kcg-code 0.0.0-stage → 0.1.0

package/src/server/db/auth.ts

@@ -0,0 +1,311 @@
+/**
+ * Repository kunci aplikasi (lock screen): pengaturan tunggal (`auth_settings`,
+ * id = 1) dan sesi login per perangkat (`auth_sessions`).
+ *
+ * Hanya hash yang disimpan: argon2id untuk sandi, SHA-256 untuk token sesi.
+ * Passkey (`auth_passkeys`) hanya menyimpan kunci publik.
+ */
+import type { Database } from "bun:sqlite";
+
+export type LockKind = "pin" | "password";
+
+export interface AuthSettings {
+  lockKind: LockKind | null;
+  lockHash: string | null;
+  nickname: string | null;
+  avatarMime: string | null;
+  /** Avatar bawaan (id preset) — null bila memakai foto / tanpa avatar. */
+  avatarPreset: string | null;
+  avatarVersion: number;
+  autoLockMinutes: number;
+  /** Onboarding (welcome screen) selesai; null = instalasi baru. */
+  onboardedAt: number | null;
+  updatedAt: number;
+}
+
+export interface AuthSessionRow {
+  id: string;
+  tokenHash: string;
+  userAgent: string | null;
+  createdAt: number;
+  lastSeenAt: number;
+  expiresAt: number;
+}
+
+export interface PasskeyRow {
+  id: string;
+  /** Credential ID WebAuthn (base64url). */
+  credentialId: string;
+  /** Kunci publik COSE. */
+  publicKey: Uint8Array;
+  counter: number;
+  transports: string[];
+  /** Domain tempat passkey didaftarkan. */
+  rpId: string;
+  name: string;
+  /** `singleDevice` | `multiDevice` (tersinkron, mis. iCloud/Google). */
+  deviceType: string | null;
+  backedUp: boolean;
+  createdAt: number;
+  lastUsedAt: number | null;
+}
+
+interface PasskeyRowRaw {
+  id: string;
+  credential_id: string;
+  public_key: Uint8Array;
+  counter: number;
+  transports: string | null;
+  rp_id: string;
+  name: string;
+  device_type: string | null;
+  backed_up: number;
+  created_at: number;
+  last_used_at: number | null;
+}
+
+function mapPasskey(r: PasskeyRowRaw): PasskeyRow {
+  let transports: string[] = [];
+  try {
+    const parsed = r.transports ? JSON.parse(r.transports) : [];
+    if (Array.isArray(parsed)) transports = parsed.filter((t) => typeof t === "string");
+  } catch {
+    // Kolom rusak -> tanpa hint transport (WebAuthn tetap jalan).
+  }
+  return {
+    id: r.id,
+    credentialId: r.credential_id,
+    publicKey: new Uint8Array(r.public_key),
+    counter: r.counter,
+    transports,
+    rpId: r.rp_id,
+    name: r.name,
+    deviceType: r.device_type,
+    backedUp: r.backed_up === 1,
+    createdAt: r.created_at,
+    lastUsedAt: r.last_used_at,
+  };
+}
+
+interface SettingsRow {
+  lock_kind: string | null;
+  lock_hash: string | null;
+  nickname: string | null;
+  avatar_mime: string | null;
+  avatar_preset: string | null;
+  avatar_version: number;
+  auto_lock_minutes: number;
+  onboarded_at: number | null;
+  updated_at: number;
+}
+
+interface SessionRowRaw {
+  id: string;
+  token_hash: string;
+  user_agent: string | null;
+  created_at: number;
+  last_seen_at: number;
+  expires_at: number;
+}
+
+export const DEFAULT_AUTO_LOCK_MINUTES = 15;
+
+function mapSettings(r: SettingsRow): AuthSettings {
+  return {
+    lockKind: r.lock_kind === "pin" || r.lock_kind === "password" ? r.lock_kind : null,
+    lockHash: r.lock_hash,
+    nickname: r.nickname,
+    avatarMime: r.avatar_mime,
