@scopebond/hook 0.8.0 → 0.9.0

package/dist/obs-store.d.ts

@@ -0,0 +1,160 @@
+import { type ObservationDraft, type ObservationPayload, type SignedObservation, type EnvelopeContext, type ObservationSigner } from "./observation.js";
+export declare const OBSERVATION_DB = "observations.db";
+/** Bounds on the local queue. Past them new observations are counted as dropped (visible
+ *  in `status`) rather than growing without limit; enforcement never depends on the queue. */
+export declare const MAX_PENDING = 5000;
+export declare const MAX_PENDING_BYTES: number;
+export declare const MAX_TERMINAL = 1000;
+/** How long a route found missing is left alone before one upload probes it again. */
+/** How long a batch stays reserved for the process that took it. */
+export declare const INFLIGHT_MS = 30000;
+export declare const UNSUPPORTED_RECHECK_MS: number;
+export type Capability = "active" | "unsupported" | "blocked";
+export interface StoreState {
+    generation: number;
+    next_sequence: number;
+    capability: Capability;
+    reason: string | null;
+    capability_at: number | null;
+    backoff_until: number;
+    last_error: string | null;
+    last_upload_at: number | null;
+    dropped: number;
+    batch_limit: number;
+}
+export interface PendingRow {
+    sequence: number;
+    generation: number;
+    observation_id: string;
+    observation_hash: string;
+    kind: string;
+    wrapper: SignedObservation;
+    bytes: number;
+    enqueued_at: number;
+    attempts: number;
+    next_attempt_at: number;
+}
+export interface TerminalRow {
+    id: number;
+    generation: number;
+    sequence: number;
+    observation_id: string;
+    kind: string;
+    code: string;
+    at: number;
+    wrapper: SignedObservation | null;
+}
+export interface SessionRow {
+    session_id: string;
+    state: "active" | "stopped";
+    started_at: number;
+    last_activity_at: number;
+    last_heartbeat_at: number;
+    heartbeat_lease_until: number;
+    repository_id: string | null;
+    stopped_reason: string | null;
+}
+export interface CallRow {
+    call_key: string;
+    parent_action_id: string;
+    source_receipt_hash: string;
+    session_id: string | null;
+    operation: Record<string, unknown>;
+    at: number;
+}
+export type EnqueueResult = {
+    queued: true;
+    duplicate: boolean;
+    sequence: number;
+    observation_id: string;
+} | {
+    queued: false;
+    reason: "unsupported" | "blocked" | "capacity" | "oversize" | "generation_mismatch";
+    detail?: string;
+};
+export declare class ObservationStore {
+    private readonly now;
+    private readonly db;
+    constructor(path: string, now?: () => number);
+    close(): void;
+    private tx;
+    state(): StoreState | null;
+    /**
+     * Bind the outbox to the installation generation the workspace enrolled. A higher
+     * generation than the stored one means the key or credential was rotated: sequence
+     * restarts at 1, and everything still pending under the old generation moves to the
+     * terminal queue as `stale_generation` (kept locally, never uploaded). A generation
+     * lower than the stored one is a stale connection file and reported, not adopted.
+     */
+    bindGeneration(generation: number): {
+        ok: true;
+        retired: number;
+    } | {
+        ok: false;
+        reason: string;
+    };
+    /**
+     * Allocate the next sequence, build and sign the payload, and store it, atomically.
+     * `observationId` makes the call idempotent: an id already stored (pending or already
+     * sent) returns without consuming a sequence.
+     */
+    enqueue(draft: ObservationDraft, context: EnvelopeContext, signer: ObservationSigner): EnqueueResult;
+    private rowToPending;
+    /** The next batch to send: current generation, in sequence order, due now, within the
+     *  item and body limits. With `lease`, the rows are marked in flight for INFLIGHT_MS in the
+     *  same transaction, so a second hook process uploading at the same moment skips them
+     *  instead of sending the same items again. The sender releases or defers them afterwards
+     *  (a crashed sender's lease simply lapses). */
+    nextBatch(limit?: number, lease?: boolean): PendingRow[];
+    /** Give leased rows back without counting an attempt (the send did not happen). */
+    release(observationIds: string[]): void;
+    pendingSummary(): {
+        count: number;
+        oldest_at: number | null;
+    };
+    /** Remove acknowledged items (accepted, duplicate, pending_link) — and only those. */
+    acknowledge(observationIds: string[]): void;
+    /** Move permanently refused items to the visible terminal queue. */
+    reject(items: Array<{
+        observation_id: string;
+        code: string;
+    }>): void;
+    /** Keep items pending but retry them later (server said deferred, or the send failed). */
+    defer(observationIds: string[], delayMs: number): void;
+    setBackoff(untilMs: number, error: string | null): void;
+    setBatchLimit(limit: number): void;
+    /** Mark the capability unsupported (route missing, batch version refused) or blocked
+     *  (stale generation). New observations are then not queued; local enforcement is
+     *  untouched. Pending items are kept. */
+    setCapability(capability: Capability, reason: string | null): void;
+    /** Move everything pending to the terminal queue with `code` (a stale generation makes
+     *  the whole backlog unsendable). */
+    rejectAllPending(code: string): number;
+    terminal(limit?: number): TerminalRow[];
+    terminalCounts(): Record<string, number>;
+    private trimTerminal;
+    mark(name: string, value: number): void;
+    getMark(name: string): number | null;
+    session(sessionId: string): SessionRow | null;
+    /** Begin (or resume) a session. Returns true when the session was not active before,
+     *  so the caller emits exactly one start. */
+    activateSession(sessionId: string, repositoryId: string | null): boolean;
+    touchSession(sessionId: string): void;
+    /** End a session. Returns true when it was active, so exactly one stop is emitted. */
+    deactivateSession(sessionId: string, reason: string): boolean;
+    activeSessions(): SessionRow[];
+    /** Claim the single heartbeat loop for a session, or refuse when another live loop
+     *  already holds it. The lease is short and renewed each tick, so a crashed loop frees
+     *  the claim within `leaseMs`. This is what keeps the number of helper processes at one
+     *  per active session no matter how many hook calls run. */
+    claimHeartbeat(sessionId: string, leaseMs: number): boolean;
+    /** Renew the loop's own claim; false when the session ended or the claim was lost. */
+    renewHeartbeat(sessionId: string, leaseMs: number, sentHeartbeat: boolean): boolean;
+    releaseHeartbeat(sessionId: string): void;
+    recordCall(call: Omit<CallRow, "at">): void;
+    /** The calls recorded under a harness call id, consumed by the after-action hook. */
+    takeCalls(callPrefix: string): CallRow[];
+}
+/** Convenience for callers that only have a payload. */
+export type { ObservationPayload };
+//# sourceMappingURL=obs-store.d.ts.map

package/dist/obs-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"obs-store.d.ts","sourceRoot":"","sources":["../src/obs-store.ts"],"names":[],"mappings":"AAsBA,OAAO,EAA0D,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAiC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK/O,eAAO,MAAM,cAAc,oBAAoB,CAAC;AAEhD;8FAC8F;AAC9F,eAAO,MAAM,WAAW,OAAQ,CAAC;AACjC,eAAO,MAAM,iBAAiB,QAAmB,CAAC;AAClD,eAAO,MAAM,YAAY,OAAQ,CAAC;AAClC,sFAAsF;AACtF,oEAAoE;AACpE,eAAO,MAAM,WAAW,QAAS,CAAC;AAClC,eAAO,MAAM,sBAAsB,QAAsB,CAAC;AAE1D,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,qBAAqB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAW5H,qBAAa,gBAAgB;IAGD,OAAO,CAAC,QAAQ,CAAC,GAAG;IAF9C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAW;gBAElB,IAAI,EAAE,MAAM,EAAmB,GAAG,GAAE,MAAM,MAAiB;IAkCvE,KAAK,IAAI,IAAI;IAEb,OAAO,CAAC,EAAE;IAMV,KAAK,IAAI,UAAU,GAAG,IAAI;IAI1B;;;;;;OAMG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IAqBjG;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB,GAAG,aAAa;IAoCpG,OAAO,CAAC,YAAY;IAIpB;;;;oDAIgD;IAChD,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,UAAU,EAAE;IAqBtD,mFAAmF;IACnF,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI;IAIvC,cAAc,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE;IAK7D,sFAAsF;IACtF,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI;IAM3C,oEAAoE;IACpE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAapE,0FAA0F;IAC1F,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAKtD,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIvD,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIlC;;6CAEyC;IACzC,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIlE;yCACqC;IACrC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAMtC,QAAQ,CAAC,KAAK,SAAK,GAAG,WAAW,EAAE;IAKnC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAMxC,OAAO,CAAC,YAAY;IAMpB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAGvC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOpC,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI7C;iDAC6C;IAC7C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAcxE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC,sFAAsF;IACtF,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAS7D,cAAc,IAAI,UAAU,EAAE;IAI9B;;;gEAG4D;IAC5D,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO;IAU3D,sFAAsF;IACtF,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,OAAO;IAUnF,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMzC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,IAAI;IAU3C,qFAAqF;IACrF,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,EAAE;CAOzC;AAED,wDAAwD;AACxD,YAAY,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/obs-store.js

@@ -0,0 +1,367 @@
+// The local observation outbox.
