forkit-connect 0.1.0

package/dist/v1/state.js

@@ -0,0 +1,1318 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalStateStore = void 0;
+const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const C2_EVENT_RETENTION_LIMIT = 1000;
+const C2_EVENT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+// Events synced more than 2 hours ago are evicted before applying the retention cap.
+const C2_SYNCED_EVICTION_AGE_MS = 2 * 60 * 60 * 1000;
+// After this many failures an event is moved to dead_letter to stop retry spam.
+const C2_MAX_RETRY_COUNT = 5;
+const PULSE_EVENT_RETENTION_LIMIT = 500;
+// Observation events repeat on every daemon scan cycle for the same entity.
+// Only the newest per (event_type, entity_key) matters; all prior copies are noise.
+const C2_OBSERVATION_EVENT_TYPES = new Set([
+    'connect_runtime_detected',
+    'connect_runtime_active',
+    'connect_runtime_unavailable',
+    'connect_runtime_restored',
+    'connect_runtime_health_changed',
+    'connect_model_detected',
+    'connect_agent_detected',
+    'connect_agent_inactive',
+    'connect_pulse_green',
+    'connect_pulse_amber',
+    'connect_pulse_red',
+    'connect_daemon_started',
+    'connect_shadow_candidate_detected',
+]);
+function c2ObservationKey(event) {
+    const entity = event.discovery_hash ?? event.runtime_gaid ?? event.model_name ?? '';
+    return `${event.event_type}|${entity}|${event.passport_gaid ?? ''}`;
+}
+const DELIVERED_NOTIFICATION_RETENTION_LIMIT = 1000;
+const AGENT_MODEL_USAGE_RETENTION_LIMIT = 5000;
+const STATE_DATABASE_FILENAME = 'state.v1.sqlite';
+const LEGACY_STATE_FILENAME = 'state.v1.json';
+const STATE_SCHEMA_VERSION = 1;
+const STATE_SECTION_NAMES = [
+    'runtime_identity',
+    'user_session_reference',
+    'workspace_binding',
+    'project_binding',
+    'effective_binding',
+    'connect_identity',
+    'connect_config',
+    'service_entitlements',
+    'daemon_status',
+    'last_c2_sync_at',
+    'last_c2_sync_error',
+    'c2_events',
+    'last_pulse_at',
+    'last_pulse_summary',
+    'last_pulse_error',
+    'pulse_events',
+    'build_sessions',
+    'detected_agents',
+    'agent_links',
+    'agent_model_usage',
+    'detected_runtimes',
+    'runtime_passports',
+    'c2_sessions',
+    'evolution_candidates',
+    'detected_models',
+    'model_bindings',
+    'delivered_notifications',
+    'evidence_events',
+    'sync_queue',
+    'pending_reviews',
+    'lifecycle_monitor_records',
+];
+function hashCredentialRef(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex').slice(0, 24);
+}
+function nowIso() {
+    return new Date().toISOString();
+}
+function buildDefaultConfig(now) {
+    return {
+        discovery_mode: 'advisory_only',
+        daemon_interval_seconds: 30,
+        notifications_enabled: true,
+        notification_min_interval_seconds: 300,
+        evolution_bridge_enabled: true,
+        updated_at: now,
+    };
+}
+function buildDefaultConnectIdentity() {
+    return {
+        connect_device_id: null,
+        connect_public_key: null,
+        connect_identity_status: 'uninitialized',
+        paired_at: null,
+        pairing_method: null,
+        last_identity_check_at: null,
+    };
+}
+function buildDefaultUserSessionReference(now) {
+    return {
+        credentialPresent: false,
+        credentialRef: null,
+        authStatus: 'missing',
+        lastAuthenticatedAt: null,
+        updatedAt: now,
+    };
+}
+function buildDefaultServiceEntitlements(now) {
+    return {
+        secure_device_pairing: true,
+        signed_events: false,
+        evolution_bridge: true,
+        orchestrator: false,
+        handoff: false,
+        advisory_mode: true,
+        auto_draft: false,
+        notifications: true,
+        authenticated: false,
+        workspace_bound: false,
+        project_bound: false,
+        tier: null,
+        updated_at: now,
+    };
+}
+function buildDefaultDaemonStatus() {
+    return {
+        daemon_running: false,
+        daemon_pid: null,
+        started_at: null,
+        last_scan_at: null,
+        last_scan_summary: null,
+        last_error: null,
+    };
+}
+function normalizeIntervalSeconds(value) {
+    const numeric = Number(value);
+    if (!Number.isFinite(numeric))
+        return 30;
+    return Math.max(5, Math.floor(numeric));
+}
+function normalizeConfig(value, now) {
+    const record = value && typeof value === 'object' ? value : {};
+    const mode = record.discovery_mode === 'auto_draft' ? 'auto_draft' : 'advisory_only';
+    const updatedAt = typeof record.updated_at === 'string' && record.updated_at.trim() ? record.updated_at : now;
+    return {
+        discovery_mode: mode,
+        daemon_interval_seconds: normalizeIntervalSeconds(record.daemon_interval_seconds),
+        notifications_enabled: record.notifications_enabled !== false,
+        notification_min_interval_seconds: normalizeIntervalSeconds(record.notification_min_interval_seconds ?? 300),
+        evolution_bridge_enabled: record.evolution_bridge_enabled !== false,
+        updated_at: updatedAt,
+    };
+}
+function normalizeConnectIdentity(value) {
+    const record = value && typeof value === 'object' ? value : {};
+    const identity = buildDefaultConnectIdentity();
+    return {
+        connect_device_id: typeof record.connect_device_id === 'string' && record.connect_device_id.trim()
+            ? record.connect_device_id
+            : identity.connect_device_id,
+        connect_public_key: typeof record.connect_public_key === 'string' && record.connect_public_key.trim()
+            ? record.connect_public_key
+            : identity.connect_public_key,
+        connect_identity_status: record.connect_identity_status === 'ready'
+            || record.connect_identity_status === 'paired'
+            || record.connect_identity_status === 'error'
+            ? record.connect_identity_status
+            : identity.connect_identity_status,
+        paired_at: typeof record.paired_at === 'string' ? record.paired_at : identity.paired_at,
+        pairing_method: record.pairing_method === 'local_generated'
+            || record.pairing_method === 'device_login'
+            || record.pairing_method === 'restored'
+            ? record.pairing_method
+            : identity.pairing_method,
+        last_identity_check_at: typeof record.last_identity_check_at === 'string'
+            ? record.last_identity_check_at
+            : identity.last_identity_check_at,
+    };
+}
+function normalizeServiceEntitlements(value, now) {
+    const record = value && typeof value === 'object' ? value : {};
+    const initial = buildDefaultServiceEntitlements(now);
+    return {
+        secure_device_pairing: record.secure_device_pairing !== false,
+        signed_events: record.signed_events === true,
+        evolution_bridge: record.evolution_bridge !== false,
+        orchestrator: record.orchestrator === true,
