@vendoai/store 0.1.0 → 0.4.1

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAGlC;;;;;;;;;;4CAU4C;AAC5C,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,kBAAkB;AAClB,eAAO,MAAM,GAAG,wqHAqEN,CAAC;AAgIX,kBAAkB;AAClB,wBAAsB,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD"}

package/dist/schema.js

@@ -1,114 +1,206 @@
-import { pgSchema, text, integer, boolean, jsonb, timestamp, primaryKey, uniqueIndex, index, bigserial } from "drizzle-orm/pg-core";
-export const vendo = pgSchema("vendo");
-export const automations = vendo.table("automations", {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    name: text("name").notNull(),
-    status: text("status").notNull(),
-    disabledReason: text("disabled_reason"),
-    spec: jsonb("spec").notNull(),
-    currentVersion: integer("current_version").notNull(),
-    triggerKind: text("trigger_kind").notNull(),
-    triggerKey: text("trigger_key"),
-    counters: jsonb("counters").notNull(),
-    createdFromThreadId: text("created_from_thread_id"),
-    createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).notNull(),
-    updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [index("automations_scope_idx").on(t.tenantId, t.subject), index("automations_trigger_idx").on(t.triggerKind, t.triggerKey)]);
-export const automationVersions = vendo.table("automation_versions", {
-    automationId: text("automation_id").notNull(),
-    version: integer("version").notNull(),
-    spec: jsonb("spec").notNull(),
-    dslVersion: integer("dsl_version").notNull(),
-    manifestHash: text("manifest_hash"),
-    grants: jsonb("grants").notNull(),
-    createdBy: text("created_by").notNull(),
-    createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [primaryKey({ columns: [t.automationId, t.version] })]);
-export const automationRuns = vendo.table("automation_runs", {
-    id: text("id").primaryKey(), // firingRunId — DB-level double-fire dedup
-    automationId: text("automation_id").notNull(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    version: integer("version").notNull(),
-    manifestHash: text("manifest_hash"),
-    status: text("status").notNull(),
-    outcome: text("outcome"),
-    trigger: jsonb("trigger").notNull(),
-    steps: jsonb("steps").notNull(),
-    pendingApproval: jsonb("pending_approval"),
-    error: text("error"),
-    isTest: boolean("is_test").notNull(),
-    /** ENG-193 §4.6 — cumulative count of parked actions this run created. */
-    parkedCount: integer("parked_count").notNull().default(0),
-    startedAt: timestamp("started_at", { withTimezone: true, mode: "string" }).notNull(),
-    finishedAt: timestamp("finished_at", { withTimezone: true, mode: "string" }),
-}, (t) => [index("runs_automation_idx").on(t.automationId, t.tenantId, t.subject)]);
-/** ENG-193 §4.6 — parked automation drafts: an action a for_each iteration or
- *  agent step couldn't run unattended, resolved standalone later. Indexed
- *  columns cover the list filters; the full ParkedAction payload (frozen
- *  input, guard bindings, tier, hashes, resolution detail) lives in `record`
- *  jsonb, mirrored the way `saved_vendos.record` already is. */
-export const parkedActions = vendo.table("parked_actions", {
-    id: text("id").primaryKey(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    automationId: text("automation_id").notNull(),
-    runId: text("run_id").notNull(),
-    resolution: text("resolution"),
-    requestedAt: timestamp("requested_at", { withTimezone: true, mode: "string" }).notNull(),
-    record: jsonb("record").notNull(),
-}, (t) => [index("parked_actions_scope_idx").on(t.tenantId, t.subject, t.automationId, t.runId)]);
-export const decisions = vendo.table("decisions", {
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    canonicalKey: text("canonical_key").notNull(),
-    decision: jsonb("decision").notNull(),
-    createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [primaryKey({ columns: [t.tenantId, t.subject, t.canonicalKey] })]);
-export const threads = vendo.table("threads", {
-    id: text("id").notNull(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    title: text("title"),
-    nextSeq: integer("next_seq").notNull().default(0),
-    createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).notNull(),
-    updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [primaryKey({ columns: [t.tenantId, t.subject, t.id] })]);
-export const threadMessages = vendo.table("thread_messages", {
-    rowId: bigserial("row_id", { mode: "number" }).primaryKey(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    threadId: text("thread_id").notNull(),
-    messageId: text("message_id").notNull(),
-    seq: integer("seq").notNull(),
-    message: jsonb("message").notNull(),
-}, (t) => [
-    uniqueIndex("thread_messages_id_uq").on(t.tenantId, t.subject, t.threadId, t.messageId),
-    uniqueIndex("thread_messages_seq_uq").on(t.tenantId, t.subject, t.threadId, t.seq),
-]);
-export const savedVendos = vendo.table("saved_vendos", {
-    id: text("id").notNull(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    record: jsonb("record").notNull(),
-    updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [primaryKey({ columns: [t.tenantId, t.subject, t.id] })]);
-export const connections = vendo.table("connections", {
-    toolkit: text("toolkit").notNull(),
-    tenantId: text("tenant_id").notNull(),
-    subject: text("subject").notNull(),
-    connectedAccountId: text("connected_account_id"),
-    status: text("status").notNull(),
-    createdAt: timestamp("created_at", { withTimezone: true, mode: "string" }).notNull(),
-}, (t) => [
-    primaryKey({ columns: [t.tenantId, t.subject, t.toolkit] }),
-    index("connections_account_idx").on(t.connectedAccountId),
-]);
-/** Tiny operational KV (scheduler heartbeat, future flags). NOT for domain data. */
-export const meta = vendo.table("meta", {
-    key: text("key").primaryKey(),
-    value: jsonb("value").notNull(),
-    updatedAt: timestamp("updated_at", { withTimezone: true, mode: "string" }).notNull(),
-});
+import { VendoError } from "@vendoai/core";
+import { randomUUID } from "node:crypto";
+import { withSchemaLock } from "./db.js";
+/** 02-store §4. v3 (block-actions design §C, ENG-263) historically added the
+    Vendo-owned org tables (`vendo_orgs` + `vendo_org_members`); those tables
+    are cut under the simplify-v2 kill-list (docs/superpowers/specs/2026-07-16
+    -simplify-v2-kill-list-design.md §A5) — orgs live on the Vendo-hosted side
+    now. Existing dev databases that already have `vendo_orgs`/
+    `vendo_org_members` keep those orphaned tables — erasing them is not
+    required and this migration does not attempt it.
