@wrongstack/core 0.313.0 → 0.313.1

package/dist/session-catalog/index.js

@@ -1,2108 +1,41 @@
-// src/session-catalog/client.ts
-import { spawn } from "node:child_process";
-import * as fs2 from "node:fs";
-import * as net from "node:net";
-import * as path2 from "node:path";
-import { fileURLToPath } from "node:url";
-
-// src/session-catalog/endpoint.ts
-import { createHash } from "node:crypto";
-import * as fs from "node:fs";
-import * as os from "node:os";
-import * as path from "node:path";
-
-// src/utils/socket-path.ts
+import "../chunk-M7BS2K6U.js";
 import {
-  assertUnixSocketPathWithinLimit,
-  checkUnixSocketPath,
-  unixSocketPathLimit
-} from "@wrongstack/persistence";
-
-// src/session-catalog/protocol.ts
-var SESSION_CATALOG_PROTOCOL_VERSION = 1;
-var SESSION_CATALOG_MAX_FRAME_CHARS = 4 * 1024 * 1024;
-var SESSION_CATALOG_DEFAULT_LEASE_MS = 3e4;
-var SESSION_CATALOG_DEFAULT_RESERVATION_MS = 15e3;
-var SESSION_CATALOG_MAX_AGENTS = 128;
-function encodeSessionCatalogMessage(message) {
-  return `${JSON.stringify(message)}
-`;
-}
-
-// src/session-catalog/endpoint.ts
-var SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
-function normalizedPath(value) {
-  const resolved = path.resolve(value);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function sessionCatalogProjectServerKey(projectDir) {
-  return createHash("sha256").update(normalizedPath(projectDir)).digest("hex").slice(0, 24);
-}
-function sessionCatalogProjectServerEndpoint(projectDir) {
-  const key = sessionCatalogProjectServerKey(projectDir);
-  if (process.platform === "win32") {
-    return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
-  }
-  return path.join(os.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
-}
-function sessionCatalogProjectServerMetadataPath(projectDir) {
-  return path.join(projectDir, SESSION_CATALOG_METADATA_FILE);
-}
-function ensureSessionCatalogSocketDirectory(endpoint) {
-  if (process.platform === "win32") return;
-  assertUnixSocketPathWithinLimit(endpoint, "session-catalog");
-  fs.mkdirSync(path.dirname(endpoint), { recursive: true, mode: 448 });
-}
-
-// src/session-catalog/client.ts
-var CONNECT_TIMEOUT_MS = 750;
-var START_TIMEOUT_MS = 1e4;
-var CALL_TIMEOUT_MS = 3e4;
-var MAX_PENDING_REQUESTS = 1024;
-var MAX_EVENT_LISTENERS = 64;
-function locateServer(moduleUrl, exists) {
-  for (const candidate of [
-    "./project-server.js",
-    "../session-catalog/project-server.js",
-    "./session-catalog/project-server.js",
-    "../../dist/session-catalog/project-server.js"
-  ]) {
-    try {
-      const url = new URL(candidate, moduleUrl);
-      if (url.protocol === "file:" && exists(fileURLToPath(url))) return url;
-    } catch {
-    }
-  }
-  return null;
-}
-function resolveSessionCatalogDaemonAvailability(moduleUrl = import.meta.url, exists = fs2.existsSync) {
-  if (process.env["WRONGSTACK_SESSION_CATALOG_INLINE"] || process.env["WRONGSTACK_SESSION_CATALOG_SERVER"] === "0")
-    return { kind: "inline-requested" };
-  const url = locateServer(moduleUrl, exists);
-  return url ? { kind: "available", url } : { kind: "missing-build" };
-}
-function resolveSessionCatalogProjectServerUrl(moduleUrl = import.meta.url, exists = fs2.existsSync) {
-  const availability = resolveSessionCatalogDaemonAvailability(moduleUrl, exists);
-  return availability.kind === "available" ? availability.url : null;
-}
-function normalize(value) {
-  const resolved = path2.resolve(value);
-  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-var SessionCatalogProjectClient = class {
-  constructor(options) {
-    this.options = options;
-    this.endpoint = sessionCatalogProjectServerEndpoint(options.projectDir);
-  }
-  options;
-  endpoint;
-  socket = null;
-  info = null;
-  buffer = "";
-  connecting = null;
-  connectResolve = null;
-  connectReject = null;
-  authToken;
-  nextId = 1;
-  pending = /* @__PURE__ */ new Map();
-  eventListeners = /* @__PURE__ */ new Set();
-  reconnectTimer;
-  explicitlyClosed = false;
-  async call(op, args, options = {}) {
-    await this.ensureConnected(true);
-    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
-  }
-  /**
-   * Call an already-running project daemon without starting one.
-   *
-   * Cross-project discovery must use this path: observing another project is
-   * never sufficient authority to wake that project's IPC owner.
-   */
-  async callExisting(op, args, options = {}) {
-    await this.ensureConnected(false);
-    return this.request({ type: "request", op, args }, options.timeoutMs ?? CALL_TIMEOUT_MS);
-  }
-  ping() {
-    return this.call("ping", {}, { timeoutMs: 3e3 });
-  }
-  async subscribe(listener) {
-    if (!this.eventListeners.has(listener) && this.eventListeners.size >= MAX_EVENT_LISTENERS) {
-      throw new Error(`Session Catalog listener limit reached (${MAX_EVENT_LISTENERS})`);
-    }
-    this.explicitlyClosed = false;
-    this.eventListeners.add(listener);
-    try {
-      await this.call("subscribe", {});
-    } catch (error) {
-      this.eventListeners.delete(listener);
-      throw error;
-    }
-    return async () => {
-      this.eventListeners.delete(listener);
-      if (this.eventListeners.size === 0)
-        await this.callExisting("unsubscribe", {}).catch(() => void 0);
-    };
-  }
-  async shutdown(reason) {
-    try {
-      await this.ensureConnected(false);
-    } catch {
-      return { stopped: false };
-    }
-    const result = await this.request({ type: "shutdown", ...reason !== void 0 ? { reason } : {} }, 5e3).catch(
-      () => ({ stopped: false })
-    );
-    if (result.stopped) {
-      const metadataPath = sessionCatalogProjectServerMetadataPath(this.options.projectDir);
-      const deadline = Date.now() + 5e3;
-      while (fs2.existsSync(metadataPath) && Date.now() < deadline) await delay(20);
-      if (result.pid && result.pid !== process.pid) {
-        while (Date.now() < deadline) {
-          try {
-            process.kill(result.pid, 0);
-            await delay(20);
-          } catch {
-            break;
-          }
-        }
-      }
-    }
-    return result;
-  }
-  async close() {
-    this.explicitlyClosed = true;
-    if (this.reconnectTimer) clearTimeout(this.reconnectTimer);
-    this.reconnectTimer = void 0;
-    const socket = this.socket;
-    this.socket = null;
-    this.info = null;
-    if (socket && !socket.destroyed)
-      await new Promise((resolve5) => {
-        socket.once("close", resolve5);
-        socket.end();
-      });
-  }
-  async ensureConnected(spawnIfMissing) {
-    if (this.socket && !this.socket.destroyed && this.info) return;
-    if (this.connecting) return this.connecting;
-    this.connecting = this.connectWithElection(spawnIfMissing).finally(() => {
-      this.connecting = null;
-    });
-    return this.connecting;
-  }
-  async connectWithElection(spawnIfMissing) {
-    const deadline = Date.now() + (spawnIfMissing ? START_TIMEOUT_MS : CONNECT_TIMEOUT_MS);
-    let spawned = false;
-    let lastError = new Error("Session Catalog project server unavailable");
-    while (Date.now() < deadline) {
-      try {
-        await this.connectOnce();
-        return;
-      } catch (error) {
-        lastError = error;
-      }
-      if (!spawnIfMissing) break;
-      if (!spawned) {
-        this.spawnDetached();
-        spawned = true;
-      }
-      await delay(75);
-    }
-    throw lastError;
-  }
-  connectOnce() {
-    this.socket?.destroy();
-    this.socket = null;
-    this.info = null;
-    this.authToken = void 0;
-    this.buffer = "";
-    return new Promise((resolve5, reject) => {
-      const socket = net.createConnection(this.endpoint);
-      this.socket = socket;
-      socket.setEncoding("utf8");
-      const timer = setTimeout(() => {
-        reject(new Error("Session Catalog handshake timed out"));
-        socket.destroy();
-      }, CONNECT_TIMEOUT_MS);
-      timer.unref?.();
-      this.connectResolve = () => {
-        clearTimeout(timer);
-        this.connectResolve = null;
-        this.connectReject = null;
-        resolve5();
-      };
-      this.connectReject = (error) => {
-        clearTimeout(timer);
-        this.connectResolve = null;
-        this.connectReject = null;
-        reject(error);
-      };
-      socket.on("data", (chunk) => this.onData(socket, chunk));
-      socket.on("error", (error) => {
-        if (!this.info) this.connectReject?.(error);
-      });
-      socket.on("close", () => this.onClose(socket));
-    });
-  }
-  currentAuthToken() {
-    if (this.authToken === void 0) {
-      try {
-        const parsed = JSON.parse(
-          fs2.readFileSync(sessionCatalogProjectServerMetadataPath(this.options.projectDir), "utf8")
-        );
-        if (typeof parsed.authToken === "string" && parsed.authToken)
-          this.authToken = parsed.authToken;
-      } catch {
-      }
-    }
-    return this.authToken;
-  }
-  request(message, timeoutMs) {
-    const socket = this.socket;
-    if (!socket || socket.destroyed)
-      return Promise.reject(new Error("Session Catalog connection is unavailable"));
-    const id = this.nextId++;
-    if (this.pending.size >= MAX_PENDING_REQUESTS) {
-      return Promise.reject(
-        new Error(`Session Catalog pending request limit reached (${MAX_PENDING_REQUESTS})`)
-      );
-    }
-    const encoded = encodeSessionCatalogMessage({
