atabey 0.1.1-beta → 0.1.2

package/dist/shared/src/modules/storage/storage.js

@@ -0,0 +1,1004 @@
+import Database from "better-sqlite3";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { AUDIT_CHAIN_GENESIS, buildAgentLogChainPayload, chainDigest, readChainAnchor, writeChainAnchor, verifyHashChain } from "../observability/audit-chain.js";
+import { databaseHolder } from "./database.js";
+import { logger } from "../observability/logger.js";
+import { backupDatabase, getMigrationStatus, restoreDatabase, runPendingMigrations, verifyDatabaseIntegrity, } from "./migrations.js";
+import { maskText } from "../security/pii.js";
+import { asAgentID, asLogID, asMessageID, asTaskID, } from "../primitives/types.js";
+let vitestWorkerFrameworkDir = null;
+function getVitestWorkerFrameworkDir() {
+    if (!vitestWorkerFrameworkDir) {
+        vitestWorkerFrameworkDir = path.join(os.tmpdir(), `atabey-vitest-worker-${process.pid}`, ".atabey");
+    }
+    return vitestWorkerFrameworkDir;
+}
+/**
+ * Resolves the framework directory (.atabey) intelligently by ascending the directory tree,
+ * preventing subpackages and test runners from spraying databases in random subfolders.
+ */
+export function resolveFrameworkDir() {
+    const testDir = process.env.ATABEY_TEST_DIR || process.env.ATABEY_FRAMEWORK_DIR;
+    if (testDir)
+        return testDir;
+    if (process.env.ATABEY_PROJECT_ROOT) {
+        return path.join(process.env.ATABEY_PROJECT_ROOT, ".atabey");
+    }
+    let cur = process.cwd();
+    while (cur !== path.parse(cur).root) {
+        const pkgJson = path.join(cur, "package.json");
+        let isMonorepoRoot = false;
+        if (fs.existsSync(pkgJson)) {
+            try {
+                const pkg = JSON.parse(fs.readFileSync(pkgJson, "utf8"));
+                if (pkg.name === "atabey-monorepo" || pkg.frameworkRepo === true || (pkg.workspaces && Array.isArray(pkg.workspaces))) {
+                    isMonorepoRoot = true;
+                }
+            }
+            catch { /* ignore */ }
+        }
+        const candidate = path.join(cur, ".atabey");
+        if (fs.existsSync(candidate) || isMonorepoRoot) {
+            if (isMonorepoRoot && process.env.VITEST) {
+                return getVitestWorkerFrameworkDir();
+            }
+            return candidate;
+        }
+        cur = path.dirname(cur);
+    }
+    return path.join(process.cwd(), ".atabey");
+}
+/**
+ * [DB] Canonical Atabey Storage Engine (Single Source of Truth)
+ * Central SQLite database for enterprise-scale multi-agent state management.
+ */
+export class AtabeyStorage {
+    static db = null;
+    static getDB() {
+        if (!this.db) {
+            const frameworkDir = resolveFrameworkDir();
+            if (!fs.existsSync(frameworkDir)) {
+                fs.mkdirSync(frameworkDir, { recursive: true });
+            }
+            const dbPath = path.join(frameworkDir, "atabey.db");
+            this.db = new Database(dbPath, { timeout: 5000 });
+            this.db.pragma("journal_mode = WAL");
+            databaseHolder.setDB(this.db);
+            this.initializeSchema();
+        }
+        return this.db;
+    }
+    static initializeSchema() {
+        const db = this.db;
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS agents (
+                name TEXT PRIMARY KEY,
+                state TEXT DEFAULT 'READY',
+                task TEXT DEFAULT 'Idle',
+                description TEXT DEFAULT '',
+                skills TEXT DEFAULT '[]',
+                last_updated DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS messages (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                sender TEXT,
+                receiver TEXT,
+                category TEXT,
+                content TEXT,
+                trace_id TEXT,
+                parent_id TEXT,
+                status TEXT DEFAULT 'PENDING',
+                priority TEXT DEFAULT 'NORMAL',
+                requires_approval BOOLEAN DEFAULT 0
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS tasks (
+                id TEXT PRIMARY KEY,
+                trace_id TEXT,
+                description TEXT,
+                agent TEXT,
+                status TEXT DEFAULT 'PENDING',
+                priority TEXT DEFAULT 'NORMAL',
+                dependencies TEXT,
+                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS logs (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                agent TEXT,
+                action TEXT,
+                trace_id TEXT,
+                status TEXT,
+                summary TEXT,
+                findings TEXT,
+                prev_hash TEXT,
+                hash TEXT
+            )
+        `);
+        try {
+            const tableInfo = db.prepare("PRAGMA table_info(logs)").all();
+            const columnNames = tableInfo.map(c => c.name);
+            if (!columnNames.includes("prev_hash"))
+                db.exec("ALTER TABLE logs ADD COLUMN prev_hash TEXT");
+            if (!columnNames.includes("hash"))
+                db.exec("ALTER TABLE logs ADD COLUMN hash TEXT");
+        }
+        catch (err) {
+            logger.error(`Failed to migrate logs table schema: ${err.message}`);
+        }
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS metadata (