+    avatarPreset: r.avatar_preset,
+    avatarVersion: r.avatar_version,
+    autoLockMinutes: r.auto_lock_minutes,
+    onboardedAt: r.onboarded_at,
+    updatedAt: r.updated_at,
+  };
+}
+
+function mapSession(r: SessionRowRaw): AuthSessionRow {
+  return {
+    id: r.id,
+    tokenHash: r.token_hash,
+    userAgent: r.user_agent,
+    createdAt: r.created_at,
+    lastSeenAt: r.last_seen_at,
+    expiresAt: r.expires_at,
+  };
+}
+
+export function createAuthRepo(db: Database) {
+  const q = {
+    ensure: db.query(
+      "INSERT OR IGNORE INTO auth_settings (id, auto_lock_minutes, updated_at) VALUES (1, ?, ?)",
+    ),
+    getSettings: db.query(
+      `SELECT lock_kind, lock_hash, nickname, avatar_mime, avatar_preset, avatar_version,
+              auto_lock_minutes, onboarded_at, updated_at FROM auth_settings WHERE id = 1`,
+    ),
+    setLock: db.query(
+      "UPDATE auth_settings SET lock_kind = ?, lock_hash = ?, updated_at = ? WHERE id = 1",
+    ),
+    setNickname: db.query("UPDATE auth_settings SET nickname = ?, updated_at = ? WHERE id = 1"),
+    // Foto & preset saling eksklusif: mengatur satu menghapus yang lain.
+    setAvatar: db.query(
+      `UPDATE auth_settings SET avatar = ?, avatar_mime = ?, avatar_preset = NULL,
+              avatar_version = avatar_version + 1, updated_at = ? WHERE id = 1`,
+    ),
+    setPreset: db.query(
+      `UPDATE auth_settings SET avatar_preset = ?, avatar = NULL, avatar_mime = NULL,
+              avatar_version = avatar_version + 1, updated_at = ? WHERE id = 1`,
+    ),
+    getAvatar: db.query("SELECT avatar, avatar_mime FROM auth_settings WHERE id = 1"),
+    setAutoLock: db.query(
+      "UPDATE auth_settings SET auto_lock_minutes = ?, updated_at = ? WHERE id = 1",
+    ),
+    setOnboarded: db.query(
+      "UPDATE auth_settings SET onboarded_at = ?, updated_at = ? WHERE id = 1 AND onboarded_at IS NULL",
+    ),
+    insertSession: db.query(
+      `INSERT INTO auth_sessions (id, token_hash, user_agent, created_at, last_seen_at, expires_at)
+       VALUES (?, ?, ?, ?, ?, ?)`,
+    ),
+    getSessionByHash: db.query("SELECT * FROM auth_sessions WHERE token_hash = ?"),
+    getSessionById: db.query("SELECT * FROM auth_sessions WHERE id = ?"),
+    touchSession: db.query("UPDATE auth_sessions SET last_seen_at = ? WHERE id = ?"),
+    deleteSession: db.query("DELETE FROM auth_sessions WHERE id = ?"),
+    deleteAllSessions: db.query("DELETE FROM auth_sessions"),
+    deleteOtherSessions: db.query("DELETE FROM auth_sessions WHERE id <> ?"),
+    listSessions: db.query("SELECT * FROM auth_sessions ORDER BY last_seen_at DESC"),
+    deleteExpired: db.query("DELETE FROM auth_sessions WHERE expires_at <= ?"),
+    insertPasskey: db.query(
+      `INSERT INTO auth_passkeys (id, credential_id, public_key, counter, transports, rp_id, name,
+                                  device_type, backed_up, created_at, last_used_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    ),
+    listPasskeys: db.query("SELECT * FROM auth_passkeys ORDER BY created_at ASC"),
+    listPasskeysByRp: db.query(
+      "SELECT * FROM auth_passkeys WHERE rp_id = ? ORDER BY created_at ASC",
+    ),
+    getPasskeyByCredential: db.query("SELECT * FROM auth_passkeys WHERE credential_id = ?"),