-      ...message,
-      id,
-      authToken: this.currentAuthToken()
-    });
-    if (encoded.length > SESSION_CATALOG_MAX_FRAME_CHARS)
-      return Promise.reject(new Error("Session Catalog request exceeded frame limit"));
-    return new Promise((resolve5, reject) => {
-      const timer = setTimeout(() => {
-        const pending = this.pending.get(id);
-        if (!pending) return;
-        this.pending.delete(id);
-        pending.reject(
-          new Error(
-            `Session Catalog ${message.type === "request" ? message.op : message.type} timed out`
-          )
-        );
-      }, timeoutMs);
-      timer.unref?.();
-      this.pending.set(id, { resolve: resolve5, reject, timer });
-      socket.write(encoded);
-    });
-  }
-  onData(socket, chunk) {
-    if (socket !== this.socket) return;
-    this.buffer += chunk;
-    if (this.buffer.length > SESSION_CATALOG_MAX_FRAME_CHARS) {
-      socket.destroy(new Error("Session Catalog response exceeded frame limit"));
-      return;
-    }
-    while (true) {
-      const newline = this.buffer.indexOf("\n");
-      if (newline < 0) return;
-      const line = this.buffer.slice(0, newline);
-      this.buffer = this.buffer.slice(newline + 1);
-      if (!line) continue;
-      try {
-        this.onMessage(JSON.parse(line));
-      } catch {
-        socket.destroy(new Error("Invalid Session Catalog response"));
-        return;
-      }
-    }
-  }
-  onMessage(message) {
-    if (message.type === "hello") {
-      if (message.protocolVersion !== SESSION_CATALOG_PROTOCOL_VERSION) {
-        this.connectReject?.(
-          new Error(
-            `Session Catalog protocol mismatch: client=${SESSION_CATALOG_PROTOCOL_VERSION}, server=${message.protocolVersion}`
-          )
-        );
-        this.socket?.destroy();
-        return;
-      }
-      if (normalize(message.projectDir) !== normalize(this.options.projectDir) || normalize(message.projectRoot) !== normalize(this.options.projectRoot)) {
-        this.connectReject?.(new Error("Session Catalog project identity mismatch"));
-        this.socket?.destroy();
-        return;
-      }
-      this.info = message;
-      this.connectResolve?.();
-      return;
-    }
-    if (message.type === "event") {
-      for (const listener of this.eventListeners) {
-        try {
-          listener(message.event);
-        } catch {
-        }
-      }
-      return;
-    }
-    const pending = this.pending.get(message.id);
-    if (!pending) return;
-    this.pending.delete(message.id);
-    clearTimeout(pending.timer);
-    if (message.ok) pending.resolve(message.result);
-    else {
-      const error = new Error(message.error);
-      if (message.errorName) error.name = message.errorName;
-      pending.reject(error);
-    }
-  }
-  onClose(socket) {
-    if (socket !== this.socket) return;
-    this.socket = null;
-    this.info = null;
-    this.authToken = void 0;
-    const error = new Error("Session Catalog connection closed");
-    this.connectReject?.(error);
-    this.connectResolve = null;
-    this.connectReject = null;
-    for (const pending of this.pending.values()) {
-      clearTimeout(pending.timer);
-      pending.reject(error);
-    }
-    this.pending.clear();
-    this.scheduleSubscriptionReconnect();
-  }
-  scheduleSubscriptionReconnect() {
-    if (this.explicitlyClosed || this.eventListeners.size === 0 || this.reconnectTimer) return;
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = void 0;
-      void this.call("subscribe", {}).catch(() => this.scheduleSubscriptionReconnect());
-    }, 250);
-    this.reconnectTimer.unref?.();
-  }
-  spawnDetached() {
-    const url = resolveSessionCatalogProjectServerUrl();
-    if (!url) throw new Error("Built Session Catalog project server is unavailable");
-    const child = spawn(
-      process.execPath,
-      [
-        fileURLToPath(url),
-        "--project-dir",
-        this.options.projectDir,
-        "--project-root",
-        this.options.projectRoot
-      ],
-      { detached: true, stdio: "ignore", windowsHide: true, env: process.env }
-    );
-    child.unref();
-  }
-};
-
-// src/session-catalog/registry.ts
-import { randomUUID } from "node:crypto";
-import * as fs3 from "node:fs/promises";
-import * as path3 from "node:path";
-var HEARTBEAT_INTERVAL_MS = 5e3;
-var AGENT_WRITE_THROTTLE_MS = 300;
-var MAX_PROJECT_CLIENTS = 128;
-var MAX_GLOBAL_ROOTS = 16;
-var ProjectSessionRegistry = class {
-  constructor(globalRoot) {
-    this.globalRoot = globalRoot;
-  }
-  globalRoot;
-  instanceId = randomUUID();
-  clients = /* @__PURE__ */ new Map();
-  current;
-  heartbeatTimer;
-  agentRevision = 0;
-  pendingAgents;
-  agentTimer;
-  lastAgentWriteAt = 0;
-  bindingKey(projectDir) {
-    const resolved = path3.resolve(projectDir);
-    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-  }
-  async closeBinding(binding) {
-    if (this.current?.binding === binding) return;
-    const key = this.bindingKey(binding.projectDir);
-    if (this.clients.get(key) === binding) this.clients.delete(key);
-    await binding.client.close();
-  }
-  binding(projectSlug, projectRoot) {
-    const projectDir = path3.join(this.globalRoot, "projects", projectSlug);
-    const key = this.bindingKey(projectDir);
-    let binding = this.clients.get(key);
-    if (!binding) {
-      if (this.clients.size >= MAX_PROJECT_CLIENTS) {
-        const oldest = [...this.clients.entries()].find(
-          ([, candidate]) => candidate !== this.current?.binding
-        );
-        if (oldest) {
-          this.clients.delete(oldest[0]);
-          void oldest[1].client.close();
-        }
-      }
-      binding = {
-        projectDir,
-        projectRoot: path3.resolve(projectRoot),
-        client: new SessionCatalogProjectClient({ projectDir, projectRoot })
-      };
-      this.clients.set(key, binding);
-    } else {
-      this.clients.delete(key);
-      this.clients.set(key, binding);
-    }
-    return binding;
-  }
-  fullEntry(entry) {
-    const agents = entry.agents ?? [];
-    return {
-      ...entry,
-      status: agents.some((agent) => agent.status !== "idle") ? "active" : "idle",
-      lastHeartbeatAt: (/* @__PURE__ */ new Date()).toISOString(),
-      agentCount: agents.length,
-      agents
-    };
-  }
-  async register(entry) {
-    const full = this.fullEntry(entry);
-    if (this.current?.entry.sessionId === full.sessionId && this.current.entry.pid === full.pid) {
-      this.current.entry = full;
-      this.current.credential = await this.current.binding.client.call("heartbeat", {
-        credential: this.current.credential,
-        status: full.status
-      });
-      return;
-    }
-    const nextBinding = this.binding(full.projectSlug, full.projectRoot);
-    let nextCredential;
-    try {
-      nextCredential = await nextBinding.client.call("claim_new", {
-        entry: full,
-        ownerInstanceId: this.instanceId
-      });
-    } catch (error) {
-      await this.closeBinding(nextBinding).catch(() => void 0);
-      throw error;
-    }
-    const previous = this.current;
-    this.current = { binding: nextBinding, credential: nextCredential, entry: full };
-    this.agentRevision = 0;
-    this.cancelAgentTimer();
-    this.startHeartbeat();
-    if (previous) {
-      await previous.binding.client.call("release", { credential: previous.credential }).catch(() => void 0);
-      if (previous.binding !== nextBinding) await this.closeBinding(previous.binding);
-    }
-  }
-  /** Reserve before transcript hydration; activation swaps ownership only after the writer opened. */
-  async reserveResume(target) {
-    const binding = this.binding(target.projectSlug, target.projectRoot);
-    let reservation;
-    try {
-      reservation = await binding.client.call("reserve_resume", {
-        targetSessionId: target.sessionId,
-        requesterInstanceId: this.instanceId,
-        ...this.current ? { currentSessionId: this.current.entry.sessionId } : {}
-      });
-    } catch (error) {
-      await this.closeBinding(binding).catch(() => void 0);
-      throw error;
-    }
-    let settled = false;
-    return {
-      reservation,
-      activate: async (registration) => {
-        if (settled) throw new Error("Resume reservation is already settled");
-        const entry = this.fullEntry(registration);
-        const credential = await binding.client.call("activate_reservation", {
-          reservation,
-          entry
-        });
-        const previous = this.current;
-        this.current = { binding, credential, entry };
-        settled = true;
-        this.agentRevision = 0;
-        this.cancelAgentTimer();
-        this.startHeartbeat();
-        if (previous) {
-          await previous.binding.client.call("release", { credential: previous.credential }).catch(() => void 0);
-          if (previous.binding !== binding) await this.closeBinding(previous.binding);
-        }
-      },
-      cancel: async () => {
-        if (settled) return;
-        settled = true;
-        try {
-          await binding.client.call("cancel_reservation", {
-            reservationId: reservation.reservationId,
-            requesterInstanceId: this.instanceId
-          }).catch(() => void 0);
-        } finally {
-          await this.closeBinding(binding).catch(() => void 0);
-        }
-      }