+//
+// One SQLite file (`observations.db`, beside the receipts) holds everything that must
+// survive a process exit, because the hook is a short-lived process per tool call:
+//
+//   state     the installation generation, the next sequence to allocate, the upload
+//             capability (active / unsupported / blocked) and a backoff deadline
+//   pending   signed observations not yet acknowledged, in sequence order
+//   terminal  observations the server refused permanently (or a stale generation made
+//             unsendable). They are kept, visible in `status`, and never retried.
+//   sessions  which harness sessions are active, and the heartbeat owner lease
+//   calls     the operation of each dispatched tool call, so the after-action hook can
+//             echo the same binding
+//
+// Sequence allocation and the pending row are written in ONE `BEGIN IMMEDIATE`
+// transaction, so a crash between the two cannot leave a gap or a reused number, and two
+// hook processes cannot allocate the same one. An observation id is unique, so a resend
+// of the same logical record returns the row that exists rather than allocating again.
+import { createRequire } from "node:module";
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { MAX_BATCH_BODY_BYTES, MAX_BATCH_ITEMS, observationHash, buildPayload, signObservation } from "./observation.js";
+export const OBSERVATION_DB = "observations.db";
+/** Bounds on the local queue. Past them new observations are counted as dropped (visible
+ *  in `status`) rather than growing without limit; enforcement never depends on the queue. */
+export const MAX_PENDING = 5_000;
+export const MAX_PENDING_BYTES = 32 * 1024 * 1024;
+export const MAX_TERMINAL = 1_000;
+/** How long a route found missing is left alone before one upload probes it again. */
+/** How long a batch stays reserved for the process that took it. */
+export const INFLIGHT_MS = 30_000;
+export const UNSUPPORTED_RECHECK_MS = 24 * 60 * 60 * 1000;
+function open(path) {
+    mkdirSync(dirname(path), { recursive: true });
+    const require = createRequire(import.meta.url);
+    const { DatabaseSync } = require("node:sqlite");
+    const db = new DatabaseSync(path);
+    db.exec("PRAGMA busy_timeout = 5000; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;");
+    return db;
+}
+export class ObservationStore {
+    now;
+    db;
+    constructor(path, now = Date.now) {
+        this.now = now;
+        this.db = open(path);
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS state (
+        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+        generation INTEGER NOT NULL, next_sequence INTEGER NOT NULL,
+        capability TEXT NOT NULL DEFAULT 'active', reason TEXT, capability_at INTEGER,
+        backoff_until INTEGER NOT NULL DEFAULT 0, last_error TEXT, last_upload_at INTEGER,
+        dropped INTEGER NOT NULL DEFAULT 0, batch_limit INTEGER NOT NULL DEFAULT ${MAX_BATCH_ITEMS}
+      );
+      CREATE TABLE IF NOT EXISTS pending (
+        generation INTEGER NOT NULL, sequence INTEGER NOT NULL,
+        observation_id TEXT NOT NULL UNIQUE, observation_hash TEXT NOT NULL, kind TEXT NOT NULL,
+        wrapper TEXT NOT NULL, bytes INTEGER NOT NULL, enqueued_at INTEGER NOT NULL,
+        attempts INTEGER NOT NULL DEFAULT 0, next_attempt_at INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (generation, sequence)
+      );
+      CREATE TABLE IF NOT EXISTS terminal (
+        id INTEGER PRIMARY KEY AUTOINCREMENT, generation INTEGER NOT NULL, sequence INTEGER NOT NULL,
+        observation_id TEXT NOT NULL, kind TEXT NOT NULL, code TEXT NOT NULL, at INTEGER NOT NULL, wrapper TEXT
+      );
+      CREATE TABLE IF NOT EXISTS sessions (
+        session_id TEXT PRIMARY KEY, state TEXT NOT NULL, started_at INTEGER NOT NULL,
+        last_activity_at INTEGER NOT NULL, last_heartbeat_at INTEGER NOT NULL DEFAULT 0,
+        heartbeat_lease_until INTEGER NOT NULL DEFAULT 0, repository_id TEXT, stopped_reason TEXT
+      );
+      CREATE TABLE IF NOT EXISTS calls (
+        call_key TEXT PRIMARY KEY, parent_action_id TEXT NOT NULL, source_receipt_hash TEXT NOT NULL,
+        session_id TEXT, operation TEXT NOT NULL, at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS marks (name TEXT PRIMARY KEY, value INTEGER NOT NULL);
+    `);
+    }
+    close() { try {
+        this.db.close();
+    }
+    catch { /* already closed */ } }
+    tx(work) {
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            const result = work();
+            this.db.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            try {
+                this.db.exec("ROLLBACK");
+            }
+            catch { /* the original error matters */ }
+            throw error;
+        }
+    }
+    state() {
+        return this.db.prepare("SELECT generation, next_sequence, capability, reason, capability_at, backoff_until, last_error, last_upload_at, dropped, batch_limit FROM state WHERE singleton = 1").get() ?? null;
+    }
+    /**
+     * Bind the outbox to the installation generation the workspace enrolled. A higher
+     * generation than the stored one means the key or credential was rotated: sequence
+     * restarts at 1, and everything still pending under the old generation moves to the
+     * terminal queue as `stale_generation` (kept locally, never uploaded). A generation
+     * lower than the stored one is a stale connection file and reported, not adopted.
+     */
+    bindGeneration(generation) {
+        return this.tx(() => {
+            const state = this.state();
+            const at = this.now();
+            if (!state) {
+                this.db.prepare("INSERT INTO state (singleton, generation, next_sequence) VALUES (1, ?, 1)").run(generation);
+                return { ok: true, retired: 0 };
+            }
+            if (generation < state.generation)
+                return { ok: false, reason: `connection generation ${generation} is older than the local generation ${state.generation}` };
+            if (generation === state.generation)
+                return { ok: true, retired: 0 };
+            const stale = this.db.prepare("SELECT generation, sequence, observation_id, kind, wrapper FROM pending WHERE generation < ?").all(generation);
+            for (const row of stale) {
+                this.db.prepare("INSERT INTO terminal (generation, sequence, observation_id, kind, code, at, wrapper) VALUES (?, ?, ?, ?, 'stale_generation', ?, ?)").run(row.generation, row.sequence, row.observation_id, row.kind, at, row.wrapper);
+            }
+            this.db.prepare("DELETE FROM pending WHERE generation < ?").run(generation);
+            this.db.prepare("UPDATE state SET generation = ?, next_sequence = 1, capability = CASE WHEN capability = 'blocked' THEN 'active' ELSE capability END, reason = CASE WHEN capability = 'blocked' THEN NULL ELSE reason END, backoff_until = 0 WHERE singleton = 1").run(generation);
+            this.trimTerminal();
+            return { ok: true, retired: stale.length };
+        });
+    }
+    /**
+     * Allocate the next sequence, build and sign the payload, and store it, atomically.