+        handoff: record.handoff === true,
+        advisory_mode: record.advisory_mode !== false,
+        auto_draft: record.auto_draft === true,
+        notifications: record.notifications !== false,
+        authenticated: record.authenticated === true,
+        workspace_bound: record.workspace_bound === true,
+        project_bound: record.project_bound === true,
+        tier: typeof record.tier === 'string' && record.tier.trim() ? record.tier : initial.tier,
+        updated_at: typeof record.updated_at === 'string' && record.updated_at.trim() ? record.updated_at : now,
+    };
+}
+function normalizeBindingState(value) {
+    return value === 'pending_approval'
+        || value === 'approved_needs_scope'
+        || value === 'active'
+        || value === 'paused'
+        || value === 'revoked'
+        || value === 'stale'
+        || value === 'needs_reconsent'
+        ? value
+        : 'pending_approval';
+}
+function normalizeBindingRole(value) {
+    return value === 'owner'
+        || value === 'maintainer'
+        || value === 'contributor'
+        || value === 'viewer'
+        ? value
+        : null;
+}
+function normalizeConsentProfile(value) {
+    const record = value && typeof value === 'object' ? value : {};
+    return {
+        allow_draft_creation: record.allow_draft_creation !== false,
+        allow_evidence_sync: record.allow_evidence_sync === true,
+        allow_runtime_session_sync: record.allow_runtime_session_sync === true,
+        allow_lineage_suggestions: record.allow_lineage_suggestions === true,
+        allow_publication_support: record.allow_publication_support === true,
+    };
+}
+function normalizeCapabilityProfile(value) {
+    const record = value && typeof value === 'object' ? value : {};
+    return {
+        binding_active: record.binding_active === true,
+        workspace_bound: record.workspace_bound === true,
+        project_bound: record.project_bound === true,
+        can_create_draft: record.can_create_draft === true,
+        can_sync_evidence: record.can_sync_evidence === true,
+        can_sync_runtime_sessions: record.can_sync_runtime_sessions === true,
+        can_emit_lineage_suggestions: record.can_emit_lineage_suggestions === true,
+        can_prepare_private_publication: record.can_prepare_private_publication === true,
+        can_prepare_public_publication: record.can_prepare_public_publication === true,
+        plan_key: typeof record.plan_key === 'string' && record.plan_key.trim() ? record.plan_key : null,
+        role: normalizeBindingRole(record.role),
+    };
+}
+function normalizeApprovedUser(value) {
+    const record = value && typeof value === 'object' ? value : null;
+    if (!record || typeof record.id !== 'string' || !record.id.trim())
+        return null;
+    const avatarUrl = typeof record.avatarUrl === 'string' && record.avatarUrl.trim()
+        ? record.avatarUrl
+        : typeof record.avatar_url === 'string' && record.avatar_url.trim()
+            ? record.avatar_url
+            : typeof record.picture === 'string' && record.picture.trim()
+                ? record.picture
+                : typeof record.pictureUrl === 'string' && record.pictureUrl.trim()
+                    ? record.pictureUrl
+                    : typeof record.picture_url === 'string' && record.picture_url.trim()
+                        ? record.picture_url
+                        : typeof record.photoUrl === 'string' && record.photoUrl.trim()
+                            ? record.photoUrl
+                            : typeof record.photo_url === 'string' && record.photo_url.trim()
+                                ? record.photo_url
+                                : null;
+    return {
+        id: record.id,
+        name: typeof record.name === 'string' && record.name.trim() ? record.name : null,
+        email: typeof record.email === 'string' && record.email.trim() ? record.email : null,
+        goaid: typeof record.goaid === 'string' && record.goaid.trim() ? record.goaid : null,
+        avatarUrl,
+    };
+}
+function normalizeWorkspaceRef(value) {
+    const record = value && typeof value === 'object' ? value : null;
+    if (!record || typeof record.id !== 'string' || !record.id.trim())
+        return null;
+    return {
+        id: record.id,
+        name: typeof record.name === 'string' && record.name.trim() ? record.name : null,
+        ownerName: typeof record.ownerName === 'string' && record.ownerName.trim() ? record.ownerName : null,
+        passportGaid: typeof record.passportGaid === 'string' && record.passportGaid.trim() ? record.passportGaid : null,
+        passportType: typeof record.passportType === 'string' && record.passportType.trim() ? record.passportType : null,
+        description: typeof record.description === 'string' && record.description.trim() ? record.description : null,
+    };
+}
+function normalizeProjectRef(value) {
+    const record = value && typeof value === 'object' ? value : null;
+    if (!record || typeof record.id !== 'string' || !record.id.trim())
+        return null;
+    return {
+        id: record.id,
+        workspaceId: typeof record.workspaceId === 'string' && record.workspaceId.trim() ? record.workspaceId : null,
+        name: typeof record.name === 'string' && record.name.trim() ? record.name : null,
+        description: typeof record.description === 'string' && record.description.trim() ? record.description : null,
+    };
+}
+function normalizeBindingRecord(value) {
+    const record = value && typeof value === 'object' ? value : null;
+    if (!record || typeof record.bindingId !== 'string' || !record.bindingId.trim())
+        return null;
+    const consentProfile = normalizeConsentProfile(record.consentProfile);
+    const capabilityProfile = normalizeCapabilityProfile(record.capabilityProfile);
+    return {
+        bindingId: record.bindingId,
+        state: normalizeBindingState(record.state),
+        connectDeviceId: typeof record.connectDeviceId === 'string' && record.connectDeviceId.trim() ? record.connectDeviceId : '',
+        approvedUserId: typeof record.approvedUserId === 'string' && record.approvedUserId.trim() ? record.approvedUserId : null,
+        approvedUserGoadid: typeof record.approvedUserGoadid === 'string' && record.approvedUserGoadid.trim() ? record.approvedUserGoadid : null,
+        workspaceId: typeof record.workspaceId === 'string' && record.workspaceId.trim() ? record.workspaceId : null,
+        projectId: typeof record.projectId === 'string' && record.projectId.trim() ? record.projectId : null,
+        planKey: typeof record.planKey === 'string' && record.planKey.trim() ? record.planKey : capabilityProfile.plan_key,
+        role: normalizeBindingRole(record.role ?? capabilityProfile.role),
+        consentProfile,
+        capabilityProfile,
