sneakoscope 4.1.0 → 4.2.0

package/dist/core/mad-db/mad-db-coordinator.js

@@ -0,0 +1,287 @@
+import path from 'node:path';
+import { createMission, missionDir, setCurrent } from '../mission.js';
+import { nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { createMadDbCapability, activateMadDbCapability, closeMadDbCycle, MAD_DB_ACK, markMadDbTransportReady, readMadDbCapability } from './mad-db-capability.js';
+import { MadDbMcpExecutor } from './mad-db-executor.js';
+import { createMadDbRuntimeProfile, closeMadDbRuntimeProfile, redactedRuntimeProfile } from './mad-db-runtime-profile.js';
+import { reserveMadDbOperation, transitionMadDbOperation } from './mad-db-operation-store.js';
+import { readBackCheck, runReadBackChecks } from './mad-db-postconditions.js';
+import { madDbOperationClassesFromClassification } from './mad-db-policy.js';
+import { projectRootHash, resolveMadDbTarget } from './mad-db-target.js';
+import { classifySql } from '../db-safety.js';
+export async function prepareMadDbMission(input) {
+    const target = await resolveMadDbTarget(input.root, { args: input.args || [] });
+    const { id, dir } = await createMission(input.root, { mode: 'mad-db', prompt: input.task || 'MadDB SQL-plane execution' });
+    const cycleId = `mad-db-${Date.now().toString(36)}`;
+    const runtimeSessionId = input.runtimeSessionId || `mad-db-session-${Date.now().toString(36)}`;
+    const blockers = [...target.blockers];
+    let profile;
+    if (!target.project_ref) {
+        profile = await createMadDbRuntimeProfile({ root: input.root, missionId: id, cycleId, projectRef: 'missing-project-ref', runtimeSessionId });
+    }
+    else {
+        profile = await createMadDbRuntimeProfile({ root: input.root, missionId: id, cycleId, projectRef: target.project_ref, runtimeSessionId });
+    }
+    const capability = await createMadDbCapability(input.root, {
+        missionId: id,
+        ack: MAD_DB_ACK,
+        cwd: input.root,
+        cycleId,
+        projectRef: target.project_ref || 'missing-project-ref',
+        targetEnvironment: target.target_environment,
+        allowedSchemas: target.allowed_schemas,
+        runtimeSessionId,
+        operatorIntent: input.task,
+        profilePath: profile.profile_path,
+        profileSha256: profile.profile_sha256,
+        serverUrlRedacted: profile.server_url_redacted,
+        operations: [...madDbOperationClassesFromClassification(classifySql(input.task))],
+        status: blockers.length ? 'quarantined' : 'transport_ready'
+    });
+    let toolInventory = null;
+    if (input.verifyTools && !blockers.length) {
+        const executor = new MadDbMcpExecutor(profile);
+        toolInventory = await executor.inventory();
+        await executor.close();
+        await writeJsonAtomic(path.join(dir, 'mad-db', 'runtime', 'tool-inventory.json'), toolInventory);
+        if (!toolInventory.ok)
+            blockers.push('mad_db_execute_sql_or_apply_migration_unavailable');
+        else
+            await markMadDbTransportReady(input.root, id);
+    }
+    await writeJsonAtomic(path.join(dir, 'route-context.json'), {
+        route: 'MadDB',
+        command: '$MAD-DB',
+        mode: 'MADDB',
+        task: input.task,
+        target: { ...target, project_ref: target.project_ref ? `<hash:${target.project_ref_hash}>` : null },
+        capability_file: 'mad-db-capability.json',
+        runtime_profile_manifest: 'mad-db/runtime/runtime-profile-manifest.json',
+        tool_inventory: toolInventory ? 'mad-db/runtime/tool-inventory.json' : null
+    });
+    await writeJsonAtomic(path.join(dir, 'mad-db-gate.json'), {
+        schema: 'sks.mad-db-gate.v1',
+        passed: false,
+        mad_db_capability_active: !blockers.length,
+        sql_plane_all_mutations_allowed: !blockers.length,
+        control_plane_denied: true,
+        mission_id: id,
+        cycle_id: cycleId,
+        blockers,
+        created_at: nowIso()
+    });
+    await setCurrent(input.root, {