+                key TEXT PRIMARY KEY,
+                value TEXT
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS costs (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                provider TEXT,
+                model TEXT,
+                input_tokens INTEGER,
+                output_tokens INTEGER,
+                cost REAL,
+                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
+                trace_id TEXT
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS knowledge (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                filename TEXT UNIQUE,
+                content TEXT,
+                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS users (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                name TEXT UNIQUE,
+                token TEXT UNIQUE,
+                role TEXT DEFAULT 'user',
+                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS loop_cooldowns (
+                agent TEXT PRIMARY KEY,
+                cooldown_until INTEGER NOT NULL,
+                detail TEXT,
+                cooldown_count INTEGER DEFAULT 1,
+                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS approvals (
+                trace_id TEXT PRIMARY KEY,
+                tool_name TEXT NOT NULL,
+                agent TEXT NOT NULL,
+                risk_score INTEGER NOT NULL,
+                risk_level TEXT NOT NULL,
+                reason TEXT NOT NULL,
+                args TEXT NOT NULL,
+                created_at INTEGER NOT NULL,
+                expires_at INTEGER NOT NULL,
+                status TEXT DEFAULT 'PENDING',
+                passcode TEXT
+            )
+        `);
+        db.exec(`
+            CREATE TABLE IF NOT EXISTS discipline (
+                agent TEXT PRIMARY KEY,
+                total_calls INTEGER DEFAULT 0,
+                violations INTEGER DEFAULT 0,
+                last_violation TEXT,
+                cooldown_until INTEGER DEFAULT 0,
+                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
+            )
+        `);
+        try {
+            runPendingMigrations(db);
+            const integrity = verifyDatabaseIntegrity(db, "quick");
+            if (!integrity.ok) {
+                logger.error(`[DB] SQLite startup integrity check failed: ${integrity.messages.join("; ")}`);
+            }
+        }
+        catch (err) {
+            const msg = err.message;
+            if (/Checksum mismatch/i.test(msg)) {
+                // Schema drift or tampering — fail closed instead of running on an unknown schema.
+                throw err;
+            }
+            logger.error(`[DB] Schema migration / integrity check warning: ${msg}`);
+        }
+    }
+    // === KNOWLEDGE PERSISTENCE ===
+    static getKnowledgeList() {
+        try {
+            return this.getDB().prepare("SELECT filename, updated_at FROM knowledge ORDER BY updated_at DESC").all();
+        }
+        catch (err) {
+            logger.debug(`Failed to get knowledge list: ${err.message}`);
+            return [];
+        }
+    }
+    static getKnowledgeFile(filename) {
+        try {
+            const row = this.getDB().prepare("SELECT * FROM knowledge WHERE filename = ?").get(filename);
+            return row || null;
+        }
+        catch (err) {
+            logger.debug(`Failed to get knowledge file: ${err.message}`);
+            return null;
+        }
+    }
+    static saveKnowledgeFile(filename, content) {
+        this.getDB().prepare(`
+            INSERT INTO knowledge (filename, content, updated_at) VALUES (?, ?, datetime('now'))
+            ON CONFLICT(filename) DO UPDATE SET content = excluded.content, updated_at = datetime('now')
+        `).run(filename, content);
+    }
+    static deleteKnowledgeFile(filename) {
+        const info = this.getDB().prepare("DELETE FROM knowledge WHERE filename = ?").run(filename);
+        return info.changes > 0;
+    }
+    // === USER PERSISTENCE ===
+    static hasUsers() {
+        try {
+            const row = this.getDB().prepare("SELECT COUNT(*) as count FROM users").get();
+            return row.count > 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    static getUsers() {
+        try {
+            return this.getDB().prepare("SELECT name, token, role FROM users ORDER BY id ASC").all();
+        }
+        catch (err) {
+            logger.debug(`Failed to get users: ${err.message}`);
+            return [];
+        }
+    }
+    static getUserByToken(token) {
+        try {
+            const row = this.getDB().prepare("SELECT name, role FROM users WHERE token = ?").get(token);
+            return row || null;
+        }
+        catch (err) {
+            logger.debug(`Failed to get user by token: ${err.message}`);
+            return null;
+        }
+    }
+    static createUser(name, token, role) {
+        this.getDB().prepare("INSERT INTO users (name, token, role) VALUES (?, ?, ?)").run(name, token, role);
+    }
+    static deleteUser(name) {
+        const info = this.getDB().prepare("DELETE FROM users WHERE name = ?").run(name);
+        return info.changes > 0;
+    }
+    // === AGENT DETAILS PERSISTENCE ===
+    static createAgent(name, description, skills) {