+
+    v4 (kill-list §B3) adds `vendo_sessions`: the ephemeral in-memory overlay is
+    gone, anonymous rows are ordinary disk rows, and this table is the session
+    registry the TTL sweep reads (02 §4). */
+export const SCHEMA_VERSION = 4;
+/** 02-store §2 */
+export const DDL = [
+    `CREATE TABLE IF NOT EXISTS vendo_apps (
+    id text PRIMARY KEY, subject text NOT NULL, enabled boolean NOT NULL DEFAULT true,
+    doc jsonb NOT NULL, created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_apps_subject_idx ON vendo_apps (subject)",
+    `CREATE TABLE IF NOT EXISTS vendo_records (
+    collection text NOT NULL, id text NOT NULL, data jsonb NOT NULL, refs jsonb,
+    created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL,
+    revision bigint NOT NULL DEFAULT 1,
+    PRIMARY KEY (collection, id)
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_records_refs_idx ON vendo_records USING GIN (refs jsonb_path_ops)",
+    `CREATE TABLE IF NOT EXISTS vendo_blobs (
+    namespace text NOT NULL, key text NOT NULL, bytes bytea NOT NULL, content_type text,
+    created_at timestamptz NOT NULL, PRIMARY KEY (namespace, key)
+  )`,
+    `CREATE TABLE IF NOT EXISTS vendo_state (
+    app_id text NOT NULL, subject text NOT NULL, data jsonb NOT NULL,
+    updated_at timestamptz NOT NULL, PRIMARY KEY (app_id, subject)
+  )`,
+    `CREATE TABLE IF NOT EXISTS vendo_threads (
+    id text PRIMARY KEY, subject text NOT NULL, messages jsonb NOT NULL,
+    created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_threads_subject_idx ON vendo_threads (subject)",
+    `CREATE TABLE IF NOT EXISTS vendo_grants (
+    id text PRIMARY KEY, subject text NOT NULL, tool text NOT NULL, descriptor_hash text NOT NULL,
+    scope jsonb NOT NULL, duration text NOT NULL, context_key text, app_id text, source text NOT NULL,
+    granted_at timestamptz NOT NULL, expires_at timestamptz, revoked_at timestamptz
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_grants_subject_tool_idx ON vendo_grants (subject, tool)",
+    `CREATE TABLE IF NOT EXISTS vendo_approvals (
+    id text PRIMARY KEY, subject text NOT NULL, request jsonb NOT NULL,
+    status text NOT NULL DEFAULT 'pending', decided_at timestamptz, session_id text,
+    consumed_at timestamptz, created_at timestamptz NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_approvals_subject_status_idx ON vendo_approvals (subject, status)",
+    `CREATE TABLE IF NOT EXISTS vendo_audit (
+    id text PRIMARY KEY, at timestamptz NOT NULL, kind text NOT NULL, subject text NOT NULL,
+    venue text NOT NULL, presence text NOT NULL, app_id text, tool text, event jsonb NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_audit_subject_at_idx ON vendo_audit (subject, at)",
+    "CREATE INDEX IF NOT EXISTS vendo_audit_at_idx ON vendo_audit (at)",
+    `CREATE TABLE IF NOT EXISTS vendo_runs (
+    id text PRIMARY KEY, app_id text NOT NULL, trigger jsonb NOT NULL, status text NOT NULL,
+    record jsonb NOT NULL, started_at timestamptz NOT NULL, finished_at timestamptz
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_runs_app_started_idx ON vendo_runs (app_id, started_at)",
+    `CREATE TABLE IF NOT EXISTS vendo_secrets (
+    name text PRIMARY KEY, ciphertext text NOT NULL, created_at timestamptz NOT NULL,
+    updated_at timestamptz
+  )`,
+    `CREATE TABLE IF NOT EXISTS vendo_mcp_clients (
+    id text PRIMARY KEY, data jsonb NOT NULL, refs jsonb,
+    created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_mcp_clients_refs_idx ON vendo_mcp_clients USING GIN (refs jsonb_path_ops)",
+    `CREATE TABLE IF NOT EXISTS vendo_mcp_grants (
+    id text PRIMARY KEY, data jsonb NOT NULL, refs jsonb,
+    created_at timestamptz NOT NULL, updated_at timestamptz NOT NULL
+  )`,
+    "CREATE INDEX IF NOT EXISTS vendo_mcp_grants_refs_idx ON vendo_mcp_grants USING GIN (refs jsonb_path_ops)",
+    // 02-store §4 (kill-list B3): the ephemeral-session registry. One row per
+    // live anonymous session; touched_at is the last-activity stamp the TTL
+    // sweep compares against. Registration == touch (upsert).
