+                realTargets.push(row.realTarget);
+        }
+        if (virtualTargets.length)
+            await this.scheduleVirtualAlarm(virtualTargets.sort()[0]);
+        if (realTargets.length)
+            await this.scheduleRealAlarm(Date.parse(realTargets.sort()[0]));
+        if (dispatchFailed)
+            await this.scheduleRealAlarm(Date.parse(wallNow) + 10_000);
+    }
+    async runAgentSkillSyncAlarm(now) {
+        if (!this.tableExists("_agent_skill_sources"))
+            return;
+        try {
+            const result = await syncDueAgentSkillSources({ control: this.agentFollowUpExecutor(), fetcher: fetch, env: this.env, now, limit: 5 });
+            if (result.nextDueAt)
+                await this.scheduleRealAlarm(Date.parse(result.nextDueAt));
+            if (result.failed.length)
+                console.warn("Raybase Agent Skill sync completed with failures.", result.failed.map(({ sourceId }) => sourceId));
+        }
+        catch (error) {
+            console.warn("Raybase Agent Skill alarm sync failed.", error);
+            await this.scheduleRealAlarm(wallNowMs() + 5 * 60 * 1000);
+        }
+    }
+    findIdempotentJobRunSync(jobName, idempotencyKey) {
+        return rowToJobRun(this.ctx.storage.sql
+            .exec(`SELECT * FROM "_job_runs" WHERE "jobName" = ? AND "idempotencyKey" = ?`, jobName, idempotencyKey)
+            .toArray()[0]);
+    }
+    insertJobRunSync(run) {
+        this.ctx.storage.sql.exec(`INSERT INTO "_job_runs"
+       ("id", "jobName", "status", "inputJson", "inputHash", "idempotencyKey", "actorKind", "actorId", "runAsKind", "runAsId",
+        "attempt", "maxAttempts", "queueMessageId", "workflowInstanceId", "leaseOwner", "leaseExpiresAt", "createdAt", "availableAt",
+        "startedAt", "endedAt", "expiresAt", "progressJson", "resultJson", "errorJson", "artifactJson", "createdBy", "retryOfRunId",
+        "scheduleKey", "scheduleGeneration", "scheduleBookedAt", "batchId", "batchSeq", "continuationOfBatchId",
+        "concurrencyKey", "rateLimitKey")
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, run.id, run.jobName, run.status, run.inputJson, run.inputHash ?? null, run.idempotencyKey ?? null, run.actorKind, run.actorId ?? null, run.runAsKind, run.runAsId ?? null, run.attempt ?? 0, run.maxAttempts, run.queueMessageId ?? null, run.workflowInstanceId ?? null, run.leaseOwner ?? null, run.leaseExpiresAt ?? null, run.createdAt, run.availableAt, run.startedAt ?? null, run.endedAt ?? null, run.expiresAt ?? null, run.progressJson ?? null, run.resultJson ?? null, run.errorJson ?? null, run.artifactJson ?? null, run.createdBy ?? null, run.retryOfRunId ?? null, run.scheduleKey ?? null, run.scheduleGeneration ?? null, run.scheduleBookedAt ?? null, run.batchId ?? null, run.batchSeq ?? null, run.continuationOfBatchId ?? null, run.concurrencyKey ?? null, run.rateLimitKey ?? null);
+        const inserted = this.getJobRun(run.id);
+        if (!inserted)
+            throw new Error("Failed to create job run");
+        return inserted;
+    }
+    async createJobRun(input) {
+        await this.ensureJobsSchema();
+        let result = undefined;
+        this.mutateSync(() => {
+            const run = input.run;
+            if (run.idempotencyKey) {
+                const existing = this.findIdempotentJobRunSync(run.jobName, run.idempotencyKey);
+                if (existing) {
+                    result = { created: false, run: existing };
+                    return;
+                }
+            }
+            result = { created: true, run: this.insertJobRunSync(run) };
+        });
+        await this.scheduleRealAlarm();
+        return result;
+    }
+    getJobBatchRowSync(batchId) {
+        return this.ctx.storage.sql.exec(`SELECT * FROM "_job_batches" WHERE "id" = ?`, batchId).toArray()[0];
+    }
+    requireJobBatchSync(batchId) {
+        const row = this.getJobBatchRowSync(batchId);
+        if (!row)
+            throw new Error(`Job batch not found: ${batchId}`);
+        return rowToJobBatch(row);
+    }
+    /**
+     * Records that `run` just became terminal. Callers invoke this inside the
+     * same transaction as the status UPDATE, and only when that UPDATE changed
+     * the row, so each child is counted exactly once however many workers,
+     * redeliveries, or lease sweeps race on it. Returns true when the batch
+     * completed and its continuation run was created.
+     */
+    settleJobRunSync(run, status, now) {
+        let completed = false;
+        if (run.batchId) {
+            const column = batchCountColumns[status];
+            if (!column)
+                throw new Error(`Job run status ${status} is not terminal`);
+            this.ctx.storage.sql.exec(`UPDATE "_job_batches"
+         SET "pending" = "pending" - 1, ${sqlIdentifier(column)} = ${sqlIdentifier(column)} + 1, "updatedAt" = ?
+         WHERE "id" = ? AND "pending" > 0`, now, run.batchId);
+            if (sqliteChanges(this.ctx.storage) > 0)
+                completed = this.completeJobBatchIfDoneSync(run.batchId, now);
+        }
+        if (run.continuationOfBatchId) {
+            this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "finishedAt" = ?, "expiresAt" = ?, "updatedAt" = ? WHERE "id" = ? AND "finishedAt" IS NULL`, now, run.expiresAt, now, run.continuationOfBatchId);
+        }
+        return completed;
+    }
+    /**
+     * Fires the batch's one continuation when it is sealed and has no pending
+     * children. The status guard (`sealed` → `completed`) and the continuation
+     * idempotency key make a second call a no-op.
+     */
+    completeJobBatchIfDoneSync(batchId, now) {
+        const row = this.getJobBatchRowSync(batchId);
+        if (!row || row.status !== "sealed" || Number(row.pending) > 0)
+            return false;
+        const batch = rowToJobBatch(row);
+        const { counts } = batch;
+        const unsuccessful = Boolean(batch.cancelledAt) || counts.failed + counts.cancelled + counts.denied + counts.expired > 0;
+        const template = JSON.parse(String(unsuccessful && row.onFailureJson ? row.onFailureJson : row.onCompleteJson));
+        const idempotencyKey = batchContinuationIdempotencyKey(batch.id);
+        const continuation = this.findIdempotentJobRunSync(template.jobName, idempotencyKey) ?? this.insertJobRunSync({
+            id: randomId("jobrun"),
+            jobName: template.jobName,
+            status: "queued",
+            inputJson: template.inputJson,
+            inputHash: template.inputHash,
+            idempotencyKey,
+            actorKind: batch.actorKind,
+            actorId: batch.actorId,
+            runAsKind: template.runAsKind,
+            runAsId: template.runAsId,
+            maxAttempts: template.maxAttempts,
+            createdAt: now,
+            availableAt: wallNowIso(),
+            expiresAt: null,
+            progressJson: null,
+            artifactJson: null,
+            createdBy: batch.createdBy,
+            retryOfRunId: null,
+            scheduleKey: null,
+            scheduleGeneration: null,
+            scheduleBookedAt: null,
+            continuationOfBatchId: batch.id,
+            concurrencyKey: template.concurrencyKey ?? null,
+            rateLimitKey: template.rateLimitKey ?? null
+        });
+        this.ctx.storage.sql.exec(`UPDATE "_job_batches"
+       SET "status" = 'completed', "completedAt" = ?, "continuationRunId" = ?, "continuationJob" = ?,
+           "continuationDispatchedAt" = NULL, "updatedAt" = ?
+       WHERE "id" = ? AND "status" = 'sealed'`, now, continuation.id, continuation.jobName, now, batch.id);
+        this.ctx.storage.sql.exec(`INSERT INTO "_job_events" ("id", "runId", "type", "level", "message", "dataJson", "createdAt")
+       VALUES (?, ?, 'batch', 'info', ?, ?, ?)`, `jobevt_${crypto.randomUUID().replace(/-/g, "")}`, continuation.id, `Batch ${batch.name} completed`, JSON.stringify({ batchId: batch.id, key: batch.key, counts, cancelled: Boolean(batch.cancelledAt) }), now);
+        return true;
+    }
+    /**
+     * Sends queue messages for continuations that are not yet dispatched. The
+     * continuation row is committed before this runs, so a crash between commit
+     * and send leaves an undispatched batch that the alarm retries; a second
+     * send is harmless because claiming a run is idempotent.
+     */
+    async dispatchJobBatchContinuations() {
+        if (!this.tableExists("_job_batches"))
+            return;
+        const pending = this.ctx.storage.sql.exec(`SELECT "id", "continuationRunId", "continuationJob" FROM "_job_batches"
+       WHERE "status" = 'completed' AND "continuationDispatchedAt" IS NULL AND "continuationRunId" IS NOT NULL
+       ORDER BY "completedAt" ASC LIMIT 50`).toArray();
+        if (!pending.length)
+            return;
+        await this.scheduleRealAlarm(wallNowMs() + 30_000);
+        const queue = this.env.RAYBASE_JOBS;
+        const claims = (await this.ctx.storage.get(agentAlarmClaimsKey)) ?? {};
+        let failed = false;
+        for (const batch of pending) {
+            try {
+                if (!queue)
+                    throw new Error("RAYBASE_JOBS queue binding is missing");
+                await queue.send(mergeRaybaseRuntimeClaims({
+                    kind: "raybase.job.run",
+                    version: 1,
+                    runId: batch.continuationRunId,
+                    jobName: batch.continuationJob
+                }, claims));
+                this.mutateSync(() => {
+                    this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "continuationDispatchedAt" = ?, "lastDispatchError" = NULL WHERE "id" = ? AND "continuationDispatchedAt" IS NULL`, wallNowIso(), batch.id);
+                });
+            }
+            catch (error) {
+                failed = true;
+                this.mutateSync(() => {
+                    this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "lastDispatchError" = ? WHERE "id" = ?`, error instanceof Error ? error.message : String(error), batch.id);
+                });
+            }
+        }
+        if (failed)
+            await this.scheduleRealAlarm(wallNowMs() + 10_000);
+    }
+    async createJobBatch(input) {
+        await this.ensureJobsSchema();
+        let result = undefined;
+        const onCompleteJson = JSON.stringify(input.onComplete);
+        const onFailureJson = input.onFailure ? JSON.stringify(input.onFailure) : null;
+        this.mutateSync(() => {
+            const existing = this.ctx.storage.sql.exec(`SELECT * FROM "_job_batches" WHERE "key" = ?`, input.key).toArray()[0];
+            if (existing) {
+                const sameDefinition = existing.name === input.name
+                    && sameContinuation(existing.onCompleteJson, onCompleteJson)
+                    && sameContinuation(existing.onFailureJson, onFailureJson);
+                if (!sameDefinition)
+                    throw new Error(`Job batch key already exists with a different definition: ${input.key}`);
+                result = { created: false, batch: rowToJobBatch(existing) };
+                return;
+            }
+            this.ctx.storage.sql.exec(`INSERT INTO "_job_batches"
+         ("id", "name", "key", "status", "onCompleteJson", "onFailureJson", "createdAt", "updatedAt", "createdBy", "actorKind", "actorId")
+         VALUES (?, ?, ?, 'open', ?, ?, ?, ?, ?, ?, ?)`, input.id, input.name, input.key, onCompleteJson, onFailureJson, input.now, input.now, input.createdBy, input.actorKind, input.actorId);
+            result = { created: true, batch: this.requireJobBatchSync(input.id) };
+        });
+        if (input.claims && Object.keys(input.claims).length)
+            await this.ctx.storage.put(agentAlarmClaimsKey, input.claims);
+        return result;
+    }
+    async getJobBatch(batchId) {
+        await this.ensureJobsSchema();
+        const row = this.getJobBatchRowSync(batchId);
+        return row ? rowToJobBatch(row) : null;
+    }
+    async listJobBatches(input = {}) {
+        await this.ensureJobsSchema();
+        const clauses = [];
+        const bindings = [];
+        if (input.status) {
+            clauses.push(`"status" = ?`);
+            bindings.push(input.status);
+        }
+        if (input.name) {
+            clauses.push(`"name" = ?`);
+            bindings.push(input.name);
+        }
+        if (input.key) {
+            clauses.push(`"key" = ?`);
+            bindings.push(input.key);
+        }
+        const limit = Math.min(Math.max(input.limit ?? 100, 1), 500);
+        const batches = this.ctx.storage.sql.exec(`SELECT * FROM "_job_batches" ${clauses.length ? `WHERE ${clauses.join(" AND ")}` : ""} ORDER BY "createdAt" DESC, "id" DESC LIMIT ?`, ...bindings, limit).toArray().map(rowToJobBatch);
+        const counts = this.ctx.storage.sql.exec(`SELECT "status", COUNT(*) AS "count" FROM "_job_batches" GROUP BY "status" ORDER BY "status"`).toArray().map((row) => ({ status: row.status, count: Number(row.count) }));
+        return { batches, counts };
+    }
+    /**
+     * Adds up to 100 children in one transaction: each run, plus the enqueue
+     * event and audit row of each one created. Children are numbered in input
+     * order; a repeated idempotency key, in this chunk or an earlier call,
+     * returns the existing child.
+     */
+    async createJobBatchChildren(input) {
+        await this.ensureJobsSchema();
+        if (input.children.length > 100)
+            throw new Error("A job batch chunk holds at most 100 children");
+        let result = undefined;
+        this.mutateSync(() => {
+            const batch = this.requireJobBatchSync(input.batchId);
+            let mayAdd = batch.status === "open" ? true : null;
+            const children = [];
+            let created = 0;
+            for (const child of input.children) {
+                const run = child.run;
+                if (run.idempotencyKey) {
+                    const existing = this.findIdempotentJobRunSync(run.jobName, run.idempotencyKey);
+                    if (existing) {
+                        if (existing.batchId !== batch.id) {
+                            throw new Error(`Idempotency key ${run.idempotencyKey} already belongs to job run ${existing.id} outside batch ${batch.key}`);
+                        }
+                        children.push({ created: false, run: existing });
+                        continue;
+                    }
+                }
+                if (mayAdd === null) {
+                    const caller = input.fromRunId ? this.getJobRun(input.fromRunId) : null;
+                    mayAdd = batch.status !== "completed" && caller?.batchId === batch.id && !terminalJobStatuses.has(caller.status);
+                }
+                if (!mayAdd) {
+                    throw new Error(`Job batch ${batch.key} is ${batch.status}; only its own running children can add children after seal`);
+                }
+                created += 1;
+                const inserted = this.insertJobRunSync({ ...run, batchId: batch.id, batchSeq: batch.counts.total + created, continuationOfBatchId: null });
+                this.ctx.storage.sql.exec(`INSERT INTO "_job_events" ("id", "runId", "type", "level", "message", "dataJson", "createdAt")
+           VALUES (?, ?, 'enqueue', 'info', ?, ?, ?)`, `jobevt_${crypto.randomUUID().replace(/-/g, "")}`, inserted.id, `Queued ${inserted.jobName} in batch ${batch.name}`, child.eventDataJson, input.now);
+                this.ctx.storage.sql.exec(`INSERT INTO "_audit" ("id", "actorKind", "actorId", "runAsKind", "runAsId", "action", "targetType", "targetId", "metadata")
+           VALUES (?, ?, ?, ?, ?, ?, '_job_runs', ?, ?)`, randomId("audit"), child.audit.actorKind, child.audit.actorId, child.audit.runAsKind, child.audit.runAsId, child.audit.action, inserted.id, child.audit.metadata);
+                children.push({ created: true, run: inserted });
+            }
+            if (created) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "total" = "total" + ?, "pending" = "pending" + ?, "updatedAt" = ? WHERE "id" = ?`, created, created, input.now, batch.id);
+            }
+            result = { children, batch: this.requireJobBatchSync(batch.id) };
+        });
+        await this.scheduleRealAlarm();
+        return result;
+    }
+    async sealJobBatch(input) {
+        await this.ensureJobsSchema();
+        let sealed = false;
+        let completed = false;
+        let batch = undefined;
+        this.mutateSync(() => {
+            this.requireJobBatchSync(input.batchId);
+            this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "status" = 'sealed', "sealedAt" = ?, "updatedAt" = ? WHERE "id" = ? AND "status" = 'open'`, input.now, input.now, input.batchId);
+            sealed = sqliteChanges(this.ctx.storage) > 0;
+            completed = this.completeJobBatchIfDoneSync(input.batchId, input.now);
+            batch = this.requireJobBatchSync(input.batchId);
+        });
+        if (completed)
+            await this.dispatchJobBatchContinuations();
+        return { sealed, batch: completed ? (await this.getJobBatch(input.batchId)) : batch };
+    }
+    async cancelJobBatch(input) {
+        await this.ensureJobsSchema();
+        let cancelledRuns = 0;
+        let completed = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            const batch = this.requireJobBatchSync(input.batchId);
+            if (batch.status === "completed")
+                return;
+            this.ctx.storage.sql.exec(`UPDATE "_job_batches"
+         SET "status" = 'sealed', "sealedAt" = COALESCE("sealedAt", ?), "cancelledAt" = ?, "cancellationReason" = ?, "updatedAt" = ?