+        const cleanName = name.replace("@", "");
+        this.getDB().prepare(`
+            INSERT INTO agents (name, state, task, description, skills, last_updated)
+            VALUES (?, 'READY', 'Idle', ?, ?, datetime('now'))
+            ON CONFLICT(name) DO UPDATE SET description = excluded.description, skills = excluded.skills
+        `).run(cleanName, description, skills);
+    }
+    static deleteAgent(name) {
+        const cleanName = name.replace("@", "");
+        const info = this.getDB().prepare("DELETE FROM agents WHERE name = ?").run(cleanName);
+        return info.changes > 0;
+    }
+    static updateAgentDetails(name, description, state, task, skills) {
+        const cleanName = name.replace("@", "");
+        this.getDB().prepare(`
+            INSERT INTO agents (name, state, task, description, skills, last_updated)
+            VALUES (?, ?, ?, ?, ?, datetime('now'))
+            ON CONFLICT(name) DO UPDATE SET
+                description = excluded.description,
+                state = excluded.state,
+                task = excluded.task,
+                skills = excluded.skills,
+                last_updated = datetime('now')
+        `).run(cleanName, state, task, description, skills);
+    }
+    // === EVENT HOOKS FOR REAL-TIME BROADCASTS ===
+    static onMessageSaved = null;
+    static onMessageStatusUpdated = null;
+    static saveLog(log) {
+        const db = this.getDB();
+        const timestamp = new Date().toISOString();
+        const agent = log.agent.replace("@", "");
+        const maskedSummary = maskText(log.summary);
+        const maskedFindings = log.findings ? maskText(log.findings) : null;
+        const traceId = log.trace_id || "";
+        let lastId = 0;
+        const insert = db.transaction(() => {
+            let prevHash = AUDIT_CHAIN_GENESIS;
+            try {
+                const lastRow = db.prepare("SELECT hash FROM logs WHERE hash IS NOT NULL ORDER BY id DESC LIMIT 1").get();
+                if (lastRow && lastRow.hash) {
+                    prevHash = lastRow.hash;
+                }
+            }
+            catch { /* best-effort fallback to genesis */ }
+            const payload = buildAgentLogChainPayload({
+                prevHash,
+                timestamp,
+                agent,
+                action: log.action,
+                traceId: traceId || "",
+                status: log.status,
+                summary: maskedSummary,
+            });
+            const hash = chainDigest(payload);
+            const result = db.prepare(`
+                INSERT INTO logs (timestamp, agent, action, trace_id, status, summary, findings, prev_hash, hash)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            `).run(timestamp, agent, log.action, log.trace_id || null, log.status, maskedSummary, maskedFindings, prevHash, hash);
+            lastId = Number(result.lastInsertRowid);
+            const count = db.prepare("SELECT COUNT(*) AS c FROM logs WHERE hash IS NOT NULL").get().c;
+            writeChainAnchor("agent-log", hash, count);
+        });
+        insert();
+        return lastId;
+    }
+    static verifyLogIntegrity() {
+        const db = this.getDB();
+        try {
+            const rows = db.prepare("SELECT * FROM logs ORDER BY id ASC").all();
+            const hashed = rows.filter((r) => r.hash);
+            if (hashed.length === 0) {
+                return { valid: true, checked: 0, reason: "No hashed log rows yet" };
+            }
+            const anchor = readChainAnchor("agent-log");
+            return verifyHashChain(hashed, (row, prevHash) => buildAgentLogChainPayload({
+                prevHash,
+                agent: row.agent,
+                action: row.action,
+                traceId: row.trace_id || "",
+                status: row.status,
+                summary: row.summary,
+                timestamp: row.timestamp,
+            }), { expectedTip: anchor?.tip, expectedCount: anchor?.count });
+        }
+        catch (err) {
+            return { valid: false, reason: `Verification error: ${err.message}` };
+        }
+    }
+    static saveCost(cost) {
+        const db = this.getDB();
+        db.prepare(`
+            INSERT INTO costs (provider, model, input_tokens, output_tokens, cost, timestamp, trace_id)
+            VALUES (?, ?, ?, ?, ?, ?, ?)
+        `).run(cost.provider, cost.model, cost.inputTokens, cost.outputTokens, cost.cost, cost.timestamp, cost.traceId || null);
+    }
+    static getAllCosts() {
+        const db = this.getDB();
+        const rows = db.prepare("SELECT * FROM costs ORDER BY timestamp ASC").all();
+        return rows.map(r => ({
+            provider: r.provider,
+            model: r.model,
+            inputTokens: r.input_tokens,
+            outputTokens: r.output_tokens,
+            cost: r.cost,
+            timestamp: r.timestamp,
+            traceId: r.trace_id || undefined
+        }));
+    }
+    static updateAgentStatus(name, state, task, lastUpdated) {
+        const cleanName = name.replace("@", "");
+        const timestamp = lastUpdated || new Date().toISOString();
+        this.getDB().prepare(`
+            INSERT INTO agents (name, state, task, last_updated)
+            VALUES (?, ?, ?, ?)