+     * `observationId` makes the call idempotent: an id already stored (pending or already
+     * sent) returns without consuming a sequence.
+     */
+    enqueue(draft, context, signer) {
+        return this.tx(() => {
+            const state = this.state();
+            const at = this.now();
+            if (!state || state.generation !== context.generation)
+                return { queued: false, reason: "generation_mismatch" };
+            if (draft.observationId) {
+                const existing = this.db.prepare("SELECT sequence FROM pending WHERE observation_id = ?").get(draft.observationId);
+                if (existing)
+                    return { queued: true, duplicate: true, sequence: existing.sequence, observation_id: draft.observationId };
+            }
+            if (state.capability === "blocked")
+                return { queued: false, reason: "blocked", detail: state.reason ?? undefined };
+            if (state.capability === "unsupported") {
+                if ((state.capability_at ?? 0) + UNSUPPORTED_RECHECK_MS > at)
+                    return { queued: false, reason: "unsupported", detail: state.reason ?? undefined };
+                // One probe after the recheck interval: the server may have been upgraded.
+                this.db.prepare("UPDATE state SET capability = 'active', reason = NULL, capability_at = NULL, backoff_until = 0 WHERE singleton = 1").run();
+            }
+            const totals = this.db.prepare("SELECT COUNT(*) AS n, COALESCE(SUM(bytes), 0) AS b FROM pending").get();
+            const sequence = state.next_sequence;
+            let wrapper;
+            try {
+                wrapper = signObservation(buildPayload(draft, context, sequence), signer);
+            }
+            catch (error) {
+                if (error instanceof RangeError)
+                    return { queued: false, reason: "oversize", detail: error.message };
+                throw error;
+            }
+            const json = JSON.stringify(wrapper);
+            const bytes = Buffer.byteLength(json, "utf8");
+            if (totals.n >= MAX_PENDING || totals.b + bytes > MAX_PENDING_BYTES) {
+                this.db.prepare("UPDATE state SET dropped = dropped + 1 WHERE singleton = 1").run();
+                return { queued: false, reason: "capacity" };
+            }
+            this.db.prepare("INSERT INTO pending (generation, sequence, observation_id, observation_hash, kind, wrapper, bytes, enqueued_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
+                .run(context.generation, sequence, wrapper.payload.observation_id, observationHash(wrapper.payload), wrapper.payload.kind, json, bytes, at);
+            this.db.prepare("UPDATE state SET next_sequence = ? WHERE singleton = 1").run(sequence + 1);
+            return { queued: true, duplicate: false, sequence, observation_id: wrapper.payload.observation_id };
+        });
+    }
+    rowToPending(row) {
+        return { ...row, wrapper: JSON.parse(String(row.wrapper)) };
+    }
+    /** The next batch to send: current generation, in sequence order, due now, within the
+     *  item and body limits. With `lease`, the rows are marked in flight for INFLIGHT_MS in the
+     *  same transaction, so a second hook process uploading at the same moment skips them
+     *  instead of sending the same items again. The sender releases or defers them afterwards
+     *  (a crashed sender's lease simply lapses). */
+    nextBatch(limit, lease = false) {
+        return this.tx(() => {
+            const state = this.state();
+            if (!state || state.capability !== "active")
+                return [];
+            const at = this.now();
+            if (state.backoff_until > at)
+                return [];
+            const rows = this.db.prepare("SELECT * FROM pending WHERE generation = ? AND next_attempt_at <= ? ORDER BY sequence LIMIT ?")
+                .all(state.generation, at, Math.max(1, Math.min(limit ?? state.batch_limit, state.batch_limit, MAX_BATCH_ITEMS)));
+            const out = [];
+            let body = 64;
+            for (const row of rows) {
+                const bytes = Number(row.bytes) + 1;
+                if (out.length > 0 && body + bytes > MAX_BATCH_BODY_BYTES)
+                    break;
+                body += bytes;
+                out.push(this.rowToPending(row));
+            }
+            if (lease)
+                for (const row of out)
+                    this.db.prepare("UPDATE pending SET next_attempt_at = ? WHERE observation_id = ?").run(at + INFLIGHT_MS, row.observation_id);
+            return out;
+        });
+    }
+    /** Give leased rows back without counting an attempt (the send did not happen). */
+    release(observationIds) {
+        this.tx(() => { for (const id of observationIds)
+            this.db.prepare("UPDATE pending SET next_attempt_at = 0 WHERE observation_id = ?").run(id); });
+    }
+    pendingSummary() {
+        const row = this.db.prepare("SELECT COUNT(*) AS n, MIN(enqueued_at) AS o FROM pending").get();
+        return { count: row.n, oldest_at: row.o };
+    }
+    /** Remove acknowledged items (accepted, duplicate, pending_link) — and only those. */
+    acknowledge(observationIds) {
+        this.tx(() => { for (const id of observationIds)
+            this.db.prepare("DELETE FROM pending WHERE observation_id = ?").run(id); });
+        this.mark("last_ack", this.now());
+        this.db.prepare("UPDATE state SET last_upload_at = ?, last_error = NULL WHERE singleton = 1").run(this.now());
+    }
+    /** Move permanently refused items to the visible terminal queue. */
+    reject(items) {
+        this.tx(() => {
+            const at = this.now();
+            for (const item of items) {
+                const row = this.db.prepare("SELECT generation, sequence, kind, wrapper FROM pending WHERE observation_id = ?").get(item.observation_id);
+                if (!row)
+                    continue;
+                this.db.prepare("INSERT INTO terminal (generation, sequence, observation_id, kind, code, at, wrapper) VALUES (?, ?, ?, ?, ?, ?, ?)").run(row.generation, row.sequence, item.observation_id, row.kind, item.code, at, row.wrapper);
+                this.db.prepare("DELETE FROM pending WHERE observation_id = ?").run(item.observation_id);
+            }
+            this.trimTerminal();
+        });
+    }
+    /** Keep items pending but retry them later (server said deferred, or the send failed). */
+    defer(observationIds, delayMs) {
+        const at = this.now() + Math.max(0, delayMs);
+        this.tx(() => { for (const id of observationIds)
+            this.db.prepare("UPDATE pending SET attempts = attempts + 1, next_attempt_at = ? WHERE observation_id = ?").run(at, id); });
+    }
+    setBackoff(untilMs, error) {
+        this.db.prepare("UPDATE state SET backoff_until = ?, last_error = ? WHERE singleton = 1").run(untilMs, error);
+    }
+    setBatchLimit(limit) {
+        this.db.prepare("UPDATE state SET batch_limit = ? WHERE singleton = 1").run(Math.max(1, Math.min(MAX_BATCH_ITEMS, Math.trunc(limit))));
+    }
+    /** Mark the capability unsupported (route missing, batch version refused) or blocked
+     *  (stale generation). New observations are then not queued; local enforcement is
+     *  untouched. Pending items are kept. */
+    setCapability(capability, reason) {
+        this.db.prepare("UPDATE state SET capability = ?, reason = ?, capability_at = ? WHERE singleton = 1").run(capability, reason, capability === "active" ? null : this.now());
+    }
+    /** Move everything pending to the terminal queue with `code` (a stale generation makes
+     *  the whole backlog unsendable). */
+    rejectAllPending(code) {
+        const ids = this.db.prepare("SELECT observation_id FROM pending").all().map((r) => r.observation_id);
+        this.reject(ids.map((observation_id) => ({ observation_id, code })));