+        mission_id: id,
+        mad_db_capability_mission_id: id,
+        route: 'MadDB',
+        route_command: '$MAD-DB',
+        mode: 'MADDB',
+        phase: blockers.length ? 'MADDB_BLOCKED' : 'MADDB_SQL_PLANE_CAPABILITY_ACTIVE',
+        questions_allowed: false,
+        implementation_allowed: !blockers.length,
+        mad_db_active: !blockers.length,
+        mad_db_cycle_id: cycleId,
+        mad_db_runtime_session_id: runtimeSessionId,
+        mad_db_profile_sha256: profile.profile_sha256,
+        mad_db_capability_file: 'mad-db-capability.json',
+        stop_gate: 'mad-db-gate.json',
+        prompt: input.task
+    });
+    return {
+        schema: 'sks.mad-db-prepared-mission.v1',
+        ok: blockers.length === 0,
+        mission_id: id,
+        cycle_id: cycleId,
+        target,
+        capability,
+        runtime_profile: redactedRuntimeProfile(profile),
+        tool_inventory: toolInventory,
+        blockers
+    };
+}
+export async function runMadDbCycle(input) {
+    const timings = {};
+    const start = Date.now();
+    const prepared = await prepareMadDbMission({ root: input.root, task: input.task, args: input.args || [], verifyTools: false });
+    timings.prepare_ms = Date.now() - start;
+    const profile = await recreateProfileFromPrepared(input.root, prepared);
+    const executor = new MadDbMcpExecutor(profile);
+    let inventory = null;
+    let execution = null;
+    let operation = null;
+    let readBack = null;
+    const blockers = [...prepared.blockers];
+    try {
+        const connectStart = Date.now();
+        inventory = await executor.inventory();
+        timings.mcp_connect_ms = Date.now() - connectStart;
+        await writeJsonAtomic(path.join(missionDir(input.root, prepared.mission_id), 'mad-db', 'runtime', 'tool-inventory.json'), inventory);
+        if (!inventory.ok) {
+            blockers.push('mad_db_execute_sql_or_apply_migration_unavailable');
+            throw new Error('mad_db_tool_inventory_failed');
+        }
+        await activateMadDbCapability(input.root, prepared.mission_id);
+        const sql = await resolveSqlInput(input);
+        if (!sql) {
+            blockers.push('mad_db_sql_missing_for_execution');
+            throw new Error('mad_db_sql_missing_for_execution');
+        }
+        const classification = classifySql(sql);
+        const toolName = input.action === 'apply-migration' ? 'apply_migration' : 'execute_sql';
+        const toolCallId = `cli-${input.action}-${sha256(`${prepared.mission_id}:${sql}:${Date.now()}`).slice(0, 16)}`;
+        const reservation = await reserveMadDbOperation({
+            root: input.root,
+            missionId: prepared.mission_id,
+            capability: prepared.capability,
+            toolCallId,
+            toolName,
+            sql,
+            migrationName: input.migrationName || null,
+            operationClasses: madDbOperationClassesFromClassification({ ...classification, toolName })
+        });
+        await transitionMadDbOperation({ root: input.root, missionId: prepared.mission_id, toolCallId, state: 'started' });
+        const execStart = Date.now();
+        execution = input.action === 'apply-migration'
+            ? await executor.applyMigration(input.migrationName || `mad_db_${Date.now()}`, sql)
+            : await executor.executeSql(sql);
+        timings.execution_ms = Date.now() - execStart;
+        operation = await transitionMadDbOperation({
+            root: input.root,
+            missionId: prepared.mission_id,
+            toolCallId,
+            state: execution.ok ? 'succeeded' : 'failed',
+            result: execution
+        });
+        if (!execution.ok)
+            blockers.push('mad_db_tool_execution_failed');
+        if (execution.ok && input.verifySql) {
+            const verifyStart = Date.now();
+            readBack = await runReadBackChecks({
+                root: input.root,
+                missionId: prepared.mission_id,