-    };
-  }
-  async updateAgents(agents) {
-    if (!this.current) return;
-    this.pendingAgents = agents;
-    this.current.entry = {
-      ...this.current.entry,
-      agents,
-      agentCount: agents.length,
-      status: agents.some((agent) => agent.status !== "idle") ? "active" : "idle",
-      lastHeartbeatAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    const elapsed = Date.now() - this.lastAgentWriteAt;
-    if (!this.agentTimer && elapsed >= AGENT_WRITE_THROTTLE_MS) {
-      await this.flushAgents();
-      return;
-    }
-    if (!this.agentTimer) {
-      this.agentTimer = setTimeout(
-        () => {
-          this.agentTimer = void 0;
-          void this.flushAgents();
-        },
-        Math.max(0, AGENT_WRITE_THROTTLE_MS - elapsed)
-      );
-      this.agentTimer.unref?.();
-    }
-  }
-  async flushAgents() {
-    const agents = this.pendingAgents;
-    const current = this.current;
-    if (!agents || !current) return;
-    this.pendingAgents = void 0;
-    this.lastAgentWriteAt = Date.now();
-    const revision = ++this.agentRevision;
-    await current.binding.client.call("publish_agents", {
-      credential: current.credential,
-      revision,
-      agents
-    });
-  }
-  async markClosing() {
-    this.stopHeartbeat();
-    this.cancelAgentTimer();
-    if (this.current)
-      await this.current.binding.client.call("mark_closing", {
-        credential: this.current.credential
-      });
-  }
-  async unregister() {
-    this.stopHeartbeat();
-    this.cancelAgentTimer();
-    const current = this.current;
-    this.current = void 0;
-    if (current) {
-      try {
-        await current.binding.client.call("release", { credential: current.credential });
-      } finally {
-        await this.closeBinding(current.binding);
-      }
-    }
-  }
-  async list() {
-    const projectsDir = path3.join(this.globalRoot, "projects");
-    let directories = [];
-    try {
-      directories = (await fs3.readdir(projectsDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).slice(0, 1e3).map((entry) => entry.name);
-    } catch {
-      return [];
-    }
-    const snapshots = await Promise.all(
-      directories.map(async (slug) => {
-        const projectDir = path3.join(projectsDir, slug);
-        let client;
-        try {
-          const metadata = JSON.parse(
-            await fs3.readFile(sessionCatalogProjectServerMetadataPath(projectDir), "utf8")
-          );
-          if (typeof metadata.projectRoot !== "string" || !metadata.projectRoot) return [];
-          client = new SessionCatalogProjectClient({
-            projectDir,
-            projectRoot: metadata.projectRoot
-          });
-          return await client.callExisting("list_live", {});
-        } catch {
-          return [];
-        } finally {
-          await client?.close().catch(() => void 0);
-        }
-      })
-    );
-    return snapshots.flat();
-  }
-  async listByProject(projectSlug) {
-    const current = this.current;
-    if (current && path3.basename(current.binding.projectDir) === projectSlug) {
-      return current.binding.client.call("list_live", {}).catch(() => []);
-    }
-    const projectDir = path3.join(this.globalRoot, "projects", projectSlug);
-    let client;
-    try {
-      const metadata = JSON.parse(
-        await fs3.readFile(sessionCatalogProjectServerMetadataPath(projectDir), "utf8")
-      );
-      if (typeof metadata.projectRoot !== "string") return [];
-      client = new SessionCatalogProjectClient({ projectDir, projectRoot: metadata.projectRoot });
-      return await client.callExisting("list_live", {}).catch(() => []);
-    } catch {
-      return [];
-    } finally {
-      await client?.close().catch(() => void 0);
-    }
-  }
-  async get(sessionId) {
-    return (await this.list()).find((entry) => entry.sessionId === sessionId);
-  }
-  subscribeProject(projectSlug, projectRoot, listener) {
-    const binding = this.binding(projectSlug, projectRoot);
-    return binding.client.subscribe(listener).then((unsubscribe) => async () => {
-      await unsubscribe();
-      await this.closeBinding(binding);
-    });
-  }
-  get registryPath() {
-    return path3.join(this.globalRoot, "projects");
-  }
-  async dispose() {
-    await this.unregister().catch(() => void 0);
-    await Promise.all([...this.clients.values()].map((binding) => binding.client.close()));
-    this.clients.clear();
-  }
-  /** Whether this facade currently owns a live session lease. */
-  ownsSession() {
-    return this.current !== void 0;
-  }
-  startHeartbeat() {
-    this.stopHeartbeat();
-    this.heartbeatTimer = setInterval(() => {
-      void this.heartbeat();
-    }, HEARTBEAT_INTERVAL_MS);
-    this.heartbeatTimer.unref?.();
-  }
-  stopHeartbeat() {
-    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
-    this.heartbeatTimer = void 0;
-  }
-  cancelAgentTimer() {
-    if (this.agentTimer) clearTimeout(this.agentTimer);
-    this.agentTimer = void 0;
-    this.pendingAgents = void 0;
-  }
-  async heartbeat() {
-    const current = this.current;
-    if (!current) return;
-    try {
-      const credential = await current.binding.client.call("heartbeat", {
-        credential: current.credential,
-        status: current.entry.status
-      });
-      if (this.current === current) current.credential = credential;
-    } catch {
-    }
-  }
-};
-var registries = /* @__PURE__ */ new Map();
-var lastRegistryKey;
-function getProjectSessionRegistry(globalRoot) {
-  const key = globalRoot !== void 0 ? path3.resolve(globalRoot) : lastRegistryKey;
-  if (!key)
-    throw new Error("SessionRegistry not initialized. Call getSessionRegistry(globalRoot) first.");
-  let registry = registries.get(key);
-  if (!registry) {
-    if (registries.size >= MAX_GLOBAL_ROOTS) {
-      const idle = [...registries.entries()].find(([, candidate]) => !candidate.ownsSession());
-      if (!idle)
-        throw new Error(`Session Registry global-root limit reached (${MAX_GLOBAL_ROOTS})`);
-      registries.delete(idle[0]);
-      void idle[1].dispose();
-    }
-    registry = new ProjectSessionRegistry(key);
-    registries.set(key, registry);
-  } else {
-    registries.delete(key);
-    registries.set(key, registry);
-  }
-  lastRegistryKey = key;
-  return registry;
-}
-function hasProjectSessionRegistry(globalRoot) {
-  if (globalRoot === void 0) return registries.size > 0;
-  return registries.has(path3.resolve(globalRoot));
-}
-
-// src/session-catalog/store.ts
-import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
-import * as fs5 from "node:fs";
-import * as path5 from "node:path";
-
-// src/coordination/sqlite-mailbox-schema.ts
-import { loadRuntimeDatabaseSync } from "@wrongstack/persistence";
-
-// src/utils/sqlite-warning.ts
-var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
-function isSqliteExperimentalWarning(warning, rest) {
-  const message = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
-  const typeOrOptions = rest[0];
-  const warningType = typeof warning === "string" ? typeof typeOrOptions === "string" ? typeOrOptions : typeof typeOrOptions === "object" && typeOrOptions !== null && "type" in typeOrOptions && typeof typeOrOptions.type === "string" ? typeOrOptions.type : "" : warning instanceof Error ? warning.name : "";
-  const warningCode = typeof warning === "string" ? typeof typeOrOptions === "object" && typeOrOptions !== null && "code" in typeOrOptions && typeof typeOrOptions.code === "string" ? typeOrOptions.code : typeof rest[1] === "string" ? rest[1] : "" : warning instanceof Error && "code" in warning && typeof warning.code === "string" ? warning.code : "";
-  return SQLITE_EXPERIMENTAL_WARNING_RE.test(message) && (warningType === "ExperimentalWarning" || warningCode === "ExperimentalWarning");
-}
-function withSqliteExperimentalWarningSuppressed(run) {
-  const originalEmitWarning = process.emitWarning;
-  const forwardWarning = originalEmitWarning.bind(process);
-  process.emitWarning = ((warning, ...rest) => {
-    if (isSqliteExperimentalWarning(warning, rest)) return;
-    forwardWarning(warning, ...rest);
-  });
-  try {
-    return run();
-  } finally {
-    process.emitWarning = originalEmitWarning;
-  }
-}
-
-// src/coordination/sqlite-mailbox-schema.ts
-var DatabaseSyncCtor;
-function loadDatabaseSync() {
-  if (DatabaseSyncCtor) return DatabaseSyncCtor;
-  return withSqliteExperimentalWarningSuppressed(() => {
-    DatabaseSyncCtor = loadRuntimeDatabaseSync();
-    return DatabaseSyncCtor;
-  });
-}
-
-// src/security/secret-scrubber.ts
-var JSON_CREDENTIAL_KEY_ANCHORS = [
-  'Key"',
-  'key"',
-  'KEY"',
-  'token"',
-  'Token"',
-  'TOKEN"',
-  'secret"',
-  'Secret"',
-  'SECRET"',
-  'password"',
-  'Password"',
-  'PASSWORD"',
-  'authorization"',
-  'Authorization"',
-  'bearer"',
-  'Bearer"'
-];
-var PATTERNS = [
-  // Anchored at the start where possible so partial matches inside larger
-  // strings don't trigger false positives.
-  {
-    type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
-    anchor: "sk-ant-"
-  },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
-  {
-    // `xai` is a first-class provider in this codebase, but its key shape was
-    // absent here — so the one credential format WrongStack itself hands users
-    // was the one the scrubber could not recognize (audit 2026-08-20).