+    getPasskeyById: db.query("SELECT * FROM auth_passkeys WHERE id = ?"),
+    usePasskey: db.query("UPDATE auth_passkeys SET counter = ?, last_used_at = ? WHERE id = ?"),
+    renamePasskey: db.query("UPDATE auth_passkeys SET name = ? WHERE id = ?"),
+    deletePasskey: db.query("DELETE FROM auth_passkeys WHERE id = ?"),
+    deleteAllPasskeys: db.query("DELETE FROM auth_passkeys"),
+  };
+
+  function ensureSettings(now: number): void {
+    q.ensure.run(DEFAULT_AUTO_LOCK_MINUTES, now);
+  }
+
+  return {
+    getAuthSettings(now: number): AuthSettings {
+      ensureSettings(now);
+      return mapSettings(q.getSettings.get() as SettingsRow);
+    },
+    setAuthLock(kind: LockKind | null, hash: string | null, now: number): void {
+      ensureSettings(now);
+      q.setLock.run(kind, hash, now);
+    },
+    setAuthNickname(nickname: string | null, now: number): void {
+      ensureSettings(now);
+      q.setNickname.run(nickname, now);
+    },
+    setAuthAvatar(bytes: Uint8Array | null, mime: string | null, now: number): void {
+      ensureSettings(now);
+      q.setAvatar.run(bytes, mime, now);
+    },
+    setAuthAvatarPreset(preset: string, now: number): void {
+      ensureSettings(now);
+      q.setPreset.run(preset, now);
+    },
+    getAuthAvatar(): { bytes: Uint8Array; mime: string } | null {
+      const row = q.getAvatar.get() as {
+        avatar: Uint8Array | null;
+        avatar_mime: string | null;
+      } | null;
+      if (!row?.avatar || !row.avatar_mime) return null;
+      return { bytes: row.avatar, mime: row.avatar_mime };
+    },
+    setAuthAutoLock(minutes: number, now: number): void {
+      ensureSettings(now);
+      q.setAutoLock.run(minutes, now);
+    },
+    /** Tandai onboarding selesai (idempoten: waktu pertama yang dipakai). */
+    setAuthOnboarded(now: number): void {
+      ensureSettings(now);
+      q.setOnboarded.run(now, now);
+    },
+    insertAuthSession(s: AuthSessionRow): void {
+      q.insertSession.run(s.id, s.tokenHash, s.userAgent, s.createdAt, s.lastSeenAt, s.expiresAt);
+    },
+    getAuthSessionByHash(tokenHash: string): AuthSessionRow | null {
+      const row = q.getSessionByHash.get(tokenHash) as SessionRowRaw | null;
+      return row ? mapSession(row) : null;
+    },
+    getAuthSessionById(id: string): AuthSessionRow | null {
+      const row = q.getSessionById.get(id) as SessionRowRaw | null;
+      return row ? mapSession(row) : null;
+    },
+    touchAuthSession(id: string, now: number): void {
+      q.touchSession.run(now, id);
+    },
+    deleteAuthSession(id: string): void {
+      q.deleteSession.run(id);
+    },
+    deleteAllAuthSessions(): void {
+      q.deleteAllSessions.run();
+    },
+    deleteOtherAuthSessions(keepId: string): void {
+      q.deleteOtherSessions.run(keepId);
+    },
+    listAuthSessions(): AuthSessionRow[] {
+      return (q.listSessions.all() as SessionRowRaw[]).map(mapSession);
+    },
+    deleteExpiredAuthSessions(now: number): void {
+      q.deleteExpired.run(now);
+    },
+    insertPasskey(p: PasskeyRow): void {
+      q.insertPasskey.run(
+        p.id,
+        p.credentialId,
+        p.publicKey,
+        p.counter,
+        JSON.stringify(p.transports),
+        p.rpId,