+                executor,
+                checks: [readBackCheck('operator_verify_sql', input.verifySql)]
+            });
+            timings.verification_ms = Date.now() - verifyStart;
+            if (!readBack.ok)
+                blockers.push('mad_db_read_back_verification_failed');
+            if (operation) {
+                operation = await transitionMadDbOperation({
+                    root: input.root,
+                    missionId: prepared.mission_id,
+                    toolCallId,
+                    state: readBack.ok ? 'verified' : 'verification_failed',
+                    verificationArtifact: readBack.proof_path || null
+                }) || operation;
+            }
+        }
+    }
+    catch (err) {
+        if (!blockers.length)
+            blockers.push(err instanceof Error ? err.message : String(err));
+    }
+    finally {
+        await executor.close();
+    }
+    const closeStart = Date.now();
+    const restoration = await closeMadDbRuntimeProfile({ root: input.root, missionId: prepared.mission_id, profile, reason: 'mad_db_cycle_finally' });
+    await closeMadDbCycle(input.root, prepared.mission_id, prepared.cycle_id, 'mad_db_cycle_finally');
+    timings.close_ms = Date.now() - closeStart;
+    timings.total_ms = Date.now() - start;
+    const result = {
+        schema: 'sks.mad-db-cycle-result.v1',
+        ok: blockers.length === 0 && execution?.ok === true && restoration.ok,
+        mission_id: prepared.mission_id,
+        cycle_id: prepared.cycle_id,
+        action: input.action,
+        target: prepared.target,
+        tool_inventory: inventory,
+        execution,
+        operation,
+        read_back: readBack,
+        read_only_restoration: restoration,
+        capability_closed: true,
+        timings_ms: timings,
+        blockers: restoration.ok ? blockers : [...blockers, ...restoration.blockers]
+    };
+    await writeJsonAtomic(path.join(missionDir(input.root, prepared.mission_id), 'mad-db-result.json'), redactCycleResult(result));
+    await clearMadDbCurrentState(input.root, prepared.mission_id, result.ok, restoration);
+    return result;
+}
+async function clearMadDbCurrentState(root, missionId, ok, restoration) {
+    const currentPath = path.join(root, '.sneakoscope', 'state', 'current.json');
+    const current = await readJson(currentPath, {});
+    if (current.mission_id !== missionId && current.mad_db_capability_mission_id !== missionId)
+        return;
+    await setCurrent(root, {
+        phase: ok ? 'MADDB_CLOSED' : 'MADDB_FAILED_CLOSED',
+        implementation_allowed: false,
+        mad_db_active: false,
+        mad_db_runtime_session_id: null,
+        mad_db_profile_sha256: null,
+        mad_db_read_only_restored: restoration.ok,
+        mad_db_closed_at: nowIso(),
+        mad_db_last_result_file: 'mad-db-result.json'
+    });
+}
+function redactCycleResult(result) {
+    return {
+        ...result,
+        target: {
+            ...result.target,
+            project_ref: result.target.project_ref ? '<redacted>' : null
+        }
+    };
+}
+async function resolveSqlInput(input) {
+    if (input.sql)
+        return input.sql;
+    if (input.migrationFile)
+        return readText(path.resolve(input.migrationFile), '');
+    const trimmed = String(input.task || '').trim();
+    return /^(select|with|show|explain|describe|insert|update|delete|drop|truncate|alter|create|grant|revoke)\b/i.test(trimmed) ? trimmed : null;
+}
+async function recreateProfileFromPrepared(root, prepared) {
+    const projectRef = prepared.target.project_ref || 'missing-project-ref';
+    return {
+        schema: 'sks.mad-db-runtime-profile.v1',
+        mission_id: prepared.mission_id,
+        cycle_id: prepared.cycle_id,
+        runtime_session_id: prepared.capability.runtime_session_id,
+        project_ref_hash: sha256(projectRef).slice(0, 16),
+        profile_path: prepared.runtime_profile.profile_path,
+        profile_sha256: prepared.runtime_profile.profile_sha256,