+        return ids.length;
+    }
+    terminal(limit = 50) {
+        return this.db.prepare("SELECT * FROM terminal ORDER BY id DESC LIMIT ?").all(limit)
+            .map((r) => ({ ...r, wrapper: r.wrapper ? JSON.parse(String(r.wrapper)) : null }));
+    }
+    terminalCounts() {
+        const out = {};
+        for (const r of this.db.prepare("SELECT code, COUNT(*) AS n FROM terminal GROUP BY code").all())
+            out[r.code] = r.n;
+        return out;
+    }
+    trimTerminal() {
+        this.db.prepare("DELETE FROM terminal WHERE id NOT IN (SELECT id FROM terminal ORDER BY id DESC LIMIT ?)").run(MAX_TERMINAL);
+    }
+    // ---- marks (small named integers, e.g. when queue telemetry last ran) --------------------
+    mark(name, value) {
+        this.db.prepare("INSERT INTO marks (name, value) VALUES (?, ?) ON CONFLICT(name) DO UPDATE SET value = excluded.value").run(name, value);
+    }
+    getMark(name) {
+        const row = this.db.prepare("SELECT value FROM marks WHERE name = ?").get(name);
+        return row ? row.value : null;
+    }
+    // ---- sessions and the heartbeat lease --------------------------------------------------------
+    session(sessionId) {
+        return this.db.prepare("SELECT * FROM sessions WHERE session_id = ?").get(sessionId) ?? null;
+    }
+    /** Begin (or resume) a session. Returns true when the session was not active before,
+     *  so the caller emits exactly one start. */
+    activateSession(sessionId, repositoryId) {
+        return this.tx(() => {
+            const at = this.now();
+            const row = this.session(sessionId);
+            if (row?.state === "active") {
+                this.db.prepare("UPDATE sessions SET last_activity_at = ? WHERE session_id = ?").run(at, sessionId);
+                return false;
+            }
+            this.db.prepare("INSERT INTO sessions (session_id, state, started_at, last_activity_at, repository_id) VALUES (?, 'active', ?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET state = 'active', stopped_reason = NULL, started_at = excluded.started_at, last_activity_at = excluded.last_activity_at, heartbeat_lease_until = 0, repository_id = excluded.repository_id")
+                .run(sessionId, at, at, repositoryId);
+            return true;
+        });
+    }
+    touchSession(sessionId) {
+        this.db.prepare("UPDATE sessions SET last_activity_at = ? WHERE session_id = ? AND state = 'active'").run(this.now(), sessionId);
+    }
+    /** End a session. Returns true when it was active, so exactly one stop is emitted. */
+    deactivateSession(sessionId, reason) {
+        return this.tx(() => {
+            const row = this.session(sessionId);
+            if (!row || row.state !== "active")
+                return false;
+            this.db.prepare("UPDATE sessions SET state = 'stopped', stopped_reason = ?, heartbeat_lease_until = 0 WHERE session_id = ?").run(reason, sessionId);
+            return true;
+        });
+    }
+    activeSessions() {
+        return this.db.prepare("SELECT * FROM sessions WHERE state = 'active' ORDER BY started_at").all();
+    }
+    /** Claim the single heartbeat loop for a session, or refuse when another live loop
+     *  already holds it. The lease is short and renewed each tick, so a crashed loop frees
+     *  the claim within `leaseMs`. This is what keeps the number of helper processes at one
+     *  per active session no matter how many hook calls run. */
+    claimHeartbeat(sessionId, leaseMs) {
+        return this.tx(() => {
+            const row = this.session(sessionId);
+            const at = this.now();
+            if (!row || row.state !== "active" || row.heartbeat_lease_until > at)
+                return false;
+            this.db.prepare("UPDATE sessions SET heartbeat_lease_until = ? WHERE session_id = ?").run(at + leaseMs, sessionId);
+            return true;
+        });
+    }
+    /** Renew the loop's own claim; false when the session ended or the claim was lost. */
+    renewHeartbeat(sessionId, leaseMs, sentHeartbeat) {
+        return this.tx(() => {
+            const row = this.session(sessionId);
+            if (!row || row.state !== "active")
+                return false;
+            const at = this.now();
+            this.db.prepare("UPDATE sessions SET heartbeat_lease_until = ?, last_heartbeat_at = CASE WHEN ? THEN ? ELSE last_heartbeat_at END WHERE session_id = ?").run(at + leaseMs, sentHeartbeat ? 1 : 0, at, sessionId);
+            return true;
+        });
+    }
+    releaseHeartbeat(sessionId) {
+        this.db.prepare("UPDATE sessions SET heartbeat_lease_until = 0 WHERE session_id = ?").run(sessionId);
+    }
+    // ---- dispatched-call records -----------------------------------------------------------------
+    recordCall(call) {
+        const at = this.now();
+        this.tx(() => {
+            this.db.prepare("INSERT OR REPLACE INTO calls (call_key, parent_action_id, source_receipt_hash, session_id, operation, at) VALUES (?, ?, ?, ?, ?, ?)")
+                .run(call.call_key, call.parent_action_id, call.source_receipt_hash, call.session_id, JSON.stringify(call.operation), at);
+            // Calls whose outcome never arrived (a denied action, a crashed tool) are dropped after a day.
+            this.db.prepare("DELETE FROM calls WHERE at < ?").run(at - 24 * 60 * 60 * 1000);
+        });
+    }
+    /** The calls recorded under a harness call id, consumed by the after-action hook. */
+    takeCalls(callPrefix) {
+        return this.tx(() => {
+            const rows = this.db.prepare("SELECT * FROM calls WHERE call_key LIKE ? ESCAPE '\\' ORDER BY call_key").all(`${callPrefix.replace(/[\\%_]/g, "\\$&")}%`);
+            this.db.prepare("DELETE FROM calls WHERE call_key LIKE ? ESCAPE '\\'").run(`${callPrefix.replace(/[\\%_]/g, "\\$&")}%`);
+            return rows.map((r) => ({ ...r, operation: JSON.parse(String(r.operation)) }));
+        });
+    }
+}
+//# sourceMappingURL=obs-store.js.map

package/dist/obs-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obs-store.js","sourceRoot":"","sources":["../src/obs-store.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,EAAE;AACF,qFAAqF;AACrF,iFAAiF;AACjF,0EAA0E;AAC1E,sFAAsF;AACtF,kFAAkF;AAClF,+EAA+E;AAC/E,uFAAuF;AACvF,oCAAoC;AACpC,EAAE;AACF,+EAA+E;AAC/E,yFAAyF;AACzF,wFAAwF;AACxF,uFAAuF;AAEvF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAgG,YAAY,EAAE,eAAe,EAA0B,MAAM,kBAAkB,CAAC;AAK/O,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEhD;8FAC8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AACjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,sFAAsF;AACtF,oEAAoE;AACpE,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiE1D,SAAS,IAAI,CAAC,IAAY;IACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,aAAa,CAAkD,CAAC;IACjG,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,EAAE,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC7F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAGgB;IAF1B,EAAE,CAAW;IAE9B,YAAY,IAAY,EAAmB,MAAoB,IAAI,CAAC,GAAG;QAA5B,QAAG,GAAH,GAAG,CAAyB;QACrE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;;;;;;mFAMkE,eAAe;;;;;;;;;;;;;;;;;;;;;;;KAuB7F,CAAC,CAAC;IACL,CAAC;IAED,KAAK,KAAW,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IAEjE,EAAE,CAAI,IAAa;QACzB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,IAAI,CAAC;YAAC,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAC,OAAO,MAAM,CAAC;QAAC,CAAC;QACrE,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IAC7G,CAAC;IAED,KAAK;QACH,OAAQ,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qKAAqK,CAAC,CAAC,GAAG,EAA6B,IAAI,IAAI,CAAC;IAC1O,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CAAC,UAAkB;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2EAA2E,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC7G,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC3C,CAAC;YACD,IAAI,UAAU,GAAG,KAAK,CAAC,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