+        approvedAt: typeof record.approvedAt === 'string' && record.approvedAt.trim() ? record.approvedAt : null,
+        revokedAt: typeof record.revokedAt === 'string' && record.revokedAt.trim() ? record.revokedAt : null,
+        lastSeenAt: typeof record.lastSeenAt === 'string' && record.lastSeenAt.trim() ? record.lastSeenAt : null,
+        createdAt: typeof record.createdAt === 'string' && record.createdAt.trim() ? record.createdAt : nowIso(),
+        updatedAt: typeof record.updatedAt === 'string' && record.updatedAt.trim() ? record.updatedAt : nowIso(),
+    };
+}
+function normalizeEffectiveBinding(value) {
+    const record = value && typeof value === 'object' ? value : null;
+    if (!record)
+        return null;
+    const binding = normalizeBindingRecord(record.binding);
+    if (!binding)
+        return null;
+    return {
+        binding,
+        capability_profile: normalizeCapabilityProfile(record.capability_profile ?? binding.capabilityProfile),
+        consent_profile: normalizeConsentProfile(record.consent_profile ?? binding.consentProfile),
+        approved_user: normalizeApprovedUser(record.approved_user),
+        workspace: normalizeWorkspaceRef(record.workspace),
+        project: normalizeProjectRef(record.project),
+        fetched_at: typeof record.fetched_at === 'string' && record.fetched_at.trim() ? record.fetched_at : nowIso(),
+    };
+}
+function normalizeDaemonStatus(value) {
+    const record = value && typeof value === 'object' ? value : {};
+    return {
+        daemon_running: Boolean(record.daemon_running),
+        daemon_pid: typeof record.daemon_pid === 'number' && Number.isFinite(record.daemon_pid) ? record.daemon_pid : null,
+        started_at: typeof record.started_at === 'string' ? record.started_at : null,
+        last_scan_at: typeof record.last_scan_at === 'string' ? record.last_scan_at : null,
+        last_scan_summary: record.last_scan_summary && typeof record.last_scan_summary === 'object'
+            ? record.last_scan_summary
+            : null,
+        last_error: typeof record.last_error === 'string' ? record.last_error : null,
+    };
+}
+function normalizeState(parsed) {
+    const now = nowIso();
+    const initial = buildInitialState();
+    const value = parsed && typeof parsed === 'object' ? parsed : {};
+    return {
+        runtime_identity: value.runtime_identity && typeof value.runtime_identity === 'object'
+            ? { ...initial.runtime_identity, ...value.runtime_identity }
+            : initial.runtime_identity,
+        user_session_reference: value.user_session_reference && typeof value.user_session_reference === 'object'
+            ? {
+                ...initial.user_session_reference,
+                ...value.user_session_reference,
+                credentialPresent: value.user_session_reference.credentialPresent === true
+                    || typeof value.user_session_reference.sessionRef === 'string',
+                credentialRef: typeof value.user_session_reference.credentialRef === 'string'
+                    ? String(value.user_session_reference.credentialRef)
+                    : typeof value.user_session_reference.sessionRef === 'string'
+                        ? hashCredentialRef(String(value.user_session_reference.sessionRef))
+                        : null,
+                authStatus: value.user_session_reference.authStatus === 'authenticated'
+                    || typeof value.user_session_reference.sessionRef === 'string'
+                    ? 'authenticated'
+                    : 'missing',
+                lastAuthenticatedAt: typeof value.user_session_reference.lastAuthenticatedAt === 'string'
+                    ? String(value.user_session_reference.lastAuthenticatedAt)
+                    : typeof value.user_session_reference.sessionRef === 'string'
+                        ? String(value.user_session_reference.updatedAt || now)
+                        : null,
+                updatedAt: typeof value.user_session_reference.updatedAt === 'string'
+                    ? String(value.user_session_reference.updatedAt)
+                    : now,
+            }
+            : initial.user_session_reference,
+        workspace_binding: value.workspace_binding && typeof value.workspace_binding === 'object'
+            ? { ...initial.workspace_binding, ...value.workspace_binding }
+            : initial.workspace_binding,
+        project_binding: value.project_binding && typeof value.project_binding === 'object'
+            ? { ...initial.project_binding, ...value.project_binding }
+            : initial.project_binding,
+        effective_binding: normalizeEffectiveBinding(value.effective_binding),
+        connect_identity: normalizeConnectIdentity(value.connect_identity),
+        connect_config: normalizeConfig(value.connect_config, now),
+        service_entitlements: normalizeServiceEntitlements(value.service_entitlements, now),
+        daemon_status: normalizeDaemonStatus(value.daemon_status),
+        last_c2_sync_at: typeof value.last_c2_sync_at === 'string' ? value.last_c2_sync_at : null,
+        last_c2_sync_error: typeof value.last_c2_sync_error === 'string' ? value.last_c2_sync_error : null,
+        c2_events: Array.isArray(value.c2_events) ? value.c2_events : [],
+        last_pulse_at: typeof value.last_pulse_at === 'string' ? value.last_pulse_at : null,
+        last_pulse_summary: value.last_pulse_summary && typeof value.last_pulse_summary === 'object'
+            ? value.last_pulse_summary
+            : null,
+        last_pulse_error: typeof value.last_pulse_error === 'string' ? value.last_pulse_error : null,
+        pulse_events: Array.isArray(value.pulse_events) ? value.pulse_events : [],
+        build_sessions: Array.isArray(value.build_sessions) ? value.build_sessions : [],
+        detected_agents: Array.isArray(value.detected_agents) ? value.detected_agents : [],
+        agent_links: Array.isArray(value.agent_links) ? value.agent_links : [],
+        agent_model_usage: Array.isArray(value.agent_model_usage) ? value.agent_model_usage : [],
+        detected_runtimes: Array.isArray(value.detected_runtimes) ? value.detected_runtimes : [],
+        runtime_passports: Array.isArray(value.runtime_passports) ? value.runtime_passports : [],
+        c2_sessions: Array.isArray(value.c2_sessions) ? value.c2_sessions : [],
+        evolution_candidates: Array.isArray(value.evolution_candidates) ? value.evolution_candidates : [],
+        detected_models: Array.isArray(value.detected_models) ? value.detected_models : [],
+        model_bindings: Array.isArray(value.model_bindings)
+            ? value.model_bindings.map((binding) => ({
+                ...binding,
+                runtimeSignalKeyPresent: binding.runtimeSignalKeyPresent === true || typeof binding.runtimeSignalApiKey === 'string',
+                runtimeSignalKeyRef: typeof binding.runtimeSignalKeyRef === 'string'