+         WHERE "id" = ?`, input.now, input.now, input.reason ?? null, input.now, batch.id);
+            const errorJson = JSON.stringify({
+                cancelled: true,
+                reason: input.reason ?? null,
+                batchId: batch.id,
+                actorKind: input.actorKind ?? null,
+                actorId: input.actorId ?? null
+            });
+            const pools = this.ctx.storage.sql.exec(`SELECT DISTINCT "jobName", "concurrencyKey" FROM "_job_runs"
+         WHERE "batchId" = ? AND "status" NOT IN ('succeeded', 'failed', 'denied', 'cancelled', 'expired')`, batch.id).toArray();
+            for (const jobName of new Set(pools.map((pool) => pool.jobName))) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+           SET "status" = 'cancelled', "endedAt" = ?, "expiresAt" = ?, "errorJson" = ?, "leaseOwner" = NULL, "leaseExpiresAt" = NULL
+           WHERE "batchId" = ? AND "jobName" = ? AND "status" NOT IN ('succeeded', 'failed', 'denied', 'cancelled', 'expired')`, input.now, input.expiresAtByJob?.[jobName] ?? input.expiresAt ?? null, errorJson, batch.id, jobName);
+                cancelledRuns += sqliteChanges(this.ctx.storage);
+            }
+            this.ctx.storage.sql.exec(`UPDATE "_job_batches" SET "pending" = "pending" - ?, "cancelled" = "cancelled" + ? WHERE "id" = ?`, cancelledRuns, cancelledRuns, batch.id);
+            completed = this.completeJobBatchIfDoneSync(batch.id, input.now);
+            // Running children give their slots up, so runs waiting on them in other
+            // batches, or outside any batch, can start.
+            wakes = this.wakeJobRunsSync(jobSlotPools(pools), wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        if (completed)
+            await this.dispatchJobBatchContinuations();
+        return { cancelledRuns, batch: (await this.getJobBatch(input.batchId)) };
+    }
+    async listJobBatchChildren(input) {
+        await this.ensureJobsSchema();
+        const limit = Math.min(Math.max(Math.trunc(input.limit ?? 50), 1), 100);
+        const afterSeq = input.cursor ? Number(input.cursor) : 0;
+        if (!Number.isInteger(afterSeq) || afterSeq < 0)
+            throw new Error("Invalid job batch children cursor");
+        const rows = this.ctx.storage.sql.exec(`SELECT * FROM "_job_runs"
+       WHERE "batchId" = ? AND "batchSeq" > ?${input.status ? ` AND "status" = ?` : ""}
+       ORDER BY "batchSeq" ASC LIMIT ?`, ...(input.status ? [input.batchId, afterSeq, input.status, limit + 1] : [input.batchId, afterSeq, limit + 1])).toArray();
+        const page = rows.slice(0, limit).map((row) => rowToJobBatchChild(row, input.batchId));
+        return { children: page, cursor: rows.length > limit ? String(page[page.length - 1].seq) : null };
+    }
+    async claimJobRun(input) {
+        await this.ensureJobsSchema();
+        const wallNow = input.wallNow ?? input.now;
+        let result = { status: "missing" };
+        let wakes = [];
+        this.mutateSync(() => {
+            this.syncJobClaimLimitsSync(input.jobName, input.limits, wallNow);
+            // Counting slots in use and taking one happen in this one synchronous
+            // block, so concurrent claims cannot both see the last free slot.
+            const gate = input.limits ? this.jobClaimGateSync(input, input.limits, wallNow) : null;
+            if (gate?.deferred) {
+                result = gate.deferred.result;
+                wakes = gate.deferred.wakes;
+                return;
+            }
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+         SET "status" = 'running',
+             "leaseOwner" = ?,
+             "leaseExpiresAt" = ?,
+             "startedAt" = COALESCE("startedAt", ?),
+             "attempt" = "attempt" + 1,
+             "deferredReason" = NULL,
+             "wokenAt" = NULL
+         WHERE "id" = ?
+           AND "jobName" = ?
+           AND "status" IN ('queued', 'leased')
+           AND "availableAt" <= ?
+           AND ("leaseExpiresAt" IS NULL OR "leaseExpiresAt" <= ?)`, input.leaseOwner, input.leaseExpiresAt, input.now, input.runId, input.jobName, wallNow, wallNow);
+            if (sqliteChanges(this.ctx.storage) > 0) {
+                if (gate?.rateBucket)
+                    this.takeJobRateTokenSync(gate.rateBucket, wallNow);
+                const claimed = this.getJobRun(input.runId);
+                if (!claimed)
+                    throw new Error("Claimed job run disappeared");
+                result = { status: "claimed", run: claimed };
+                return;
+            }
+            const current = this.getJobRun(input.runId);
+            if (!current) {
+                result = { status: "missing" };
+            }
+            else if (terminalJobStatuses.has(current.status)) {
+                result = { status: "terminal", run: current };
+            }
+            else if (current.status === "queued" && current.availableAt > wallNow) {
+                result = { status: "not-due", run: current };
+            }
+            else if (current.status === "cancelled") {
+                result = { status: "cancelled", run: current };
+            }
+            else {
+                result = { status: "leased", run: current };
+            }
+        });
+        const finalized = result;
+        if (finalized.status !== "deferred") {
+            await this.scheduleRealAlarm(Date.parse(input.leaseExpiresAt));
+        }
+        else if (finalized.deferral.parked) {
+            await this.storeAlarmClaims(input.claims);
+            await this.scheduleRealAlarm(wallNowMs() + jobWakeSweepMs);
+        }
+        await this.sendJobWakes(wakes);
+        return finalized;
+    }
+    /**
+     * Keeps the limits each job last claimed with, so that when a slot frees the
+     * Durable Object can tell which parked runs a claim would now admit.
+     */
+    syncJobClaimLimitsSync(jobName, limits, wallNow) {
+        const max = limits?.max ?? null;
+        const perKeyMax = limits?.perKeyMax ?? null;
+        const stored = this.ctx.storage.sql
+            .exec(`SELECT "max", "perKeyMax" FROM "_job_claim_limits" WHERE "jobName" = ?`, jobName)
+            .toArray()[0];
+        if (max === null && perKeyMax === null) {
+            if (stored)
+                this.ctx.storage.sql.exec(`DELETE FROM "_job_claim_limits" WHERE "jobName" = ?`, jobName);
+            return;
+        }
+        if (stored && stored.max === max && stored.perKeyMax === perKeyMax)
+            return;
+        this.ctx.storage.sql.exec(`INSERT INTO "_job_claim_limits" ("jobName", "max", "perKeyMax", "updatedAt") VALUES (?, ?, ?, ?)
+       ON CONFLICT("jobName") DO UPDATE SET "max" = excluded."max", "perKeyMax" = excluded."perKeyMax", "updatedAt" = excluded."updatedAt"`, jobName, max, perKeyMax, wallNow);
+    }
+    /**
+     * Slots of one pool in use: runs holding a live lease, plus parked runs
+     * woken in the last 30 seconds, which hold the slot that woke them while
+     * their message is in flight. A run whose worker died stops counting when
+     * its lease expires, before stale-lease compaction fails it.
+     */
+    jobSlotsInUseSync(column, value, wallNow, exceptRunId = null) {
+        const reservedSince = new Date(Date.parse(wallNow) - jobWakeReservationMs).toISOString();
+        return Number(this.ctx.storage.sql.exec(`SELECT COUNT(*) AS "count" FROM "_job_runs"
+         WHERE ${sqlIdentifier(column)} = ?
+           AND (("status" IN ('running', 'leased') AND "leaseExpiresAt" > ?)
+             OR ("status" = 'queued' AND "wokenAt" > ? AND "id" != ?))`, value, wallNow, reservedSince, exceptRunId ?? "").toArray()[0]?.count ?? 0);
+    }
+    /** Decides whether a claim that would otherwise succeed must wait on a full limit. */
+    jobClaimGateSync(input, limits, wallNow) {
+        const run = this.getJobRun(input.runId);
+        if (!run || run.jobName !== input.jobName || (run.status !== "queued" && run.status !== "leased"))
+            return null;
+        if (run.availableAt > wallNow || (run.leaseExpiresAt !== null && run.leaseExpiresAt > wallNow))
+            return null;
+        let deferral = null;
+        if (limits.max !== undefined) {
+            const count = this.jobSlotsInUseSync("jobName", run.jobName, wallNow, run.id);
+            if (count >= limits.max)
+                deferral = { reason: "concurrency", limit: limits.max, inFlight: count, key: null };
+        }
+        if (!deferral && limits.perKeyMax !== undefined && run.concurrencyKey !== null) {
+            const count = this.jobSlotsInUseSync("concurrencyKey", run.concurrencyKey, wallNow, run.id);
+            if (count >= limits.perKeyMax)
+                deferral = { reason: "concurrency-key", limit: limits.perKeyMax, inFlight: count, key: run.concurrencyKey };
+        }
+        let rateBucket;
+        if (!deferral && limits.rateLimit) {
+            const { perSecond, burst, keyed } = limits.rateLimit;
+            const key = keyed ? run.rateLimitKey : null;
+            const id = key === null ? `job:${run.jobName}` : `key:${key}`;
+            const tokens = this.jobRateTokensSync(id, perSecond, burst, wallNow);
+            if (tokens < 1)
+                deferral = { reason: "rate-limit", limit: burst, key, retryAfterMs: Math.ceil(((1 - tokens) / perSecond) * 1000) };
+            else
+                rateBucket = { id, tokens, perSecond, burst };
+        }
+        if (!deferral)
+            return { rateBucket };
+        return { deferred: this.deferJobRunSync(run, deferral, input.now, wallNow) };
+    }
+    /**
+     * A run deferred on a concurrency slot is parked: the Durable Object wakes
+     * it when a slot in its pools frees, so the consumer drops its message
+     * instead of polling. A rate-limit wait is a known delay, so that message
+     * is redelivered after it. Without a queue binding to wake from, every
+     * deferral falls back to redelivery with backoff.
+     */
+    deferJobRunSync(run, deferral, now, wallNow) {
+        const deferrals = run.deferrals + 1;
+        const parked = deferral.reason !== "rate-limit" && Boolean(this.jobsQueue());
+        this.ctx.storage.sql.exec(`UPDATE "_job_runs" SET "deferrals" = ?, "deferredAt" = ?, "deferredReason" = ?, "wokenAt" = NULL WHERE "id" = ?`, deferrals, now, deferral.reason, run.id);
+        // A backlog can defer one run many times; record the wait once, when it
+        // starts or changes reason, rather than once per redelivery or wake.
+        if (run.deferredReason !== deferral.reason) {
+            this.ctx.storage.sql.exec(`INSERT INTO "_job_events" ("id", "runId", "type", "level", "message", "dataJson", "createdAt")
+         VALUES (?, ?, 'deferred', 'info', ?, ?, ?)`, `jobevt_${crypto.randomUUID().replace(/-/g, "")}`, run.id, jobDeferralMessage(run.jobName, deferral), JSON.stringify({ ...deferral, deferrals }), now);
+        }
+        // A woken run that waits again gives back the slot it was holding.
+        const wakes = run.wokenAt ? this.wakeJobRunsSync(jobSlotPools([run]), wallNow) : [];
+        const updated = this.getJobRun(run.id);
+        if (!updated)
+            throw new Error("Deferred job run disappeared");
+        return { result: { status: "deferred", run: updated, deferral: { ...deferral, deferrals, parked } }, wakes };
+    }
+    /**
+     * Picks the parked runs a claim would now admit, oldest first, and marks
+     * them woken so they hold their slots until their message arrives. Scoped
+     * to the pools a released run held, or every parked run for the alarm's
+     * sweep. Each candidate is checked against its own job's last claimed
+     * limits; the claim gate still has the final say.
+     */
+    wakeJobRunsSync(requested, wallNow, max = 100) {
+        // Without a queue binding nothing is parked: waiting runs redeliver themselves.
+        if (!this.jobsQueue())
+            return [];
+        if (requested && !requested.jobNames.length && !requested.keys.length)
+            return [];
+        // A statement binds at most 100 values; many pools at once (a batch
+        // cancelled across hundreds of sites) take the unscoped sweep instead.