+    `CREATE TABLE IF NOT EXISTS vendo_sessions (
+    subject text PRIMARY KEY, touched_at timestamptz NOT NULL
+  )`,
+];
+// Additive columns stay compatible with same-version development databases (02 §2
+// allows additive columns within the version train; key columns are untouched).
+// vendo_state gains a stable record id (generated from the app_id:subject PK, so
+// point lookups hit an index instead of seq-scanning) and its own created_at, so
+// the seam can expose a creation timestamp that survives updates.
+const ADDITIVE_DDL = [
+    "ALTER TABLE vendo_records ADD COLUMN IF NOT EXISTS revision bigint NOT NULL DEFAULT 1",
+    "ALTER TABLE vendo_approvals ADD COLUMN IF NOT EXISTS session_id text",
+    "ALTER TABLE vendo_approvals ADD COLUMN IF NOT EXISTS consumed_at timestamptz",
+    "ALTER TABLE vendo_state ADD COLUMN IF NOT EXISTS id text GENERATED ALWAYS AS (app_id || ':' || subject) STORED",
+    // created_at is the pagination cursor column, so it must never be NULL. DEFAULT now()
+    // fills the column for any direct INSERT that omits it (the table map is public); our
+    // own write paths always populate it explicitly.
+    "ALTER TABLE vendo_state ADD COLUMN IF NOT EXISTS created_at timestamptz DEFAULT now()",
+    // ADD COLUMN IF NOT EXISTS SKIPS when the column already exists, so databases that
+    // booted before the DEFAULT was introduced would keep a default-less column forever.
+    // SET DEFAULT is idempotent, so it runs every boot like the rest of this block.
+    "ALTER TABLE vendo_state ALTER COLUMN created_at SET DEFAULT now()",
+    "CREATE INDEX IF NOT EXISTS vendo_state_id_idx ON vendo_state (id)",
+    // Keyset pagination lists order by (created_at, id) DESC — compared at millisecond
+    // precision via date_trunc (helpers/utils.ts cursorMs; cursors round-trip through JS
+    // Dates) — with a matching `<` tuple predicate (records.ts / routing.ts). These btree
+    // indexes serve the equality/filter legs (the truncated sort itself is a top-N over the
+    // filtered set); a dropped index here is exactly the order-of-magnitude regression the
+    // perf gate exists to catch.
+    "CREATE INDEX IF NOT EXISTS vendo_records_collection_created_idx ON vendo_records (collection, created_at DESC, id DESC)",
+    "CREATE INDEX IF NOT EXISTS vendo_mcp_clients_created_idx ON vendo_mcp_clients (created_at DESC, id DESC)",
+    "CREATE INDEX IF NOT EXISTS vendo_mcp_grants_created_idx ON vendo_mcp_grants (created_at DESC, id DESC)",
+    // The automations tick and vendo.emit fetch apps by trigger kind (schedule / host-event).
+    // A STORED generated column projects doc->trigger->on->kind into an indexable value so
+    // those paths query only the matching apps instead of scanning every app for every subject.
+    // ADD COLUMN ... GENERATED ALWAYS AS ... STORED backfills existing rows on ALTER, so no
+    // separate data migration is needed (mirrors the vendo_state.id generated column above).
+    "ALTER TABLE vendo_apps ADD COLUMN IF NOT EXISTS trigger_kind text GENERATED ALWAYS AS (doc->'trigger'->'on'->>'kind') STORED",
+    "CREATE INDEX IF NOT EXISTS vendo_apps_subject_trigger_idx ON vendo_apps (subject, trigger_kind)",
+    // Thread listing derives a title without loading the full messages array (routing.ts uses a
+    // messages-less listSelect once a row has a stored title). NULLable; populated on next write.
+    "ALTER TABLE vendo_threads ADD COLUMN IF NOT EXISTS title text",
+    // ENG-310: revision counter backing the routed vendo_threads atomic capability
+    // (01 §12 — insertIfAbsent / compareAndSwap), so concurrent turns on one thread
+    // can do guarded read-merge-write instead of last-write-wins. DEFAULT backfills
+    // existing rows on ALTER; every write path bumps it.