+        p.name,
+        p.deviceType,
+        p.backedUp ? 1 : 0,
+        p.createdAt,
+        p.lastUsedAt,
+      );
+    },
+    listPasskeys(rpId?: string): PasskeyRow[] {
+      const rows = (
+        rpId === undefined ? q.listPasskeys.all() : q.listPasskeysByRp.all(rpId)
+      ) as PasskeyRowRaw[];
+      return rows.map(mapPasskey);
+    },
+    getPasskeyByCredentialId(credentialId: string): PasskeyRow | null {
+      const row = q.getPasskeyByCredential.get(credentialId) as PasskeyRowRaw | null;
+      return row ? mapPasskey(row) : null;
+    },
+    getPasskeyById(id: string): PasskeyRow | null {
+      const row = q.getPasskeyById.get(id) as PasskeyRowRaw | null;
+      return row ? mapPasskey(row) : null;
+    },
+    markPasskeyUsed(id: string, counter: number, now: number): void {
+      q.usePasskey.run(counter, now, id);
+    },
+    renamePasskey(id: string, name: string): void {
+      q.renamePasskey.run(name, id);
+    },
+    deletePasskey(id: string): void {
+      q.deletePasskey.run(id);
+    },
+    deleteAllPasskeys(): void {
+      q.deleteAllPasskeys.run();
+    },
+  };
+}
+
+export type AuthRepo = ReturnType<typeof createAuthRepo>;

package/src/server/db/messages.ts

@@ -0,0 +1,50 @@
+/**
+ * Repository pesan percakapan terstruktur (append-only). Seluruh tulis baca
+ * pesan milik satu Session, jadi penjagaan `SESSION_NOT_FOUND` ada di sini.
+ */
+import type { Database } from "bun:sqlite";
+import type { SessionMessage } from "../../types";
+import type { Result } from "../result";
+import { errResult, type MessageRow, mapMessage } from "./rows";
+import { sessionExists } from "./sessions";
+
+export function createMessageRepo(db: Database) {
+  const q = {
+    insertMessage: db.query(
+      "INSERT INTO messages (session_id, message_id, role, parts_json, created_at) VALUES (?, ?, ?, ?, ?)",
+    ),
+    getMessages: db.query(
+      "SELECT session_id, message_id, role, parts_json, created_at FROM messages WHERE session_id = ? ORDER BY created_at ASC, id ASC",
+    ),
+  };
+
+  return {
+    insertMessage(message: SessionMessage): Result<SessionMessage> {
+      try {
+        if (!sessionExists(db, message.sessionId)) return errResult("SESSION_NOT_FOUND");
+        q.insertMessage.run(
+          message.sessionId,
+          message.id,
+          message.role,
+          JSON.stringify(message.parts),
+          message.createdAt,
+        );
+        return { ok: true, data: message };
+      } catch (e) {
+        return errResult(`MESSAGE_WRITE_FAILED: ${(e as Error).message}`);
+      }
+    },
+
+    getMessages(sessionId: string): Result<SessionMessage[]> {
+      try {
+        if (!sessionExists(db, sessionId)) return errResult("SESSION_NOT_FOUND");
+        const rows = q.getMessages.all(sessionId) as MessageRow[];
+        return { ok: true, data: rows.map(mapMessage) };
+      } catch (e) {
+        return errResult(`MESSAGE_READ_FAILED: ${(e as Error).message}`);
+      }
+    },
+  };
+}
+
+export type MessageRepo = ReturnType<typeof createMessageRepo>;

package/src/server/db/projects.ts

@@ -0,0 +1,106 @@
+/**
+ * Repository Projects. Berinteraksi dengan tabel `sessions` hanya untuk
+ * penjagaan referensial `deleteProject` (membaca, tidak menulis).