+        const scope = requested && requested.jobNames.length + requested.keys.length <= 90 ? requested : null;
+        const reservedSince = new Date(Date.parse(wallNow) - jobWakeReservationMs).toISOString();
+        const bindings = [wallNow, reservedSince];
+        let poolSql = "";
+        if (scope) {
+            const clauses = [];
+            if (scope.jobNames.length) {
+                clauses.push(`"jobName" IN (${scope.jobNames.map(() => "?").join(", ")})`);
+                bindings.push(...scope.jobNames);
+            }
+            if (scope.keys.length) {
+                clauses.push(`"concurrencyKey" IN (${scope.keys.map(() => "?").join(", ")})`);
+                bindings.push(...scope.keys);
+            }
+            poolSql = ` AND (${clauses.join(" OR ")})`;
+        }
+        const candidates = this.ctx.storage.sql.exec(`SELECT "id", "jobName", "concurrencyKey" FROM "_job_runs"
+       WHERE "status" = 'queued' AND "deferredReason" IN ${parkedDeferralReasons}
+         AND "availableAt" <= ? AND ("wokenAt" IS NULL OR "wokenAt" <= ?)${poolSql}
+       ORDER BY "createdAt" ASC, rowid ASC
+       LIMIT ?`, ...bindings, scope ? 200 : 1000).toArray();
+        if (!candidates.length)
+            return [];
+        const limitsByJob = new Map();
+        const inUse = new Map();
+        const poolKey = (column, value) => `${column}:${value}`;
+        const slotsInUse = (column, value) => {
+            const key = poolKey(column, value);
+            if (!inUse.has(key))
+                inUse.set(key, this.jobSlotsInUseSync(column, value, wallNow));
+            return inUse.get(key);
+        };
+        const woken = [];
+        for (const candidate of candidates) {
+            if (!limitsByJob.has(candidate.jobName)) {
+                limitsByJob.set(candidate.jobName, this.ctx.storage.sql
+                    .exec(`SELECT "max", "perKeyMax" FROM "_job_claim_limits" WHERE "jobName" = ?`, candidate.jobName)
+                    .toArray()[0] ?? null);
+            }
+            const limits = limitsByJob.get(candidate.jobName);
+            if (limits?.max != null && slotsInUse("jobName", candidate.jobName) >= Number(limits.max))
+                continue;
+            if (limits?.perKeyMax != null && candidate.concurrencyKey !== null && slotsInUse("concurrencyKey", candidate.concurrencyKey) >= Number(limits.perKeyMax))
+                continue;
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs" SET "wokenAt" = ? WHERE "id" = ?`, wallNow, candidate.id);
+            // The woken run now holds a slot in each pool it belongs to, whichever
+            // job's limit counts that pool.
+            for (const key of [poolKey("jobName", candidate.jobName), candidate.concurrencyKey === null ? null : poolKey("concurrencyKey", candidate.concurrencyKey)]) {
+                if (key && inUse.has(key))
+                    inUse.set(key, inUse.get(key) + 1);
+            }
+            woken.push({ id: candidate.id, jobName: candidate.jobName });
+            if (woken.length >= max)
+                break;
+        }
+        return woken;
+    }
+    /**
+     * Sends the wake messages chosen inside a committed transaction. A failed
+     * send gives the unsent runs' slots back and arms the alarm, whose sweep
+     * wakes them again; a duplicate wake is harmless because claiming is
+     * idempotent.
+     */
+    async sendJobWakes(wakes) {
+        if (!wakes.length)
+            return;
+        const queue = this.jobsQueue();
+        const claims = (await this.ctx.storage.get(agentAlarmClaimsKey)) ?? {};
+        let sent = 0;
+        try {
+            if (!queue)
+                throw new Error("RAYBASE_JOBS queue binding is missing");
+            for (; sent < wakes.length; sent += 100) {
+                await queue.sendBatch(wakes.slice(sent, sent + 100).map((wake) => ({
+                    body: mergeRaybaseRuntimeClaims({ kind: "raybase.job.run", version: 1, runId: wake.id, jobName: wake.jobName }, claims)
+                })));
+            }
+        }
+        catch (error) {
+            console.warn("Raybase could not send job wake messages; the alarm will wake those runs again.", error);
+            const unsent = wakes.slice(sent).map((wake) => wake.id);
+            this.mutateSync(() => {
+                for (let offset = 0; offset < unsent.length; offset += 90) {
+                    const ids = unsent.slice(offset, offset + 90);
+                    this.ctx.storage.sql.exec(`UPDATE "_job_runs" SET "wokenAt" = NULL WHERE "status" = 'queued' AND "id" IN (${ids.map(() => "?").join(", ")})`, ...ids);
+                }
+            });
+            await this.scheduleRealAlarm(wallNowMs() + jobWakeRetryMs);
+        }
+    }
+    /** The alarm's backstop: wakes parked runs that a lost, failed, or never-sent wake left waiting. */
+    async sweepParkedJobRuns() {
+        if (!this.jobsQueue() || !this.tableExists("_job_runs") || !this.columnExists("_job_runs", "wokenAt"))
+            return;
+        let wakes = [];
+        this.mutateSync(() => {
+            wakes = this.wakeJobRunsSync(null, wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        const parked = this.ctx.storage.sql.exec(`SELECT 1 FROM "_job_runs" WHERE "status" = 'queued' AND "deferredReason" IN ${parkedDeferralReasons} LIMIT 1`).toArray();
+        if (parked.length)
+            await this.scheduleRealAlarm(wallNowMs() + jobWakeSweepMs);
+    }
+    /**
+     * A parked run of a job this deployment no longer registers stops waiting
+     * for a wake, so it cannot keep taking the slots of jobs that share its key.
+     */
+    async unparkJobRun(input) {
+        await this.ensureJobsSchema();
+        let unparked = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            const run = this.getJobRun(input.runId);
+            if (!run || run.status !== "queued" || (run.deferredReason !== "concurrency" && run.deferredReason !== "concurrency-key"))
+                return;
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs" SET "deferredReason" = NULL, "wokenAt" = NULL WHERE "id" = ?`, run.id);
+            this.ctx.storage.sql.exec(`INSERT INTO "_job_events" ("id", "runId", "type", "level", "message", "dataJson", "createdAt")
+         VALUES (?, ?, 'unparked', 'warn', ?, NULL, ?)`, `jobevt_${crypto.randomUUID().replace(/-/g, "")}`, run.id, `Job ${run.jobName} is not registered, so this run no longer waits for a concurrency slot`, input.now);
+            unparked = true;
+            if (run.wokenAt)
+                wakes = this.wakeJobRunsSync(jobSlotPools([run]), wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        return { unparked };
+    }
+    jobsQueue() {
+        return this.env.RAYBASE_JOBS;
+    }
+    async storeAlarmClaims(claims) {
+        if (!claims || !Object.keys(claims).length)
+            return;
+        const stored = await this.ctx.storage.get(agentAlarmClaimsKey);
+        if (JSON.stringify(stored ?? null) !== JSON.stringify(claims))
+            await this.ctx.storage.put(agentAlarmClaimsKey, claims);
+    }
+    jobRateTokensSync(id, perSecond, burst, wallNow) {
+        const row = this.ctx.storage.sql
+            .exec(`SELECT "tokens", "refilledAt" FROM "_job_rate_buckets" WHERE "key" = ?`, id)
+            .toArray()[0];
+        if (!row)
+            return burst;
+        const elapsedSeconds = Math.max(0, (Date.parse(wallNow) - Date.parse(String(row.refilledAt))) / 1000);
+        return Math.min(burst, Number(row.tokens) + elapsedSeconds * perSecond);
+    }
+    takeJobRateTokenSync(bucket, wallNow) {
+        const tokens = bucket.tokens - 1;
+        // A bucket past fullAt reads the same as no row, so compaction may drop it.
+        const fullAt = new Date(Date.parse(wallNow) + ((bucket.burst - tokens) / bucket.perSecond) * 1000).toISOString();
+        this.ctx.storage.sql.exec(`INSERT INTO "_job_rate_buckets" ("key", "tokens", "refilledAt", "fullAt") VALUES (?, ?, ?, ?)
+       ON CONFLICT("key") DO UPDATE SET "tokens" = excluded."tokens", "refilledAt" = excluded."refilledAt", "fullAt" = excluded."fullAt"`, bucket.id, tokens, wallNow, fullAt);
+    }
+    async completeJobRun(input) {
+        await this.ensureJobsSchema();
+        let batchCompleted = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+         SET "status" = 'succeeded',
+             "endedAt" = ?,
+             "expiresAt" = ?,
+             "resultJson" = ?,
+             "artifactJson" = COALESCE(?, "artifactJson"),
+             "leaseOwner" = NULL,
+             "leaseExpiresAt" = NULL
+         WHERE "id" = ? AND "status" = 'running' AND "leaseOwner" = ?`, input.now, input.expiresAt, input.resultJson, input.artifactJson ?? null, input.runId, input.leaseOwner);
+            if (sqliteChanges(this.ctx.storage) === 0)
+                throw new Error("Job run was not completed because its lease is stale or it is no longer running");
+            const run = this.getJobRun(input.runId);
+            batchCompleted = this.settleJobRunSync(run, "succeeded", input.now);
+            wakes = this.wakeJobRunsSync(jobSlotPools([run]), wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        if (batchCompleted)
+            await this.dispatchJobBatchContinuations();
+        await this.scheduleVirtualAlarm(input.expiresAt);
+        return { ok: true };
+    }
+    async failJobRun(input) {
+        await this.ensureJobsSchema();
+        let batchCompleted = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            if (input.retry) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+           SET "status" = 'queued',
+               "availableAt" = ?,
+               "errorJson" = ?,
+               "leaseOwner" = NULL,
+               "leaseExpiresAt" = NULL
+           WHERE "id" = ? AND "status" = 'running' AND "leaseOwner" = ?`, input.availableAt ?? input.now, input.errorJson, input.runId, input.leaseOwner);
+            }
+            else {
+                this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+           SET "status" = 'failed',
+               "endedAt" = ?,
+               "expiresAt" = ?,
+               "errorJson" = ?,
+               "leaseOwner" = NULL,
+               "leaseExpiresAt" = NULL
+           WHERE "id" = ? AND "status" = 'running' AND "leaseOwner" = ?`, input.now, input.expiresAt ?? null, input.errorJson, input.runId, input.leaseOwner);
+            }
+            if (sqliteChanges(this.ctx.storage) === 0)
+                throw new Error("Job run was not failed because its lease is stale or it is no longer running");
+            const run = this.getJobRun(input.runId);
+            if (!input.retry)
+                batchCompleted = this.settleJobRunSync(run, "failed", input.now);
+            // A run waiting out its retry delay holds no slot.
+            wakes = this.wakeJobRunsSync(jobSlotPools([run]), wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        if (batchCompleted)
+            await this.dispatchJobBatchContinuations();
+        if (input.retry)
+            await this.scheduleRealAlarm(Date.parse(input.availableAt ?? input.now));
+        else
+            await this.scheduleVirtualAlarm(input.expiresAt);
+        return { ok: true };
+    }
+    async denyJobRun(input) {
+        await this.ensureJobsSchema();
+        let batchCompleted = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            const leaseSql = input.leaseOwner ? ` AND "leaseOwner" = ?` : "";
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+         SET "status" = 'denied',
+             "endedAt" = ?,
+             "expiresAt" = ?,
+             "errorJson" = ?,
+             "leaseOwner" = NULL,
+             "leaseExpiresAt" = NULL
+         WHERE "id" = ? AND "status" IN ('queued', 'leased', 'running')${leaseSql}`, ...(input.leaseOwner
+                ? [input.now, input.expiresAt, input.errorJson, input.runId, input.leaseOwner]
+                : [input.now, input.expiresAt, input.errorJson, input.runId]));
+            if (sqliteChanges(this.ctx.storage) > 0) {
+                const run = this.getJobRun(input.runId);
+                batchCompleted = this.settleJobRunSync(run, "denied", input.now);
+                wakes = this.wakeJobRunsSync(jobSlotPools([run]), wallNowIso());
+            }
+        });
+        await this.sendJobWakes(wakes);
+        if (batchCompleted)
+            await this.dispatchJobBatchContinuations();
+        await this.scheduleVirtualAlarm(input.expiresAt);
+        return { ok: true };
+    }
+    async cancelJobRun(input) {
+        await this.ensureJobsSchema();
+        let result = { status: "missing" };
+        let batchCompleted = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            const current = this.getJobRun(input.runId);
+            if (!current) {
+                result = { status: "missing" };
+                return;
+            }
+            if (terminalJobStatuses.has(current.status)) {
+                result = { status: "already-terminal", run: current };
+                return;
+            }
+            const errorJson = JSON.stringify({
+                cancelled: true,
+                reason: input.reason ?? null,
+                actorKind: input.actorKind ?? null,
+                actorId: input.actorId ?? null
+            });
+            this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+         SET "status" = 'cancelled',
+             "endedAt" = ?,
+             "expiresAt" = ?,
+             "errorJson" = ?,
+             "leaseOwner" = NULL,
+             "leaseExpiresAt" = NULL
+         WHERE "id" = ? AND "status" NOT IN ('succeeded', 'failed', 'denied', 'cancelled', 'expired')`, input.now, input.expiresAt ?? null, errorJson, input.runId);
+            const changed = sqliteChanges(this.ctx.storage) > 0;
+            const run = this.getJobRun(input.runId);
+            if (!run)
+                throw new Error("Cancelled job run disappeared");
+            if (changed) {
+                batchCompleted = this.settleJobRunSync(run, "cancelled", input.now);
+                wakes = this.wakeJobRunsSync(jobSlotPools([run]), wallNowIso());
+            }
+            result = { status: "cancelled", run };
+        });
+        await this.sendJobWakes(wakes);
+        if (batchCompleted)
+            await this.dispatchJobBatchContinuations();
+        await this.scheduleVirtualAlarm(input.expiresAt);
+        return result;
+    }
+    async appendJobEvent(input) {
+        await this.ensureJobsSchema();
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(`INSERT INTO "_job_events" ("id", "runId", "type", "level", "message", "dataJson", "createdAt")
+         VALUES (?, ?, ?, ?, ?, ?, ?)`, input.id ?? `jobevt_${crypto.randomUUID().replace(/-/g, "")}`, input.runId, input.type, input.level, input.message ?? null, input.dataJson ?? null, input.createdAt ?? new Date().toISOString());
+        });
+        return { ok: true };
+    }
+    async listDueSchedules(input) {
+        await this.ensureJobsSchema();
+        const limit = Math.min(Math.max(input.limit ?? 100, 1), 500);
+        const schedules = this.ctx.storage.sql
+            .exec(`SELECT * FROM "_job_schedules"
+         WHERE "status" = 'pending' AND "bookedAt" IS NOT NULL AND "bookedAt" <= ?
+         ORDER BY "bookedAt" ASC
+         LIMIT ?`, input.now, limit)
+            .toArray()
+            .map(rowToJobSchedule);
+        return { schedules };
+    }
+    async upsertJobSchedule(input) {
+        await this.ensureJobsSchema();
+        this.mutateSync(() => {
+            const key = `raybase:declared:${input.jobName}`;
+            const existingRow = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "key" = ?`, key).toArray()[0];
+            if (!existingRow) {
+                this.ctx.storage.sql.exec(`INSERT INTO "_job_schedules"
+           ("id", "jobName", "key", "kind", "status", "inputJson", "cron", "timezone", "enabled", "lastRunAt", "nextRunAt", "bookedAt", "generation", "createdAt", "updatedAt", "createdBy", "service", "actorKind", "actorId")
+           VALUES (?, ?, ?, 'cron', ?, ?, ?, ?, ?, NULL, ?, ?, 1, ?, ?, ?, ?, 'service', ?)`, input.id, input.jobName, key, input.enabled === false ? "cancelled" : "pending", input.inputJson, input.cron, input.timezone ?? null, input.enabled === false ? 0 : 1, input.nextRunAt ?? null, input.nextRunAt ?? null, input.now, input.now, input.createdBy ?? null, input.service ?? null, input.service ?? "scheduler");
+                return;
+            }
+            const existing = rowToJobSchedule(existingRow);
+            const desiredEnabled = input.enabled !== false;
+            const definitionChanged = existing.jobName !== input.jobName
+                || existing.inputJson !== input.inputJson
+                || existing.cron !== input.cron
+                || existing.timezone !== (input.timezone ?? null)
+                || (existing.status === "cancelled") !== !desiredEnabled;
+            if (definitionChanged) {
+                const nextStatus = desiredEnabled
+                    ? existing.status === "suspended" ? "suspended" : "pending"
+                    : "cancelled";
+                this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET
+             "jobName" = ?, "kind" = 'cron', "status" = ?, "inputJson" = ?, "cron" = ?, "timezone" = ?,
+             "enabled" = ?, "bookedAt" = ?, "nextRunAt" = ?, "generation" = "generation" + 1,
+             "dispatchAttempts" = 0, "dispatchLeaseExpiresAt" = NULL, "lastDispatchAt" = NULL,
+             "lastDispatchError" = NULL, "cancelledAt" = ?, "cancellationReason" = ?, "updatedAt" = ?,
+             "service" = ?, "actorKind" = 'service', "actorId" = ?