+    "ALTER TABLE vendo_threads ADD COLUMN IF NOT EXISTS revision bigint NOT NULL DEFAULT 1",
+    // Wave 7: the same counter for vendo_apps, so the machine lifecycle and the
+    // schedule engine's fire claims (updateAppRow's read-mutate-CAS) stop
+    // degrading to read-then-put on the dev store — a multi-process dev host
+    // could double-fire a schedule or clobber a concurrent lifecycle write.
+    "ALTER TABLE vendo_apps ADD COLUMN IF NOT EXISTS revision bigint NOT NULL DEFAULT 1",
+    // Tracks the secret's last rewrite (rotation) separately from created_at;
+    // set() stamps it. NULL on legacy rows means created_at IS the last write.
+    "ALTER TABLE vendo_secrets ADD COLUMN IF NOT EXISTS updated_at timestamptz",
+    // The TTL sweep's stale scan and the host-driven claim both predicate on
+    // touched_at (sessions.ts); without this a busy anonymous host seq-scans
+    // the registry on every sweep interval.
+    "CREATE INDEX IF NOT EXISTS vendo_sessions_touched_idx ON vendo_sessions (touched_at)",
+];
+// v2 backfill (runs once, only when upgrading from a version < 2 — 02 §4 keys
+// migrations by vendo_meta.schema_version, forward-only). Three moves:
+//   1. Relocate legacy vendo_state singletons that a pre-fix deployment wrote into
+//      vendo_records (collection 'vendo_state', id `${app_id}:${subject}`) into the
+//      dedicated table. App ids are colon-free and non-empty (`^app_[^:]+$`), so the
+//      FIRST colon splits id into app_id + subject unambiguously; the
+//      `id ~ '^app_[^:]+:.'` predicate relocates only rows whose leading segment is a
+//      real app id AND whose subject is non-empty — the SAME shape the state door
+//      (splitStateId) enforces. Anything else (colon-less rows, ids whose first
+//      segment is not app-shaped, or empty-subject ids like 'app_x:') SURVIVES in
+//      vendo_records rather than being silently destroyed or misrouted.
+//   2. The DELETE is scoped to the identical predicate as the INSERT — only the rows
+//      actually relocated are removed.
+//   3. Both write doors were live pre-fix (stateStore wrote the dedicated table, the
+//      seam wrote vendo_records), so a legacy row can be NEWER than an existing
+//      dedicated row. Resolve by timestamp (`WHERE vendo_state.updated_at <
+//      EXCLUDED.updated_at`) so the newer write wins instead of DO NOTHING dropping it.
+//   4. Relocated rows set created_at = updated_at on insert (the column now DEFAULTs to
+//      now(), so it must be given the legacy timestamp explicitly); the trailing UPDATE
+//      still backfills created_at for any pre-existing row that predates the column.
+const DATA_BACKFILL = [
+    `INSERT INTO vendo_state (app_id, subject, data, updated_at, created_at)
+   SELECT split_part(id, ':', 1), substring(id FROM position(':' IN id) + 1), data, updated_at, updated_at
+   FROM vendo_records WHERE collection = 'vendo_state' AND id ~ '^app_[^:]+:.'
+   ON CONFLICT (app_id, subject) DO UPDATE SET data = EXCLUDED.data, updated_at = EXCLUDED.updated_at
+     WHERE vendo_state.updated_at < EXCLUDED.updated_at`,
+    "DELETE FROM vendo_records WHERE collection = 'vendo_state' AND id ~ '^app_[^:]+:.'",
+    "UPDATE vendo_state SET created_at = updated_at WHERE created_at IS NULL",
+];
+async function migrate(query) {
+    await query("CREATE TABLE IF NOT EXISTS vendo_meta (key text PRIMARY KEY, value jsonb NOT NULL)");
+    const result = await query("SELECT value FROM vendo_meta WHERE key = 'schema_version'");
+    const value = result.rows[0]?.["value"];
+    const version = typeof value === "number" ? value : undefined;
+    if (version !== undefined && version > SCHEMA_VERSION) {
+        throw new VendoError("conflict", `Store schema version ${version} is newer than supported version ${SCHEMA_VERSION}`);
+    }
+    const upgrading = version === undefined || version < SCHEMA_VERSION;
+    if (upgrading) {
+        for (const statement of DDL)
+            await query(statement);
+        await query(`INSERT INTO vendo_meta (key, value) VALUES ('schema_version', $1::jsonb)
+       ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value`, [JSON.stringify(SCHEMA_VERSION)]);
+    }
+    // Additive columns are safe to re-apply every run (IF NOT EXISTS); they keep
+    // same-version development databases compatible without a version bump.
+    for (const statement of ADDITIVE_DDL)
+        await query(statement);
+    // The v2 backfill is destructive-adjacent (it DELETEs from vendo_records), so it
+    // runs ONLY while upgrading past ITS version (< 2) — never unconditionally, or a
+    // newer vendo_records write in a mixed-version deploy would be repeatedly
+    // relocated/lost, and never on later bumps (v2→v3 adds tables only).