+                    ? String(binding.runtimeSignalKeyRef)
+                    : typeof binding.runtimeSignalApiKey === 'string'
+                        ? hashCredentialRef(String(binding.runtimeSignalApiKey))
+                        : null,
+            }))
+            : [],
+        delivered_notifications: Array.isArray(value.delivered_notifications) ? value.delivered_notifications : [],
+        evidence_events: Array.isArray(value.evidence_events) ? value.evidence_events : [],
+        sync_queue: Array.isArray(value.sync_queue) ? value.sync_queue : [],
+        pending_reviews: Array.isArray(value.pending_reviews) ? value.pending_reviews : [],
+        lifecycle_monitor_records: Array.isArray(value.lifecycle_monitor_records) ? value.lifecycle_monitor_records : [],
+    };
+}
+function buildInitialState() {
+    const now = nowIso();
+    return {
+        runtime_identity: {
+            runtimeId: (0, node_crypto_1.randomUUID)(),
+            hostname: node_os_1.default.hostname(),
+            platform: node_os_1.default.platform(),
+            arch: node_os_1.default.arch(),
+            createdAt: now,
+        },
+        user_session_reference: buildDefaultUserSessionReference(now),
+        workspace_binding: {
+            workspaceId: null,
+            updatedAt: now,
+        },
+        project_binding: {
+            projectId: null,
+            updatedAt: now,
+        },
+        effective_binding: null,
+        connect_identity: buildDefaultConnectIdentity(),
+        connect_config: buildDefaultConfig(now),
+        service_entitlements: buildDefaultServiceEntitlements(now),
+        daemon_status: buildDefaultDaemonStatus(),
+        last_c2_sync_at: null,
+        last_c2_sync_error: null,
+        c2_events: [],
+        last_pulse_at: null,
+        last_pulse_summary: null,
+        last_pulse_error: null,
+        pulse_events: [],
+        build_sessions: [],
+        detected_agents: [],
+        agent_links: [],
+        agent_model_usage: [],
+        detected_runtimes: [],
+        runtime_passports: [],
+        c2_sessions: [],
+        evolution_candidates: [],
+        detected_models: [],
+        model_bindings: [],
+        delivered_notifications: [],
+        evidence_events: [],
+        sync_queue: [],
+        pending_reviews: [],
+        lifecycle_monitor_records: [],
+    };
+}
+function readJsonFile(filePath) {
+    try {
+        const raw = node_fs_1.default.readFileSync(filePath, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+class LocalStateStore {
+    paths;
+    db = null;
+    constructor(baseDir) {
+        const envStateDir = String(process.env.FORKIT_CONNECT_STATE_DIR || '').trim();
+        const stateDir = baseDir ?? (envStateDir || node_path_1.default.join(node_os_1.default.homedir(), '.forkit-connect'));
+        this.paths = {
+            stateDir,
+            stateFile: node_path_1.default.join(stateDir, STATE_DATABASE_FILENAME),
+            legacyStateFile: node_path_1.default.join(stateDir, LEGACY_STATE_FILENAME),
+            identityPrivateKeyFile: node_path_1.default.join(stateDir, 'connect-device.v1.pem'),
+        };
+    }
+    getPaths() {
+        return this.paths;
+    }
+    ensureInitialized() {
+        this.ensureInitializedInternal();
+        return this.readStateFromDatabase();
+    }
+    readState() {
+        this.ensureInitializedInternal();
+        return this.readStateFromDatabase();
+    }
+    readRawStateFile() {
+        const legacy = this.readLegacyStateFile();
+        if (legacy)
+            return legacy;
+        try {
+            this.ensureInitializedInternal();
+            return this.withDatabase((db) => this.loadRawStateRecord(db), true);
+        }
+        catch {
+            return null;
+        }
+    }
+    writeState(state) {
+        const normalized = normalizeState(state);
+        this.ensureInitializedInternal();
+        this.withDatabase((db) => {
+            this.persistState(db, normalized);
+        }, true);
+    }
+    updateSessionCredentialMetadata(input) {
+        return this.mutateState((state) => {
+            state.user_session_reference = {
+                credentialPresent: input.credentialPresent,
+                credentialRef: input.credentialRef,
+                authStatus: input.authStatus,
+                lastAuthenticatedAt: input.lastAuthenticatedAt,
+                updatedAt: input.updatedAt ?? nowIso(),
+            };
+        });
+    }
+    updateWorkspaceProjectBinding(workspaceId, projectId) {
+        return this.mutateState((state) => {
+            state.workspace_binding = {
+                workspaceId,
+                updatedAt: nowIso(),
+            };
+            state.project_binding = {
+                projectId,
+                updatedAt: nowIso(),
+            };
+        });
+    }
+    updateEffectiveBinding(effectiveBinding) {
+        return this.mutateState((state) => {
+            state.effective_binding = effectiveBinding;
+        });
+    }
+    updateConnectConfig(configPatch) {
+        return this.mutateState((state) => {
+            state.connect_config = {
+                ...state.connect_config,
+                ...configPatch,
+                daemon_interval_seconds: configPatch.daemon_interval_seconds !== undefined
+                    ? normalizeIntervalSeconds(configPatch.daemon_interval_seconds)
+                    : state.connect_config.daemon_interval_seconds,
+                notification_min_interval_seconds: configPatch.notification_min_interval_seconds !== undefined
+                    ? normalizeIntervalSeconds(configPatch.notification_min_interval_seconds)
+                    : state.connect_config.notification_min_interval_seconds,
+                updated_at: nowIso(),
+            };
+        });
+    }
+    updateConnectIdentity(identityPatch) {
+        return this.mutateState((state) => {
+            state.connect_identity = {
+                ...state.connect_identity,
+                ...identityPatch,
+            };
+        });
+    }
+    updateServiceEntitlements(entitlements) {
+        return this.mutateState((state) => {
+            state.service_entitlements = entitlements;
+        });
+    }
+    updateDaemonStatus(statusPatch) {
+        return this.mutateState((state) => {
+            state.daemon_status = {
+                ...state.daemon_status,
+                ...statusPatch,
+            };
+        });
+    }
+    appendC2Events(events) {
+        if (events.length === 0) {
+            return this.ensureInitialized();
+        }
+        return this.mutateState((state) => {
+            const existingIds = new Set(state.c2_events.map((event) => event.event_id));
+            // For observation events already pending, track their content keys so we
+            // skip recording a new event when nothing meaningful has changed.