+           WHERE "key" = ?`, input.jobName, nextStatus, input.inputJson, input.cron, input.timezone ?? null, desiredEnabled ? 1 : 0, input.nextRunAt ?? null, input.nextRunAt ?? null, desiredEnabled ? null : input.now, desiredEnabled ? null : "Declared schedule is disabled", input.now, input.service ?? null, input.service ?? "scheduler", key);
+            }
+            else if (existing.service !== (input.service ?? null)
+                || existing.actorKind !== "service"
+                || existing.actorId !== (input.service ?? "scheduler")) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "service" = ?, "actorKind" = 'service', "actorId" = ? WHERE "key" = ?`, input.service ?? null, input.service ?? "scheduler", key);
+            }
+        });
+        await this.scheduleVirtualAlarm(input.nextRunAt);
+        return { ok: true };
+    }
+    async advanceSchedule(input) {
+        await this.ensureJobsSchema();
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules"
+         SET "lastRunAt" = ?, "bookedAt" = ?, "nextRunAt" = ?, "generation" = "generation" + 1, "updatedAt" = ?
+         WHERE "id" = ?`, input.lastRunAt, input.nextRunAt, input.nextRunAt, input.now, input.id);
+        });
+        await this.scheduleVirtualAlarm(input.nextRunAt);
+        return { ok: true };
+    }
+    async createJobSchedule(input) {
+        await this.ensureJobsSchema();
+        if (!input.key || input.key.length > 512)
+            throw new Error("Job schedule key must be between 1 and 512 characters");
+        let created = null;
+        this.mutateSync(() => {
+            if (this.ctx.storage.sql.exec(`SELECT 1 FROM "_job_schedules" WHERE "key" = ?`, input.key).toArray()[0]) {
+                throw new Error(`Job schedule key already exists: ${input.key}`);
+            }
+            this.ctx.storage.sql.exec(`INSERT INTO "_job_schedules"
+         ("id", "jobName", "key", "kind", "status", "inputJson", "cron", "timezone", "enabled", "nextRunAt", "bookedAt",
+          "generation", "dispatchAttempts", "createdAt", "updatedAt", "createdBy", "service", "actorKind", "actorId")
+         VALUES (?, ?, ?, ?, 'pending', ?, ?, ?, 1, ?, ?, 1, 0, ?, ?, ?, ?, ?, ?)`, input.id, input.jobName, input.key, input.kind, input.inputJson, input.cron ?? null, input.timezone ?? null, input.bookedAt, input.bookedAt, input.now, input.now, input.createdBy ?? null, input.service ?? "scheduler", input.actorKind ?? (input.createdBy ? "user" : "service"), input.actorId ?? input.createdBy ?? input.service ?? "scheduler");
+            created = rowToJobSchedule(this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "key" = ?`, input.key).toArray()[0]);
+        });
+        if (input.claims && Object.keys(input.claims).length)
+            await this.ctx.storage.put(agentAlarmClaimsKey, input.claims);
+        await this.scheduleVirtualAlarm(input.bookedAt);
+        return created;
+    }
+    async getJobSchedule(key) {
+        await this.ensureJobsSchema();
+        const row = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "key" = ?`, key).toArray()[0];
+        return row ? rowToJobSchedule(row) : null;
+    }
+    async listJobSchedules(input = {}) {
+        await this.ensureJobsSchema();
+        const clauses = [];
+        const bindings = [];
+        if (input.name) {
+            clauses.push(`"jobName" = ?`);
+            bindings.push(input.name);
+        }
+        if (input.prefix) {
+            clauses.push(`"key" LIKE ? ESCAPE '\\'`);
+            bindings.push(`${input.prefix.replace(/[\\%_]/g, "\\$&")}%`);
+        }
+        if (input.status) {
+            clauses.push(`"status" = ?`);
+            bindings.push(input.status);
+        }
+        const limit = Math.min(Math.max(input.limit ?? 100, 1), 500);
+        const rows = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" ${clauses.length ? `WHERE ${clauses.join(" AND ")}` : ""} ORDER BY "key" LIMIT ?`, ...bindings, limit).toArray();
+        return { schedules: rows.map(rowToJobSchedule) };
+    }
+    async replaceJobSchedule(input) {
+        await this.ensureJobsSchema();
+        let schedule = null;
+        this.mutateSync(() => {
+            const existing = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "key" = ?`, input.key).toArray()[0];
+            if (!existing)
+                throw new Error(`Job schedule does not exist: ${input.key}`);
+            const expectedClause = input.expected
+                ? ` AND "id" = ? AND "generation" = ? AND "bookedAt" IS ?`
+                : "";
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "jobName" = ?, "kind" = ?, "status" = 'pending', "inputJson" = ?, "cron" = ?, "timezone" = ?,
+          "enabled" = 1, "bookedAt" = ?, "nextRunAt" = ?, "generation" = "generation" + 1, "dispatchAttempts" = 0,
+          "dispatchLeaseExpiresAt" = NULL, "lastDispatchAt" = NULL, "lastDispatchError" = NULL, "suspendedAt" = NULL,
+          "cancelledAt" = NULL, "cancellationReason" = NULL, "updatedAt" = ?, "service" = ?, "actorKind" = ?, "actorId" = ? WHERE "key" = ?${expectedClause}`, input.jobName, input.kind, input.inputJson, input.cron ?? null, input.timezone ?? null, input.bookedAt, input.bookedAt, input.now, input.service ?? "scheduler", input.actorKind ?? "service", input.actorId ?? input.service ?? "scheduler", input.key, ...(input.expected
+                ? [input.expected.scheduleId, input.expected.generation, input.expected.bookedAt]
+                : []));
+            if (input.expected && sqliteChanges(this.ctx.storage) === 0) {
+                throw new Error(`Job schedule changed while authorizing replacement: ${input.key}`);
+            }
+            schedule = rowToJobSchedule(this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "key" = ?`, input.key).toArray()[0]);
+        });
+        if (input.claims && Object.keys(input.claims).length)
+            await this.ctx.storage.put(agentAlarmClaimsKey, input.claims);
+        await this.scheduleVirtualAlarm(input.bookedAt);
+        return schedule;
+    }
+    async cancelJobSchedule(input) {
+        await this.ensureJobsSchema();
+        let changed = false;
+        this.mutateSync(() => {
+            const expectedClause = input.expected
+                ? ` AND "id" = ? AND "generation" = ? AND "bookedAt" IS ?`
+                : "";
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "status" = 'cancelled', "enabled" = 0, "cancelledAt" = ?, "cancellationReason" = ?,
+          "dispatchLeaseExpiresAt" = NULL, "updatedAt" = ? WHERE "key" = ? AND "status" != 'cancelled'${expectedClause}`, input.now, input.reason ?? null, input.now, input.key, ...(input.expected
+                ? [input.expected.scheduleId, input.expected.generation, input.expected.bookedAt]
+                : []));
+            changed = sqliteChanges(this.ctx.storage) > 0;
+        });
+        if (input.expected && !changed)
+            return null;
+        return this.getJobSchedule(input.key);
+    }
+    scheduleSelection(input) {
+        if ("keys" in input && input.keys) {
+            const keys = [...new Set(input.keys.filter(Boolean))].slice(0, 500);
+            if (!keys.length)
+                return { where: "0", bindings: [] };
+            return { where: `"key" IN (${keys.map(() => "?").join(", ")})`, bindings: keys };
+        }
+        const prefix = "prefix" in input ? input.prefix : "";
+        if (!prefix)
+            throw new Error("Schedule selection requires a non-empty prefix or keys");
+        return { where: `"key" LIKE ? ESCAPE '\\'`, bindings: [`${prefix.replace(/[\\%_]/g, "\\$&")}%`] };
+    }
+    async suspendJobSchedules(input) {
+        await this.ensureJobsSchema();
+        const selected = this.scheduleSelection(input);
+        let schedules = [];
+        this.mutateSync(() => {
+            let rows = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE ${selected.where} AND "status" = 'pending' ORDER BY "key" LIMIT 500`, ...selected.bindings).toArray();
+            if (input.expected) {
+                const expected = new Map(input.expected.map((coordinate) => [coordinate.key, coordinate]));
+                rows = rows.filter((row) => {
+                    const coordinate = expected.get(String(row.key));
+                    return coordinate
+                        && coordinate.scheduleId === String(row.id)
+                        && coordinate.generation === Number(row.generation)
+                        && coordinate.bookedAt === (row.bookedAt == null ? null : String(row.bookedAt));
+                });
+            }
+            if (!rows.length)
+                return;
+            const ids = rows.map((row) => String(row.id));
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "status" = 'suspended', "enabled" = 0, "suspendedAt" = ?, "dispatchLeaseExpiresAt" = NULL, "updatedAt" = ?
+         WHERE "id" IN (${ids.map(() => "?").join(", ")}) AND "status" = 'pending'`, input.now, input.now, ...ids);
+            schedules = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "id" IN (${ids.map(() => "?").join(", ")}) ORDER BY "key"`, ...ids).toArray().map(rowToJobSchedule);
+        });
+        return { count: schedules.length, schedules };
+    }
+    async resumeJobSchedules(input) {
+        await this.ensureJobsSchema();
+        const selected = this.scheduleSelection(input);
+        let earliest = null;
+        let scheduleIds = [];
+        this.mutateSync(() => {
+            let rows = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE ${selected.where} AND "status" = 'suspended' ORDER BY "key" LIMIT 500`, ...selected.bindings).toArray();
+            if (input.expected) {
+                const expected = new Map(input.expected.map((coordinate) => [coordinate.key, coordinate]));
+                rows = rows.filter((row) => {
+                    const coordinate = expected.get(String(row.key));
+                    return coordinate
+                        && coordinate.scheduleId === String(row.id)
+                        && coordinate.generation === Number(row.generation)
+                        && coordinate.bookedAt === (row.bookedAt == null ? null : String(row.bookedAt));
+                });
+            }
+            scheduleIds = rows.map((row) => String(row.id));
+            for (const row of rows) {
+                const current = rowToJobSchedule(row);
+                // Resume is the inverse of suspend, which preserved both. `bookedAt` is
+                // the signed moment a handler stamps its ledger with, so it survives the
+                // pause even when it has passed: the row comes back late, not rebooked.
+                // Only a cron whose instant elapsed while suspended moves, because that
+                // is a genuinely new occurrence — and a new occurrence is a new
+                // generation. Anything still in the future resumes untouched, so a
+                // repeated resume cannot walk the schedule forward.
+                const elapsedCron = current.kind === "cron"
+                    && current.cron
+                    && Date.parse(current.bookedAt ?? input.now) <= Date.parse(input.now);
+                const bookedAt = elapsedCron
+                    ? nextCronRun(current.cron, input.now, current.timezone)
+                    : current.bookedAt;
+                if (!bookedAt)
+                    continue;
+                const rebooked = bookedAt !== current.bookedAt;
+                this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "status" = 'pending', "enabled" = 1, "bookedAt" = ?, "nextRunAt" = ?,
+           "generation" = "generation" + ?, "suspendedAt" = NULL, "updatedAt" = ? WHERE "id" = ?`, bookedAt, bookedAt, rebooked ? 1 : 0, input.now, current.id);
+                // The alarm arms at the later of the two; a past instant fires at once.
+                const armAt = new Date(Math.max(Date.parse(bookedAt), Date.parse(input.now))).toISOString();
+                if (!earliest || armAt < earliest)
+                    earliest = armAt;
+            }
+        });
+        if (earliest)
+            await this.scheduleVirtualAlarm(earliest);
+        if (!scheduleIds.length)
+            return { count: 0, schedules: [] };
+        const schedules = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "id" IN (${scheduleIds.map(() => "?").join(", ")}) ORDER BY "key"`, ...scheduleIds).toArray().map(rowToJobSchedule);
+        return { count: schedules.length, schedules };
+    }
+    async claimDueJobSchedules(input) {
+        await this.ensureJobsSchema();
+        const limit = Math.min(Math.max(input.limit ?? 100, 1), 500);
+        let schedules = [];
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "status" = 'cancelled', "enabled" = 0, "cancelledAt" = ?,
+         "cancellationReason" = 'dispatch-attempts-exhausted', "dispatchLeaseExpiresAt" = NULL,
+         "lastDispatchError" = 'dispatch-attempts-exhausted', "updatedAt" = ?
+         WHERE "status" = 'pending' AND "bookedAt" <= ? AND "dispatchAttempts" >= ?
+           AND ("dispatchLeaseExpiresAt" IS NULL OR "dispatchLeaseExpiresAt" <= ?)`, input.now, input.now, input.now, maxJobScheduleDispatchAttempts, input.wallNow);
+            const due = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "status" = 'pending' AND "bookedAt" <= ?
+         AND ("dispatchLeaseExpiresAt" IS NULL OR "dispatchLeaseExpiresAt" <= ?)
+         AND "dispatchAttempts" < ?