+            ON CONFLICT(name) DO UPDATE SET
+                state = excluded.state,
+                task = excluded.task,
+                last_updated = excluded.last_updated
+        `).run(cleanName, state, task, timestamp);
+    }
+    static getAllAgents() {
+        const db = this.getDB();
+        const rows = db.prepare("SELECT * FROM agents").all();
+        return rows.map(r => ({
+            name: asAgentID(r.name),
+            state: r.state,
+            task: r.task,
+            last_updated: r.last_updated
+        }));
+    }
+    static saveMessage(msg) {
+        const from = msg.from.replace("@", "");
+        const to = msg.to.replace("@", "");
+        const cleanContent = maskText(msg.content);
+        this.getDB().prepare(`
+            INSERT INTO messages (timestamp, sender, receiver, category, content, trace_id, parent_id, status, priority, requires_approval)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(msg.timestamp, from, to, msg.category, cleanContent, msg.traceId, msg.parentId || null, msg.status, msg.priority, msg.requiresApproval ? 1 : 0);
+        if (this.onMessageSaved) {
+            try {
+                this.onMessageSaved({ traceId: msg.traceId, category: msg.category });
+            }
+            catch (err) {
+                logger.debug(`onMessageSaved hook error: ${err.message}`);
+            }
+        }
+    }
+    static getPendingMessages() {
+        const db = this.getDB();
+        const rows = db.prepare("SELECT * FROM messages WHERE status = 'PENDING'").all();
+        return rows.map(r => ({
+            id: asMessageID(r.id),
+            timestamp: r.timestamp,
+            from: asAgentID(r.sender),
+            to: asAgentID(r.receiver),
+            category: r.category,
+            content: maskText(r.content),
+            traceId: r.trace_id,
+            parentId: r.parent_id || undefined,
+            status: r.status,
+            priority: r.priority,
+            requiresApproval: r.requires_approval === 1
+        }));
+    }
+    static updateMessageStatus(id, status) {
+        this.getDB().prepare("UPDATE messages SET status = ? WHERE id = ?").run(status, id);
+        if (this.onMessageStatusUpdated) {
+            try {
+                this.onMessageStatusUpdated(id, status);
+            }
+            catch (err) {
+                logger.debug(`onMessageStatusUpdated hook error: ${err.message}`);
+            }
+        }
+    }
+    static saveTask(task) {
+        const agent = task.agent;
+        const cleanDesc = task.description;
+        this.getDB().prepare(`
+            INSERT INTO tasks (id, trace_id, description, agent, status, priority, dependencies, created_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET
+                status = excluded.status,
+                priority = excluded.priority,
+                dependencies = excluded.dependencies,
+                agent = excluded.agent
+        `).run(task.id, task.traceId, cleanDesc, agent, task.status, task.priority, JSON.stringify(task.dependencies), task.createdAt || new Date().toISOString());
+    }
+    static getTasks(traceId) {
+        const db = this.getDB();
+        let rows;
+        if (traceId) {
+            rows = db.prepare("SELECT * FROM tasks WHERE trace_id = ?").all(traceId);
+        }
+        else {
+            rows = db.prepare("SELECT * FROM tasks").all();
+        }
+        return rows.map(r => {
+            let deps;
+            try {
+                deps = JSON.parse(r.dependencies || "[]");
+            }
+            catch {
+                deps = [];
+            }
+            return {
+                id: asTaskID(r.id),
+                traceId: r.trace_id,
+                description: maskText(r.description),
+                agent: asAgentID(r.agent),
+                status: r.status,
+                priority: r.priority,
+                dependencies: deps,
+                createdAt: r.created_at
+            };
+        });
+    }
+    static getLogs(agentName) {
+        const db = this.getDB();
+        let rows;
+        const cleanName = agentName ? agentName.replace("@", "") : undefined;
+        if (cleanName) {
+            rows = db.prepare("SELECT * FROM logs WHERE agent = ? ORDER BY timestamp DESC").all(cleanName);
+        }
+        else {
+            rows = db.prepare("SELECT * FROM logs ORDER BY timestamp DESC").all();
+        }
+        return rows.map(r => ({
+            id: asLogID(r.id),
+            timestamp: r.timestamp,
+            agent: asAgentID(r.agent),
+            action: r.action,
+            trace_id: r.trace_id || undefined,
+            status: r.status,
+            summary: maskText(r.summary),
+            findings: r.findings ? maskText(r.findings) : undefined,
+            prev_hash: r.prev_hash || undefined,
+            hash: r.hash || undefined
+        }));
+    }
+    static setMetadata(key, value) {
+        this.getDB().prepare(`
+            INSERT INTO metadata (key, value) VALUES (?, ?)