+            const pendingObservationKeys = new Set(state.c2_events
+                .filter((e) => e.sync_state === 'pending' && C2_OBSERVATION_EVENT_TYPES.has(e.event_type))
+                .map(c2ObservationKey));
+            for (const event of events) {
+                if (existingIds.has(event.event_id))
+                    continue;
+                if (C2_OBSERVATION_EVENT_TYPES.has(event.event_type)) {
+                    const key = c2ObservationKey(event);
+                    if (pendingObservationKeys.has(key))
+                        continue; // already have a pending copy of this observation
+                    pendingObservationKeys.add(key);
+                }
+                state.c2_events.push(event);
+                existingIds.add(event.event_id);
+            }
+            // Evict old synced events first so they don't consume the retention cap.
+            const cutoff = Date.now() - C2_SYNCED_EVICTION_AGE_MS;
+            state.c2_events = state.c2_events.filter((event) => event.sync_state !== 'synced' || !event.synced_at || new Date(event.synced_at).getTime() > cutoff);
+            if (state.c2_events.length > C2_EVENT_RETENTION_LIMIT) {
+                state.c2_events = state.c2_events.slice(-C2_EVENT_RETENTION_LIMIT);
+            }
+        });
+    }
+    // Collapses all pending observation events down to one per (event_type, entity_key),
+    // keeping the newest. Also removes any pending events older than C2_EVENT_MAX_AGE_MS.
+    // Safe to call before flushing — transition events and already-synced events are untouched.
+    pruneRedundantPendingC2Events() {
+        let pruned = 0;
+        this.mutateState((state) => {
+            const cutoff = new Date(Date.now() - C2_EVENT_MAX_AGE_MS).toISOString();
+            const keepIds = new Set();
+            const newestObservationByKey = new Map();
+            for (const event of state.c2_events) {
+                // Always keep synced events and transition events; only collapse observation events.
+                if (event.sync_state === 'synced' || !C2_OBSERVATION_EVENT_TYPES.has(event.event_type)) {
+                    // Still drop stale observation-unrelated events that are beyond the age limit
+                    if (event.occurred_at >= cutoff)
+                        keepIds.add(event.event_id);
+                    continue;
+                }
+                // For observation events: track the newest per logical key
+                const key = c2ObservationKey(event);
+                const existing = newestObservationByKey.get(key);
+                if (!existing || event.occurred_at > existing.occurred_at) {
+                    newestObservationByKey.set(key, event);
+                }
+            }
+            for (const event of newestObservationByKey.values()) {
+                keepIds.add(event.event_id);
+            }
+            const before = state.c2_events.length;
+            state.c2_events = state.c2_events.filter((e) => keepIds.has(e.event_id));
+            pruned = before - state.c2_events.length;
+        });
+        return pruned;
+    }
+    // Assigns gaid to every pending event that has none, so events recorded before
+    // a binding existed can still be synced once a binding is established.
+    // Idempotent: only touches events where passport_gaid is null.
+    backfillMissingGaidOnPendingC2Events(gaid) {
+        let count = 0;
+        this.mutateState((state) => {
+            for (let i = 0; i < state.c2_events.length; i++) {
+                const event = state.c2_events[i];
+                if (!event || event.sync_state !== 'pending' || event.passport_gaid)
+                    continue;
+                state.c2_events[i] = { ...event, passport_gaid: gaid };
+                count += 1;
+            }
+        });
+        return count;
+    }
+    updateC2SyncStatus(lastSyncAt, lastSyncError) {
+        return this.mutateState((state) => {
+            state.last_c2_sync_at = lastSyncAt;
+            state.last_c2_sync_error = lastSyncError;
+        });
+    }
+    /**
+     * Backfill pending events that have no passport_gaid with the supplied gaid.
+     * Events recorded before a model was bound lack a GAID; once binding is
+     * confirmed this promotes them to syncable without altering their content.
+     * Returns the number of events updated.
+     */
+    backfillC2EventsWithGaid(gaid) {
+        const trimmed = String(gaid || '').trim();
+        if (!trimmed)
+            return 0;
+        let count = 0;
+        this.mutateState((state) => {
+            for (let i = 0; i < state.c2_events.length; i++) {
+                const event = state.c2_events[i];
+                if (event && event.sync_state === 'pending' && !String(event.passport_gaid || '').trim()) {
+                    state.c2_events[i] = { ...event, passport_gaid: trimmed };
+                    count += 1;
+                }
+            }
+        });
+        return count;
+    }
+    markC2EventSynced(eventId) {
+        return this.mutateState((state) => {
+            const index = state.c2_events.findIndex((event) => event.event_id === eventId);
+            if (index < 0)
+                return;
+            const current = state.c2_events[index];
+            if (!current)
+                return;
+            state.c2_events[index] = {
+                ...current,
+                sync_state: 'synced',
+                synced_at: nowIso(),
+                last_error: null,
+            };
+        });
+    }
+    markC2EventFailed(eventId, errorMessage) {
+        return this.mutateState((state) => {
+            const index = state.c2_events.findIndex((event) => event.event_id === eventId);
+            if (index < 0)
+                return;
+            const current = state.c2_events[index];
+            if (!current)
+                return;
+            const retryCount = (current.retry_count ?? 0) + 1;
+            state.c2_events[index] = {
+                ...current,
+                sync_state: retryCount >= C2_MAX_RETRY_COUNT ? 'dead_letter' : 'pending',
+                synced_at: null,
+                last_error: errorMessage,
+                retry_count: retryCount,
+            };
+        });
+    }
+    discardC2Event(eventId, errorMessage) {
+        return this.mutateState((state) => {
+            const index = state.c2_events.findIndex((event) => event.event_id === eventId);
+            if (index < 0)
+                return;
+            const current = state.c2_events[index];
+            if (!current)
+                return;
+            state.c2_events[index] = {
+                ...current,
+                sync_state: 'dead_letter',
+                synced_at: null,
+                last_error: errorMessage,
+                retry_count: Math.max(current.retry_count ?? 0, C2_MAX_RETRY_COUNT),
+            };
+        });
+    }
+    updatePulseState(summary, lastError, pulseEvents) {
+        return this.mutateState((state) => {
+            state.last_pulse_at = summary?.measured_at ?? state.last_pulse_at;
+            state.last_pulse_summary = summary;
+            state.last_pulse_error = lastError;
+            if (pulseEvents && pulseEvents.length > 0) {
+                state.pulse_events.push(...pulseEvents.map((event) => ({