+         ORDER BY "bookedAt" LIMIT ?`, input.now, input.wallNow, maxJobScheduleDispatchAttempts, limit).toArray();
+            for (const row of due) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "dispatchAttempts" = "dispatchAttempts" + 1, "dispatchLeaseExpiresAt" = ?,
+           "lastDispatchAt" = ?, "lastDispatchError" = NULL, "updatedAt" = ? WHERE "id" = ? AND "generation" = ?`, input.leaseExpiresAt, input.wallNow, input.now, row.id, row.generation);
+            }
+            schedules = due.map((row) => rowToJobSchedule({ ...row, dispatchAttempts: Number(row.dispatchAttempts ?? 0) + 1, dispatchLeaseExpiresAt: input.leaseExpiresAt }));
+        });
+        if (schedules.length)
+            await this.scheduleRealAlarm(Date.parse(input.leaseExpiresAt));
+        return { schedules };
+    }
+    async materializeScheduledJobRun(input) {
+        await this.ensureJobsSchema();
+        let result = { status: "missing" };
+        this.mutateSync(() => {
+            const row = this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "id" = ? AND "key" = ?`, input.scheduleId, input.key).toArray()[0];
+            if (!row)
+                return;
+            const schedule = rowToJobSchedule(row);
+            const existing = rowToJobRun(this.ctx.storage.sql.exec(`SELECT * FROM "_job_runs" WHERE "scheduleKey" = ? AND "scheduleGeneration" = ?`, input.key, input.generation).toArray()[0]);
+            if (existing) {
+                result = { status: "existing", run: existing, schedule };
+                return;
+            }
+            if (schedule.status !== "pending" || schedule.generation !== input.generation || schedule.bookedAt !== input.bookedAt) {
+                result = { status: "stale" };
+                return;
+            }
+            const run = { ...input.run, scheduleKey: input.key, scheduleGeneration: input.generation, scheduleBookedAt: input.bookedAt };
+            this.insertJobRunSync(run);
+            const recurring = schedule.kind === "cron" && input.nextBookedAt !== null;
+            const nextStatus = recurring ? "pending" : "fired";
+            const nextGeneration = recurring ? input.generation + 1 : input.generation;
+            const nextBookedAt = recurring ? input.nextBookedAt : input.bookedAt;
+            this.ctx.storage.sql.exec(`UPDATE "_job_schedules" SET "status" = ?, "enabled" = ?, "lastRunAt" = ?, "bookedAt" = ?, "nextRunAt" = ?,
+         "generation" = ?, "dispatchLeaseExpiresAt" = NULL, "lastDispatchError" = NULL, "updatedAt" = ? WHERE "id" = ? AND "generation" = ?`, nextStatus, nextStatus === "pending" ? 1 : 0, input.materializedAt, nextBookedAt, nextBookedAt, nextGeneration, input.materializedAt, input.scheduleId, input.generation);
+            const inserted = this.getJobRun(run.id);
+            const updated = rowToJobSchedule(this.ctx.storage.sql.exec(`SELECT * FROM "_job_schedules" WHERE "id" = ?`, input.scheduleId).toArray()[0]);
+            result = { status: "materialized", run: inserted, schedule: updated };
+        });
+        const finalized = result;
+        if (finalized.status === "materialized" && finalized.schedule.status === "pending" && finalized.schedule.bookedAt) {
+            await this.scheduleVirtualAlarm(finalized.schedule.bookedAt);
+        }
+        return finalized;
+    }
+    async findMaterializedScheduledJobRun(input) {
+        await this.ensureJobsSchema();
+        return rowToJobRun(this.ctx.storage.sql.exec(`SELECT * FROM "_job_runs" WHERE "idempotencyKey" = ? AND "scheduleKey" = ? AND "scheduleGeneration" = ? AND "scheduleBookedAt" = ? LIMIT 1`, `job_schedule:${input.scheduleId}:${input.generation}`, input.key, input.generation, input.bookedAt).toArray()[0]);
+    }
+    async schedulerState() {
+        await this.ensureJobsSchema();
+        const row = this.ctx.storage.sql.exec(`SELECT MIN(CASE WHEN "status" = 'pending' AND "dispatchLeaseExpiresAt" IS NULL THEN "bookedAt" END) AS "nextAt",
+       SUM(CASE WHEN "status" = 'pending' THEN 1 ELSE 0 END) AS "pending",
+       SUM(CASE WHEN "dispatchLeaseExpiresAt" IS NOT NULL THEN 1 ELSE 0 END) AS "leased" FROM "_job_schedules"`).toArray()[0];
+        return { nextJobScheduleAt: row?.nextAt ?? null, pendingJobSchedules: Number(row?.pending ?? 0), leasedJobSchedules: Number(row?.leased ?? 0) };
+    }
+    async compactJobs(input) {
+        await this.ensureJobsSchema();
+        const start = wallNowMs();
+        const batchSize = Math.min(Math.max(input.batchSize ?? defaultCompactionBatchSize, 1), 500);
+        const budgetMs = Math.min(Math.max(input.wallClockBudgetMs ?? 20, 5), 100);
+        const now = input.now;
+        const wallNow = input.wallNow ?? input.now;
+        const failedExpiresAt = new Date(new Date(now).getTime() + defaultFailedRetentionMs).toISOString();
+        const result = { expiredLeases: 0, rolledUpRuns: 0, deletedEvents: 0, deletedRuns: 0, more: false };
+        let batchCompleted = false;
+        let wakes = [];
+        this.mutateSync(() => {
+            const stale = this.ctx.storage.sql.exec(`SELECT "id" FROM "_job_runs"
+         WHERE "status" IN ('running', 'leased')
+           AND "leaseExpiresAt" IS NOT NULL
+           AND "leaseExpiresAt" <= ?
+         ORDER BY "leaseExpiresAt" ASC
+         LIMIT ?`, input.staleLeaseBefore ?? wallNow, batchSize).toArray();
+            const released = [];
+            for (const { id } of stale) {
+                this.ctx.storage.sql.exec(`UPDATE "_job_runs"
+           SET "status" = 'failed',
+               "endedAt" = ?,
+               "expiresAt" = COALESCE("expiresAt", ?),
+               "errorJson" = COALESCE("errorJson", '{"error":"stale job lease expired"}'),
+               "leaseOwner" = NULL,
+               "leaseExpiresAt" = NULL
+           WHERE "id" = ? AND "status" IN ('running', 'leased')`, now, failedExpiresAt, id);
+                if (sqliteChanges(this.ctx.storage) === 0)
+                    continue;
+                result.expiredLeases += 1;
+                const run = this.getJobRun(id);
+                released.push(run);
+                if (this.settleJobRunSync(run, "failed", now))
+                    batchCompleted = true;
+            }
+            wakes = this.wakeJobRunsSync(jobSlotPools(released), wallNowIso());
+        });
+        await this.sendJobWakes(wakes);
+        if (batchCompleted)
+            await this.dispatchJobBatchContinuations();
+        if (wallNowMs() - start > budgetMs) {
+            result.more = true;
+            return result;
+        }
+        // Children of a batch whose continuation has not finished stay readable
+        // through `ctx.batch.children()` whatever their own retention says.
+        const expired = this.ctx.storage.sql
+            .exec(`SELECT "id", "jobName", "status", "startedAt", "endedAt"
+         FROM "_job_runs"
+         WHERE "status" IN ('succeeded', 'failed', 'denied', 'cancelled', 'expired')
+           AND "expiresAt" IS NOT NULL
+           AND "expiresAt" <= ?
+           AND ("batchId" IS NULL OR "batchId" NOT IN (SELECT "id" FROM "_job_batches" WHERE "finishedAt" IS NULL))
+         ORDER BY "expiresAt" ASC
+         LIMIT ?`, now, batchSize)
+            .toArray();
+        this.mutateSync(() => {
+            for (const run of expired) {
+                const day = String(run.endedAt ?? now).slice(0, 10);
+                const duration = run.startedAt && run.endedAt ? Math.max(0, new Date(run.endedAt).getTime() - new Date(run.startedAt).getTime()) : 0;
+                this.ctx.storage.sql.exec(`INSERT INTO "_job_stats_daily" ("day", "jobName", "status", "count", "totalDurationMs")
+           VALUES (?, ?, ?, 1, ?)
+           ON CONFLICT("day", "jobName", "status") DO UPDATE SET
+             "count" = "count" + 1,
+             "totalDurationMs" = COALESCE("totalDurationMs", 0) + excluded."totalDurationMs"`, day, run.jobName, run.status, duration);
+                result.rolledUpRuns += 1;
+            }
+            if (expired.length) {
+                const ids = expired.map((run) => run.id);
+                const placeholders = ids.map(() => "?").join(", ");
+                this.ctx.storage.sql.exec(`DELETE FROM "_job_events" WHERE "runId" IN (${placeholders})`, ...ids);
+                result.deletedEvents = sqliteChanges(this.ctx.storage);
+                this.ctx.storage.sql.exec(`DELETE FROM "_job_runs" WHERE "id" IN (${placeholders})`, ...ids);
+                result.deletedRuns = sqliteChanges(this.ctx.storage);
+            }
+            this.ctx.storage.sql.exec(`DELETE FROM "_job_events"
+         WHERE "id" IN (
+           SELECT "id" FROM "_job_events"
+           WHERE "createdAt" <= ?
+             AND "runId" NOT IN (SELECT "id" FROM "_job_runs")
+           ORDER BY "createdAt" ASC
+           LIMIT ?
+         )`, now, batchSize);
+            result.deletedEvents += sqliteChanges(this.ctx.storage);
+            this.ctx.storage.sql.exec(`DELETE FROM "_job_batches"
+         WHERE "id" IN (
+           SELECT "id" FROM "_job_batches"
+           WHERE "expiresAt" IS NOT NULL AND "expiresAt" <= ?
+           ORDER BY "expiresAt" ASC
+           LIMIT ?
+         )`, now, batchSize);
+            this.ctx.storage.sql.exec(`DELETE FROM "_job_rate_buckets"
+         WHERE "key" IN (SELECT "key" FROM "_job_rate_buckets" WHERE "fullAt" <= ? LIMIT ?)`, wallNow, batchSize);
+        });
+        result.more = result.expiredLeases === batchSize || expired.length === batchSize;
+        return result;
+    }
+    async all(sql, params = []) {
+        await this.ensureSchema({ migrations: [] });
+        this.assertReadableSync();
+        this.assertPublicSqlDoesNotTargetBackupState(sql);
+        return this.publicRowsSync(sql, params);
+    }
+    async first(sql, params = []) {
+        await this.ensureSchema({ migrations: [] });
+        this.assertReadableSync();
+        this.assertPublicSqlDoesNotTargetBackupState(sql);
+        return this.publicRowsSync(sql, params)[0] ?? null;
+    }
+    async run(sql, params = []) {
+        await this.ensureSchema({ migrations: [] });
+        this.assertPublicSqlDoesNotTargetBackupState(sql);
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(sql, ...params);
+        });
+    }
+    async runTransaction(input) {
+        const statements = Array.isArray(input) ? input : input.statements;
+        await this.ensureSchema(Array.isArray(input) ? { migrations: [] } : input.bundle);
+        for (const statement of statements)
+            this.assertPublicSqlDoesNotTargetBackupState(statement.sql);
+        this.mutateSync(() => {
+            for (const statement of statements) {
+                this.ctx.storage.sql.exec(statement.sql, ...(statement.params ?? []));
+            }
+        });
+    }
+    async configureRealtime(input) {
+        await this.ensureSchema({ migrations: [] });
+        this.realtimeConfig = input.config;
+        this.realtimeSchema = input.schema;
+        this.realtimeAuth = input.auth;
+        await this.ctx.storage.put({
+            [realtimeConfigKey]: input.config,
+            [realtimeSchemaKey]: input.schema,
+            [realtimeAuthKey]: input.auth
+        });
+        await this.ctx.storage.setAlarm(Date.now() + realtimeSweepMs);
+        return { ok: true };
+    }
+    async runWithChange(input) {
+        await this.ensureSchema({ migrations: [] });
+        this.assertPublicSqlDoesNotTargetBackupState(input.sql);
+        let stored = null;
+        this.mutateSync(() => {
+            this.ctx.storage.sql.exec(input.sql, ...(input.params ?? []));
+            const createdAt = new Date().toISOString();
+            this.ctx.storage.sql.exec(`INSERT INTO "_changes" ("tableName", "op", "rowId", "oldRow", "newRow", "actorId", "adminOverride", "createdAt")
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`, input.change.tableName, input.change.op, input.change.rowId, input.change.oldRow ? JSON.stringify(input.change.oldRow) : null, input.change.newRow ? JSON.stringify(input.change.newRow) : null, input.change.actorId ?? null, input.change.adminOverride ? 1 : 0, createdAt);
+            const seq = this.ctx.storage.sql.exec(`SELECT last_insert_rowid() AS "seq"`).toArray()[0]?.seq;
+            if (!seq)
+                throw new Error("Could not assign realtime change sequence");
+            stored = { ...input.change, seq: Number(seq), createdAt };
+        });
+        await this.pruneChanges(input.realtime);
+        if (!stored)
+            throw new Error("Realtime change was not stored");
+        return stored;
+    }
+    async notifyDataChange(input) {
+        this.realtimeConfig = input.config;
+        this.realtimeSchema = input.schema;
+        await this.ctx.storage.put({
+            [realtimeConfigKey]: input.config,
+            [realtimeSchemaKey]: input.schema
+        });
+        await this.fanout(input.change);
+        return { ok: true };
+    }
+    async notifyNotificationFeed(input) {
+        await this.fanoutNotification(input);
+        return { ok: true };
+    }
+    async broadcastRealtimeResync(input = {}) {
+        await this.ensureRealtimeState();
+        for (const ws of this.ctx.getWebSockets()) {
+            const attachment = this.attachment(ws);
+            for (const subscription of Object.values(attachment?.subscriptions ?? {})) {
+                this.send(ws, { v: 1, type: "resync", subscriptionId: subscription.id, reason: input.reason ?? "gap" });
+            }
+        }
+        return { ok: true };
+    }
+    async fetch(request) {
+        await this.ensureSchema({ migrations: [] });
+        try {
+            this.assertReadableSync();
+        }
+        catch (error) {
+            if (error instanceof RaybaseBackupError)
+                return new Response(error.message, { status: 503 });
+            throw error;
+        }
+        await this.ensureRealtimeState();
+        if (request.headers.get("Upgrade")?.toLowerCase() !== "websocket") {
+            return new Response("Expected WebSocket upgrade", { status: 400 });
+        }
+        const config = this.realtimeConfig;
+        if (!config?.enabled)
+            return new Response("Realtime is disabled", { status: 404 });
+        if (this.ctx.getWebSockets().length >= config.limits.maxSockets) {
+            return new Response("Realtime socket limit reached", { status: 429 });
+        }
+        const rawSession = request.headers.get("x-raybase-realtime-session");
+        if (!rawSession)
+            return new Response("Missing realtime session", { status: 401 });
+        const session = JSON.parse(rawSession);
+        const pair = new WebSocketPair();
+        const [client, server] = Object.values(pair);
+        const attachment = {
+            v: 1,
+            connectionId: randomId("rt"),
+            sessionToken: session.sessionToken,
+            sessionId: session.sessionId,
+            user: session.user,
+            subscriptions: {},
+            notificationSubscription: undefined,
+            presenceRooms: {},
+            lastSeq: 0
+        };
+        this.saveAttachment(server, attachment);
+        this.ctx.acceptWebSocket(server);
+        return new Response(null, { status: 101, webSocket: client });
+    }
+    async webSocketMessage(ws, message) {
+        await this.ensureSchema({ migrations: [] });
+        try {
+            this.assertReadableSync();
+        }
+        catch (error) {
+            ws.close(1013, error instanceof Error ? error.message : "Database maintenance is active");
+            return;
+        }
+        await this.ensureRealtimeState();
+        const attachment = this.attachment(ws);
+        if (!attachment) {
+            ws.close(1011, "Missing realtime attachment");
+            return;
+        }
+        const user = await this.revalidate(attachment);
+        if (!user) {
+            ws.close(4001, "Session is no longer valid");
+            return;
+        }
+        attachment.user = user;
+        let parsed;
+        try {
+            const text = typeof message === "string" ? message : new TextDecoder().decode(message);
+            parsed = JSON.parse(text);
+        }
+        catch {
+            this.sendError(ws, undefined, "invalid_json", "Realtime messages must be valid JSON");
+            return;
+        }
+        if (parsed.v !== 1) {