,yBAAyB,UAAU,uCAAuC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACvK,IAAI,UAAU,KAAK,KAAK,CAAC,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8FAA8F,CAAC,CAAC,GAAG,CAAC,UAAU,CAA2G,CAAC;YACxP,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oIAAoI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACzO,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC5E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iPAAiP,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnR,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,KAAuB,EAAE,OAAwB,EAAE,MAAyB;QAClF,OAAO,IAAI,CAAC,EAAE,CAAC,GAAkB,EAAE;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAC/G,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAqC,CAAC;gBACvJ,IAAI,QAAQ;oBAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3H,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YACnH,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,sBAAsB,GAAG,EAAE;oBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBACjJ,2EAA2E;gBAC3E,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oHAAoH,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9I,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,EAA8B,CAAC;YACpI,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC;YACrC,IAAI,OAA0B,CAAC;YAC/B,IAAI,CAAC;gBAAC,OAAO,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAClF,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,UAAU;oBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;gBACrG,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,CAAC,IAAI,WAAW,IAAI,MAAM,CAAC,CAAC,GAAG,KAAK,GAAG,iBAAiB,EAAE,CAAC;gBACpE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC,GAAG,EAAE,CAAC;gBACpF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC/C,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iJAAiJ,CAAC;iBAC/J,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9I,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACtG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,GAA4B;QAC/C,OAAO,EAAE,GAAI,GAA6B,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAsB,EAAE,CAAC;IAC9G,CAAC;IAED;;;;oDAIgD;IAChD,SAAS,CAAC,KAAc,EAAE,KAAK,GAAG,KAAK;QACrC,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YACvD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,aAAa,GAAG,EAAE;gBAAE,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+FAA+F,CAAC;iBAC1H,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAmC,CAAC;YACtJ,MAAM,GAAG,GAAiB,EAAE,CAAC;YAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,GAAG,oBAAoB;oBAAE,MAAM;gBACjE,IAAI,IAAI,KAAK,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,KAAK;gBAAE,KAAK,MAAM,GAAG,IAAI,GAAG;oBAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;YAC/J,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,OAAO,CAAC,cAAwB;QAC9B,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,IAAI,cAAc;YAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClJ,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,EAAqC,CAAC;QACjI,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,sFAAsF;IACtF,WAAW,CAAC,cAAwB;QAClC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,IAAI,cAAc;YAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7H,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,KAAsD;QAC3D,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YACX,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kFAAkF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAwF,CAAC;gBAChO,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mHAAmH,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAClO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,cAAwB,EAAE,OAAe;QAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,IAAI,cAAc;YAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,0FAA0F,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/K,CAAC;IAED,UAAU,CAAC,OAAe,EAAE,KAAoB;QAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChH,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzI,CAAC;IAED;;6CAEyC;IACzC,aAAa,CAAC,UAAsB,EAAE,MAAqB;QACzD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7K,CAAC;IAED;yCACqC;IACrC,gBAAgB,CAAC,IAAY;QAC3B,MAAM,GAAG,GAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,EAAwC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAC5I,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,QAAQ,CAAC,KAAK,GAAG,EAAE;QACjB,OAAQ,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAoC;aACrH,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAA4B,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAuB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1I,CAAC;IAED,cAAc;QACZ,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,EAAwC;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzJ,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yFAAyF,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/H,CAAC;IAED,6FAA6F;IAE7F,IAAI,CAAC,IAAY,EAAE,KAAa;QAC9B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sGAAsG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3I,CAAC;IACD,OAAO,CAAC,IAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAkC,CAAC;QACjH,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,iGAAiG;IAEjG,OAAO,CAAC,SAAiB;QACvB,OAAQ,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAA4B,IAAI,IAAI,CAAC;IAC3H,CAAC;IAED;iDAC6C;IAC7C,eAAe,CAAC,SAAiB,EAAE,YAA2B;QAC5D,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,GAAG,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;gBACpG,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,sVAAsV,CAAC;iBACpW,GAAG,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oFAAoF,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACnI,CAAC;IAED,sFAAsF;IACtF,iBAAiB,CAAC,SAAiB,EAAE,MAAc;QACjD,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,2GAA2G,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACpJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,GAAG,EAA6B,CAAC;IAC/H,CAAC;IAED;;;gEAG4D;IAC5D,cAAc,CAAC,SAAiB,EAAE,OAAe;QAC/C,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,qBAAqB,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAC;YACnF,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC;YACnH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sFAAsF;IACtF,cAAc,CAAC,SAAiB,EAAE,OAAe,EAAE,aAAsB;QACvE,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACjD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,uIAAuI,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;YACjN,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB,CAAC,SAAiB;QAChC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IAED,iGAAiG;IAEjG,UAAU,CAAC,IAAyB;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qIAAqI,CAAC;iBACnJ,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5H,+FAA+F;YAC/F,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,SAAS,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;YAClB,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAmC,CAAC;YAC3L,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACxH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAI,CAAwB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAA4B,EAAE,CAAC,CAAC,CAAC;QACpI,CAAC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["// The local observation outbox.\n//\n// One SQLite file (`observations.db`, beside the receipts) holds everything that must\n// survive a process exit, because the hook is a short-lived process per tool call:\n//\n//   state     the installation generation, the next sequence to allocate, the upload\n//             capability (active / unsupported / blocked) and a backoff deadline\n//   pending   signed observations not yet acknowledged, in sequence order\n//   terminal  observations the server refused permanently (or a stale generation made\n//             unsendable). They are kept, visible in `status`, and never retried.