+            ON CONFLICT(key) DO UPDATE SET value = excluded.value
+        `).run(key, value);
+    }
+    static getMetadata(key) {
+        const row = this.getDB().prepare("SELECT value FROM metadata WHERE key = ?").get(key);
+        return row ? row.value : null;
+    }
+    // === LOOP COOLDOWN PERSISTENCE ===
+    static saveLoopCooldown(agent, cooldownUntil, detail, cooldownCount = 1) {
+        const cleanAgent = agent.replace("@", "");
+        this.getDB().prepare(`
+            INSERT INTO loop_cooldowns (agent, cooldown_until, detail, cooldown_count, updated_at)
+            VALUES (?, ?, ?, ?, datetime('now'))
+            ON CONFLICT(agent) DO UPDATE SET
+                cooldown_until = excluded.cooldown_until,
+                detail = excluded.detail,
+                cooldown_count = excluded.cooldown_count,
+                updated_at = datetime('now')
+        `).run(cleanAgent, cooldownUntil, detail, cooldownCount);
+    }
+    static getLoopCooldown(agent) {
+        const cleanAgent = agent.replace("@", "");
+        try {
+            const row = this.getDB().prepare("SELECT * FROM loop_cooldowns WHERE agent = ?").get(cleanAgent);
+            if (!row)
+                return null;
+            return {
+                agent: row.agent,
+                cooldownUntil: row.cooldown_until,
+                detail: row.detail,
+                cooldownCount: row.cooldown_count
+            };
+        }
+        catch (err) {
+            logger.debug(`Failed to get loop cooldown: ${err.message}`);
+            return null;
+        }
+    }
+    static clearLoopCooldown(agent) {
+        const cleanAgent = agent.replace("@", "");
+        const info = this.getDB().prepare("DELETE FROM loop_cooldowns WHERE agent = ?").run(cleanAgent);
+        return info.changes > 0;
+    }
+    static clearAllLoopCooldowns() {
+        try {
+            this.getDB().prepare("DELETE FROM loop_cooldowns").run();
+        }
+        catch (err) {
+            logger.debug(`Failed to clear all loop cooldowns: ${err.message}`);
+        }
+    }
+    static listActiveLoopCooldowns() {
+        const now = Date.now();
+        try {
+            const rows = this.getDB().prepare("SELECT * FROM loop_cooldowns WHERE cooldown_until > ?").all(now);
+            return rows.map(r => ({
+                agent: r.agent,
+                cooldownUntil: r.cooldown_until,
+                detail: r.detail,
+                cooldownCount: r.cooldown_count
+            }));
+        }
+        catch (err) {
+            logger.debug(`Failed to list active loop cooldowns: ${err.message}`);
+            return [];
+        }
+    }
+    static purgeExpiredLoopCooldowns() {
+        const now = Date.now();
+        try {
+            const info = this.getDB().prepare("DELETE FROM loop_cooldowns WHERE cooldown_until <= ?").run(now);
+            return info.changes;
+        }
+        catch (err) {
+            logger.debug(`Failed to purge expired loop cooldowns: ${err.message}`);
+            return 0;
+        }
+    }
+    // === APPROVALS PERSISTENCE ===
+    static saveApproval(app) {
+        this.saveApprovalRequest(app);
+    }
+    static saveApprovalRequest(request) {
+        const db = this.getDB();
+        db.prepare(`
+            INSERT OR REPLACE INTO approvals (
+                trace_id, tool_name, agent, risk_score, risk_level, reason, args,
+                created_at, expires_at, status, passcode
+            ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `).run(request.traceId, request.toolName, request.agent, request.riskScore, request.riskLevel, request.reason, JSON.stringify(request.args), request.createdAt, request.expiresAt, request.status || "PENDING", request.passcode || null);
+    }
+    static getApproval(traceId) {
+        try {
+            const row = this.getDB().prepare("SELECT * FROM approvals WHERE trace_id = ?").get(traceId);
+            if (!row)
+                return null;
+            return {
+                traceId: row.trace_id,
+                toolName: row.tool_name,
+                agent: row.agent,
+                riskScore: row.risk_score,
+                riskLevel: row.risk_level,
+                reason: row.reason,
+                args: JSON.parse(row.args || "{}"),
+                createdAt: row.created_at,
+                expiresAt: row.expires_at,
+                status: row.status,
+                passcode: row.passcode || undefined
+            };
+        }
+        catch (err) {
+            logger.debug(`Failed to get approval: ${err.message}`);
+            return null;
+        }
+    }
+    static getPendingApprovals() {
+        try {
+            const rows = this.getDB().prepare("SELECT * FROM approvals WHERE status = 'PENDING'").all();
+            return rows.map(row => ({
+                traceId: row.trace_id,
+                toolName: row.tool_name,
+                agent: row.agent,
+                riskScore: row.risk_score,