+            this.sendError(ws, parsed.ref, "unsupported_version", "Unsupported realtime protocol version");
+            return;
+        }
+        try {
+            if (parsed.type === "hello") {
+                attachment.lastSeq = Math.max(attachment.lastSeq, parsed.lastSeq ?? 0);
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, ref: parsed.ref, type: "status", status: "subscribed" });
+                return;
+            }
+            if (parsed.type === "subscribe") {
+                const config = this.realtimeConfig;
+                if (!config)
+                    throw new Error("Realtime config is not loaded");
+                if (Object.keys(attachment.subscriptions).length >= config.limits.maxSubscriptionsPerSocket) {
+                    throw new Error("Too many realtime subscriptions on this socket");
+                }
+                const table = this.tableFor(parsed.table);
+                if (!table)
+                    throw new Error(`Unknown realtime table: ${parsed.table}`);
+                if (classifyReadPolicy(table.policies?.read, { user: attachment.user, adminOverride: false }) === "denied") {
+                    throw new RaybaseDataReadDeniedError({ table: table.name, context: { user: attachment.user } });
+                }
+                assertRealtimeListOptions(table, parsed.options);
+                const subscription = {
+                    id: parsed.id,
+                    table: table.name,
+                    events: parsed.events,
+                    options: parsed.options,
+                    lastSeq: parsed.lastSeq ?? attachment.lastSeq
+                };
+                attachment.subscriptions[subscription.id] = subscription;
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, ref: parsed.ref, type: "status", status: "subscribed", subscriptionId: subscription.id });
+                await this.replay(ws, attachment, subscription, subscription.lastSeq ?? 0);
+                return;
+            }
+            if (parsed.type === "unsubscribe") {
+                delete attachment.subscriptions[parsed.id];
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, ref: parsed.ref, type: "status", status: "closed", subscriptionId: parsed.id });
+                return;
+            }
+            if (parsed.type === "notifications.subscribe") {
+                attachment.notificationSubscription = {
+                    subjectId: user.id,
+                    lastSeq: parsed.lastSeq ?? 0
+                };
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, ref: parsed.ref, type: "status", status: "subscribed" });
+                if (parsed.lastSeq) {
+                    this.send(ws, { v: 1, type: "notifications.resync", reason: "gap" });
+                }
+                return;
+            }
+            if (parsed.type === "notifications.unsubscribe") {
+                delete attachment.notificationSubscription;
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, ref: parsed.ref, type: "status", status: "closed" });
+                return;
+            }
+            if (parsed.type === "presence.join") {
+                const config = this.realtimeConfig;
+                if (!config)
+                    throw new Error("Realtime config is not loaded");
+                if (!attachment.presenceRooms[parsed.room] && Object.keys(attachment.presenceRooms).length >= config.limits.maxPresenceRoomsPerSocket) {
+                    throw new Error("Too many realtime presence rooms on this socket");
+                }
+                const now = new Date().toISOString();
+                attachment.presenceRooms[parsed.room] = {
+                    state: this.parseState(parsed.state, config.limits.maxPresenceStateBytes),
+                    joinedAt: attachment.presenceRooms[parsed.room]?.joinedAt ?? now,
+                    updatedAt: now
+                };
+                this.saveAttachment(ws, attachment);
+                this.send(ws, { v: 1, type: "presence.sync", room: parsed.room, members: this.roomMembers(parsed.room) });
+                this.broadcastPresence(parsed.room, { type: "presence.join", members: [this.presenceMember(attachment, parsed.room)] });
+                return;
+            }
+            if (parsed.type === "presence.update") {
+                const config = this.realtimeConfig;
+                if (!config)
+                    throw new Error("Realtime config is not loaded");
+                const room = attachment.presenceRooms[parsed.room];
+                if (!room)
+                    throw new Error("Presence room has not been joined");
+                room.state = this.parseState(parsed.state, config.limits.maxPresenceStateBytes);
+                room.updatedAt = new Date().toISOString();
+                this.saveAttachment(ws, attachment);
+                this.broadcastPresence(parsed.room, { type: "presence.sync", members: this.roomMembers(parsed.room) });
+                return;
+            }
+            if (parsed.type === "presence.leave") {
+                const member = attachment.presenceRooms[parsed.room] ? this.presenceMember(attachment, parsed.room) : null;
+                delete attachment.presenceRooms[parsed.room];
+                this.saveAttachment(ws, attachment);
+                if (member)
+                    this.broadcastPresence(parsed.room, { type: "presence.leave", members: [member] });
+                return;
+            }
+            const unsupported = parsed;
+            this.sendError(ws, unsupported.ref, "unsupported_message", `Unsupported realtime message type: ${String(unsupported.type)}`);
+        }
+        catch (error) {
+            this.sendError(ws, parsed.ref, error instanceof RaybaseDataReadDeniedError ? error.code : "realtime_error", error instanceof Error ? error.message : String(error));
+        }
+    }
+    async webSocketClose(ws) {
+        const attachment = this.attachment(ws);
+        if (!attachment)
+            return;
+        for (const room of Object.keys(attachment.presenceRooms)) {
+            const member = this.presenceMember(attachment, room);
+            delete attachment.presenceRooms[room];
+            this.broadcastPresence(room, { type: "presence.leave", members: [member] });
+        }
+    }
+    async webSocketError(ws) {
+        await this.webSocketClose(ws);
+    }
+    async alarm() {
+        await this.ensureSchema({ migrations: [] });
+        await this.hydrateClock(true);
+        const backupState = this.backupMutationStateSync();
+        if (backupState.gateKind) {
+            await this.ctx.storage.setAlarm(wallNowMs() + 30_000);
+            if (backupState.gateKind === "restore") {
+                for (const ws of this.ctx.getWebSockets())
+                    ws.close(1013, "Database restore maintenance is active");
+            }
+            return;
+        }
+        await this.ensureRealtimeState();
+        const config = this.realtimeConfig;
+        if (config)
+            await this.pruneChanges(config);
+        const wallNow = wallNowIso();
+        const appNow = appNowIso();
+        const result = await this.compactJobs({ now: appNow, wallNow, batchSize: defaultCompactionBatchSize, wallClockBudgetMs: 40 });
+        if (result.more)
+            await this.scheduleRealAlarm(wallNowMs() + 30_000);
+        await this.runJobScheduleAlarm(appNow, wallNow);
+        await this.dispatchJobBatchContinuations();
+        await this.sweepParkedJobRuns();
+        await this.runAgentTimerAlarm(appNow, wallNow);
+        await this.runAgentFollowUpAlarm(appNow, wallNow);
+        await this.runAgentSkillSyncAlarm(wallNow);
+        for (const ws of this.ctx.getWebSockets()) {
+            const attachment = this.attachment(ws);
+            if (!attachment) {
+                ws.close(1011, "Missing realtime attachment");
+                continue;
+            }
+            const user = await this.revalidate(attachment);
+            if (!user)
+                ws.close(4001, "Session is no longer valid");
+            else {
+                attachment.user = user;
+                this.saveAttachment(ws, attachment);
+            }
+        }
+    }
+    async schemaInfo() {
+        await this.ensureSchema({ migrations: [] });
+        this.assertReadableSync();
+        const tables = this.ctx.storage.sql
+            .exec(`SELECT "name" FROM "sqlite_master"
+         WHERE "type" = 'table' AND "name" NOT LIKE 'sqlite_%'
+           AND "name" != '_changes'
+         ORDER BY "name"`)
+            .toArray()
+            .filter((table) => !backupOperationalTables.has(table.name) &&
+            !isRaybaseSearchInternalTable(table.name));
+        return {
+            tables: tables.map((table) => {
+                try {
+                    const row = this.ctx.storage.sql.exec(`SELECT COUNT(*) as "count" FROM "${table.name.replace(/"/g, '""')}"`).toArray()[0];
+                    return { name: table.name, rowCount: Number(row?.count ?? 0) };
+                }
+                catch {
+                    return { name: table.name, rowCount: null };
+                }
+            })
+        };
+    }
+    async databaseSize() {
+        await this.ensureSchema({ migrations: [] });
+        this.assertReadableSync();
+        return this.ctx.storage.sql.databaseSize;
+    }
+    async ping() {
+        await this.ensureSchema({ migrations: [] });
+        return { ok: true };
+    }
+    async pingDiagnostics() {
+        const ensured = await this.ensureSchema({ migrations: [] });
+        return { ok: true, schema: { cached: ensured.cached, durationMs: ensured.durationMs } };
+    }
+    async purge() {
+        this.assertMutationAllowedSync();
+        await this.ctx.storage.deleteAll();
+        this.initialized = false;
+        this.ensuredSchemaBundles.clear();
+        this.ctx.storage.transactionSync(() => {
+            this.ensureBackupProtocolSchemaSync();
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+         SET "epoch" = ?, "generation" = 1, "gateKind" = NULL, "gateOperationId" = NULL
+         WHERE "id" = 1`, crypto.randomUUID());
+        });
+        return { ok: true };
+    }
+    async pitrCurrentBookmark() {
+        await this.ensureSchema({ migrations: [] });
+        return this.ctx.storage.getCurrentBookmark();
+    }
+    async pitrBookmarkForTime(epochMs) {
+        await this.ensureSchema({ migrations: [] });
+        return this.ctx.storage.getBookmarkForTime(new Date(epochMs));
+    }
+    async pitrRestore(bookmark) {
+        return this.ctx.storage.onNextSessionRestoreBookmark(bookmark);
+    }
+    async pitrRestartToApply() {
+        this.ctx.abort("Raybase point-in-time restore");
+        throw new Error("Durable Object restart requested");
+    }
+    async backupMutationState() {
+        await this.ensureSchema({ migrations: [] });
+        const state = this.backupMutationStateSync();
+        return { epoch: state.epoch, generation: state.generation, gate: state.gateKind };
+    }
+    async beginBackupSnapshot(input) {
+        await this.ensureSchema({ migrations: [] });
+        const operationId = validateBackupOperationId(input.operationId);
+        const mode = input.mode ?? "optimistic";
+        if (!["small", "optimistic", "write-gated"].includes(mode)) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Backup snapshot mode is unsupported");
+        }
+        if (mode === "write-gated") {
+            this.ctx.storage.transactionSync(() => {
+                const state = this.backupMutationStateSync();
+                if (state.gateKind &&
+                    !(state.gateKind === "snapshot" && state.gateOperationId === operationId)) {
+                    backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Another database maintenance operation is active");
+                }
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+           SET "gateKind" = 'snapshot', "gateOperationId" = ?
+           WHERE "id" = 1`, operationId);
+            });
+        }
+        try {
+            const plan = await this.backupSnapshotPlan();
+            return {
+                operationId,
+                mode,
+                epoch: plan.epoch,
+                generation: plan.generation,
+                databaseBytes: plan.databaseBytes,
+                schemaFingerprint: plan.schemaFingerprint,
+                applicationId: plan.applicationId,
+                userVersion: plan.userVersion,
+                tables: plan.tables.map(({ paginationSqlColumns: _paginationSqlColumns, pageAlias: _pageAlias, references: _references, ...table }) => table),
+                secondaryDdlCount: plan.secondaryDdl.length,
+                cursor: { phase: "metadata", recordOffset: 0 },
+                recommendedMode: plan.databaseBytes <= backupDatabaseProtocolLimits.smallSnapshotDatabaseBytes
+                    ? "small"
+                    : "optimistic"
+            };
+        }
+        catch (error) {
+            if (mode === "write-gated") {
+                await this.cancelBackupSnapshot({ operationId }).catch(() => undefined);
+            }
+            throw error;
+        }
+    }
+    async readBackupSnapshotPage(input) {
+        await this.ensureSchema({ migrations: [] });
+        const plan = await this.backupSnapshotPlan();
+        this.assertSnapshotMatches(plan, input);
+        const maxBytes = Math.min(Math.max(Math.trunc(input.maxBytes ?? backupDatabaseProtocolLimits.defaultPageBytes), 1), backupDatabaseProtocolLimits.maximumPageBytes);
+        const maxRows = Math.min(Math.max(Math.trunc(input.maxRows ?? backupDatabaseProtocolLimits.defaultPageRows), 1), backupDatabaseProtocolLimits.maximumPageRows);
+        const chunks = [];
+        let nextCursor = input.cursor;
+        let rowCount = 0;
+        let encodedBytes = 0;
+        while (encodedBytes < maxBytes && nextCursor.phase !== "done") {
+            const cursor = nextCursor;
+            let record;
+            let afterRecord;
+            let rowRecord = false;
+            if (cursor.phase === "metadata") {
+                record = this.snapshotMetadataRecord(plan);
+                afterRecord = plan.tables.length
+                    ? { phase: "table-schema", tableIndex: 0, recordOffset: 0 }
+                    : plan.secondaryDdl.length
+                        ? { phase: "secondary-ddl", ddlIndex: 0, recordOffset: 0 }
+                        : { phase: "done" };
+            }
+            else if (cursor.phase === "table-schema") {
+                const table = plan.tables[cursor.tableIndex];
+                if (!table)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot table cursor is out of range");
+                record = this.snapshotTableSchemaRecord(table);
+                afterRecord = { phase: "table-ddl", tableIndex: cursor.tableIndex, recordOffset: 0 };
+            }
+            else if (cursor.phase === "table-ddl") {
+                const table = plan.tables[cursor.tableIndex];
+                if (!table)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot table DDL cursor is out of range");
+                record = { kind: "ddl", sql: table.createSql };
+                afterRecord = { phase: "table-start", tableIndex: cursor.tableIndex, recordOffset: 0 };
+            }
+            else if (cursor.phase === "table-start") {
+                const table = plan.tables[cursor.tableIndex];
+                if (!table)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot table-start cursor is out of range");
+                record = { kind: "table-start", tableId: table.tableId };
+                afterRecord = {
+                    phase: "table-rows",
+                    tableIndex: cursor.tableIndex,
+                    after: null,
+                    recordOffset: 0
+                };
+            }
+            else if (cursor.phase === "table-rows") {
+                const table = plan.tables[cursor.tableIndex];
+                if (!table)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot row cursor is out of range");
+                // Querying one row at a time is deliberate. SQLite cannot constrain a
+                // result by encoded bytes, so LIMIT maxRows could materialize
+                // maxRows × 16 MiB before Core had a chance to enforce the page bound.