+ */
+import type { Database } from "bun:sqlite";
+import type { Project, Session } from "../../types";
+import type { Result, SimpleResult } from "../result";
+import { errResult, mapProject, mapSession, type ProjectRow, type SessionRow } from "./rows";
+
+export function createProjectRepo(db: Database) {
+  const q = {
+    insertProject: db.query(
+      "INSERT INTO projects (id, name, path, instructions, created_at) VALUES (?, ?, ?, ?, ?)",
+    ),
+    updateInstructions: db.query("UPDATE projects SET instructions = ? WHERE id = ?"),
+    getProjectById: db.query("SELECT * FROM projects WHERE id = ?"),
+    getProjectByName: db.query("SELECT * FROM projects WHERE name = ?"),
+    getProjectByPath: db.query("SELECT * FROM projects WHERE path = ?"),
+    listProjects: db.query("SELECT * FROM projects ORDER BY created_at ASC, name ASC"),
+    listProjectSessions: db.query(
+      "SELECT * FROM sessions WHERE project_id = ? ORDER BY created_at ASC, id ASC",
+    ),
+    deleteProjectRow: db.query("DELETE FROM projects WHERE id = ?"),
+  };
+
+  return {
+    insertProject(project: Project): Result<Project> {
+      try {
+        q.insertProject.run(
+          project.id,
+          project.name,
+          project.path,
+          project.instructions ?? null,
+          project.createdAt,
+        );
+        return { ok: true, data: project };
+      } catch (e) {
+        const msg = (e as Error).message;
+        if (msg.includes("projects.name")) return errResult("NAME_TAKEN");
+        if (msg.includes("projects.path")) return errResult("PATH_TAKEN");
+        return errResult(`PROJECT_WRITE_FAILED: ${msg}`);
+      }
+    },
+
+    getProjectById(id: string): Result<Project> {
+      const row = q.getProjectById.get(id) as ProjectRow | null;
+      if (!row) return errResult("PROJECT_NOT_FOUND");
+      return { ok: true, data: mapProject(row) };
+    },
+
+    getProjectByName(name: string): Result<Project> {
+      const row = q.getProjectByName.get(name) as ProjectRow | null;
+      if (!row) return errResult("PROJECT_NOT_FOUND");
+      return { ok: true, data: mapProject(row) };
+    },
+
+    getProjectByPath(filePath: string): Result<Project> {
+      const row = q.getProjectByPath.get(filePath) as ProjectRow | null;
+      if (!row) return errResult("PROJECT_NOT_FOUND");
+      return { ok: true, data: mapProject(row) };
+    },
+
+    /** Simpan custom instruction Project; `null` = hapus instruksi. */
+    updateProjectInstructions(projectId: string, instructions: string | null): Result<Project> {
+      try {
+        const res = q.updateInstructions.run(instructions, projectId);
+        if (res.changes === 0) return errResult("PROJECT_NOT_FOUND");
+        const row = q.getProjectById.get(projectId) as ProjectRow | null;
+        if (!row) return errResult("PROJECT_NOT_FOUND");
+        return { ok: true, data: mapProject(row) };
+      } catch (e) {
+        return errResult(`PROJECT_WRITE_FAILED: ${(e as Error).message}`);
+      }
+    },
+
+    listProjects(): Project[] {
+      return (q.listProjects.all() as ProjectRow[]).map(mapProject);
+    },
+
+    /** Session milik satu Project (dipakai sebelum menghapus Project). */
+    listProjectSessions(projectId: string): Session[] {
+      return (q.listProjectSessions.all(projectId) as SessionRow[]).map(mapSession);
+    },
+
+    /**
+     * Hapus baris Project. Session milik Project harus sudah dihapus lebih
+     * dulu: `sessions.project_id` punya foreign key ke `projects(id)`, dan
+     * menghapus Session lewat jalur ini akan melewatkan pembersihan sesi
+     * remote opencode + lampiran gambarnya.
+     */
+    deleteProject(projectId: string): SimpleResult {
+      try {
+        const existing = q.getProjectById.get(projectId) as ProjectRow | null;
+        if (!existing) return errResult("PROJECT_NOT_FOUND");
+        const sessions = q.listProjectSessions.all(projectId) as SessionRow[];
+        if (sessions.length > 0) return errResult("PROJECT_HAS_SESSIONS");
+        q.deleteProjectRow.run(projectId);
+        return { ok: true };
+      } catch (e) {
+        return errResult(`PROJECT_DELETE_FAILED: ${(e as Error).message}`);
+      }
+    },
+  };
+}
+
+export type ProjectRepo = ReturnType<typeof createProjectRepo>;

package/src/server/db/prompts.ts

@@ -0,0 +1,78 @@
+/**
+ * Repository prompt interaktif (permission/question opencode) per Session.