+                riskLevel: row.risk_level,
+                reason: row.reason,
+                args: JSON.parse(row.args || "{}"),
+                createdAt: row.created_at,
+                expiresAt: row.expires_at,
+                status: row.status,
+                passcode: row.passcode || undefined
+            }));
+        }
+        catch (err) {
+            logger.debug(`Failed to get pending approvals: ${err.message}`);
+            return [];
+        }
+    }
+    static updateApprovalStatus(traceId, status) {
+        this.getDB().prepare("UPDATE approvals SET status = ? WHERE trace_id = ?").run(status, traceId);
+    }
+    static clearAllApprovals() {
+        try {
+            this.getDB().prepare("DELETE FROM approvals").run();
+        }
+        catch (err) {
+            logger.debug(`Failed to clear approvals: ${err.message}`);
+        }
+    }
+    // === DISCIPLINE PERSISTENCE ===
+    static saveDiscipline(agent, stats) {
+        const cleanAgent = agent.replace("@", "");
+        this.getDB().prepare(`
+            INSERT INTO discipline (agent, total_calls, violations, last_violation, cooldown_until, updated_at)
+            VALUES (?, ?, ?, ?, ?, datetime('now'))
+            ON CONFLICT(agent) DO UPDATE SET
+                total_calls = excluded.total_calls,
+                violations = excluded.violations,
+                last_violation = excluded.last_violation,
+                cooldown_until = excluded.cooldown_until,
+                updated_at = datetime('now')
+        `).run(cleanAgent, stats.totalCalls, stats.violations, stats.lastViolation, stats.cooldownUntil);
+    }
+    static getDiscipline(agent) {
+        const cleanAgent = agent.replace("@", "");
+        try {
+            const row = this.getDB().prepare("SELECT * FROM discipline WHERE agent = ?").get(cleanAgent);
+            if (!row)
+                return null;
+            return {
+                agent: row.agent,
+                totalCalls: row.total_calls,
+                violations: row.violations,
+                lastViolation: row.last_violation,
+                cooldownUntil: row.cooldown_until
+            };
+        }
+        catch (err) {
+            logger.debug(`Failed to get discipline: ${err.message}`);
+            return null;
+        }
+    }
+    static getAllDiscipline() {
+        try {
+            const rows = this.getDB().prepare("SELECT * FROM discipline").all();
+            return rows.map(row => ({
+                agent: row.agent,
+                totalCalls: row.total_calls,
+                violations: row.violations,
+                lastViolation: row.last_violation,
+                cooldownUntil: row.cooldown_until
+            }));
+        }
+        catch (err) {
+            logger.debug(`Failed to get all discipline: ${err.message}`);
+            return [];
+        }
+    }
+    static clearAllDiscipline() {
+        try {
+            this.getDB().prepare("DELETE FROM discipline").run();
+        }
+        catch (err) {
+            logger.debug(`Failed to clear discipline: ${err.message}`);
+        }
+    }
+    // === DISCIPLINE CALL HISTORY (restart-durable rate limiting) ===
+    static recordDisciplineCall(agent, tool, timestamp, argsSize) {
+        const cleanAgent = agent.replace("@", "");
+        try {
+            this.getDB().prepare("INSERT INTO discipline_calls (agent, tool, ts, args_size) VALUES (?, ?, ?, ?)").run(cleanAgent, tool, timestamp, argsSize);
+        }
+        catch (err) {
+            logger.debug(`Failed to record discipline call: ${err.message}`);
+        }
+    }
+    static getRecentDisciplineCalls(agent, sinceTs) {
+        const cleanAgent = agent.replace("@", "");
+        try {
+            const rows = this.getDB().prepare("SELECT tool, ts, args_size FROM discipline_calls WHERE agent = ? AND ts > ? ORDER BY ts ASC").all(cleanAgent, sinceTs);
+            return rows.map(r => ({ tool: r.tool, timestamp: r.ts, argsSize: r.args_size }));
+        }
+        catch (err) {
+            logger.debug(`Failed to get recent discipline calls: ${err.message}`);
+            return [];
+        }
+    }
+    static pruneDisciplineCalls(beforeTs) {
+        try {
+            this.getDB().prepare("DELETE FROM discipline_calls WHERE ts < ?").run(beforeTs);
+        }
+        catch (err) {
+            logger.debug(`Failed to prune discipline calls: ${err.message}`);
+        }
+    }
+    static clearDisciplineCalls(agent) {
+        try {
+            if (agent) {
+                this.getDB().prepare("DELETE FROM discipline_calls WHERE agent = ?").run(agent.replace("@", ""));
+            }
+            else {
+                this.getDB().prepare("DELETE FROM discipline_calls").run();
+            }
+        }
+        catch (err) {
+            logger.debug(`Failed to clear discipline calls: ${err.message}`);
+        }
+    }
+    // === CODE GRAPH (incremental symbol/file index) ===
+    static getCodeFileHash(filePath) {