+    if (version === undefined || version < 2) {
+        for (const statement of DATA_BACKFILL)
+            await query(statement);
+    }
+    await query(`INSERT INTO vendo_meta (key, value) VALUES ('boot_id', $1::jsonb)
+     ON CONFLICT (key) DO NOTHING`, [JSON.stringify(randomUUID())]);
+}
+/** 02-store §4 */
+export async function ensureSchema(db) {
+    await withSchemaLock(db, migrate);
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;;;4CAU4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,kBAAkB;AAClB,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB;;;IAGE;IACF,2EAA2E;IAC3E;;;;;IAKE;IACF,oGAAoG;IACpG;;;IAGE;IACF;;;IAGE;IACF;;;IAGE;IACF,iFAAiF;IACjF;;;;IAIE;IACF,0FAA0F;IAC1F;;;;IAIE;IACF,oGAAoG;IACpG;;;IAGE;IACF,oFAAoF;IACpF,mEAAmE;IACnE;;;IAGE;IACF,0FAA0F;IAC1F;;;IAGE;IACF;;;IAGE;IACF,4GAA4G;IAC5G;;;IAGE;IACF,0GAA0G;IAC1G,0EAA0E;IAC1E,wEAAwE;IACxE,0DAA0D;IAC1D;;IAEE;CACM,CAAC;AAEX,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,kEAAkE;AAClE,MAAM,YAAY,GAAG;IACnB,uFAAuF;IACvF,sEAAsE;IACtE,8EAA8E;IAC9E,gHAAgH;IAChH,sFAAsF;IACtF,sFAAsF;IACtF,iDAAiD;IACjD,uFAAuF;IACvF,mFAAmF;IACnF,qFAAqF;IACrF,gFAAgF;IAChF,mEAAmE;IACnE,mEAAmE;IACnE,mFAAmF;IACnF,qFAAqF;IACrF,sFAAsF;IACtF,wFAAwF;IACxF,uFAAuF;IACvF,6BAA6B;IAC7B,yHAAyH;IACzH,0GAA0G;IAC1G,wGAAwG;IACxG,0FAA0F;IAC1F,uFAAuF;IACvF,4FAA4F;IAC5F,wFAAwF;IACxF,yFAAyF;IACzF,8HAA8H;IAC9H,iGAAiG;IACjG,4FAA4F;IAC5F,8FAA8F;IAC9F,+DAA+D;IAC/D,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,qDAAqD;IACrD,uFAAuF;IACvF,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,oFAAoF;IACpF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,wCAAwC;IACxC,sFAAsF;CAC9E,CAAC;AAEX,8EAA8E;AAC9E,uEAAuE;AACvE,mFAAmF;AACnF,oFAAoF;AACpF,qFAAqF;AACrF,sEAAsE;AACtE,sFAAsF;AACtF,kFAAkF;AAClF,gFAAgF;AAChF,kFAAkF;AAClF,wEAAwE;AACxE,qFAAqF;AACrF,uCAAuC;AACvC,qFAAqF;AACrF,gFAAgF;AAChF,4EAA4E;AAC5E,wFAAwF;AACxF,wFAAwF;AACxF,wFAAwF;AACxF,qFAAqF;AACrF,MAAM,aAAa,GAAG;IACpB;;;;wDAIsD;IACtD,oFAAoF;IACpF,yEAAyE;CACjE,CAAC;AAIX,KAAK,UAAU,OAAO,CAAC,KAAY;IACjC,MAAM,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,UAAU,CAClB,UAAU,EACV,wBAAwB,OAAO,oCAAoC,cAAc,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,cAAc,CAAC;IACpE,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,SAAS,IAAI,GAAG;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,KAAK,CACT;8DACwD,EACxD,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CACjC,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,wEAAwE;IACxE,KAAK,MAAM,SAAS,IAAI,YAAY;QAAE,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAC7D,iFAAiF;IACjF,iFAAiF;IACjF,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACzC,KAAK,MAAM,SAAS,IAAI,aAAa;YAAE,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,KAAK,CACT;kCAC8B,EAC9B,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM;IACvC,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AACpC,CAAC"}

package/dist/secrets.d.ts

@@ -0,0 +1,13 @@
+import { type SecretsProvider } from "@vendoai/core";
+import { type VendoStore } from "./store.js";
+/** 02-store §1 */
+export declare function envSecrets(prefix?: string): SecretsProvider;
+/** 02-store §1 */
+export declare function storeSecrets(store: VendoStore): SecretsProvider;
+/** 02-store §3 */
+export declare function secretStore(store: VendoStore): {
+    set(name: string, value: string): Promise<void>;
+    delete(name: string): Promise<void>;
+    list(): Promise<string[]>;
+};
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAEjE,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAGtE,kBAAkB;AAClB,wBAAgB,UAAU,CAAC,MAAM,SAAK,GAAG,eAAe,CAMvD;AAiCD,kBAAkB;AAClB,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CAkB/D;AAED,kBAAkB;AAClB,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC3B,CA0BA"}

package/dist/secrets.js

@@ -0,0 +1,86 @@
+import { VendoError } from "@vendoai/core";
+import { decryptSecret, encryptSecret } from "./crypto.js";
+import { dbFor, secretsConfigFor } from "./store.js";
+import { text } from "./helpers/utils.js";
+/** 02-store §1 */
+export function envSecrets(prefix = "") {
+    return {
+        async get(name) {
+            return process.env[`${prefix}${name}`];
+        },
+    };
+}
+/** 02-store §4 — dev-mode plaintext envelope. Version-prefixed like the
+ *  encrypted `v2:` envelope so a store that later gains a key still reads
+ *  rows written before it. */
+const PLAINTEXT_PREFIX = "plain@1:";
+/** One loud line the first time a plaintext secret is actually stored — the
+ *  guard against a deploy that forgot both NODE_ENV=production and the key
+ *  (Devin review on the NODE_ENV-only gate). */
+let plaintextWarned = false;
+function warnPlaintextOnce() {