-    type: "xai_key",
-    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
-    anchor: "xai-"
-  },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
-  {
-    type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
-    anchor: "sk_"
-  },
-  {
-    type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "AC"
-  },
-  {
-    type: "telegram_bot_token",
-    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "/bot"
-  },
-  {
-    type: "jwt",
-    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
-    anchor: "eyJ"
-  },
-  {
-    type: "private_key",
-    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
-    anchor: "-----BEGIN"
-  },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
-  // AI/ML provider keys — modern LLM services with well-known prefixes
-  {
-    type: "huggingface_token",
-    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
-    anchor: "hf_"
-  },
-  {
-    type: "replicate_token",
-    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "r8_"
-  },
-  {
-    type: "perplexity_key",
-    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "pplx-"
-  },
-  {
-    type: "groq_key",
-    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "gsk_"
-  },
-  {
-    type: "bearer_token",
-    // Anchored with alternation instead of negative lookahead — avoids V8
-    // backtracking risk on adversarial input. Bounded at 512 chars.
-    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
-    // chars). A 12-char base64 string has ~71 bits of entropy — above the
-    // threshold where random strings are unlikely to produce false matches.
-    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
-    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
-    // redacted. A consuming trailing delimiter would eat the separator the
-    // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
-    anchor: "Bearer"
-  },
-  {
-    type: "high_entropy_env",
-    // Anchored with alternation instead of lookbehind to avoid backtracking.
-    // Value bounded at 512 chars.
-    // The trailing boundary is a NON-consuming lookahead so two secrets
-    // separated by a single delimiter (one space OR one newline, e.g.
-    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
-    // redacted. A consuming trailing `\s` would swallow the separator the
-    // next match needs for its leading anchor, so every other secret would
-    // leak in plaintext.
-    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
-    // replacement so the separator between adjacent secrets is preserved
-    // rather than collapsed. Capture groups are therefore: 1=leading
-    // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
-  },
-  {
-    type: "json_credential_key",
-    // The JSON counterpart to `high_entropy_env`, and the pattern that the
-    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
-    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
-    // "this text may hold a secret", every pattern then declined to match, and
-    // the value went out verbatim. `high_entropy_env` cannot cover these: it
-    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
-    // never matched.
-    //
-    // Tool results are routinely serialised as JSON, and a credential with no
-    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
-    // has no other pattern that can catch it — this is the only thing standing
-    // between such a value and the session JSONL, chronicle, HQ broadcast and
-    // the model's own context.
-    //
-    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
-    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
-    // the closing quote has to follow the word immediately.
-    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
-    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
-    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
-    anchor: JSON_CREDENTIAL_KEY_ANCHORS
-  },
-  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
-  // The plugin runtime carried 37 patterns while this scrubber — the one that
-  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
-  // audit — carried 22. The plugin side already had a parity test; it just did
-  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
-  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
-  {
-    type: "github_oauth_token",
-    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
-    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
-  },
-  {
-    type: "gitlab_pat",
-    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glpat-"
-  },
-  {
-    type: "gitlab_runner_token",
-    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glrt-"
-  },
-  {
-    type: "npm_token",
-    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
-    anchor: "npm_"
-  },
-  {
-    type: "slack_app_token",
-    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
-    anchor: "xapp-"
-  },
-  {
-    type: "slack_webhook",
-    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
-    anchor: "hooks.slack.com"
-  },
-  {
-    type: "sendgrid_key",
-    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "SG."
-  },
-  {
-    type: "digitalocean_token",
-    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
-    anchor: "dop_v1_"
-  },
-  {
-    type: "doppler_token",
-    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "dp."
-  },
-  {
-    type: "shopify_token",
-    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "shp"
-  },
-  {
-    type: "docker_pat",
-    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "dckr_pat_"
-  },
-  {
-    type: "linear_key",
-    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "lin_api_"
-  },
-  {
-    type: "atlassian_token",
-    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
-    anchor: "ATATT3"
-  },
-  {
-    type: "square_token",
-    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
-  },
-  {
-    type: "google_oauth_client_secret",
-    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "GOCSPX-"
-  }
-];
-var SIMPLE_PATTERNS = PATTERNS.filter(
-  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
-);
-var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
-var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
-var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
-var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
-var SCRUB_CHUNK_BYTES = 64 * 1024;
-var SCRUB_OVERLAP_BYTES = 1024;
-var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
-var PEM_END_MARKER = "-----END";
-var MAX_PEM_BLOCK_BYTES = 64 * 1024;
-var PEM_END_LINE_TOLERANCE = 64;
-function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
-  const head = text.slice(chunkStart, proposedEnd);
-  const lastBegin = head.lastIndexOf("-----BEGIN ");
-  if (lastBegin === -1) return proposedEnd;
-  const fromBegin = text.slice(chunkStart + lastBegin);
-  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
-  if (!marker || marker.index !== 0) return proposedEnd;
-  const bodyStart = marker[0].length;
-  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
-  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
-  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
-    return proposedEnd;
-  }
-  const lineEnd = fromBegin.indexOf("\n", closeIdx);
-  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
-  return Math.max(proposedEnd, end);
-}
-var PATTERN_ANCHORS = [
-  ...new Set(
-    PATTERNS.flatMap(
-      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
-    )
-  )
-];
-var ALL_ANCHORS = PATTERN_ANCHORS;
-function hasCredentialAnchors(text) {
-  for (const anchor of ALL_ANCHORS) {
-    if (text.includes(anchor)) return true;
-  }
-  return false;
-}
-var DefaultSecretScrubber = class {
-  scrub(text) {
-    if (!text) return text;
-    if (!hasCredentialAnchors(text)) return text;
-    if (text.length <= SCRUB_CHUNK_BYTES) {
-      return this.scrubOne(text);
-    }
-    const out = [];
-    let i = 0;
-    while (i < text.length) {
-      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
-      if (end < text.length) {
-        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
-        let safe = -1;
-        for (let j = end; j < limit; j++) {
-          const ch = text.charCodeAt(j);
-          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
-            safe = j;
-            break;
-          }
-        }
-        end = safe === -1 ? end : safe + 1;
-        end = extendChunkBoundaryPastPem(text, i, end);
-      }
-      out.push(this.scrubOne(text.slice(i, end)));
-      i = end;
-    }
-    return out.join("");
-  }
-  scrubOne(text) {
-    if (!hasCredentialAnchors(text)) return text;
-    let out = text.replace(
-      COMBINED_REGEX,
-      (match, ...groups) => {
-        const idx = groups.findIndex((g) => g !== void 0);
-        if (idx < 0) return match;
-        const replacement = COMBINED_REPLACEMENTS[idx];
-        return replacement !== void 0 ? replacement : match;
-      }
-    );
-    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
-      return `${lead}${key}=[REDACTED:high_entropy_env]`;
-    });
-    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
-      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
-    });
-    return out;
-  }
-  /**
-   * Recursively scrub every string value in an object/array graph. Secrets can
-   * appear under any key — a URL query param, an `authorization` header, an
-   * arbitrarily-named nested field — so we don't gate recursion on key names.
-   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
-   * value without a credential anchor returns immediately without regex work.