+                const row = this.snapshotRowsSync(table, cursor.after, 1)[0];
+                if (!row) {
+                    nextCursor = { phase: "table-end", tableIndex: cursor.tableIndex, recordOffset: 0 };
+                    continue;
+                }
+                record = row.record;
+                afterRecord = {
+                    phase: "table-rows",
+                    tableIndex: cursor.tableIndex,
+                    after: row.key,
+                    recordOffset: 0
+                };
+                rowRecord = true;
+            }
+            else if (cursor.phase === "table-end") {
+                const table = plan.tables[cursor.tableIndex];
+                if (!table)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot table-end cursor is out of range");
+                record = { kind: "table-end", tableId: table.tableId };
+                afterRecord = cursor.tableIndex + 1 < plan.tables.length
+                    ? { phase: "table-schema", tableIndex: cursor.tableIndex + 1, recordOffset: 0 }
+                    : plan.secondaryDdl.length
+                        ? { phase: "secondary-ddl", ddlIndex: 0, recordOffset: 0 }
+                        : { phase: "done" };
+            }
+            else if (cursor.phase === "secondary-ddl") {
+                const sql = plan.secondaryDdl[cursor.ddlIndex];
+                if (!sql)
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot DDL cursor is out of range");
+                record = { kind: "ddl", sql };
+                afterRecord = cursor.ddlIndex + 1 < plan.secondaryDdl.length
+                    ? { phase: "secondary-ddl", ddlIndex: cursor.ddlIndex + 1, recordOffset: 0 }
+                    : { phase: "done" };
+            }
+            else {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot cursor phase is unsupported");
+            }
+            const encoded = encodeBackupLogicalRecord(record);
+            if (!Number.isSafeInteger(cursor.recordOffset) ||
+                cursor.recordOffset < 0 ||
+                cursor.recordOffset >= encoded.byteLength) {
+                backupError("BACKUP_ARCHIVE_CORRUPT", "Snapshot record offset is out of range");
+            }
+            const available = maxBytes - encodedBytes;
+            const end = Math.min(cursor.recordOffset + available, encoded.byteLength);
+            chunks.push(encoded.slice(cursor.recordOffset, end));
+            encodedBytes += end - cursor.recordOffset;
+            if (end < encoded.byteLength) {
+                nextCursor = { ...cursor, recordOffset: end };
+                break;
+            }
+            nextCursor = afterRecord;
+            if (rowRecord) {
+                rowCount += 1;
+                if (rowCount >= maxRows)
+                    break;
+            }
+        }
+        return {
+            epoch: plan.epoch,
+            generation: plan.generation,
+            schemaFingerprint: plan.schemaFingerprint,
+            chunks,
+            encodedBytes,
+            rowCount,
+            nextCursor,
+            done: nextCursor.phase === "done"
+        };
+    }
+    async readBackupSnapshotSmall(input) {
+        await this.ensureSchema({ migrations: [] });
+        const plan = await this.backupSnapshotPlan();
+        this.assertSnapshotMatches(plan, input);
+        if (plan.databaseBytes > backupDatabaseProtocolLimits.smallSnapshotDatabaseBytes) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Database exceeds the bounded small-snapshot size");
+        }
+        const maxBytes = Math.min(Math.max(Math.trunc(input.maxBytes ?? backupDatabaseProtocolLimits.smallSnapshotLogicalBytes), 1), backupDatabaseProtocolLimits.smallSnapshotLogicalBytes);
+        const records = [];
+        let encodedBytes = 0;
+        let recordCount = 0;
+        let rowCount = 0;
+        let tableCount = 0;
+        const append = (record) => {
+            const encoded = encodeBackupLogicalRecord(record);
+            if (encodedBytes + encoded.byteLength > maxBytes) {
+                backupError("BACKUP_LIMIT_EXCEEDED", "Logical snapshot exceeds the bounded small-snapshot size");
+            }
+            records.push(encoded);
+            encodedBytes += encoded.byteLength;
+            recordCount += 1;
+        };
+        append(this.snapshotMetadataRecord(plan));
+        for (const table of plan.tables) {
+            append(this.snapshotTableSchemaRecord(table));
+            append({ kind: "ddl", sql: table.createSql });
+            append({ kind: "table-start", tableId: table.tableId });
+            let after = null;
+            while (true) {
+                const rows = this.snapshotRowsSync(table, after, backupDatabaseProtocolLimits.maximumPageRows);
+                if (!rows.length)
+                    break;
+                for (const row of rows) {
+                    append(row.record);
+                    after = row.key;
+                    rowCount += 1;
+                }
+            }
+            append({ kind: "table-end", tableId: table.tableId });
+            tableCount += 1;
+        }
+        for (const sql of plan.secondaryDdl)
+            append({ kind: "ddl", sql });
+        const plaintextSha256 = await sha256Hex(concatBackupBytes(records));
+        const refreshedPlan = await this.backupSnapshotPlan();
+        this.assertSnapshotMatches(refreshedPlan, input);
+        const endRecord = encodeBackupLogicalRecord({
+            kind: "logical-end",
+            recordCount,
+            rowCount,
+            tableCount,
+            plaintextSha256
+        });
+        if (encodedBytes + endRecord.byteLength > maxBytes) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Logical snapshot end record exceeds the bounded small-snapshot size");
+        }
+        records.push(endRecord);
+        encodedBytes += endRecord.byteLength;
+        return {
+            epoch: plan.epoch,
+            generation: plan.generation,
+            schemaFingerprint: plan.schemaFingerprint,
+            records,
+            encodedBytes,
+            recordCount,
+            rowCount,
+            tableCount,
+            plaintextSha256
+        };
+    }
+    async finishBackupSnapshot(input) {
+        await this.ensureSchema({ migrations: [] });
+        const plan = await this.backupSnapshotPlan();
+        this.assertSnapshotMatches(plan, input);
+        const record = encodeBackupLogicalRecord({
+            kind: "logical-end",
+            recordCount: backupNonNegativeInteger(input.recordCount, "Snapshot record count"),
+            rowCount: backupNonNegativeInteger(input.rowCount, "Snapshot row count"),
+            tableCount: backupNonNegativeInteger(input.tableCount, "Snapshot table count"),
+            plaintextSha256: validateBackupDigest(input.plaintextSha256, "Snapshot plaintext digest")
+        });
+        const operationId = validateBackupOperationId(input.operationId);
+        this.ctx.storage.transactionSync(() => {
+            const state = this.backupMutationStateSync();
+            if (state.gateKind === "snapshot" && state.gateOperationId === operationId) {
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+           SET "gateKind" = NULL, "gateOperationId" = NULL
+           WHERE "id" = 1`);
+            }
+        });
+        return { record };
+    }
+    async cancelBackupSnapshot(input) {
+        await this.ensureSchema({ migrations: [] });
+        const operationId = validateBackupOperationId(input.operationId);
+        this.ctx.storage.transactionSync(() => {
+            const state = this.backupMutationStateSync();
+            if (state.gateKind === "snapshot" && state.gateOperationId === operationId) {
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+           SET "gateKind" = NULL, "gateOperationId" = NULL
+           WHERE "id" = 1`);
+            }
+        });
+        return { ok: true };
+    }
+    async backupRestoreStatus() {
+        this.ensureBackupProtocolSchemaSync();
+        return restoreStatusFromRow(this.backupRestoreJournalSync());
+    }
+    async backupRestoreAuthenticateSession(input) {
+        this.ensureBackupProtocolSchemaSync();
+        const status = restoreStatusFromRow(this.backupRestoreJournalSync());
+        const state = this.backupMutationStateSync();
+        if (!status.active || state.gateKind !== "restore")
+            return null;
+        if (typeof input.sessionToken !== "string" ||
+            input.sessionToken.length < 1 ||
+            input.sessionToken.length > 4_096) {
+            return null;
+        }
+        const row = this.ctx.storage.sql
+            .exec(`SELECT "sessionId", "sessionToken", "expiresAt", "userId", "email", "name",
+                "emailVerified", "operatorRole", "appRoles", "banned"
+         FROM ${sqlIdentifier(backupRestoreSessionsTable)}
+         WHERE "operationId" = ? AND "sessionToken" = ?
+         LIMIT 1`, status.operationId, input.sessionToken)
+            .toArray()[0];
+        if (!row || this.expiresAtMs(row.expiresAt) <= Date.now() || Boolean(row.banned))
+            return null;
+        return {
+            user: withHostUserRoleCeiling({
+                id: row.userId,
+                email: row.email,
+                name: row.name,
+                operatorRole: normalizeStoredAdminRole(row.operatorRole),
+                appRoles: this.parseRoles(row.appRoles),
+                emailVerified: row.emailVerified === 1 || row.emailVerified === "1",
+                disabled: false
+            }),
+            session: {
+                id: row.sessionId,
+                token: row.sessionToken,
+                userId: row.userId,
+                expiresAt: row.expiresAt
+            }
+        };
+    }
+    async beginBackupRestore(input) {
+        await this.ensureSchema({ migrations: [] });
+        const operationId = validateBackupOperationId(input.operationId, "Restore operation id");
+        validateBackupOperationId(input.archiveId, "Restore archive id");
+        validateBackupOperationId(input.targetId, "Restore target id");
+        validateBackupDigest(input.sourceSha256, "Restore source digest");
+        validateBackupDigest(input.plaintextSha256, "Restore plaintext digest");
+        const expectedRecordCount = backupNonNegativeInteger(input.expectedRecordCount, "Expected restore record count");
+        const expectedRowCount = backupNonNegativeInteger(input.expectedRowCount, "Expected restore row count");
+        const expectedTableCount = backupNonNegativeInteger(input.expectedTableCount, "Expected restore table count");
+        let status = null;
+        let failure = null;
+        await this.ctx.blockConcurrencyWhile(async () => {
+            try {
+                const undoBookmark = await this.ctx.storage.getCurrentBookmark();
+                this.ctx.storage.transactionSync(() => {
+                    this.ensureBackupProtocolSchemaSync();
+                    const existing = this.backupRestoreJournalSync(operationId);
+                    if (existing) {
+                        if (existing.sourceSha256 !== input.sourceSha256 ||
+                            existing.archiveId !== input.archiveId ||
+                            existing.targetId !== input.targetId ||
+                            existing.expectedRecordCount !== expectedRecordCount ||
+                            existing.expectedRowCount !== expectedRowCount ||
+                            existing.expectedTableCount !== expectedTableCount ||
+                            existing.plaintextSha256 !== input.plaintextSha256) {
+                            backupError("BACKUP_ARCHIVE_IDENTITY_MISMATCH", "Restore operation id was reused for a different archive");
+                        }
+                        status = restoreStatusFromRow(existing);
+                        return;
+                    }
+                    const state = this.backupMutationStateSync();
+                    const active = this.backupRestoreJournalSync();
+                    if (active ||
+                        (state.gateKind && !(state.gateKind === "restore" && state.gateOperationId === operationId))) {
+                        backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Another database maintenance operation is active");
+                    }
+                    const now = input.createdAt ?? new Date().toISOString();
+                    this.ctx.storage.sql.exec(`INSERT INTO ${sqlIdentifier(backupRestoreJournalTable)}
+             ("operationId", "sourceSha256", "archiveId", "targetId", "undoBookmark", "phase",
+              "expectedRecordCount", "expectedRowCount", "expectedTableCount", "plaintextSha256",
+              "nextBatchIndex", "lastBatchSha256", "recordCount", "rowCount", "tableCount",
+              "currentTableId", "schemaReplaced", "metadataSeen", "logicalEndSeen", "error", "createdAt", "updatedAt")
+             VALUES (?, ?, ?, ?, ?, 'applying', ?, ?, ?, ?, 0, NULL, 0, 0, 0, NULL, 0, 0, 0, NULL, ?, ?)`, operationId, input.sourceSha256, input.archiveId, input.targetId, undoBookmark, expectedRecordCount, expectedRowCount, expectedTableCount, input.plaintextSha256, now, now);
+                    this.ctx.storage.sql.exec(`DELETE FROM ${sqlIdentifier(backupRestoreSessionsTable)}
+             WHERE "operationId" = ?`, operationId);
+                    if (this.tableExists("_auth_sessions") && this.tableExists("_auth_users")) {
+                        this.ctx.storage.sql.exec(`INSERT INTO ${sqlIdentifier(backupRestoreSessionsTable)}
+               ("operationId", "sessionId", "sessionToken", "expiresAt", "userId", "email", "name",
+                "emailVerified", "operatorRole", "appRoles", "banned")
+               SELECT ?, s."id", s."token", s."expiresAt", u."id", u."email", u."name",
+                      u."emailVerified", u."operatorRole", u."appRoles", u."banned"
+               FROM "_auth_sessions" s INNER JOIN "_auth_users" u ON u."id" = s."userId"
+               WHERE u."operatorRole" IN ('admin', 'owner')`, operationId);
+                    }
+                    this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+             SET "gateKind" = 'restore', "gateOperationId" = ?
+             WHERE "id" = 1`, operationId);
+                    status = restoreStatusFromRow(this.backupRestoreJournalSync(operationId));
+                });
+            }
+            catch (error) {
+                failure = error;
+            }
+        });
+        if (failure)
+            throw failure;
+        if (!status)
+            throw new Error("Restore journal was not created");
+        return status;
+    }
+    async applyBackupRestoreBatch(input) {
+        this.ensureBackupProtocolSchemaSync();
+        const operationId = validateBackupOperationId(input.operationId, "Restore operation id");
+        const batchIndex = backupNonNegativeInteger(input.batchIndex, "Restore batch index");
+        validateBackupDigest(input.batchSha256, "Restore batch digest");
+        if (!Array.isArray(input.records) ||
+            input.records.length < 1 ||
+            input.records.length > backupDatabaseProtocolLimits.maximumRestoreBatchRecords) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Restore batch record count is outside its bound");
+        }
+        const encoded = input.records.map(encodeBackupLogicalRecord);
+        const encodedBytes = encoded.reduce((total, record) => total + record.byteLength, 0);
+        if (encodedBytes > backupDatabaseProtocolLimits.maximumRestoreBatchBytes &&
+            !(encoded.length === 1 && encodedBytes <= backupFormatLimits.logicalRecordBytes + 6)) {
+            backupError("BACKUP_LIMIT_EXCEEDED", "Restore batch exceeds its encoded byte bound");
+        }
+        const actualBatchSha256 = await sha256Hex(concatBackupBytes(encoded));
+        if (actualBatchSha256 !== input.batchSha256) {
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Restore batch digest does not match its records");
+        }
+        let result = null;
+        this.ctx.storage.sql.exec("PRAGMA foreign_keys=OFF");
+        try {
+            this.mutateSync(() => {
+                const journal = this.backupRestoreJournalSync(operationId);
+                if (!journal) {
+                    backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore journal is missing");
+                }
+                if (journal.phase !== "applying") {
+                    backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", `Restore is in ${journal.phase} phase`);
+                }
+                if (batchIndex === journal.nextBatchIndex - 1) {
+                    if (journal.lastBatchSha256 !== input.batchSha256) {
+                        backupError("BACKUP_ARCHIVE_CORRUPT", "Repeated restore batch has a different digest");
+                    }
+                    result = {
+                        operationId,
+                        nextBatchIndex: journal.nextBatchIndex,
+                        duplicate: true,
+                        phase: journal.phase,
+                        recordCount: Number(journal.recordCount),
+                        rowCount: Number(journal.rowCount),
+                        tableCount: Number(journal.tableCount)
+                    };
+                    return;
+                }
+                if (batchIndex !== journal.nextBatchIndex) {
+                    backupError("BACKUP_ARCHIVE_CORRUPT", "Restore batch index is not the next journal checkpoint");
+                }
+                if (!journal.schemaReplaced) {
+                    this.replaceRestorableSchemaSync();
+                    journal.schemaReplaced = 1;
+                }
+                for (const record of input.records)
+                    this.applyRestoreRecordSync(journal, record);
+                journal.nextBatchIndex += 1;
+                journal.lastBatchSha256 = input.batchSha256;
+                journal.updatedAt = new Date().toISOString();
+                this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupRestoreJournalTable)}
+           SET "nextBatchIndex" = ?, "lastBatchSha256" = ?,
+               "recordCount" = ?, "rowCount" = ?, "tableCount" = ?,
+               "currentTableId" = ?, "schemaReplaced" = ?,
+               "metadataSeen" = ?, "logicalEndSeen" = ?, "updatedAt" = ?