+ */
+import type { Database } from "bun:sqlite";
+import type { InteractivePrompt, PromptStatus } from "../../types";
+import type { Result } from "../result";
+import { errResult, mapPrompt, type PromptRow } from "./rows";
+import { sessionExists } from "./sessions";
+
+export function createPromptRepo(db: Database) {
+  const q = {
+    insertPrompt: db.query(
+      "INSERT INTO prompts (id, session_id, kind, type, custom, multiple, title, options_json, questions_json, status, created_at, resolved_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)",
+    ),
+    getPrompt: db.query("SELECT * FROM prompts WHERE id = ?"),
+    pendingPrompts: db.query(
+      "SELECT * FROM prompts WHERE session_id = ? AND status = 'pending' ORDER BY created_at ASC, id ASC",
+    ),
+    updatePrompt: db.query("UPDATE prompts SET status = ?, resolved_at = ? WHERE id = ?"),
+  };
+
+  return {
+    insertPrompt(prompt: InteractivePrompt): Result<InteractivePrompt> {
+      try {
+        if (!sessionExists(db, prompt.sessionId)) return errResult("SESSION_NOT_FOUND");
+        q.insertPrompt.run(
+          prompt.id,
+          prompt.sessionId,
+          prompt.kind,
+          prompt.type,
+          prompt.custom === true ? 1 : 0,
+          // Flag multi-select question (default false) — ikut tersimpan agar
+          // kartu yang dirender ulang dari history tetap multi-select.
+          prompt.multiple === true ? 1 : 0,
+          prompt.title,
+          prompt.options ? JSON.stringify(prompt.options) : null,
+          // Multi-question: seluruh pertanyaan request (null = pertanyaan
+          // tunggal — field legacy sudah cukup).
+          prompt.questions && prompt.questions.length > 0 ? JSON.stringify(prompt.questions) : null,
+          prompt.status,
+          prompt.createdAt,
+          prompt.resolvedAt,
+        );
+        return { ok: true, data: prompt };
+      } catch (e) {
+        return errResult(`PROMPT_WRITE_FAILED: ${(e as Error).message}`);
+      }
+    },
+
+    getPrompt(promptId: string): Result<InteractivePrompt> {
+      const row = q.getPrompt.get(promptId) as PromptRow | null;
+      if (!row) return errResult("PROMPT_NOT_FOUND");
+      return { ok: true, data: mapPrompt(row) };
+    },
+
+    listPendingPrompts(sessionId: string): InteractivePrompt[] {
+      return (q.pendingPrompts.all(sessionId) as PromptRow[]).map(mapPrompt);
+    },
+
+    updatePromptStatus(
+      promptId: string,
+      status: PromptStatus,
+      resolvedAt = Date.now(),
+    ): Result<InteractivePrompt> {
+      try {
+        const existing = q.getPrompt.get(promptId) as PromptRow | null;
+        if (!existing) return errResult("PROMPT_NOT_FOUND");
+        q.updatePrompt.run(status, resolvedAt, promptId);
+        const updated = mapPrompt(q.getPrompt.get(promptId) as PromptRow);
+        return { ok: true, data: updated };
+      } catch (e) {
+        return errResult(`PROMPT_UPDATE_FAILED: ${(e as Error).message}`);
+      }
+    },
+  };
+}
+
+export type PromptRepo = ReturnType<typeof createPromptRepo>;

package/src/server/db/rows.ts

@@ -0,0 +1,150 @@
+/**
+ * Bentuk baris SQLite & pemetaan ke tipe domain (shared antar repository).
+ * Internal data-layer — tidak untuk dipakai luar `server/db`.