-   */
-  scrubObject(obj) {
-    const seen = /* @__PURE__ */ new WeakSet();
-    const visit = (v) => {
-      if (typeof v === "string") return this.scrub(v);
-      if (v === null || typeof v !== "object") return v;
-      if (seen.has(v)) return v;
-      seen.add(v);
-      if (Array.isArray(v)) return v.map(visit);
-      const out = {};
-      for (const [k, val] of Object.entries(v)) {
-        out[k] = visit(val);
-      }
-      return out;
-    };
-    return visit(obj);
-  }
-};
-
-// src/utils/atomic-write.ts
+  ProjectSessionRegistry,
+  getProjectSessionRegistry,
+  hasProjectSessionRegistry
+} from "../chunk-YBUJCZ57.js";
 import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-
-// src/utils/atomic-write.ts
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/utils/pid.ts
-function isPidAlive(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  if (pid === process.pid) return true;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    const code = err.code;
-    if (code === "EPERM") return true;
-    return false;
-  }
-}
-
-// src/session-catalog/store-rebuild.ts
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
-
-// src/utils/session-scoped-path.ts
-var SESSION_SIDECAR_JSONL_SUFFIXES = [
-  ".replay.jsonl",
-  ".audit.jsonl",
-  ".annotations.jsonl"
-];
-var RESERVED_SESSION_JSONL_NAMES = /* @__PURE__ */ new Set([
-  "_index.jsonl",
-  "_mailbox.jsonl"
-]);
-function isSessionTranscriptFileName(name) {
-  if (!name.endsWith(".jsonl")) return false;
-  if (RESERVED_SESSION_JSONL_NAMES.has(name)) return false;
-  return !SESSION_SIDECAR_JSONL_SUFFIXES.some((suffix) => name.endsWith(suffix));
-}
-
-// src/session-catalog/store-schema.ts
-import { createHash as createHash2, timingSafeEqual } from "node:crypto";
-var SCHEMA_VERSION = 1;
-var MAX_LEASE_MS = 12e4;
-var MAX_RESERVATION_MS = 6e4;
-var MAX_MAINTENANCE_MS = 5 * 6e4;
-var MAX_PAGE = 1e3;
-function hashSecret(secret) {
-  return createHash2("sha256").update(secret).digest("hex");
-}
-function secretMatches(secret, expectedHex) {
-  const actual = Buffer.from(hashSecret(secret), "hex");
-  const expected = Buffer.from(expectedHex, "hex");
-  return actual.length === expected.length && timingSafeEqual(actual, expected);
-}
-function boundedMs(value, fallback, max) {
-  return Math.min(max, Math.max(1e3, Number.isFinite(value) ? Math.floor(value) : fallback));
-}
-function parseJson(value) {
-  return JSON.parse(value);
-}
-function conflict(message) {
-  const error = new Error(message);
-  error.name = "SessionOwnershipConflictError";
-  return error;
-}
-function assertId(value, label = "session id") {
-  if (!value || value.length > 256 || value.includes("\\") || value.startsWith("/") || value.includes("..")) {
-    throw new TypeError(`Invalid ${label}`);
-  }
-}
-function boundPresenceValue(value, depth) {
-  if (typeof value === "string") {
-    return value.length <= 6e3 ? value : `${value.slice(0, 5988)}\u2026[truncated]`;
-  }
-  if (value === null || typeof value !== "object") return value;
-  if (depth >= 8) return "[truncated depth]";
-  if (Array.isArray(value)) {
-    return value.slice(0, 64).map((item) => boundPresenceValue(item, depth + 1));
-  }
-  const result = {};
-  for (const [key, item] of Object.entries(value).slice(0, 64)) {
-    result[key] = boundPresenceValue(item, depth + 1);
-  }
-  return result;
-}
-function configureCatalogDatabase(db) {
-  db.exec(
-    "PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000; PRAGMA synchronous=NORMAL;"
-  );
-}
-function initializeCatalogSchema(db) {
-  db.exec(`
-    CREATE TABLE IF NOT EXISTS catalog_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-    CREATE TABLE IF NOT EXISTS sessions (
-      session_id TEXT PRIMARY KEY,
-      transcript_relative_path TEXT NOT NULL,
-      summary_relative_path TEXT NOT NULL,
-      summary_json TEXT NOT NULL,
-      transcript_size INTEGER NOT NULL DEFAULT 0,
-      transcript_mtime_ms REAL NOT NULL DEFAULT 0,
-      summary_revision INTEGER NOT NULL DEFAULT 1,
-      indexed_at TEXT NOT NULL,
-      damaged INTEGER NOT NULL DEFAULT 0
-    );
-    CREATE TABLE IF NOT EXISTS session_leases (
-      session_id TEXT PRIMARY KEY,
-      lease_id TEXT NOT NULL UNIQUE,
-      lease_secret_hash TEXT NOT NULL,
-      owner_instance_id TEXT NOT NULL,
-      owner_pid INTEGER NOT NULL,
-      owner_started_at TEXT NOT NULL,
-      entry_json TEXT NOT NULL,
-      agent_revision INTEGER NOT NULL DEFAULT 0,
-      status TEXT NOT NULL,
-      last_heartbeat_at INTEGER NOT NULL,
-      lease_expires_at INTEGER NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS resume_reservations (
-      reservation_id TEXT PRIMARY KEY,
-      target_session_id TEXT NOT NULL UNIQUE,
-      requester_instance_id TEXT NOT NULL,
-      current_session_id TEXT,
-      created_at INTEGER NOT NULL,
-      expires_at INTEGER NOT NULL
-    );
-    CREATE TABLE IF NOT EXISTS maintenance_leases (
-      session_id TEXT PRIMARY KEY,
-      operation TEXT NOT NULL,
-      holder_id TEXT NOT NULL,
-      lease_id TEXT NOT NULL UNIQUE,
-      acquired_at INTEGER NOT NULL,
-      expires_at INTEGER NOT NULL
-    );
-    CREATE INDEX IF NOT EXISTS idx_sessions_activity ON sessions(indexed_at DESC);
-    CREATE INDEX IF NOT EXISTS idx_leases_expiry ON session_leases(lease_expires_at);
-    CREATE INDEX IF NOT EXISTS idx_reservations_expiry ON resume_reservations(expires_at);
-    CREATE INDEX IF NOT EXISTS idx_maintenance_expiry ON maintenance_leases(expires_at);
-  `);
-  db.prepare("INSERT INTO catalog_meta(key,value) VALUES (?,?) ON CONFLICT(key) DO NOTHING").run("schema_version", String(SCHEMA_VERSION));
-  db.prepare("INSERT INTO catalog_meta(key,value) VALUES (?,?) ON CONFLICT(key) DO NOTHING").run("generation", "0");
-  const row = db.prepare("SELECT value FROM catalog_meta WHERE key=?").get("schema_version");
-  if (Number(row.value) !== SCHEMA_VERSION)
-    throw new Error(`Unsupported session catalog schema ${row.value}`);
-}
-
-// src/session-catalog/store-rebuild.ts
-function walkSessionFiles(root, suffix) {
-  const result = [];
-  const visit = (dir) => {
-    for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
-      if (entry.isDirectory()) {
-        if (entry.name !== "_cas" && entry.name !== "_trash") visit(path4.join(dir, entry.name));
-      } else if (entry.isFile() && entry.name.endsWith(suffix))
-        result.push(path4.join(dir, entry.name));
-    }
-  };
-  visit(root);
-  return result;
-}
-function summarizeTranscriptFile(transcriptFilePath, id) {
-  const lines = fs4.readFileSync(transcriptFilePath, "utf8").split(/\r?\n/);
-  let start;
-  let endedAt;
-  let lastActivityAt;
-  let messageCount = 0;
-  let iterationCount = 0;
-  let toolCallCount = 0;
-  let compactionCount = 0;
-  let tokenTotal = 0;
-  for (const line of lines) {
-    if (!line) continue;
-    let event;
-    try {
-      event = parseJson(line);
-    } catch {
-      continue;
-    }
-    lastActivityAt = event.ts;
-    if (event.type === "session_start") start = event;
-    if (event.type === "session_end") endedAt = event.ts;
-    if (event.type === "message_appended" && (event.message.role === "user" || event.message.role === "assistant"))
-      messageCount++;
-    if (event.type === "llm_response") {
-      iterationCount++;
-      tokenTotal += event.usage.input + event.usage.output + (event.usage.cacheRead ?? 0) + (event.usage.cacheWrite ?? 0);
-    }
-    if (event.type === "tool_call_end") toolCallCount++;
-    if (event.type === "compaction") compactionCount++;
-  }
-  if (!start) throw new Error("missing session_start");
-  return {
-    id,
-    title: id,
-    startedAt: start.ts,
-    ...endedAt ? { endedAt } : {},
-    model: start.model,
-    provider: start.provider,
-    tokenTotal,
-    ...lastActivityAt ? { lastActivityAt } : {},
-    messageCount,
-    iterationCount,
-    toolCallCount,
-    compactionCount
-  };
-}
-function rebuildCatalogIndex(db, sessionsDir, containedPathFn, transactionFn, bumpGenerationFn) {
-  const summaries = walkSessionFiles(sessionsDir, ".summary.json");
-  const transcripts = walkSessionFiles(sessionsDir, ".jsonl").filter(
-    (file) => isSessionTranscriptFileName(path4.basename(file))
-  );
-  const ids = /* @__PURE__ */ new Set();
-  for (const file of [...summaries, ...transcripts]) {
-    const relative2 = path4.relative(sessionsDir, file).replaceAll("\\", "/");
-    ids.add(relative2.replace(/\.summary\.json$|\.jsonl$/, ""));
-  }
-  let indexed = 0;
-  let damaged = 0;
-  transactionFn(() => {
-    db.prepare("DELETE FROM sessions").run();
-    for (const id of ids) {
-      try {
-        const summaryFile = containedPathFn(`${id}.summary.json`);
-        const summary = fs4.existsSync(summaryFile) ? parseJson(fs4.readFileSync(summaryFile, "utf8")) : summarizeTranscriptFile(containedPathFn(`${id}.jsonl`), id);
-        if (!summary || summary.id !== id) throw new Error("summary identity mismatch");
-        const transcript = containedPathFn(`${id}.jsonl`);
-        const stat = fs4.existsSync(transcript) ? fs4.statSync(transcript) : void 0;
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        db.prepare(
-          "INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,transcript_size,transcript_mtime_ms,summary_revision,indexed_at,damaged) VALUES (?,?,?,?,?,?,?,?,0)"
-        ).run(
-          id,
-          `${id}.jsonl`,
-          `${id}.summary.json`,
-          JSON.stringify(summary),
-          stat?.size ?? 0,
-          stat?.mtimeMs ?? 0,
-          1,
-          now
-        );
-        indexed++;
-      } catch {
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const fallback = {
-          id,
-          title: id,
-          startedAt: now,
-          model: "",
-          provider: "",
-          tokenTotal: 0
-        };
-        db.prepare(
-          "INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,summary_revision,indexed_at,damaged) VALUES (?,?,?,?,1,?,1)"
-        ).run(id, `${id}.jsonl`, `${id}.summary.json`, JSON.stringify(fallback), now);
-        damaged++;
-      }
-    }
-    db.prepare(
-      "INSERT INTO catalog_meta(key,value) VALUES ('last_reconciliation',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value"