+    if (plaintextWarned)
+        return;
+    plaintextWarned = true;
+    console.warn("[vendo] Storing secrets UNENCRYPTED (dev mode). If this is a real deployment, set NODE_ENV=production "
+        + "and VENDO_STORE_ENCRYPTION_KEY (base64 32-byte) — production refuses plaintext secrets.");
+}
+/** The key when configured; null when plaintext is allowed (dev mode);
+ *  fail-closed otherwise — production stores secrets encrypted or not at all. */
+function keyFor(store) {
+    const { encryptionKey, allowPlaintextSecrets } = secretsConfigFor(store);
+    if (encryptionKey)
+        return encryptionKey;
+    if (allowPlaintextSecrets)
+        return null;
+    throw new VendoError("not-implemented", "Stored secrets require an encryption key in production: set VENDO_STORE_ENCRYPTION_KEY "
+        + "(base64 32-byte) or pass createStore({ encryption: { key } }).");
+}
+/** 02-store §1 */
+export function storeSecrets(store) {
+    const db = dbFor(store);
+    return {
+        async get(name) {
+            const key = keyFor(store);
+            const result = await db.query("SELECT ciphertext FROM vendo_secrets WHERE name = $1", [name]);
+            const row = result.rows[0];
+            if (!row)
+                return undefined;
+            const stored = text(row["ciphertext"]);
+            if (stored.startsWith(PLAINTEXT_PREFIX)) {
+                return Buffer.from(stored.slice(PLAINTEXT_PREFIX.length), "base64").toString("utf8");
+            }
+            if (key === null) {
+                throw new VendoError("validation", "Stored secret is encrypted but no encryption key is configured");
+            }
+            return decryptSecret(stored, key, name);
+        },
+    };
+}
+/** 02-store §3 */
+export function secretStore(store) {
+    const db = dbFor(store);
+    return {
+        async set(name, value) {
+            const key = keyFor(store);
+            if (key === null)
+                warnPlaintextOnce();
+            const ciphertext = key === null
+                ? `${PLAINTEXT_PREFIX}${Buffer.from(value, "utf8").toString("base64")}`
+                : encryptSecret(value, key, name);
+            // updated_at marks the last write (rotation), distinct from created_at.
+            await db.query(`INSERT INTO vendo_secrets (name, ciphertext, created_at, updated_at) VALUES ($1, $2, $3, $3)
+         ON CONFLICT (name) DO UPDATE SET ciphertext = EXCLUDED.ciphertext, updated_at = EXCLUDED.updated_at`, [name, ciphertext, new Date().toISOString()]);
+        },
+        async delete(name) {
+            await db.query("DELETE FROM vendo_secrets WHERE name = $1", [name]);
+        },
+        async list() {
+            const result = await db.query("SELECT name FROM vendo_secrets");
+            // Sort in JS: SQL ORDER BY is collation-dependent (PGlite ships C,
+            // hosted Postgres usually a locale) — one deterministic order everywhere.
+            return result.rows.map((row) => text(row["name"])).sort();
+        },
+    };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAwB,MAAM,eAAe,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,kBAAkB;AAClB,MAAM,UAAU,UAAU,CAAC,MAAM,GAAG,EAAE;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;8BAE8B;AAC9B,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;gDAEgD;AAChD,IAAI,eAAe,GAAG,KAAK,CAAC;AAC5B,SAAS,iBAAiB;IACxB,IAAI,eAAe;QAAE,OAAO;IAC5B,eAAe,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,IAAI,CACV,wGAAwG;UACpG,yFAAyF,CAC9F,CAAC;AACJ,CAAC;AAED;iFACiF;AACjF,SAAS,MAAM,CAAC,KAAiB;IAC/B,MAAM,EAAE,aAAa,EAAE,qBAAqB,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,yFAAyF;UACrF,gEAAgE,CACrE,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,sDAAsD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACxC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,UAAU,CAAC,YAAY,EAAE,gEAAgE,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,WAAW,CAAC,KAAiB;IAK3C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK;YACnB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,GAAG,KAAK,IAAI;gBAAE,iBAAiB,EAAE,CAAC;YACtC,MAAM,UAAU,GAAG,GAAG,KAAK,IAAI;gBAC7B,CAAC,CAAC,GAAG,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACvE,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACpC,wEAAwE;YACxE,MAAM,EAAE,CAAC,KAAK,CACZ;6GACqG,EACrG,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,EAAE,CAAC,KAAK,CAAC,2CAA2C,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChE,mEAAmE;YACnE,0EAA0E;YAC1E,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sessions.d.ts

@@ -0,0 +1,53 @@
+import { type VendoStore } from "./store.js";
+/** 02-store §4 (kill-list B3) — ephemeral (anonymous) sessions on disk.