+                    event_id: (0, node_crypto_1.randomUUID)(),
+                    ...event,
+                })));
+                if (state.pulse_events.length > PULSE_EVENT_RETENTION_LIMIT) {
+                    state.pulse_events = state.pulse_events.slice(-PULSE_EVENT_RETENTION_LIMIT);
+                }
+            }
+        });
+    }
+    upsertDetectedRuntime(runtime) {
+        return this.mutateState((state) => {
+            const index = state.detected_runtimes.findIndex((item) => item.discoveryHash === runtime.discoveryHash);
+            if (index >= 0) {
+                state.detected_runtimes[index] = runtime;
+            }
+            else {
+                state.detected_runtimes.push(runtime);
+            }
+        });
+    }
+    upsertRuntimePassport(runtimePassport) {
+        return this.mutateState((state) => {
+            const index = state.runtime_passports.findIndex((item) => item.runtime_gaid === runtimePassport.runtime_gaid);
+            if (index >= 0) {
+                state.runtime_passports[index] = runtimePassport;
+            }
+            else {
+                state.runtime_passports.push(runtimePassport);
+            }
+            state.runtime_passports.sort((left, right) => right.last_seen_at.localeCompare(left.last_seen_at));
+        });
+    }
+    replaceRuntimePassports(runtimePassports) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const runtimePassport of runtimePassports) {
+                seen.set(runtimePassport.runtime_gaid, runtimePassport);
+            }
+            state.runtime_passports = [...seen.values()].sort((left, right) => right.last_seen_at.localeCompare(left.last_seen_at));
+        });
+    }
+    upsertC2Session(session) {
+        return this.mutateState((state) => {
+            const index = state.c2_sessions.findIndex((item) => item.session_id === session.session_id && item.passport_gaid === session.passport_gaid);
+            if (index >= 0) {
+                state.c2_sessions[index] = session;
+            }
+            else {
+                state.c2_sessions.push(session);
+            }
+            state.c2_sessions.sort((left, right) => String(right.last_seen_at || right.last_control_seen_at || '').localeCompare(String(left.last_seen_at || left.last_control_seen_at || '')));
+        });
+    }
+    replaceC2Sessions(sessions) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const session of sessions) {
+                seen.set(`${session.passport_gaid}:${session.session_id}`, session);
+            }
+            state.c2_sessions = [...seen.values()].sort((left, right) => String(right.last_seen_at || right.last_control_seen_at || '').localeCompare(String(left.last_seen_at || left.last_control_seen_at || '')));
+        });
+    }
+    upsertBuildSession(buildSession) {
+        return this.mutateState((state) => {
+            const index = state.build_sessions.findIndex((item) => item.build_session_id === buildSession.build_session_id);
+            if (index >= 0) {
+                state.build_sessions[index] = buildSession;
+            }
+            else {
+                state.build_sessions.push(buildSession);
+            }
+            state.build_sessions.sort((left, right) => right.updated_at.localeCompare(left.updated_at));
+        });
+    }
+    upsertDetectedAgent(agent) {
+        return this.mutateState((state) => {
+            const index = state.detected_agents.findIndex((item) => item.agent_id === agent.agent_id);
+            if (index >= 0) {
+                state.detected_agents[index] = agent;
+            }
+            else {
+                state.detected_agents.push(agent);
+            }
+            state.detected_agents.sort((left, right) => right.last_seen_at.localeCompare(left.last_seen_at));
+        });
+    }
+    replaceDetectedAgents(agents) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const agent of agents) {
+                seen.set(agent.agent_id, agent);
+            }
+            state.detected_agents = [...seen.values()].sort((left, right) => right.last_seen_at.localeCompare(left.last_seen_at));
+        });
+    }
+    upsertAgentLink(link) {
+        return this.mutateState((state) => {
+            const index = state.agent_links.findIndex((item) => item.agent_id === link.agent_id && item.discoveryHash === link.discoveryHash);
+            if (index >= 0) {
+                state.agent_links[index] = link;
+            }
+            else {
+                state.agent_links.push(link);
+            }
+            state.agent_links.sort((left, right) => right.updated_at.localeCompare(left.updated_at));
+        });
+    }
+    upsertAgentModelUsage(record) {
+        return this.mutateState((state) => {
+            const index = state.agent_model_usage.findIndex((item) => item.usage_id === record.usage_id);
+            if (index >= 0) {
+                state.agent_model_usage[index] = record;
+            }
+            else {
+                state.agent_model_usage.push(record);
+            }
+            state.agent_model_usage.sort((left, right) => right.last_observed_at.localeCompare(left.last_observed_at));
+            if (state.agent_model_usage.length > AGENT_MODEL_USAGE_RETENTION_LIMIT) {
+                state.agent_model_usage = state.agent_model_usage.slice(0, AGENT_MODEL_USAGE_RETENTION_LIMIT);
+            }
+        });
+    }
+    replaceAgentModelUsage(records) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const record of records) {
+                seen.set(record.usage_id, record);
+            }
+            state.agent_model_usage = [...seen.values()]
+                .sort((left, right) => right.last_observed_at.localeCompare(left.last_observed_at))
+                .slice(0, AGENT_MODEL_USAGE_RETENTION_LIMIT);
+        });
+    }
+    replaceDetectedModels(models) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const model of models) {
+                const existing = state.detected_models.find((item) => item.discoveryHash === model.discoveryHash);
+                seen.set(model.discoveryHash, {
+                    ...model,
+                    status: model.status === 'ignored' || model.status === 'bound'
+                        ? model.status
+                        : existing?.status === 'ignored' || existing?.status === 'bound'
+                            ? existing.status
+                            : model.status,
+                    review_state: model.review_state ?? existing?.review_state ?? (existing?.status === 'ignored' ? 'ignored' : undefined),
+                    review_deferred_until: Object.prototype.hasOwnProperty.call(model, 'review_deferred_until')
+                        ? model.review_deferred_until ?? null
+                        : existing?.review_deferred_until ?? null,
+                });
+            }
+            state.detected_models = [...seen.values()];
+        });
+    }
+    replaceEvolutionCandidates(candidates) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const candidate of candidates) {
+                seen.set(candidate.candidate_id, candidate);
+            }
+            state.evolution_candidates = [...seen.values()].sort((left, right) => right.last_detected_at.localeCompare(left.last_detected_at));
+        });
+    }
+    upsertModelBinding(binding) {