+           WHERE "operationId" = ?`, journal.nextBatchIndex, journal.lastBatchSha256, journal.recordCount, journal.rowCount, journal.tableCount, journal.currentTableId, journal.schemaReplaced, journal.metadataSeen, journal.logicalEndSeen, journal.updatedAt, operationId);
+                result = {
+                    operationId,
+                    nextBatchIndex: journal.nextBatchIndex,
+                    duplicate: false,
+                    phase: journal.phase,
+                    recordCount: journal.recordCount,
+                    rowCount: journal.rowCount,
+                    tableCount: journal.tableCount
+                };
+            }, { kind: "restore", operationId });
+        }
+        catch (error) {
+            await this.failBackupRestore({
+                operationId,
+                error: error instanceof Error ? error.message : String(error)
+            }).catch(() => undefined);
+            throw error;
+        }
+        finally {
+            this.ctx.storage.sql.exec("PRAGMA foreign_keys=ON");
+        }
+        if (!result)
+            throw new Error("Restore batch did not produce a journal checkpoint");
+        return result;
+    }
+    async finishBackupRestore(input) {
+        this.ensureBackupProtocolSchemaSync();
+        const operationId = validateBackupOperationId(input.operationId, "Restore operation id");
+        const journal = this.backupRestoreJournalSync(operationId);
+        if (!journal)
+            backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore journal is missing");
+        if (journal.phase === "completed")
+            return restoreStatusFromRow(journal);
+        if (journal.phase !== "applying" ||
+            !journal.logicalEndSeen ||
+            journal.currentTableId ||
+            journal.recordCount !== journal.expectedRecordCount ||
+            journal.rowCount !== journal.expectedRowCount ||
+            journal.tableCount !== journal.expectedTableCount) {
+            backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore has not reached its verified logical end");
+        }
+        const restoredSchemas = this.ctx.storage.sql
+            .exec(`SELECT "tableName" FROM ${sqlIdentifier(backupRestoreSchemasTable)}
+         WHERE "operationId" = ? ORDER BY "tableId"`, operationId)
+            .toArray();
+        const expectedTables = restoredSchemas.map((schema) => schema.tableName).sort();
+        const actualTables = this.ctx.storage.sql
+            .exec(`SELECT "name" FROM "sqlite_master"
+         WHERE "type" = 'table'
+           AND "name" NOT LIKE 'sqlite_%'
+           AND "name" NOT LIKE '_cf_%'
+         ORDER BY "name"`)
+            .toArray()
+            .map((table) => table.name)
+            .filter((name) => !backupOperationalTables.has(name) && !isRaybaseSearchInternalTable(name))
+            .sort();
+        if (JSON.stringify(actualTables) !== JSON.stringify(expectedTables)) {
+            await this.failBackupRestore({ operationId, error: "Restored SQLite table-set integrity check failed" });
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Restored SQLite database contains an unexpected table set");
+        }
+        const restoredRows = restoredSchemas.reduce((total, schema) => {
+            const count = this.ctx.storage.sql
+                .exec(`SELECT COUNT(*) AS "count" FROM ${sqlIdentifier(schema.tableName)}`)
+                .toArray()[0]?.count;
+            return total + Number(count ?? 0);
+        }, 0);
+        if (restoredRows !== journal.expectedRowCount) {
+            await this.failBackupRestore({ operationId, error: "Restored SQLite row-count integrity check failed" });
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Restored SQLite database failed its row-count integrity check");
+        }
+        let foreignKeyFailures = [];
+        try {
+            foreignKeyFailures = this.ctx.storage.sql
+                .exec("PRAGMA foreign_key_check")
+                .toArray();
+        }
+        catch (error) {
+            if (!String(error).includes("SQLITE_AUTH"))
+                throw error;
+            // SqlStorage currently rejects global integrity PRAGMAs. The bounded
+            // table/count checks above remain mandatory; Plan 5 status reports this
+            // platform limit instead of claiming native SQLite integrity_check.
+        }
+        if (foreignKeyFailures.length) {
+            await this.failBackupRestore({ operationId, error: "SQLite foreign-key check failed" });
+            backupError("BACKUP_ARCHIVE_CORRUPT", "Restored SQLite database failed its foreign-key check");
+        }
+        this.ctx.storage.transactionSync(() => {
+            const current = this.backupRestoreJournalSync(operationId);
+            if (!current)
+                backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore journal disappeared");
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupRestoreJournalTable)}
+         SET "phase" = 'completed', "error" = NULL, "updatedAt" = ?
+         WHERE "operationId" = ?`, new Date().toISOString(), operationId);
+            this.ctx.storage.sql.exec(`DELETE FROM ${sqlIdentifier(backupRestoreSchemasTable)}
+         WHERE "operationId" = ?`, operationId);
+            this.ctx.storage.sql.exec(`DELETE FROM ${sqlIdentifier(backupRestoreSessionsTable)}
+         WHERE "operationId" = ?`, operationId);
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupStateTable)}
+         SET "gateKind" = NULL, "gateOperationId" = NULL
+         WHERE "id" = 1 AND "gateKind" = 'restore' AND "gateOperationId" = ?`, operationId);
+        });
+        this.initialized = true;
+        this.ensuredSchemaBundles.clear();
+        return restoreStatusFromRow(this.backupRestoreJournalSync(operationId));
+    }
+    async failBackupRestore(input) {
+        this.ensureBackupProtocolSchemaSync();
+        const operationId = validateBackupOperationId(input.operationId, "Restore operation id");
+        const message = String(input.error).slice(0, 1_024);
+        this.ctx.storage.transactionSync(() => {
+            const journal = this.backupRestoreJournalSync(operationId);
+            if (!journal)
+                backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore journal is missing");
+            if (journal.phase === "completed")
+                return;
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupRestoreJournalTable)}
+         SET "phase" = 'failed', "error" = ?, "updatedAt" = ?
+         WHERE "operationId" = ?`, message, new Date().toISOString(), operationId);
+        });
+        return restoreStatusFromRow(this.backupRestoreJournalSync(operationId));
+    }
+    async markBackupRestoreRollbackRequested(input) {
+        this.ensureBackupProtocolSchemaSync();
+        const operationId = validateBackupOperationId(input.operationId, "Restore operation id");
+        this.ctx.storage.transactionSync(() => {
+            const journal = this.backupRestoreJournalSync(operationId);
+            if (!journal)
+                backupError("BACKUP_RESTORE_MAINTENANCE_REQUIRED", "Restore journal is missing");
+            if (journal.phase === "completed")
+                return;
+            this.ctx.storage.sql.exec(`UPDATE ${sqlIdentifier(backupRestoreJournalTable)}
+         SET "phase" = 'rollback-requested', "updatedAt" = ?
+         WHERE "operationId" = ?`, new Date().toISOString(), operationId);
+        });
+        return restoreStatusFromRow(this.backupRestoreJournalSync(operationId));
+    }
+    async prepareAuditArchive(input) {
+        await this.ensureSchema({ migrations: [] });
+        const window = validateAuditArchiveWindow(input);
+        const limitBytes = input.limitBytes ?? defaultAuditArchiveLimitBytes;
+        if (!Number.isInteger(limitBytes) || limitBytes <= 0) {
+            throw new Error("Audit archive limitBytes must be a positive integer");
+        }
+        const existing = this.ctx.storage.sql
+            .exec(`SELECT "windowStart", "windowEnd", "objectKey", "rowCount", "firstCreatedAt", "lastCreatedAt", "sha256", "archivedAt", "prunedAt"
+         FROM "_audit_archives"
+         WHERE "windowStart" = ?`, window.windowStart)
+            .toArray()[0];
+        if (existing && existing.windowEnd !== window.windowEnd) {
+            throw new Error("Audit archive manifest windowEnd mismatch");
+        }
+        if (existing?.prunedAt) {
+            return { empty: true, windowStart: window.windowStart, windowEnd: window.windowEnd };
+        }
+        const startSql = isoToSqliteTimestamp(window.windowStart);
+        const endSql = isoToSqliteTimestamp(window.windowEnd);
+        const rows = this.ctx.storage.sql
+            .exec(`SELECT "id", "actorId", "action", "targetType", "targetId", "metadata", "createdAt"
+         FROM "_audit"
+         WHERE "createdAt" >= ? AND "createdAt" < ?
+         ORDER BY "createdAt" ASC, "id" ASC`, startSql, endSql)
+            .toArray();
+        if (!rows.length) {
+            if (existing) {
+                return { empty: false, alreadyArchived: true, ...archiveMetadataFromManifest(existing) };
+            }
+            return { empty: true, windowStart: window.windowStart, windowEnd: window.windowEnd };
+        }
+        const body = serializeAuditArchiveRows(rows);
+        const bodyBytes = new TextEncoder().encode(body).byteLength;
+        if (bodyBytes > limitBytes) {
+            throw new Error(`Audit archive body is ${bodyBytes} bytes, exceeding limitBytes ${limitBytes}`);
+        }
+        const prepared = {
+            empty: false,
+            windowStart: window.windowStart,
+            windowEnd: window.windowEnd,
+            objectKey: auditArchiveObjectKey(window.windowStart),
+            body,
+            rowCount: rows.length,
+            firstCreatedAt: rows[0].createdAt,
+            lastCreatedAt: rows[rows.length - 1].createdAt,
+            sha256: await sha256Hex(body)
+        };
+        if (existing) {
+            assertArchiveMetadataMatches(archiveMetadataFromManifest(existing), prepared);
+        }
+        return prepared;
+    }
+    async confirmAuditArchive(input) {
+        await this.ensureSchema({ migrations: [] });
+        const expected = assertConfirmInput(input);
+        const archivedAt = new Date().toISOString();
+        this.mutateSync(() => {
+            const existing = this.ctx.storage.sql
+                .exec(`SELECT "windowStart", "windowEnd", "objectKey", "rowCount", "firstCreatedAt", "lastCreatedAt", "sha256", "archivedAt", "prunedAt"
+           FROM "_audit_archives"
+           WHERE "windowStart" = ?`, expected.windowStart)
+                .toArray()[0];
+            if (existing) {
+                assertArchiveMetadataMatches(archiveMetadataFromManifest(existing), expected);
+                return;
+            }
+            this.ctx.storage.sql.exec(`INSERT INTO "_audit_archives"
+         ("windowStart", "windowEnd", "objectKey", "rowCount", "firstCreatedAt", "lastCreatedAt", "sha256", "archivedAt", "prunedAt")
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`, expected.windowStart, expected.windowEnd, expected.objectKey, expected.rowCount, expected.firstCreatedAt, expected.lastCreatedAt, expected.sha256, archivedAt);
+        });
+        return { ok: true };
+    }
+    async pruneAuditArchive(input) {
+        await this.ensureSchema({ migrations: [] });
+        const window = validateAuditArchiveWindow(input);
+        if (input.objectKey !== auditArchiveObjectKey(window.windowStart)) {
+            throw new Error("Audit archive objectKey does not match the window");
+        }
+        const startSql = isoToSqliteTimestamp(window.windowStart);
+        const endSql = isoToSqliteTimestamp(window.windowEnd);
+        const prunedAt = new Date().toISOString();
+        this.mutateSync(() => {
+            const manifest = this.ctx.storage.sql
+                .exec(`SELECT "windowStart", "windowEnd", "objectKey", "rowCount", "firstCreatedAt", "lastCreatedAt", "sha256", "archivedAt", "prunedAt"
+           FROM "_audit_archives"
+           WHERE "windowStart" = ?`, window.windowStart)
+                .toArray()[0];
+            if (!manifest)
+                throw new Error("Audit archive manifest is missing");
+            if (manifest.windowEnd !== window.windowEnd || manifest.objectKey !== input.objectKey || manifest.sha256 !== input.sha256) {
+                throw new Error("Audit archive manifest mismatch");
+            }
+            if (manifest.prunedAt)
+                return;
+            this.ctx.storage.sql.exec(`DELETE FROM "_audit"
+         WHERE "createdAt" >= ? AND "createdAt" < ?`, startSql, endSql);
+            this.ctx.storage.sql.exec(`UPDATE "_audit_archives" SET "prunedAt" = ? WHERE "windowStart" = ?`, prunedAt, window.windowStart);
+        });
+        return { ok: true };
+    }
+    async dump() {
+        await this.ensureSchema({ migrations: [] });
+        this.assertReadableSync();
+        const rawTables = this.ctx.storage.sql
+            .exec(`SELECT "name", "sql" FROM "sqlite_master"
+         WHERE "type" = 'table'
+           AND "name" NOT LIKE 'sqlite_%'
+           AND "name" NOT LIKE '_cf_%'
+           AND "name" != '_changes'
+         ORDER BY "name"`)
+            .toArray()
+            .filter((table) => !isRaybaseSearchInternalTable(table.name) && !backupOperationalTables.has(table.name));
+        const tableNames = new Set(rawTables.map((table) => table.name));
+        const tables = dependencyOrder(rawTables.map((table) => ({
+            ...table,
+            references: this.ctx.storage.sql
+                .exec(`PRAGMA foreign_key_list(${sqlIdentifier(table.name)})`)
+                .toArray()
+                .map((foreignKey) => foreignKey.table)
+                .filter((name) => tableNames.has(name))
+        })));
+        const statements = ["PRAGMA foreign_keys=OFF"];
+        for (const table of [...tables].reverse()) {
+            statements.push(`DROP TABLE IF EXISTS ${sqlIdentifier(table.name)}`);
+        }
+        for (const table of tables) {
+            if (table.sql)
+                statements.push(table.sql);
+        }
+        for (const table of tables) {
+            const rows = this.ctx.storage.sql.exec(`SELECT * FROM ${sqlIdentifier(table.name)}`).toArray();
+            for (const row of rows) {
+                const columns = Object.keys(row);
+                statements.push(`INSERT INTO ${sqlIdentifier(table.name)} (${columns.map(sqlIdentifier).join(", ")}) VALUES (${columns.map((column) => sqlLiteral(row[column])).join(", ")})`);
+            }
+        }
+        statements.push("PRAGMA foreign_keys=ON");
+        return { sql: `${statements.join(statementSeparator)};` };
+    }
+    async restoreDump(sql) {
+        await this.ctx.blockConcurrencyWhile(async () => {
+            this.ctx.storage.sql.exec("PRAGMA foreign_keys=OFF");
+            try {
+                this.mutateSync(() => {
+                    this.ensureJournal();
+                    const rawTables = this.ctx.storage.sql
+                        .exec(`SELECT "name" FROM "sqlite_master"
+               WHERE "type" = 'table'
+                 AND "name" NOT LIKE 'sqlite_%'
+                 AND "name" NOT LIKE '_cf_%'`)
+                        .toArray()
+                        .filter((table) => !isRaybaseSearchInternalTable(table.name) && !backupOperationalTables.has(table.name));
+                    const tableNames = new Set(rawTables.map((table) => table.name));
+                    const tables = dependencyOrder(rawTables.map((table) => ({
+                        ...table,
+                        sql: "",
+                        references: this.ctx.storage.sql
+                            .exec(`PRAGMA foreign_key_list(${sqlIdentifier(table.name)})`)
+                            .toArray()
+                            .map((foreignKey) => foreignKey.table)
+                            .filter((name) => tableNames.has(name))
+                    })));
+                    for (const table of [...tables].reverse()) {
+                        this.ctx.storage.sql.exec(`DROP TABLE IF EXISTS ${sqlIdentifier(table.name)}`);
+                    }
+                    for (const statement of splitSqlStatements(sql)) {
+                        this.ctx.storage.sql.exec(statement);
+                    }
+                });
+            }
+            finally {
+                this.ctx.storage.sql.exec("PRAGMA foreign_keys=ON");
+            }
+            this.initialized = true;
+            this.ensuredSchemaBundles.clear();
+        });
+        return { ok: true };
+    }
+}
+/**
+ * Builds a Wrangler-exportable database object around the shared Core
+ * implementation. First-party layered distributions configure storage mode
+ * and control-plane session revalidation without subclassing feature methods.
+ */
+export function createRaybaseDatabaseObject(runtime) {
+    return class RaybaseComposedDatabaseObject extends RaybaseDatabaseObject {
+        runtimeOptions() {
+            return runtime;
+        }
+    };
+}
+//# sourceMappingURL=do.js.map