\n//   sessions  which harness sessions are active, and the heartbeat owner lease\n//   calls     the operation of each dispatched tool call, so the after-action hook can\n//             echo the same binding\n//\n// Sequence allocation and the pending row are written in ONE `BEGIN IMMEDIATE`\n// transaction, so a crash between the two cannot leave a gap or a reused number, and two\n// hook processes cannot allocate the same one. An observation id is unique, so a resend\n// of the same logical record returns the row that exists rather than allocating again.\n\nimport { createRequire } from \"node:module\";\nimport { mkdirSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { MAX_BATCH_BODY_BYTES, MAX_BATCH_ITEMS, observationHash, type ObservationDraft, type ObservationPayload, type SignedObservation, type EnvelopeContext, buildPayload, signObservation, type ObservationSigner } from \"./observation.js\";\n\ninterface SqliteStatement { run(...args: unknown[]): unknown; all(...args: unknown[]): unknown[]; get(...args: unknown[]): unknown }\ninterface SqliteDb { exec(sql: string): void; prepare(sql: string): SqliteStatement; close(): void }\n\nexport const OBSERVATION_DB = \"observations.db\";\n\n/** Bounds on the local queue. Past them new observations are counted as dropped (visible\n *  in `status`) rather than growing without limit; enforcement never depends on the queue. */\nexport const MAX_PENDING = 5_000;\nexport const MAX_PENDING_BYTES = 32 * 1024 * 1024;\nexport const MAX_TERMINAL = 1_000;\n/** How long a route found missing is left alone before one upload probes it again. */\n/** How long a batch stays reserved for the process that took it. */\nexport const INFLIGHT_MS = 30_000;\nexport const UNSUPPORTED_RECHECK_MS = 24 * 60 * 60 * 1000;\n\nexport type Capability = \"active\" | \"unsupported\" | \"blocked\";\n\nexport interface StoreState {\n  generation: number;\n  next_sequence: number;\n  capability: Capability;\n  reason: string | null;\n  capability_at: number | null;\n  backoff_until: number;\n  last_error: string | null;\n  last_upload_at: number | null;\n  dropped: number;\n  batch_limit: number;\n}\n\nexport interface PendingRow {\n  sequence: number;\n  generation: number;\n  observation_id: string;\n  observation_hash: string;\n  kind: string;\n  wrapper: SignedObservation;\n  bytes: number;\n  enqueued_at: number;\n  attempts: number;\n  next_attempt_at: number;\n}\n\nexport interface TerminalRow {\n  id: number;\n  generation: number;\n  sequence: number;\n  observation_id: string;\n  kind: string;\n  code: string;\n  at: number;\n  wrapper: SignedObservation | null;\n}\n\nexport interface SessionRow {\n  session_id: string;\n  state: \"active\" | \"stopped\";\n  started_at: number;\n  last_activity_at: number;\n  last_heartbeat_at: number;\n  heartbeat_lease_until: number;\n  repository_id: string | null;\n  stopped_reason: string | null;\n}\n\nexport interface CallRow {\n  call_key: string;\n  parent_action_id: string;\n  source_receipt_hash: string;\n  session_id: string | null;\n  operation: Record<string, unknown>;\n  at: number;\n}\n\nexport type EnqueueResult =\n  | { queued: true; duplicate: boolean; sequence: number; observation_id: string }\n  | { queued: false; reason: \"unsupported\" | \"blocked\" | \"capacity\" | \"oversize\" | \"generation_mismatch\"; detail?: string };\n\nfunction open(path: string): SqliteDb {\n  mkdirSync(dirname(path), { recursive: true });\n  const require = createRequire(import.meta.url);\n  const { DatabaseSync } = require(\"node:sqlite\") as { DatabaseSync: new (p: string) => SqliteDb };\n  const db = new DatabaseSync(path);\n  db.exec(\"PRAGMA busy_timeout = 5000; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;\");\n  return db;\n}\n\nexport class ObservationStore {\n  private readonly db: SqliteDb;\n\n  constructor(path: string, private readonly now: () => number = Date.now) {\n    this.db = open(path);\n    this.db.exec(`\n      CREATE TABLE IF NOT EXISTS state (\n        singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n        generation INTEGER NOT NULL, next_sequence INTEGER NOT NULL,\n        capability TEXT NOT NULL DEFAULT 'active', reason TEXT, capability_at INTEGER,\n        backoff_until INTEGER NOT NULL DEFAULT 0, last_error TEXT, last_upload_at INTEGER,\n        dropped INTEGER NOT NULL DEFAULT 0, batch_limit INTEGER NOT NULL DEFAULT ${MAX_BATCH_ITEMS}\n      );\n      CREATE TABLE IF NOT EXISTS pending (\n        generation INTEGER NOT NULL, sequence INTEGER NOT NULL,\n        observation_id TEXT NOT NULL UNIQUE, observation_hash TEXT NOT NULL, kind TEXT NOT NULL,\n        wrapper TEXT NOT NULL, bytes INTEGER NOT NULL, enqueued_at INTEGER NOT NULL,\n        attempts INTEGER NOT NULL DEFAULT 0, next_attempt_at INTEGER NOT NULL DEFAULT 0,\n        PRIMARY KEY (generation, sequence)\n      );\n      CREATE TABLE IF NOT EXISTS terminal (\n        id INTEGER PRIMARY KEY AUTOINCREMENT, generation INTEGER NOT NULL, sequence INTEGER NOT NULL,\n        observation_id TEXT NOT NULL, kind TEXT NOT NULL, code TEXT NOT NULL, at INTEGER NOT NULL, wrapper TEXT\n      );\n      CREATE TABLE IF NOT EXISTS sessions (\n        session_id TEXT PRIMARY KEY, state TEXT NOT NULL, started_at INTEGER NOT NULL,\n        last_activity_at INTEGER NOT NULL, last_heartbeat_at INTEGER NOT NULL DEFAULT 0,\n        heartbeat_lease_until INTEGER NOT NULL DEFAULT 0, repository_id TEXT, stopped_reason TEXT\n      );\n      CREATE TABLE IF NOT EXISTS calls (\n        call_key TEXT PRIMARY KEY, parent_action_id TEXT NOT NULL, source_receipt_hash TEXT NOT NULL,\n        session_id TEXT, operation TEXT NOT NULL, at INTEGER NOT NULL\n      );\n      CREATE TABLE IF NOT EXISTS marks (name TEXT PRIMARY KEY, value INTEGER NOT NULL);\n    `);\n  }\n\n  close(): void { try { this.db.close(); } catch { /* already closed */ } }\n\n  private tx<T>(work: () => T): T {\n    this.db.exec(\"BEGIN IMMEDIATE\");\n    try { const result = work(); this.db.exec(\"COMMIT\"); return result; }\n    catch (error) { try { this.db.exec(\"ROLLBACK\"); } catch { /* the original error matters */ } throw error; }\n  }\n\n  state(): StoreState | null {\n    return (this.db.prepare(\"SELECT generation, next_sequence, capability, reason, capability_at, backoff_until, last_error, last_upload_at, dropped, batch_limit FROM state WHERE singleton = 1\").get() as StoreState | undefined) ?? null;\n  }\n\n  /**\n   * Bind the outbox to the installation generation the workspace enrolled. A higher\n   * generation than the stored one means the key or credential was rotated: sequence\n   * restarts at 1, and everything still pending under the old generation moves to the\n   * terminal queue as `stale_generation` (kept locally, never uploaded). A generation\n   * lower than the stored one is a stale connection file and reported, not adopted.\n   */\n  bindGeneration(generation: number): { ok: true; retired: number } | { ok: false; reason: string } {\n    return this.tx(() => {\n      const state = this.state();\n      const at = this.now();\n      if (!state) {\n        this.db.prepare(\"INSERT INTO state (singleton, generation, next_sequence) VALUES (1, ?, 1)\").run(generation);\n        return { ok: true as const, retired: 0 };\n      }\n      if (generation < state.generation) return { ok: false as const, reason: `connection generation ${generation} is older than the local generation ${state.generation}` };\n      if (generation === state.generation) return { ok: true as const, retired: 0 };\n      const stale = this.db.prepare(\"SELECT generation, sequence, observation_id, kind, wrapper FROM pending WHERE generation < ?\").all(generation) as Array<{ generation: number; sequence: number; observation_id: string; kind: string; wrapper: string }>;\n      for (const row of stale) {\n        this.db.prepare(\"INSERT INTO terminal (generation, sequence, observation_id, kind, code, at, wrapper) VALUES (?, ?, ?, ?, 'stale_generation', ?, ?)\").run(row.generation, row.sequence, row.observation_id, row.kind, at, row.wrapper);\n      }\n      this.db.prepare(\"DELETE FROM pending WHERE generation < ?