+ *
+ * Anonymous principals write ORDINARY rows under their subject; what makes a
+ * session ephemeral is its registration in `vendo_sessions`, and what ends it
+ * is the TTL sweep (or adoption on sign-in — helpers/subjects). Registration
+ * is the caller's job: the umbrella registers the subject on every
+ * ephemeral-principal request (registration == touch), so idle time is
+ * measured from the last request, reads included. The store itself stays
+ * config-free — TTL policy arrives as an argument. */
+/** Touch (or create) an ephemeral session: stamps `touched_at` for the TTL
+    sweep. `now` is a millisecond clock reading; the umbrella passes its own
+    session clock so tests are deterministic. */
+export declare function registerEphemeralSubject(store: VendoStore, subject: string, now?: number): Promise<void>;
+/** The stale-session candidates for a HOST-DRIVEN sweep (the hosted-store
+    service exposes this so the umbrella's hosted sweep can list → claim →
+    erase over the wire, ending in the erase cascade — 2026-07-18 hosted-store
+    one-pager). sweepEphemeralSubjects lists through this too; reading a
+    candidate confers no ownership — winning claimEphemeralSubject does. */
+export declare function listStaleEphemeralSubjects(store: VendoStore, opts: {
+    idleMs: number;
+    now?: number;
+}): Promise<string[]>;
+/** The claim leg of a sweep (host-driven or sweepEphemeralSubjects): deleting
+    the session row is the mutual-exclusion point (the idleness predicate is
+    repeated in the claim — a re-touch after the stale listing defeats it, so
+    a live session is never erased out from under its visitor). The winner
+    owns the subject and MUST follow with the erase cascade. */
+export declare function claimEphemeralSubject(store: VendoStore, subject: string, opts: {
+    idleMs: number;
+    now?: number;
+}): Promise<boolean>;
+/** Whether the subject currently has a registered ephemeral session. */
+export declare function isEphemeralSubject(store: VendoStore, subject: string): Promise<boolean>;
+/** The TTL sweep: erase every registered session idle for at least `idleMs`
+    (now - touched_at >= idleMs), cascading through the erase API (02 §5) so a
+    swept subject leaves zero rows anywhere. Returns the swept subjects so the
+    caller can cascade further (the umbrella forwards them to
+    `agent.evictSubject`, 03 §1).
+
+    Claim-first serialization with adoption (helpers/subjects): the sweep owns
+    a subject only after winning `claimEphemeralSubject` — a subject whose
+    session row an interleaved adopt already claimed is SKIPPED, so the erase
+    cascade can never chase app ids the adopt just moved to the signed-in
+    user. The claim repeats the idleness predicate, so a re-touch landing
+    after the stale listing (the window is wide — a full erase cascade runs
+    between candidates) also defeats it: a live session is never erased out
+    from under its visitor. */
+export declare function sweepEphemeralSubjects(store: VendoStore, opts: {
+    idleMs: number;
+    now?: number;
+}): Promise<string[]>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;sDAQsD;AAEtD;;gDAEgD;AAChD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;2EAI2E;AAC3E,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CAOnB;AAED;;;;+DAI+D;AAC/D,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM7F;AAED;;;;;;;;;;;;;8BAa8B;AAC9B,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,MAAM,EAAE,CAAC,CA2BnB"}

package/dist/sessions.js

@@ -0,0 +1,85 @@
+import { eraseStore } from "./erase.js";
+import { dbFor } from "./store.js";
+/** 02-store §4 (kill-list B3) — ephemeral (anonymous) sessions on disk.