+        return this.mutateState((state) => {
+            const index = state.model_bindings.findIndex((item) => item.modelKey === binding.modelKey);
+            if (index >= 0) {
+                state.model_bindings[index] = binding;
+            }
+            else {
+                state.model_bindings.push(binding);
+            }
+        });
+    }
+    replaceModelBindings(bindings) {
+        return this.mutateState((state) => {
+            const seen = new Map();
+            for (const binding of bindings) {
+                seen.set(binding.modelKey, binding);
+            }
+            state.model_bindings = [...seen.values()];
+        });
+    }
+    recordDeliveredNotification(notification) {
+        return this.mutateState((state) => {
+            const index = state.delivered_notifications.findIndex((item) => item.notification_type === notification.notification_type && item.target_id === notification.target_id);
+            if (index >= 0) {
+                state.delivered_notifications[index] = notification;
+            }
+            else {
+                state.delivered_notifications.push(notification);
+            }
+            state.delivered_notifications.sort((left, right) => right.delivered_at.localeCompare(left.delivered_at));
+            if (state.delivered_notifications.length > DELIVERED_NOTIFICATION_RETENTION_LIMIT) {
+                state.delivered_notifications = state.delivered_notifications.slice(0, DELIVERED_NOTIFICATION_RETENTION_LIMIT);
+            }
+        });
+    }
+    addEvidenceEvent(event) {
+        return this.mutateState((state) => {
+            const nextEvent = {
+                id: (0, node_crypto_1.randomUUID)(),
+                createdAt: nowIso(),
+                ...event,
+            };
+            state.evidence_events.push(nextEvent);
+            if (state.evidence_events.length > 5000) {
+                state.evidence_events = state.evidence_events.slice(-5000);
+            }
+        });
+    }
+    enqueue(item) {
+        const state = this.ensureInitialized();
+        const queued = {
+            id: (0, node_crypto_1.randomUUID)(),
+            attempts: 0,
+            createdAt: nowIso(),
+            nextRetryAt: nowIso(),
+            lastError: null,
+            ...item,
+        };
+        state.sync_queue.push(queued);
+        this.writeState(state);
+        return queued;
+    }
+    trimQueueItemsByType(type, keepLatest) {
+        const state = this.ensureInitialized();
+        const safeKeepLatest = Math.max(0, Math.floor(keepLatest));
+        const matchingIndexes = state.sync_queue
+            .map((item, index) => ({ item, index }))
+            .filter((entry) => entry.item.type === type)
+            .map((entry) => entry.index);
+        const overflow = matchingIndexes.length - safeKeepLatest;
+        if (overflow <= 0) {
+            return 0;
+        }
+        const indexesToRemove = new Set(matchingIndexes.slice(0, overflow));
+        state.sync_queue = state.sync_queue.filter((_item, index) => !indexesToRemove.has(index));
+        this.writeState(state);
+        return overflow;
+    }
+    listReadyQueueItems(referenceTime = new Date()) {
+        const state = this.ensureInitialized();
+        return state.sync_queue.filter((item) => new Date(item.nextRetryAt).getTime() <= referenceTime.getTime());
+    }
+    hasPendingPassportDraftForDiscoveryHash(discoveryHash, registrationKey) {
+        const state = this.ensureInitialized();
+        return state.sync_queue.some((item) => {
+            if (item.type !== 'passport-draft')
+                return false;
+            const metadata = item.payload?.metadata;
+            if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
+                return false;
+            const record = metadata;
+            const queuedDiscoveryHash = String(record.discoveryHash || '').trim();
+            const queuedRegistrationKey = String(record.registrationKey || '').trim();
+            return queuedDiscoveryHash === discoveryHash
+                || (!!registrationKey && queuedRegistrationKey === registrationKey);
+        });
+    }
+    markQueueItemResult(id, ok, errorMessage) {
+        const state = this.ensureInitialized();
+        const index = state.sync_queue.findIndex((item) => item.id === id);
+        if (index < 0)
+            return;
+        if (ok) {
+            state.sync_queue.splice(index, 1);
+            this.writeState(state);
+            return;
+        }
+        const item = state.sync_queue[index];
+        if (!item) {
+            this.writeState(state);
+            return;
+        }
+        const attempts = item.attempts + 1;
+        const backoffMs = Math.min(60_000, 2 ** Math.min(10, attempts) * 1000);
+        state.sync_queue[index] = {
+            ...item,
+            attempts,
+            nextRetryAt: new Date(Date.now() + backoffMs).toISOString(),
+            lastError: errorMessage ?? 'sync_failed',
+        };
+        this.writeState(state);
+    }
+    // ─── Lifecycle Monitor ─────────────────────────────────────────────────────
+    upsertPendingReview(review) {
+        return this.mutateState((state) => {
+            const index = state.pending_reviews.findIndex((r) => r.review_id === review.review_id);
+            if (index >= 0) {
+                state.pending_reviews[index] = review;
+            }
+            else {
+                state.pending_reviews.push(review);
+            }
+            // Keep at most 500 reviews (oldest resolved first)
+            if (state.pending_reviews.length > 500) {
+                const resolved = state.pending_reviews.filter((r) => r.status !== 'pending');
+                const pending = state.pending_reviews.filter((r) => r.status === 'pending');
+                state.pending_reviews = [...resolved.slice(-250), ...pending].slice(-500);
+            }
+        });
+    }
+    resolvePendingReview(reviewId, status) {
+        return this.mutateState((state) => {
+            const review = state.pending_reviews.find((r) => r.review_id === reviewId);
+            if (review) {
+                review.status = status;
+                review.reviewed_at = new Date().toISOString();
+            }
+        });
+    }
+    upsertLifecycleMonitorRecord(record) {
+        return this.mutateState((state) => {
+            const index = state.lifecycle_monitor_records.findIndex((r) => r.subject_id === record.subject_id && r.subject_type === record.subject_type);
+            if (index >= 0) {
+                state.lifecycle_monitor_records[index] = record;
+            }
+            else {
+                state.lifecycle_monitor_records.push(record);
+            }
+        });
+    }
+    readIdentityPrivateKey() {
+        if (!node_fs_1.default.existsSync(this.paths.identityPrivateKeyFile)) {
+            return null;
+        }
+        return node_fs_1.default.readFileSync(this.paths.identityPrivateKeyFile, 'utf8');
+    }
+    writeIdentityPrivateKey(privateKeyPem) {
+        this.ensureStateDirectory();
+        node_fs_1.default.writeFileSync(this.paths.identityPrivateKeyFile, privateKeyPem, { mode: 0o600 });
+    }
+    retireLegacyStateFile() {
+        if (!node_fs_1.default.existsSync(this.paths.legacyStateFile))
+            return;