+ */
+import type {
+  InteractivePrompt,
+  MessagePart,
+  Project,
+  PromptStatus,
+  Session,
+  SessionMessage,
+  SessionModel,
+  SessionStatus,
+} from "../../types";
+import { normalizePromptOptions } from "../../types";
+
+/** Hasil gagal seragam `{ ok: false; error }`. */
+export function errResult(msg: string): { ok: false; error: string } {
+  return { ok: false, error: msg };
+}
+
+export interface ProjectRow {
+  id: string;
+  name: string;
+  path: string;
+  instructions: string | null;
+  created_at: number;
+}
+
+export interface SessionRow {
+  id: string;
+  project_id: string;
+  agent_type: string;
+  cwd: string;
+  status: string;
+  oc_session_id: string | null;
+  model: string | null;
+  agent: string | null;
+  title: string | null;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface PromptRow {
+  id: string;
+  session_id: string;
+  kind: string;
+  type: string;
+  custom: number;
+  multiple: number;
+  title: string | null;
+  options_json: string | null;
+  questions_json: string | null;
+  status: string;
+  created_at: number;
+  resolved_at: number | null;
+}
+
+export interface MessageRow {
+  session_id: string;
+  message_id: string;
+  role: string;
+  parts_json: string;
+  created_at: number;
+}
+
+export function mapProject(r: ProjectRow): Project {
+  return {
+    id: r.id,
+    name: r.name,
+    path: r.path,
+    createdAt: r.created_at,
+    instructions: r.instructions ?? null,
+  };
+}
+
+/**
+ * Parse kolom `sessions.model` (JSON) -> SessionModel.
+ * Nilai NULL/korup/tidak lengkap dianggap "pakai model default" (null).
+ */
+export function parseModel(raw: string | null): SessionModel | null {
+  if (raw === null || raw === "") return null;
+  try {
+    const obj = JSON.parse(raw) as { providerID?: unknown; modelID?: unknown } | null;
+    if (obj && typeof obj.providerID === "string" && typeof obj.modelID === "string") {
+      return { providerID: obj.providerID, modelID: obj.modelID };
+    }
+  } catch {
+    /* data korup -> default */
+  }
+  return null;
+}
+
+export function mapSession(r: SessionRow): Session {
+  return {
+    id: r.id,
+    projectId: r.project_id,
+    agentType: r.agent_type as Session["agentType"],
+    cwd: r.cwd,
+    status: r.status as SessionStatus,
+    ocSessionId: r.oc_session_id,
+    model: parseModel(r.model),
+    agent: r.agent ?? null,
+    title: r.title ?? null,
+    createdAt: r.created_at,
+    updatedAt: r.updated_at,
+  };
+}
+
+export function mapPrompt(r: PromptRow): InteractivePrompt {
+  // `questions_json` korup / bukan array -> dianggap tanpa multi-question
+  // (field legacy tetap dipakai) — sama seperti toleransi options_json.
+  let questions: InteractivePrompt["questions"];
+  if (r.questions_json) {
+    try {
+      const parsed: unknown = JSON.parse(r.questions_json);
+      if (Array.isArray(parsed) && parsed.length > 0) {
+        questions = parsed as InteractivePrompt["questions"];
+      }
+    } catch {
+      /* data korup -> tanpa multi-question */
+    }
+  }
+  return {
+    id: r.id,
+    sessionId: r.session_id,
+    kind: (r.kind as InteractivePrompt["kind"]) ?? "permission",
+    type: r.type as InteractivePrompt["type"],
+    custom: r.custom === 1,
+    multiple: r.multiple === 1,
+    title: r.title,
+    // `options_json` bisa berisi string polos (DB lama) atau objek opsi
+    // ({label, description}) — normalisasi toleran terhadap keduanya.
+    options: r.options_json ? normalizePromptOptions(JSON.parse(r.options_json)) : null,
+    questions,
+    status: r.status as PromptStatus,
+    createdAt: r.created_at,
+    resolvedAt: r.resolved_at,
+  };
+}
+
+export function mapMessage(r: MessageRow): SessionMessage {
+  return {
+    id: r.message_id,
+    sessionId: r.session_id,
+    role: r.role as SessionMessage["role"],
+    parts: JSON.parse(r.parts_json) as MessagePart[],
+    createdAt: r.created_at,
+  };
+}