+ *
+ * Anonymous principals write ORDINARY rows under their subject; what makes a
+ * session ephemeral is its registration in `vendo_sessions`, and what ends it
+ * is the TTL sweep (or adoption on sign-in — helpers/subjects). Registration
+ * is the caller's job: the umbrella registers the subject on every
+ * ephemeral-principal request (registration == touch), so idle time is
+ * measured from the last request, reads included. The store itself stays
+ * config-free — TTL policy arrives as an argument. */
+/** Touch (or create) an ephemeral session: stamps `touched_at` for the TTL
+    sweep. `now` is a millisecond clock reading; the umbrella passes its own
+    session clock so tests are deterministic. */
+export async function registerEphemeralSubject(store, subject, now = Date.now()) {
+    await dbFor(store).query(`INSERT INTO vendo_sessions (subject, touched_at) VALUES ($1, $2)
+     ON CONFLICT (subject) DO UPDATE SET touched_at = EXCLUDED.touched_at`, [subject, new Date(now).toISOString()]);
+}
+/** The stale-session candidates for a HOST-DRIVEN sweep (the hosted-store
+    service exposes this so the umbrella's hosted sweep can list → claim →
+    erase over the wire, ending in the erase cascade — 2026-07-18 hosted-store
+    one-pager). sweepEphemeralSubjects lists through this too; reading a
+    candidate confers no ownership — winning claimEphemeralSubject does. */
+export async function listStaleEphemeralSubjects(store, opts) {
+    const cutoff = new Date((opts.now ?? Date.now()) - opts.idleMs).toISOString();
+    const result = await dbFor(store).query("SELECT subject FROM vendo_sessions WHERE touched_at <= $1 ORDER BY touched_at ASC", [cutoff]);
+    return result.rows.map((row) => String(row["subject"]));
+}
+/** The claim leg of a sweep (host-driven or sweepEphemeralSubjects): deleting
+    the session row is the mutual-exclusion point (the idleness predicate is
+    repeated in the claim — a re-touch after the stale listing defeats it, so
+    a live session is never erased out from under its visitor). The winner
+    owns the subject and MUST follow with the erase cascade. */
+export async function claimEphemeralSubject(store, subject, opts) {
+    const cutoff = new Date((opts.now ?? Date.now()) - opts.idleMs).toISOString();
+    const result = await dbFor(store).query("DELETE FROM vendo_sessions WHERE subject = $1 AND touched_at <= $2 RETURNING 1", [subject, cutoff]);
+    return result.rows[0] !== undefined;
+}
+/** Whether the subject currently has a registered ephemeral session. */
+export async function isEphemeralSubject(store, subject) {
+    const result = await dbFor(store).query("SELECT 1 FROM vendo_sessions WHERE subject = $1", [subject]);
+    return result.rows.length > 0;
+}
+/** The TTL sweep: erase every registered session idle for at least `idleMs`
+    (now - touched_at >= idleMs), cascading through the erase API (02 §5) so a
+    swept subject leaves zero rows anywhere. Returns the swept subjects so the
+    caller can cascade further (the umbrella forwards them to
+    `agent.evictSubject`, 03 §1).
+
+    Claim-first serialization with adoption (helpers/subjects): the sweep owns
+    a subject only after winning `claimEphemeralSubject` — a subject whose
+    session row an interleaved adopt already claimed is SKIPPED, so the erase
+    cascade can never chase app ids the adopt just moved to the signed-in
+    user. The claim repeats the idleness predicate, so a re-touch landing
+    after the stale listing (the window is wide — a full erase cascade runs
+    between candidates) also defeats it: a live session is never erased out
+    from under its visitor. */
+export async function sweepEphemeralSubjects(store, opts) {
+    const now = opts.now ?? Date.now();
+    const stale = await listStaleEphemeralSubjects(store, { idleMs: opts.idleMs, now });
+    const erase = eraseStore(store);
+    const evicted = [];
+    for (const subject of stale) {
+        if (!(await claimEphemeralSubject(store, subject, { idleMs: opts.idleMs, now })))
+            continue; // adopted or re-touched mid-sweep — not ours
+        try {
+            await erase.bySubject(subject);
+        }
+        catch (error) {
+            // The claim deleted the session row; a failed cascade must give it back
+            // or no later sweep can ever see this subject again and its remaining
+            // rows are stranded (the callers log "will retry next interval" — make
+            // that true). Restore at the cutoff so it stays sweep-eligible; DO
+            // NOTHING keeps a visitor who re-registered mid-erase live. Best
+            // effort: if the restore itself fails, the original error still
+            // propagates.
+            await dbFor(store).query(`INSERT INTO vendo_sessions (subject, touched_at) VALUES ($1, $2)
+         ON CONFLICT (subject) DO NOTHING`, [subject, new Date(now - opts.idleMs).toISOString()]).catch(() => undefined);
+            throw error;
+        }
+        evicted.push(subject);
+    }
+    return evicted;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AAEpD;;;;;;;;sDAQsD;AAEtD;;gDAEgD;AAChD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAiB,EACjB,OAAe,EACf,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CACtB;0EACsE,EACtE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CACvC,CAAC;AACJ,CAAC;AAED;;;;2EAI2E;AAC3E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAiB,EACjB,IAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CACrC,mFAAmF,EACnF,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;+DAI+D;AAC/D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiB,EACjB,OAAe,EACf,IAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CACrC,gFAAgF,EAChF,CAAC,OAAO,EAAE,MAAM,CAAC,CAClB,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;AACtC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAAiB,EAAE,OAAe;IACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CACrC,iDAAiD,EACjD,CAAC,OAAO,CAAC,CACV,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;;8BAa8B;AAC9B,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,IAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAAE,SAAS,CAAC,6CAA6C;QACzI,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,iEAAiE;YACjE,gEAAgE;YAChE,cAAc;YACd,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CACtB;0CACkC,EAClC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CACrD,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}