\").run(generation);\n      this.db.prepare(\"UPDATE state SET generation = ?, next_sequence = 1, capability = CASE WHEN capability = 'blocked' THEN 'active' ELSE capability END, reason = CASE WHEN capability = 'blocked' THEN NULL ELSE reason END, backoff_until = 0 WHERE singleton = 1\").run(generation);\n      this.trimTerminal();\n      return { ok: true as const, retired: stale.length };\n    });\n  }\n\n  /**\n   * Allocate the next sequence, build and sign the payload, and store it, atomically.\n   * `observationId` makes the call idempotent: an id already stored (pending or already\n   * sent) returns without consuming a sequence.\n   */\n  enqueue(draft: ObservationDraft, context: EnvelopeContext, signer: ObservationSigner): EnqueueResult {\n    return this.tx((): EnqueueResult => {\n      const state = this.state();\n      const at = this.now();\n      if (!state || state.generation !== context.generation) return { queued: false, reason: \"generation_mismatch\" };\n      if (draft.observationId) {\n        const existing = this.db.prepare(\"SELECT sequence FROM pending WHERE observation_id = ?\").get(draft.observationId) as { sequence: number } | undefined;\n        if (existing) return { queued: true, duplicate: true, sequence: existing.sequence, observation_id: draft.observationId };\n      }\n      if (state.capability === \"blocked\") return { queued: false, reason: \"blocked\", detail: state.reason ?? undefined };\n      if (state.capability === \"unsupported\") {\n        if ((state.capability_at ?? 0) + UNSUPPORTED_RECHECK_MS > at) return { queued: false, reason: \"unsupported\", detail: state.reason ?? undefined };\n        // One probe after the recheck interval: the server may have been upgraded.\n        this.db.prepare(\"UPDATE state SET capability = 'active', reason = NULL, capability_at = NULL, backoff_until = 0 WHERE singleton = 1\").run();\n      }\n      const totals = this.db.prepare(\"SELECT COUNT(*) AS n, COALESCE(SUM(bytes), 0) AS b FROM pending\").get() as { n: number; b: number };\n      const sequence = state.next_sequence;\n      let wrapper: SignedObservation;\n      try { wrapper = signObservation(buildPayload(draft, context, sequence), signer); }\n      catch (error) {\n        if (error instanceof RangeError) return { queued: false, reason: \"oversize\", detail: error.message };\n        throw error;\n      }\n      const json = JSON.stringify(wrapper);\n      const bytes = Buffer.byteLength(json, \"utf8\");\n      if (totals.n >= MAX_PENDING || totals.b + bytes > MAX_PENDING_BYTES) {\n        this.db.prepare(\"UPDATE state SET dropped = dropped + 1 WHERE singleton = 1\").run();\n        return { queued: false, reason: \"capacity\" };\n      }\n      this.db.prepare(\"INSERT INTO pending (generation, sequence, observation_id, observation_hash, kind, wrapper, bytes, enqueued_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)\")\n        .run(context.generation, sequence, wrapper.payload.observation_id, observationHash(wrapper.payload), wrapper.payload.kind, json, bytes, at);\n      this.db.prepare(\"UPDATE state SET next_sequence = ? WHERE singleton = 1\").run(sequence + 1);\n      return { queued: true, duplicate: false, sequence, observation_id: wrapper.payload.observation_id };\n    });\n  }\n\n  private rowToPending(row: Record<string, unknown>): PendingRow {\n    return { ...(row as unknown as PendingRow), wrapper: JSON.parse(String(row.wrapper)) as SignedObservation };\n  }\n\n  /** The next batch to send: current generation, in sequence order, due now, within the\n   *  item and body limits. With `lease`, the rows are marked in flight for INFLIGHT_MS in the\n   *  same transaction, so a second hook process uploading at the same moment skips them\n   *  instead of sending the same items again. The sender releases or defers them afterwards\n   *  (a crashed sender's lease simply lapses). */\n  nextBatch(limit?: number, lease = false): PendingRow[] {\n    return this.tx(() => {\n      const state = this.state();\n      if (!state || state.capability !== \"active\") return [];\n      const at = this.now();\n      if (state.backoff_until > at) return [];\n      const rows = this.db.prepare(\"SELECT * FROM pending WHERE generation = ? AND next_attempt_at <= ? ORDER BY sequence LIMIT ?\")\n        .all(state.generation, at, Math.max(1, Math.min(limit ?? state.batch_limit, state.batch_limit, MAX_BATCH_ITEMS))) as Array<Record<string, unknown>>;\n      const out: PendingRow[] = [];\n      let body = 64;\n      for (const row of rows) {\n        const bytes = Number(row.bytes) + 1;\n        if (out.length > 0 && body + bytes > MAX_BATCH_BODY_BYTES) break;\n        body += bytes;\n        out.push(this.rowToPending(row));\n      }\n      if (lease) for (const row of out) this.db.prepare(\"UPDATE pending SET next_attempt_at = ? WHERE observation_id = ?\").run(at + INFLIGHT_MS, row.observation_id);\n      return out;\n    });\n  }\n\n  /** Give leased rows back without counting an attempt (the send did not happen). */\n  release(observationIds: string[]): void {\n    this.tx(() => { for (const id of observationIds) this.db.prepare(\"UPDATE pending SET next_attempt_at = 0 WHERE observation_id = ?\").run(id); });\n  }\n\n  pendingSummary(): { count: number; oldest_at: number | null } {\n    const row = this.db.prepare(\"SELECT COUNT(*) AS n, MIN(enqueued_at) AS o FROM pending\").get() as { n: number; o: number | null };\n    return { count: row.n, oldest_at: row.o };\n  }\n\n  /** Remove acknowledged items (accepted, duplicate, pending_link) — and only those. */\n  acknowledge(observationIds: string[]): void {\n    this.tx(() => { for (const id of observationIds) this.db.prepare(\"DELETE FROM pending WHERE observation_id = ?\").run(id); });\n    this.mark(\"last_ack\", this.now());\n    this.db.prepare(\"UPDATE state SET last_upload_at = ?, last_error = NULL WHERE singleton = 1\").run(this.now());\n  }\n\n  /** Move permanently refused items to the visible terminal queue. */\n  reject(items: Array<{ observation_id: string; code: string }>): void {\n    this.tx(() => {\n      const at = this.now();\n      for (const item of items) {\n        const row = this.db.prepare(\"SELECT generation, sequence, kind, wrapper FROM pending WHERE observation_id = ?\").get(item.observation_id) as { generation: number; sequence: number; kind: string; wrapper: string } | undefined;\n        if (!row) continue;\n        this.db.prepare(\"INSERT INTO terminal (generation, sequence, observation_id, kind, code, at, wrapper) VALUES (?, ?, ?, ?, ?, ?, ?)\").run(row.generation, row.sequence, item.observation_id, row.kind, item.code, at, row.wrapper);\n        this.db.prepare(\"DELETE FROM pending WHERE observation_id = ?\").run(item.observation_id);\n      }\n      this.trimTerminal();\n    });\n  }\n\n  /** Keep items pending but retry them later (server said deferred, or the send failed). */\n  defer(observationIds: string[], delayMs: number): void {\n    const at = this.now() + Math.max(0, delayMs);\n    this.tx(() => { for (const id of observationIds) this.db.prepare(\"UPDATE pending SET attempts = attempts + 1, next_attempt_at = ? WHERE observation_id = ?\").run(at, id); });\n  }\n\n  setBackoff(untilMs: number, error: string | null): void {\n    this.db.prepare(\"UPDATE state SET backoff_until = ?, last_error = ? WHERE singleton = 1\").run(untilMs, error);\n  }\n\n  setBatchLimit(limit: number): void {\n    this.db.prepare(\"UPDATE state SET batch_limit = ? WHERE singleton = 1\").run(Math.max(1, Math.min(MAX_BATCH_ITEMS, Math.trunc(limit))));\n  }\n\n  /** Mark the capability unsupported (route missing, batch version refused) or blocked\n   *  (stale generation). New observations are then not queued; local enforcement is\n   *  untouched. Pending items are kept. */\n  setCapability(capability: Capability, reason: string | null): void {\n    this.db.prepare(\"UPDATE state SET capability = ?, reason = ?, capability_at = ? WHERE singleton = 1\").run(capability, reason, capability === \"active\" ? null : this.now());\n  }\n\n  /** Move everything pending to the terminal queue with `code` (a stale generation makes\n   *  the whole backlog unsendable). */\n  rejectAllPending(code: string): number {\n    const ids = (this.db.prepare(\"SELECT observation_id FROM pending\").all() as Array<{ observation_id: string }>).map((r) => r.observation_id);\n    this.reject(ids.map((observation_id) => ({ observation_id, code })));\n    return ids.length;\n  }\n\n  terminal(limit = 50): TerminalRow[] {\n    return (this.db.prepare(\"SELECT * FROM terminal ORDER BY id DESC LIMIT ?