+        try {
+            const row = this.getDB().prepare("SELECT hash FROM code_files WHERE path = ?").get(filePath);
+            return row?.hash ?? null;
+        }
+        catch (err) {
+            logger.debug(`Failed to get code file hash: ${err.message}`);
+            return null;
+        }
+    }
+    static upsertCodeFile(filePath, hash) {
+        this.getDB().prepare(`
+            INSERT INTO code_files (path, hash, updated_at) VALUES (?, ?, datetime('now'))
+            ON CONFLICT(path) DO UPDATE SET hash = excluded.hash, updated_at = datetime('now')
+        `).run(filePath, hash);
+    }
+    static replaceCodeSymbols(filePath, symbols) {
+        const db = this.getDB();
+        const tx = db.transaction(() => {
+            db.prepare("DELETE FROM code_symbols WHERE file = ?").run(filePath);
+            const ins = db.prepare("INSERT INTO code_symbols (file, name, kind, start_line, end_line, signature, exported) VALUES (?, ?, ?, ?, ?, ?, ?)");
+            for (const s of symbols) {
+                ins.run(filePath, s.name, s.kind, s.startLine, s.endLine, s.signature, s.exported ? 1 : 0);
+            }
+        });
+        tx();
+    }
+    static replaceCodeImports(filePath, specifiers) {
+        const db = this.getDB();
+        const tx = db.transaction(() => {
+            db.prepare("DELETE FROM code_imports WHERE file = ?").run(filePath);
+            const ins = db.prepare("INSERT INTO code_imports (file, specifier) VALUES (?, ?)");
+            for (const s of specifiers)
+                ins.run(filePath, s);
+        });
+        tx();
+    }
+    static deleteCodeFile(filePath) {
+        const db = this.getDB();
+        const tx = db.transaction(() => {
+            db.prepare("DELETE FROM code_symbols WHERE file = ?").run(filePath);
+            db.prepare("DELETE FROM code_imports WHERE file = ?").run(filePath);
+            db.prepare("DELETE FROM code_files WHERE path = ?").run(filePath);
+        });
+        tx();
+    }
+    static getAllCodeFilePaths() {
+        try {
+            return this.getDB().prepare("SELECT path FROM code_files").all().map((r) => r.path);
+        }
+        catch (err) {
+            logger.debug(`Failed to list code files: ${err.message}`);
+            return [];
+        }
+    }
+    static searchCodeSymbols(query, limit = 20) {
+        try {
+            const rows = this.getDB()
+                .prepare("SELECT file, name, kind, start_line, end_line, signature, exported FROM code_symbols " +
+                "WHERE name LIKE ? ORDER BY (name = ?) DESC, length(name) ASC LIMIT ?")
+                .all(`%${query}%`, query, limit);
+            return rows.map((r) => ({
+                file: r.file,
+                name: r.name,
+                kind: r.kind,
+                startLine: r.start_line,
+                endLine: r.end_line,
+                signature: r.signature,
+                exported: r.exported === 1,
+            }));
+        }
+        catch (err) {
+            logger.debug(`Failed to search code symbols: ${err.message}`);
+            return [];
+        }
+    }
+    static getCodeGraphStats() {
+        try {
+            const db = this.getDB();
+            const files = db.prepare("SELECT COUNT(*) AS c FROM code_files").get().c;
+            const symbols = db.prepare("SELECT COUNT(*) AS c FROM code_symbols").get().c;
+            const imports = db.prepare("SELECT COUNT(*) AS c FROM code_imports").get().c;
+            return { files, symbols, imports };
+        }
+        catch (err) {
+            logger.debug(`Failed to read code graph stats: ${err.message}`);
+            return { files: 0, symbols: 0, imports: 0 };
+        }
+    }
+    static clearCodeGraph() {
+        const db = this.getDB();
+        const tx = db.transaction(() => {
+            db.prepare("DELETE FROM code_symbols").run();
+            db.prepare("DELETE FROM code_imports").run();
+            db.prepare("DELETE FROM code_files").run();
+        });
+        tx();
+    }
+    static checkIntegrity() {
+        try {
+            const db = this.getDB();
+            const res = verifyDatabaseIntegrity(db, "quick");
+            return { ok: res.ok, message: res.messages.join("; ") || "unknown" };
+        }
+        catch (err) {
+            return { ok: false, message: err.message };
+        }
+    }
+    static verifyDatabaseIntegrity(mode = "full") {
+        return verifyDatabaseIntegrity(this.getDB(), mode);
+    }
+    static getMigrationStatus() {
+        return getMigrationStatus(this.getDB());
+    }
+    static backup(destinationPath) {
+        const db = this.getDB();
+        const frameworkDir = resolveFrameworkDir();
+        const defaultDest = path.join(frameworkDir, "backups", `atabey-${new Date().toISOString().replace(/[:.]/g, "-")}.db`);
+        return backupDatabase(db, destinationPath || defaultDest);
+    }
+    static restore(backupPath, targetDbPath) {