+        node_fs_1.default.rmSync(this.paths.legacyStateFile, { force: true });
+    }
+    mutateState(mutator) {
+        const state = this.ensureInitialized();
+        mutator(state);
+        const normalized = normalizeState(state);
+        this.writeState(normalized);
+        return normalized;
+    }
+    ensureInitializedInternal() {
+        this.withDatabase((db) => {
+            const existing = this.loadRawStateRecord(db);
+            if (existing)
+                return;
+            const legacy = this.readLegacyStateFile();
+            if (legacy) {
+                this.persistState(db, normalizeState(legacy));
+                return;
+            }
+            this.persistState(db, buildInitialState());
+        }, true);
+    }
+    readStateFromDatabase() {
+        return this.withDatabase((db) => {
+            const raw = this.loadRawStateRecord(db);
+            if (!raw) {
+                const initial = buildInitialState();
+                this.persistState(db, initial);
+                return initial;
+            }
+            return normalizeState(raw);
+        }, true);
+    }
+    withDatabase(operation, allowRecovery) {
+        try {
+            const db = this.getDb();
+            return operation(db);
+        }
+        catch (error) {
+            if (allowRecovery && this.isRecoverableDatabaseError(error)) {
+                this.recoverDatabaseFiles();
+                return this.withDatabase(operation, false);
+            }
+            throw error;
+        }
+        finally {
+            this.tightenStatePathPermissions();
+        }
+    }
+    getDb() {
+        if (this.db) {
+            return this.db;
+        }
+        this.ensureStateDirectory();
+        const db = new better_sqlite3_1.default(this.paths.stateFile);
+        try {
+            db.pragma('journal_mode = WAL');
+            db.pragma('synchronous = NORMAL');
+            db.pragma('foreign_keys = ON');
+            db.pragma('busy_timeout = 5000');
+            db.exec(`
+        CREATE TABLE IF NOT EXISTS connect_state_meta (
+          key TEXT PRIMARY KEY,
+          value TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+
+        CREATE TABLE IF NOT EXISTS connect_state_sections (
+          section_name TEXT PRIMARY KEY,
+          payload_json TEXT NOT NULL,
+          updated_at TEXT NOT NULL
+        );
+
+        CREATE TABLE IF NOT EXISTS schema_migrations (
+          version INTEGER PRIMARY KEY,
+          applied_at TEXT NOT NULL
+        );
+      `);
+            const appliedAt = nowIso();
+            db.prepare(`
+        INSERT OR IGNORE INTO schema_migrations (version, applied_at)
+        VALUES (?, ?)
+      `).run(STATE_SCHEMA_VERSION, appliedAt);
+            db.prepare(`
+        INSERT INTO connect_state_meta (key, value, updated_at)
+        VALUES (?, ?, ?)
+        ON CONFLICT(key) DO UPDATE SET
+          value = excluded.value,
+          updated_at = excluded.updated_at
+      `).run('schema_version', String(STATE_SCHEMA_VERSION), appliedAt);
+        }
+        catch (error) {
+            db.close();
+            throw error;
+        }
+        this.db = db;
+        this.tightenStatePathPermissions();
+        return db;
+    }
+    persistState(db, state) {
+        const normalized = normalizeState(state);
+        const updatedAt = nowIso();
+        const upsertSection = db.prepare(`
+      INSERT INTO connect_state_sections (section_name, payload_json, updated_at)
+      VALUES (?, ?, ?)
+      ON CONFLICT(section_name) DO UPDATE SET
+        payload_json = excluded.payload_json,
+        updated_at = excluded.updated_at
+    `);
+        const upsertMeta = db.prepare(`
+      INSERT INTO connect_state_meta (key, value, updated_at)
+      VALUES (?, ?, ?)
+      ON CONFLICT(key) DO UPDATE SET
+        value = excluded.value,
+        updated_at = excluded.updated_at
+    `);
+        const persist = db.transaction((nextState) => {
+            for (const sectionName of STATE_SECTION_NAMES) {
+                upsertSection.run(sectionName, JSON.stringify(nextState[sectionName] ?? null), updatedAt);
+            }
+            upsertMeta.run('last_state_write_at', updatedAt, updatedAt);
+        });
+        persist(normalized);
+    }
+    loadRawStateRecord(db) {
+        const rows = db.prepare(`
+      SELECT section_name, payload_json
+      FROM connect_state_sections
+    `).all();
+        if (rows.length === 0) {
+            return null;
+        }
+        const record = {};
+        for (const row of rows) {
+            try {
+                record[row.section_name] = JSON.parse(row.payload_json);
+            }
+            catch (error) {
+                throw new Error(`invalid_state_payload:${row.section_name}:${error instanceof Error ? error.message : 'parse_failed'}`);
+            }
+        }
+        return record;
+    }
+    readLegacyStateFile() {
+        if (!node_fs_1.default.existsSync(this.paths.legacyStateFile)) {
+            return null;
+        }
+        return readJsonFile(this.paths.legacyStateFile);
+    }
+    ensureStateDirectory() {
+        if (!node_fs_1.default.existsSync(this.paths.stateDir)) {
+            node_fs_1.default.mkdirSync(this.paths.stateDir, { recursive: true, mode: 0o700 });
+        }
+    }
+    tightenStatePathPermissions() {
+        const paths = [
+            this.paths.stateFile,
+            `${this.paths.stateFile}-wal`,
+            `${this.paths.stateFile}-shm`,
+            this.paths.identityPrivateKeyFile,
+        ];
+        for (const filePath of paths) {
+            if (!node_fs_1.default.existsSync(filePath))
+                continue;
+            try {
+                node_fs_1.default.chmodSync(filePath, 0o600);
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    recoverDatabaseFiles() {
+        if (this.db) {
+            try {
+                this.db.close();
+            }
+            catch {
+                // ignore close errors during recovery
+            }
+            this.db = null;
+        }
+        const suffix = `.corrupt-${Date.now()}`;
+        const databaseSidecars = [
+            this.paths.stateFile,
+            `${this.paths.stateFile}-wal`,
+            `${this.paths.stateFile}-shm`,
+        ];
+        for (const filePath of databaseSidecars) {
+            if (!node_fs_1.default.existsSync(filePath))
+                continue;
+            try {
+                node_fs_1.default.renameSync(filePath, `${filePath}${suffix}`);
+            }
+            catch {
+                try {
+                    node_fs_1.default.rmSync(filePath, { force: true });
+                }
+                catch {
+                    continue;
+                }
+            }
+        }
+    }
+    isRecoverableDatabaseError(error) {
+        if (!(error instanceof Error))
+            return false;
+        const message = error.message.toLowerCase();
+        return message.includes('sqlite_corrupt')
+            || message.includes('database disk image is malformed')
+            || message.includes('file is not a database')
+            || message.includes('not a database')
+            || message.includes('malformed')
+            || message.includes('invalid_state_payload:');
+    }
+}
+exports.LocalStateStore = LocalStateStore;
+//# sourceMappingURL=state.js.map