-    ).run((/* @__PURE__ */ new Date()).toISOString());
-    bumpGenerationFn();
-  });
-  return { indexed, damaged };
-}
-
-// src/session-catalog/store.ts
-var SessionCatalogStore = class {
-  constructor(projectDir) {
-    this.projectDir = projectDir;
-    this.sessionsDir = path5.join(projectDir, "sessions");
-    fs5.mkdirSync(this.sessionsDir, { recursive: true, mode: 448 });
-    this.databasePath = path5.join(this.sessionsDir, "catalog.sqlite");
-    const Database = loadDatabaseSync();
-    this.db = new Database(this.databasePath);
-    try {
-      this.configureDatabase();
-      this.initialize();
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      if (!/SQLITE_CORRUPT|SQLITE_NOTADB|database disk image is malformed|file is not a database/i.test(
-        message
-      )) {
-        this.db.close();
-        throw error;
-      }
-      this.db.close();
-      const quarantine = `${this.databasePath}.corrupt-${Date.now()}`;
-      try {
-        fs5.renameSync(this.databasePath, quarantine);
-      } catch {
-      }
-      for (const suffix of ["-wal", "-shm"]) {
-        try {
-          fs5.renameSync(`${this.databasePath}${suffix}`, `${quarantine}${suffix}`);
-        } catch {
-        }
-      }
-      this.db = new Database(this.databasePath);
-      this.configureDatabase();
-      this.initialize();
-    }
-    this.reapExpired();
-    const rowCount = Number(
-      this.db.prepare("SELECT COUNT(*) AS count FROM sessions").get().count
-    );
-    if (rowCount === 0 && walkSessionFiles(this.sessionsDir, ".jsonl").some((file) => !file.endsWith("_index.jsonl"))) {
-      this.rebuildCatalog();
-    }
-  }
-  projectDir;
-  databasePath;
-  sessionsDir;
-  db;
-  scrubber = new DefaultSecretScrubber();
-  configureDatabase() {
-    configureCatalogDatabase(this.db);
-  }
-  close() {
-    this.db.close();
-  }
-  initialize() {
-    initializeCatalogSchema(this.db);
-  }
-  transaction(run) {
-    this.db.exec("BEGIN IMMEDIATE");
-    try {
-      const result = run();
-      this.db.exec("COMMIT");
-      return result;
-    } catch (error) {
-      this.db.exec("ROLLBACK");
-      throw error;
-    }
-  }
-  bumpGeneration() {
-    this.db.prepare("UPDATE catalog_meta SET value=CAST(value AS INTEGER)+1 WHERE key='generation'").run();
-    return this.generation();
-  }
-  generation() {
-    const row = this.db.prepare("SELECT value FROM catalog_meta WHERE key='generation'").get();
-    return Number(row.value) || 0;
-  }
-  reapExpired(now = Date.now()) {
-    this.db.prepare("DELETE FROM resume_reservations WHERE expires_at<=?").run(now);
-    this.db.prepare("DELETE FROM maintenance_leases WHERE expires_at<=?").run(now);
-    const rows = this.db.prepare("SELECT * FROM session_leases WHERE lease_expires_at<=?").all(now);
-    for (const row of rows) {
-      if (!isPidAlive(row.owner_pid)) {
-        this.db.prepare("DELETE FROM session_leases WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
-      } else if (row.status !== "lost") {
-        this.db.prepare("UPDATE session_leases SET status='lost' WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
-      }
-    }
-  }
-  maintenanceExists(sessionId) {
-    return Boolean(
-      this.db.prepare("SELECT 1 AS yes FROM maintenance_leases WHERE session_id=? AND expires_at>?").get(sessionId, Date.now())
-    );
-  }
-  leaseRow(sessionId) {
-    return this.db.prepare("SELECT * FROM session_leases WHERE session_id=?").get(sessionId);
-  }
-  foreignLiveLease(sessionId, callerPid = process.pid) {
-    const live = this.leaseRow(sessionId);
-    return Boolean(live) && live.owner_pid !== callerPid;
-  }
-  verifyCredential(credential) {
-    assertId(credential.sessionId);
-    const row = this.leaseRow(credential.sessionId);
-    if (!row || row.lease_id !== credential.leaseId || row.owner_instance_id !== credential.ownerInstanceId || !secretMatches(credential.leaseSecret, row.lease_secret_hash)) {
-      throw conflict(`Session ${credential.sessionId} lease proof is invalid or no longer owned`);
-    }
-    return row;
-  }
-  createLease(entry, ownerInstanceId, leaseMs) {
-    assertId(entry.sessionId);
-    if (!ownerInstanceId || ownerInstanceId.length > 256)
-      throw new TypeError("Invalid owner instance id");
-    if (!Number.isSafeInteger(entry.pid) || entry.pid <= 0)
-      throw new TypeError("Invalid owner pid");
-    const now = Date.now();
-    const leaseId = randomUUID2();
-    const leaseSecret = randomBytes(32).toString("hex");
-    const expiresAt = now + boundedMs(leaseMs, SESSION_CATALOG_DEFAULT_LEASE_MS, MAX_LEASE_MS);
-    this.db.prepare(`INSERT INTO session_leases(
-      session_id,lease_id,lease_secret_hash,owner_instance_id,owner_pid,owner_started_at,
-      entry_json,agent_revision,status,last_heartbeat_at,lease_expires_at
-    ) VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(
-      entry.sessionId,
-      leaseId,
-      hashSecret(leaseSecret),
-      ownerInstanceId,
-      entry.pid,
-      entry.startedAt,
-      JSON.stringify(entry),
-      0,
-      entry.status,
-      now,
-      expiresAt
-    );
-    return { sessionId: entry.sessionId, leaseId, leaseSecret, ownerInstanceId, expiresAt };
-  }
-  claimNew(entry, ownerInstanceId, leaseMs) {
-    return this.transaction(() => {
-      this.reapExpired();
-      const existing = this.leaseRow(entry.sessionId);
-      if (existing)
-        throw conflict(
-          `Session ${entry.sessionId} is already open in another running wstack (pid ${existing.owner_pid}).`
-        );
-      if (this.maintenanceExists(entry.sessionId))
-        throw conflict(`Session ${entry.sessionId} is under maintenance`);
-      const reserved = this.db.prepare(
-        "SELECT 1 AS yes FROM resume_reservations WHERE target_session_id=? AND expires_at>?"
-      ).get(entry.sessionId, Date.now());
-      if (reserved) throw conflict(`Session ${entry.sessionId} is reserved for resume`);
-      const credential = this.createLease(entry, ownerInstanceId, leaseMs);
-      this.bumpGeneration();
-      return credential;
-    });
-  }
-  reconnectLease(credential) {
-    return this.transaction(() => {
-      const row = this.verifyCredential(credential);
-      if (row.owner_pid !== process.pid && !isPidAlive(row.owner_pid))
-        throw conflict(`Session ${credential.sessionId} owner process is no longer alive`);
-      const expiresAt = Date.now() + SESSION_CATALOG_DEFAULT_LEASE_MS;
-      this.db.prepare(
-        "UPDATE session_leases SET lease_expires_at=?,last_heartbeat_at=?,status=? WHERE session_id=? AND lease_id=?"
-      ).run(
-        expiresAt,
-        Date.now(),
-        row.status === "lost" ? "idle" : row.status,
-        row.session_id,
-        row.lease_id
-      );
-      return { ...credential, expiresAt };
-    });
-  }
-  reserveResume(targetSessionId, requesterInstanceId, currentSessionId, reservationMs) {
-    assertId(targetSessionId);
-    return this.transaction(() => {
-      this.reapExpired();
-      const live = this.leaseRow(targetSessionId);
-      if (live)
-        throw conflict(
-          `Session ${targetSessionId} is already open in another running wstack (pid ${live.owner_pid}).`
-        );
-      if (this.maintenanceExists(targetSessionId))
-        throw conflict(`Session ${targetSessionId} is under maintenance`);
-      const catalog = this.db.prepare("SELECT 1 AS yes FROM sessions WHERE session_id=?").get(targetSessionId);
-      if (!catalog && !fs5.existsSync(this.containedPath(`${targetSessionId}.jsonl`)))
-        throw new Error(`Session not found: ${targetSessionId}`);
-      const reservationId = randomUUID2();
-      const now = Date.now();
-      const expiresAt = now + boundedMs(reservationMs, SESSION_CATALOG_DEFAULT_RESERVATION_MS, MAX_RESERVATION_MS);
-      try {
-        this.db.prepare(
-          "INSERT INTO resume_reservations(reservation_id,target_session_id,requester_instance_id,current_session_id,created_at,expires_at) VALUES (?,?,?,?,?,?)"
-        ).run(
-          reservationId,
-          targetSessionId,
-          requesterInstanceId,
-          currentSessionId ?? null,
-          now,
-          expiresAt
-        );
-      } catch {
-        throw conflict(`Session ${targetSessionId} is already reserved for resume`);
-      }
-      this.bumpGeneration();
-      return { reservationId, targetSessionId, requesterInstanceId, expiresAt };
-    });
-  }
-  activateReservation(reservation, entry, leaseMs) {
-    return this.transaction(() => {
-      this.reapExpired();
-      const row = this.db.prepare("SELECT * FROM resume_reservations WHERE reservation_id=?").get(reservation.reservationId);
-      if (!row || row.target_session_id !== reservation.targetSessionId || row.requester_instance_id !== reservation.requesterInstanceId || row.expires_at <= Date.now())
-        throw conflict("Resume reservation expired or is not owned by this requester");
-      if (entry.sessionId !== row.target_session_id)
-        throw new TypeError("Reservation target and session entry differ");
-      if (this.leaseRow(entry.sessionId) || this.maintenanceExists(entry.sessionId))
-        throw conflict(`Session ${entry.sessionId} can no longer be activated`);
-      const credential = this.createLease(entry, reservation.requesterInstanceId, leaseMs);
-      this.db.prepare("DELETE FROM resume_reservations WHERE reservation_id=?").run(row.reservation_id);
-      this.bumpGeneration();
-      return credential;
-    });
-  }
-  cancelReservation(reservationId, requesterInstanceId) {
-    this.db.prepare("DELETE FROM resume_reservations WHERE reservation_id=? AND requester_instance_id=?").run(reservationId, requesterInstanceId);
-  }
-  heartbeat(credential, status) {
-    return this.transaction(() => {
-      const row = this.verifyCredential(credential);
-      const expiresAt = Date.now() + SESSION_CATALOG_DEFAULT_LEASE_MS;
-      const nextStatus = status ?? (row.status === "closing" ? "closing" : row.status === "lost" ? "idle" : row.status);
-      const entry = parseJson(row.entry_json);
-      entry.status = nextStatus;
-      entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.db.prepare(
-        "UPDATE session_leases SET status=?,entry_json=?,last_heartbeat_at=?,lease_expires_at=? WHERE session_id=? AND lease_id=?"