+        const frameworkDir = resolveFrameworkDir();
+        const target = targetDbPath || path.join(frameworkDir, "atabey.db");
+        this.reset();
+        return restoreDatabase(backupPath, target);
+    }
+    // === API CATALOG (endpoint registry) ===
+    static saveApiEndpoint(endpoint) {
+        this.getDB().prepare(`
+            INSERT INTO api_endpoints (method, path, tag, summary, auth_required, request_schema, response_schema, source, updated_at)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+            ON CONFLICT(method, path) DO UPDATE SET
+                tag = excluded.tag,
+                summary = excluded.summary,
+                auth_required = excluded.auth_required,
+                request_schema = excluded.request_schema,
+                response_schema = excluded.response_schema,
+                source = excluded.source,
+                updated_at = excluded.updated_at
+        `).run(endpoint.method.toUpperCase(), endpoint.path, endpoint.tag ?? null, endpoint.summary ?? null, endpoint.authRequired ? 1 : 0, endpoint.requestSchema ?? null, endpoint.responseSchema ?? null, endpoint.source ?? null, endpoint.updatedAt || new Date().toISOString());
+    }
+    static getApiEndpoints(filter = {}) {
+        const conditions = [];
+        const params = [];
+        if (filter.tag) {
+            conditions.push("tag = ?");
+            params.push(filter.tag);
+        }
+        if (filter.method) {
+            conditions.push("method = ?");
+            params.push(filter.method.toUpperCase());
+        }
+        if (filter.search) {
+            conditions.push("(LOWER(path) LIKE ? OR LOWER(request_schema) LIKE ? OR LOWER(response_schema) LIKE ? OR LOWER(summary) LIKE ?)");
+            const like = `%${filter.search.toLowerCase()}%`;
+            params.push(like, like, like, like);
+        }
+        const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+        const rows = this.getDB().prepare(`SELECT method, path, tag, summary, auth_required, request_schema, response_schema, source, updated_at
+             FROM api_endpoints ${where} ORDER BY path ASC, method ASC`).all(...params);
+        return rows.map((r) => this.rowToApiEndpoint(r));
+    }
+    static findApiEndpoint(pathQuery, method) {
+        const conditions = ["path = ?"];
+        const params = [pathQuery];
+        if (method) {
+            conditions.push("method = ?");
+            params.push(method.toUpperCase());
+        }
+        let rows = this.getDB().prepare(`SELECT method, path, tag, summary, auth_required, request_schema, response_schema, source, updated_at
+             FROM api_endpoints WHERE ${conditions.join(" AND ")}`).all(...params);
+        if (rows.length === 0) {
+            // Fallback: substring match when exact path not found.
+            rows = this.getDB().prepare(`SELECT method, path, tag, summary, auth_required, request_schema, response_schema, source, updated_at
+                 FROM api_endpoints WHERE path LIKE ?${method ? " AND method = ?" : ""}`).all(`%${pathQuery}%`, ...(method ? [method.toUpperCase()] : []));
+        }
+        return rows.map((r) => this.rowToApiEndpoint(r));
+    }
+    static deleteApiEndpoint(method, path) {
+        return this.getDB().prepare("DELETE FROM api_endpoints WHERE method = ? AND path = ?")
+            .run(method.toUpperCase(), path).changes > 0;
+    }
+    /** Replace the whole catalog with a fresh scan; returns upserted/deleted counts. */
+    static replaceApiCatalog(endpoints) {
+        const db = this.getDB();
+        const tx = db.transaction(() => {
+            const keys = new Set(endpoints.map((e) => `${e.method.toUpperCase()} ${e.path}`));
+            const existing = db.prepare("SELECT method, path FROM api_endpoints").all();
+            let deleted = 0;
+            for (const row of existing) {
+                if (!keys.has(`${row.method} ${row.path}`)) {
+                    deleted += db.prepare("DELETE FROM api_endpoints WHERE method = ? AND path = ?").run(row.method, row.path).changes;
+                }
+            }
+            for (const e of endpoints)
+                this.saveApiEndpoint(e);
+            return { upserted: endpoints.length, deleted };
+        });
+        return tx();
+    }
+    static rowToApiEndpoint(r) {
+        return {
+            method: String(r.method),
+            path: String(r.path),
+            tag: r.tag ?? undefined,
+            summary: r.summary ?? undefined,
+            authRequired: Number(r.auth_required) === 1,
+            requestSchema: r.request_schema ?? undefined,
+            responseSchema: r.response_schema ?? undefined,
+            source: r.source ?? undefined,
+            updatedAt: String(r.updated_at),
+        };
+    }
+    static reset() {
+        if (this.db) {
+            this.db.close();
+            this.db = null;
+        }
+    }
+}
+/** Canonical alias */
+export const Storage = AtabeyStorage;
+//# sourceMappingURL=storage.js.map