\").all(limit) as Array<Record<string, unknown>>)\n      .map((r) => ({ ...(r as unknown as TerminalRow), wrapper: r.wrapper ? (JSON.parse(String(r.wrapper)) as SignedObservation) : null }));\n  }\n\n  terminalCounts(): Record<string, number> {\n    const out: Record<string, number> = {};\n    for (const r of this.db.prepare(\"SELECT code, COUNT(*) AS n FROM terminal GROUP BY code\").all() as Array<{ code: string; n: number }>) out[r.code] = r.n;\n    return out;\n  }\n\n  private trimTerminal(): void {\n    this.db.prepare(\"DELETE FROM terminal WHERE id NOT IN (SELECT id FROM terminal ORDER BY id DESC LIMIT ?)\").run(MAX_TERMINAL);\n  }\n\n  // ---- marks (small named integers, e.g. when queue telemetry last ran) --------------------\n\n  mark(name: string, value: number): void {\n    this.db.prepare(\"INSERT INTO marks (name, value) VALUES (?, ?) ON CONFLICT(name) DO UPDATE SET value = excluded.value\").run(name, value);\n  }\n  getMark(name: string): number | null {\n    const row = this.db.prepare(\"SELECT value FROM marks WHERE name = ?\").get(name) as { value: number } | undefined;\n    return row ? row.value : null;\n  }\n\n  // ---- sessions and the heartbeat lease --------------------------------------------------------\n\n  session(sessionId: string): SessionRow | null {\n    return (this.db.prepare(\"SELECT * FROM sessions WHERE session_id = ?\").get(sessionId) as SessionRow | undefined) ?? null;\n  }\n\n  /** Begin (or resume) a session. Returns true when the session was not active before,\n   *  so the caller emits exactly one start. */\n  activateSession(sessionId: string, repositoryId: string | null): boolean {\n    return this.tx(() => {\n      const at = this.now();\n      const row = this.session(sessionId);\n      if (row?.state === \"active\") {\n        this.db.prepare(\"UPDATE sessions SET last_activity_at = ? WHERE session_id = ?\").run(at, sessionId);\n        return false;\n      }\n      this.db.prepare(\"INSERT INTO sessions (session_id, state, started_at, last_activity_at, repository_id) VALUES (?, 'active', ?, ?, ?) ON CONFLICT(session_id) DO UPDATE SET state = 'active', stopped_reason = NULL, started_at = excluded.started_at, last_activity_at = excluded.last_activity_at, heartbeat_lease_until = 0, repository_id = excluded.repository_id\")\n        .run(sessionId, at, at, repositoryId);\n      return true;\n    });\n  }\n\n  touchSession(sessionId: string): void {\n    this.db.prepare(\"UPDATE sessions SET last_activity_at = ? WHERE session_id = ? AND state = 'active'\").run(this.now(), sessionId);\n  }\n\n  /** End a session. Returns true when it was active, so exactly one stop is emitted. */\n  deactivateSession(sessionId: string, reason: string): boolean {\n    return this.tx(() => {\n      const row = this.session(sessionId);\n      if (!row || row.state !== \"active\") return false;\n      this.db.prepare(\"UPDATE sessions SET state = 'stopped', stopped_reason = ?, heartbeat_lease_until = 0 WHERE session_id = ?\").run(reason, sessionId);\n      return true;\n    });\n  }\n\n  activeSessions(): SessionRow[] {\n    return this.db.prepare(\"SELECT * FROM sessions WHERE state = 'active' ORDER BY started_at\").all() as unknown as SessionRow[];\n  }\n\n  /** Claim the single heartbeat loop for a session, or refuse when another live loop\n   *  already holds it. The lease is short and renewed each tick, so a crashed loop frees\n   *  the claim within `leaseMs`. This is what keeps the number of helper processes at one\n   *  per active session no matter how many hook calls run. */\n  claimHeartbeat(sessionId: string, leaseMs: number): boolean {\n    return this.tx(() => {\n      const row = this.session(sessionId);\n      const at = this.now();\n      if (!row || row.state !== \"active\" || row.heartbeat_lease_until > at) return false;\n      this.db.prepare(\"UPDATE sessions SET heartbeat_lease_until = ? WHERE session_id = ?\").run(at + leaseMs, sessionId);\n      return true;\n    });\n  }\n\n  /** Renew the loop's own claim; false when the session ended or the claim was lost. */\n  renewHeartbeat(sessionId: string, leaseMs: number, sentHeartbeat: boolean): boolean {\n    return this.tx(() => {\n      const row = this.session(sessionId);\n      if (!row || row.state !== \"active\") return false;\n      const at = this.now();\n      this.db.prepare(\"UPDATE sessions SET heartbeat_lease_until = ?, last_heartbeat_at = CASE WHEN ? THEN ? ELSE last_heartbeat_at END WHERE session_id = ?\").run(at + leaseMs, sentHeartbeat ? 1 : 0, at, sessionId);\n      return true;\n    });\n  }\n\n  releaseHeartbeat(sessionId: string): void {\n    this.db.prepare(\"UPDATE sessions SET heartbeat_lease_until = 0 WHERE session_id = ?\").run(sessionId);\n  }\n\n  // ---- dispatched-call records -----------------------------------------------------------------\n\n  recordCall(call: Omit<CallRow, \"at\">): void {\n    const at = this.now();\n    this.tx(() => {\n      this.db.prepare(\"INSERT OR REPLACE INTO calls (call_key, parent_action_id, source_receipt_hash, session_id, operation, at) VALUES (?, ?, ?, ?, ?, ?)\")\n        .run(call.call_key, call.parent_action_id, call.source_receipt_hash, call.session_id, JSON.stringify(call.operation), at);\n      // Calls whose outcome never arrived (a denied action, a crashed tool) are dropped after a day.\n      this.db.prepare(\"DELETE FROM calls WHERE at < ?\").run(at - 24 * 60 * 60 * 1000);\n    });\n  }\n\n  /** The calls recorded under a harness call id, consumed by the after-action hook. */\n  takeCalls(callPrefix: string): CallRow[] {\n    return this.tx(() => {\n      const rows = this.db.prepare(\"SELECT * FROM calls WHERE call_key LIKE ? ESCAPE '\\\\' ORDER BY call_key\").all(`${callPrefix.replace(/[\\\\%_]/g, \"\\\\$&\")}%`) as Array<Record<string, unknown>>;\n      this.db.prepare(\"DELETE FROM calls WHERE call_key LIKE ? ESCAPE '\\\\'\").run(`${callPrefix.replace(/[\\\\%_]/g, \"\\\\$&\")}%`);\n      return rows.map((r) => ({ ...(r as unknown as CallRow), operation: JSON.parse(String(r.operation)) as Record<string, unknown> }));\n    });\n  }\n}\n\n/** Convenience for callers that only have a payload. */\nexport type { ObservationPayload };\n"]}

package/dist/obs-upload.d.ts

@@ -0,0 +1,24 @@
+import type { ObservationStore } from "./obs-store.js";
+export declare const OBSERVATIONS_PATH = "/v1/observations";
+export declare const BATCH_VERSION = "1.0";
+export interface UploadOutcome {
+    /** What happened, for `status` and tests. */
+    result: "empty" | "paused" | "sent" | "unsupported" | "blocked" | "backoff" | "error";
+    acknowledged: number;
+    deferred: number;
+    rejected: number;
+    detail?: string;
+}
+export interface UploadOptions {
+    url: string;
+    credential: string;
+    fetch?: typeof fetch;
+    now?: () => number;
+    timeoutMs?: number;
+    /** Send at most this many batches in one call. */
+    maxBatches?: number;
+}
+/** Parse Retry-After: delta-seconds or an HTTP date. Bounded; undefined when unusable. */
+export declare function parseRetryAfter(header: string | null, now: number): number | undefined;
+export declare function uploadPending(store: ObservationStore, options: UploadOptions): Promise<UploadOutcome>;
+//# sourceMappingURL=obs-upload.d.ts.map