-      ).run(
-        nextStatus,
-        JSON.stringify(entry),
-        Date.now(),
-        expiresAt,
-        row.session_id,
-        row.lease_id
-      );
-      return { ...credential, expiresAt };
-    });
-  }
-  publishAgents(credential, revision, agents) {
-    if (!Number.isSafeInteger(revision) || revision < 0)
-      throw new TypeError("Invalid presence revision");
-    if (!Array.isArray(agents) || agents.length > SESSION_CATALOG_MAX_AGENTS)
-      throw new TypeError(`Agent snapshot exceeds ${SESSION_CATALOG_MAX_AGENTS} agents`);
-    const boundedAgents = boundPresenceValue(
-      this.scrubber.scrubObject(agents),
-      0
-    );
-    const encoded = JSON.stringify(boundedAgents);
-    if (encoded.length > 1024 * 1024) throw new TypeError("Agent snapshot exceeds 1 MiB");
-    return this.transaction(() => {
-      const row = this.verifyCredential(credential);
-      if (revision <= row.agent_revision) return { accepted: false, revision: row.agent_revision };
-      const entry = parseJson(row.entry_json);
-      entry.agents = boundedAgents;
-      entry.agentCount = boundedAgents.length;
-      entry.status = boundedAgents.some((agent) => agent.status !== "idle") ? "active" : "idle";
-      entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
-      this.db.prepare(
-        "UPDATE session_leases SET entry_json=?,agent_revision=?,status=?,last_heartbeat_at=? WHERE session_id=? AND lease_id=?"
-      ).run(
-        JSON.stringify(entry),
-        revision,
-        entry.status,
-        Date.now(),
-        row.session_id,
-        row.lease_id
-      );
-      this.bumpGeneration();
-      return { accepted: true, revision };
-    });
-  }
-  markClosing(credential) {
-    const row = this.verifyCredential(credential);
-    const entry = parseJson(row.entry_json);
-    entry.status = "closing";
-    entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
-    this.db.prepare(
-      "UPDATE session_leases SET status='closing',entry_json=?,last_heartbeat_at=? WHERE session_id=? AND lease_id=?"
-    ).run(JSON.stringify(entry), Date.now(), row.session_id, row.lease_id);
-    this.bumpGeneration();
-  }
-  release(credential) {
-    this.transaction(() => {
-      const row = this.verifyCredential(credential);
-      this.db.prepare("DELETE FROM session_leases WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
-      this.bumpGeneration();
-    });
-  }
-  listLive() {
-    this.reapExpired();
-    return this.db.prepare(
-      "SELECT entry_json,status,last_heartbeat_at FROM session_leases ORDER BY last_heartbeat_at DESC"
-    ).all().map((row) => ({
-      ...parseJson(row.entry_json),
-      status: row.status,
-      lastHeartbeatAt: new Date(row.last_heartbeat_at).toISOString()
-    }));
-  }
-  getLive(sessionId) {
-    return this.listLive().find((entry) => entry.sessionId === sessionId) ?? null;
-  }
-  containedPath(relative2) {
-    assertId(relative2.replace(/\.(jsonl|summary\.json)$/, ""), "session path");
-    const root = path5.resolve(this.sessionsDir);
-    const candidate = path5.resolve(root, relative2);
-    const prefix = `${root}${path5.sep}`;
-    if (candidate !== root && !(process.platform === "win32" ? candidate.toLowerCase().startsWith(prefix.toLowerCase()) : candidate.startsWith(prefix)))
-      throw new TypeError("Session path escapes sessions directory");
-    return candidate;
-  }
-  upsertSummary(summary, transcriptRelativePath = `${summary.id}.jsonl`, summaryRelativePath = `${summary.id}.summary.json`) {
-    assertId(summary.id);
-    summary = this.scrubber.scrubObject(summary);
-    const normalizedTranscript = transcriptRelativePath.replaceAll("\\", "/");
-    const normalizedSummary = summaryRelativePath.replaceAll("\\", "/");
-    if (normalizedTranscript !== `${summary.id}.jsonl` || normalizedSummary !== `${summary.id}.summary.json`) {
-      throw new TypeError("Session catalog paths must match the canonical session identity");
-    }
-    transcriptRelativePath = normalizedTranscript;
-    summaryRelativePath = normalizedSummary;
-    const transcript = this.containedPath(transcriptRelativePath);
-    const stat = fs5.existsSync(transcript) ? fs5.statSync(transcript) : void 0;
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    return this.transaction(() => {
-      const prior = this.db.prepare("SELECT summary_revision FROM sessions WHERE session_id=?").get(summary.id);
-      const revision = (prior?.summary_revision ?? 0) + 1;
-      this.db.prepare(`INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,transcript_size,transcript_mtime_ms,summary_revision,indexed_at,damaged)
-        VALUES (?,?,?,?,?,?,?,?,0) ON CONFLICT(session_id) DO UPDATE SET transcript_relative_path=excluded.transcript_relative_path,summary_relative_path=excluded.summary_relative_path,summary_json=excluded.summary_json,transcript_size=excluded.transcript_size,transcript_mtime_ms=excluded.transcript_mtime_ms,summary_revision=excluded.summary_revision,indexed_at=excluded.indexed_at,damaged=0`).run(
-        summary.id,
-        transcriptRelativePath,
-        summaryRelativePath,
-        JSON.stringify(summary),
-        stat?.size ?? 0,
-        stat?.mtimeMs ?? 0,
-        revision,
-        now
-      );
-      this.bumpGeneration();
-      return {
-        ...summary,
-        transcriptRelativePath,
-        summaryRelativePath,
-        transcriptSize: stat?.size ?? 0,
-        transcriptMtimeMs: stat?.mtimeMs ?? 0,
-        summaryRevision: revision,
-        indexedAt: now,
-        damaged: false
-      };
-    });
-  }
-  catalogRecord(row) {
-    return {
-      ...parseJson(row.summary_json),
-      transcriptRelativePath: row.transcript_relative_path,
-      summaryRelativePath: row.summary_relative_path,
-      transcriptSize: row.transcript_size,
-      transcriptMtimeMs: row.transcript_mtime_ms,
-      summaryRevision: row.summary_revision,
-      indexedAt: row.indexed_at,
-      damaged: row.damaged !== 0
-    };
-  }
-  listCatalog(criteria = {}) {
-    const requestedLimit = criteria.limit ?? 100;
-    if (!Number.isFinite(requestedLimit)) throw new TypeError("Invalid session catalog limit");
-    const bounded = Math.min(MAX_PAGE, Math.max(1, Math.floor(requestedLimit)));
-    const clauses = [];
-    const values = [];
-    const jsonText = (field) => `CASE WHEN json_valid(summary_json) THEN json_extract(summary_json,'$.${field}') END`;
-    const literalLike = (value) => `%${value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_")}%`;
-    const search = criteria.search?.trim();
-    if (search) {
-      const pattern = literalLike(search);
-      clauses.push(
-        `(session_id LIKE ? ESCAPE '\\' OR ${jsonText("title")} LIKE ? ESCAPE '\\' OR ${jsonText("name")} LIKE ? ESCAPE '\\')`
-      );
-      values.push(pattern, pattern, pattern);
-    }
-    if (criteria.since) {
-      clauses.push(`${jsonText("startedAt")}>=?`);
-      values.push(criteria.since);
-    }
-    if (criteria.until) {
-      clauses.push(`${jsonText("startedAt")}<=?`);
-      values.push(criteria.until);
-    }
-    if (criteria.provider) {
-      clauses.push(`${jsonText("provider")}=?`);
-      values.push(criteria.provider);
-    }
-    if (criteria.model) {
-      clauses.push(`${jsonText("model")}=?`);
-      values.push(criteria.model);
-    }
-    if (criteria.minTokens !== void 0) {
-      if (!Number.isFinite(criteria.minTokens)) throw new TypeError("Invalid minimum token count");
-      clauses.push(`CAST(COALESCE(${jsonText("tokenTotal")},0) AS REAL)>=?`);
-      values.push(criteria.minTokens);
-    }
-    if (criteria.titleContains) {
-      clauses.push(`${jsonText("title")} LIKE ? ESCAPE '\\'`);
-      values.push(literalLike(criteria.titleContains.toLocaleLowerCase()));
-    }
-    const where = clauses.length > 0 ? ` WHERE ${clauses.join(" AND ")}` : "";
-    const rows = this.db.prepare(
-      `SELECT * FROM sessions${where} ORDER BY COALESCE(${jsonText("lastActivityAt")},${jsonText("endedAt")},${jsonText("startedAt")}) DESC,${jsonText("startedAt")} DESC,session_id ASC LIMIT ?`
-    ).all(...values, bounded);
-    return rows.map((row) => this.catalogRecord(row));
-  }
-  getSummary(sessionId) {
-    const row = this.db.prepare("SELECT * FROM sessions WHERE session_id=?").get(sessionId);
-    return row ? this.catalogRecord(row) : null;
-  }
-  resolveId(query) {
-    const normalized = query.trim();
-    if (!normalized) throw new Error("Session not found: (empty query)");
-    if (this.getSummary(normalized)) return normalized;
-    const rows = this.db.prepare(
-      "SELECT session_id FROM sessions WHERE session_id LIKE ? OR session_id LIKE ? LIMIT 3"
-    ).all(`%/${normalized}`, `${normalized}%`);
-    const ids = [...new Set(rows.map((row) => row.session_id))];
-    if (ids.length === 1) return ids[0];
-    if (ids.length === 0) throw new Error(`Session not found: ${query}`);
-    throw new Error(`Ambiguous session id "${query}": ${ids.join(", ")}`);
-  }
-  async rename(sessionId, name) {
-    const current = this.getSummary(this.resolveId(sessionId));
-    if (!current) throw new Error(`Session not found: ${sessionId}`);
-    const trimmed = name.trim();
-    const summary = { ...current };
-    for (const key of [
-      "transcriptRelativePath",
-      "summaryRelativePath",
-      "transcriptSize",
-      "transcriptMtimeMs",
-      "summaryRevision",
-      "indexedAt",
-      "damaged"
-    ])
-      delete summary[key];
-    const previous = { ...summary };
-    if (trimmed) summary.name = this.scrubber.scrub(trimmed).slice(0, 500);
-    else delete summary.name;
-    const summaryPath = this.containedPath(current.summaryRelativePath);
-    fs5.mkdirSync(path5.dirname(summaryPath), { recursive: true, mode: 448 });
-    await atomicWrite(summaryPath, `${JSON.stringify(summary)}
-`, { mode: 384 });
-    try {
-      return this.upsertSummary(
-        summary,
-        current.transcriptRelativePath,
-        current.summaryRelativePath
-      );
-    } catch (error) {
-      await atomicWrite(summaryPath, `${JSON.stringify(previous)}
-`, { mode: 384 }).catch(
-        () => void 0
-      );
-      throw error;
-    }
-  }
-  acquireMaintenance(sessionId, operation, holderId, leaseMs, holderPid) {
-    assertId(sessionId);
-    return this.transaction(() => {
-      this.reapExpired();
-      const live = this.leaseRow(sessionId);
-      if (live && (operation === "delete" || this.foreignLiveLease(sessionId, holderPid))) {
-        throw conflict(`Session ${sessionId} is live`);
-      }
-      const reservation = this.db.prepare(
-        "SELECT 1 AS yes FROM resume_reservations WHERE target_session_id=? AND expires_at>?"
-      ).get(sessionId, Date.now());
-      if (reservation) throw conflict(`Session ${sessionId} is reserved for resume`);
-      const leaseId = randomUUID2();
-      const now = Date.now();
-      const expiresAt = now + boundedMs(leaseMs, 6e4, MAX_MAINTENANCE_MS);
-      try {
-        this.db.prepare(
-          "INSERT INTO maintenance_leases(session_id,operation,holder_id,lease_id,acquired_at,expires_at) VALUES (?,?,?,?,?,?)"
-        ).run(sessionId, operation, holderId, leaseId, now, expiresAt);
-      } catch {
-        throw conflict(`Session ${sessionId} already has maintenance in progress`);
-      }
-      return { sessionId, operation, holderId, leaseId, expiresAt };
-    });
-  }
-  releaseMaintenance(lease) {
-    this.db.prepare("DELETE FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=?").run(lease.sessionId, lease.leaseId, lease.holderId);
-  }
-  delete(sessionId, lease) {
-    const row = this.db.prepare(
-      "SELECT * FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=? AND operation=? AND expires_at>?"
-    ).get(sessionId, lease.leaseId, lease.holderId, lease.operation, Date.now());
-    if (!row || lease.operation !== "delete")
-      throw conflict("A valid delete maintenance lease is required");
-    const record = this.getSummary(sessionId);
-    if (!record) throw new Error(`Session not found: ${sessionId}`);
-    const transcript = this.containedPath(record.transcriptRelativePath);
-    const artifacts = [
-      transcript,
-      this.containedPath(record.summaryRelativePath),
-      this.containedPath(`${sessionId}.plan.json`),
-      this.containedPath(`${sessionId}.tasks.json`),
-      this.containedPath(`${sessionId}.todos.json`),
-      path5.join(path5.dirname(transcript), path5.basename(sessionId))
-    ];
-    const trashRoot = path5.join(this.sessionsDir, "_trash", lease.leaseId);
-    fs5.mkdirSync(trashRoot, { recursive: true, mode: 448 });
-    const moved = [];
-    try {
-      artifacts.forEach((artifact, index) => {
-        if (!fs5.existsSync(artifact)) return;
-        const target = path5.join(trashRoot, `${index}-${path5.basename(artifact)}`);
-        fs5.renameSync(artifact, target);
-        moved.push({ from: artifact, to: target });
-      });
-      this.transaction(() => {
-        const current = this.db.prepare(
-          "SELECT 1 AS yes FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=? AND operation=? AND expires_at>?"
-        ).get(sessionId, lease.leaseId, lease.holderId, "delete", Date.now());
-        if (!current) throw conflict("Delete maintenance lease expired while staging artifacts");
-        this.db.prepare("DELETE FROM sessions WHERE session_id=?").run(sessionId);
-        this.db.prepare("DELETE FROM maintenance_leases WHERE session_id=?").run(sessionId);
-        this.bumpGeneration();
-      });
-    } catch (error) {
-      for (const item of moved.reverse()) {
-        try {
-          fs5.mkdirSync(path5.dirname(item.from), { recursive: true, mode: 448 });
-          fs5.renameSync(item.to, item.from);
-        } catch {
-        }
-      }
-      throw error;
-    }
-    try {
-      fs5.rmSync(trashRoot, { recursive: true, force: true });
-      const trashParent = path5.dirname(trashRoot);
-      if (fs5.readdirSync(trashParent).length === 0) fs5.rmdirSync(trashParent);
-    } catch {
-    }
-  }
-  prune(maxAgeDays, holderId) {
-    if (!Number.isFinite(maxAgeDays) || maxAgeDays < 0) throw new TypeError("Invalid prune age");
-    const cutoff = Date.now() - maxAgeDays * 864e5;
-    const candidates = this.db.prepare("SELECT session_id FROM sessions WHERE transcript_mtime_ms<?").all(cutoff);
-    let deleted = 0;
-    for (const { session_id: id } of candidates) {
-      try {
-        const lease = this.acquireMaintenance(id, "delete", holderId);
-        this.delete(id, lease);
-        deleted++;
-      } catch (error) {
-        if (error.name !== "SessionOwnershipConflictError") throw error;
-      }
-    }
-    return deleted;
-  }
-  rebuildCatalog() {
-    return rebuildCatalogIndex(
-      this.db,
-      this.sessionsDir,
-      (rel) => this.containedPath(rel),
-      (run) => this.transaction(run),
-      () => this.bumpGeneration()
-    );
-  }
-  health(base) {
-    this.reapExpired();
-    const count = (table, where = "") => Number(
-      this.db.prepare(`SELECT COUNT(*) AS count FROM ${table} ${where}`).get().count
-    );
-    const reconciliation = this.db.prepare("SELECT value FROM catalog_meta WHERE key='last_reconciliation'").get();
-    return {
-      ...base,
-      catalogRows: count("sessions"),
-      damagedRows: count("sessions", "WHERE damaged<>0"),
-      liveLeases: count("session_leases"),
-      reservations: count("resume_reservations"),
-      maintenanceLeases: count("maintenance_leases"),
-      generation: this.generation(),
-      ...reconciliation ? { lastReconciliation: reconciliation.value } : {}
-    };
-  }
-};
+  SessionCatalogStore
+} from "../chunk-AI4LLQ2U.js";
+import {
+  SessionCatalogProjectClient,
+  resolveSessionCatalogDaemonAvailability,
+  resolveSessionCatalogProjectServerUrl
+} from "../chunk-52RTVH4M.js";
+import {
+  SESSION_CATALOG_DEFAULT_LEASE_MS,
+  SESSION_CATALOG_DEFAULT_RESERVATION_MS,
+  SESSION_CATALOG_MAX_AGENTS,
+  SESSION_CATALOG_MAX_FRAME_CHARS,
+  SESSION_CATALOG_METADATA_FILE,
+  SESSION_CATALOG_PROTOCOL_VERSION,
+  encodeSessionCatalogMessage,
+  ensureSessionCatalogSocketDirectory,
+  sessionCatalogProjectServerEndpoint,
+  sessionCatalogProjectServerKey,
+  sessionCatalogProjectServerMetadataPath
+} from "../chunk-E6I5RXVK.js";
+import "../chunk-GM54GJBU.js";
+import "../chunk-W4A6QA3D.js";
+import "../chunk-3E244UDA.js";
+import "../chunk-AD7ZFZCS.js";
+import "../chunk-TRT2HRWZ.js";
+import "../chunk-LX5QWLBL.js";
+import "../chunk-FAYRX2AD.js";
+import "../chunk-7ZHZE5EO.js";
+import "../chunk-YNCVSFGF.js";
+import "../chunk-WOEZV3Q4.js";
+import "../chunk-TBRL2RCC.js";
 export {
   ProjectSessionRegistry,
   SESSION_CATALOG_DEFAULT_LEASE_MS,