+        server_url_redacted: prepared.runtime_profile.server_url_redacted,
+        server_url: `https://mcp.supabase.com/mcp?project_ref=${encodeURIComponent(projectRef)}&features=database`,
+        features: ['database'],
+        write_capable: true,
+        normal_config_hash_before: prepared.runtime_profile.normal_config_hash_before,
+        created_at: prepared.runtime_profile.created_at
+    };
+}
+export async function madDbRouteIdentityProof(root, missionId) {
+    const capability = await readMadDbCapability(root, missionId);
+    const state = await readJson(path.join(root, '.sneakoscope', 'state', 'current.json'), {});
+    const profile = await readJson(path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'runtime-profile-manifest.json'), null);
+    const sameMission = Boolean(capability && capability.mission_id === missionId && state?.mission_id === missionId);
+    return {
+        schema: 'sks.mad-db-route-identity-proof.v1',
+        ok: sameMission && state?.route === 'MadDB' && state?.route_command === '$MAD-DB',
+        mission_id: missionId,
+        capability_mission_id: capability?.mission_id || null,
+        same_mission: sameMission,
+        route: state?.route || null,
+        route_command: state?.route_command || null,
+        cycle_id: capability?.cycle_id || null,
+        project_root_hash: await projectRootHash(root),
+        runtime_profile: profile,
+        blockers: [
+            ...(capability ? [] : ['capability_missing']),
+            ...(profile ? [] : ['runtime_profile_manifest_missing']),
+            ...(sameMission ? [] : ['mission_binding_mismatch']),
+            ...(state?.route === 'MadDB' ? [] : ['route_state_not_maddb']),
+            ...(state?.route_command === '$MAD-DB' ? [] : ['route_command_not_maddb'])
+        ]
+    };
+}
+//# sourceMappingURL=mad-db-coordinator.js.map

package/dist/core/mad-db/mad-db-executor.js

@@ -0,0 +1,156 @@
+import { performance } from 'node:perf_hooks';
+import { nowIso, sha256 } from '../fsx.js';
+export class MadDbMcpExecutor {
+    profile;
+    opts;
+    client = null;
+    transport = null;
+    constructor(profile, opts = {}) {
+        this.profile = profile;
+        this.opts = opts;
+    }
+    async connect() {
+        if (this.client)
+            return;
+        const { Client, StreamableHTTPClientTransport } = await loadMcpSdk();
+        this.client = new Client({ name: 'sneakoscope-mad-db', version: '4.2.0' });
+        const headers = authHeaders();
+        const options = headers ? { requestInit: { headers } } : {};
+        this.transport = new StreamableHTTPClientTransport(new URL(this.profile.server_url), options);
+        await this.client.connect(this.transport);
+    }
+    async inventory() {
+        const started = performance.now();
+        try {
+            await this.connect();
+            const result = await this.client.listTools({}, { timeout: this.opts.timeoutMs || 10_000 });
+            const names = (result.tools || []).map((tool) => String(tool?.name || '')).filter(Boolean).sort();
+            return {
+                schema: 'sks.mad-db-tool-inventory.v1',
+                checked_at: nowIso(),
+                ok: hasTool(names, 'execute_sql') && hasTool(names, 'apply_migration'),
+                tool_names: names,
+                execute_sql_available: hasTool(names, 'execute_sql'),
+                apply_migration_available: hasTool(names, 'apply_migration'),
+                duration_ms: Math.round(performance.now() - started),
+                error_digest: null
+            };
+        }
+        catch (err) {
+            return {
+                schema: 'sks.mad-db-tool-inventory.v1',
+                checked_at: nowIso(),
+                ok: false,
+                tool_names: [],
+                execute_sql_available: false,
+                apply_migration_available: false,
+                duration_ms: Math.round(performance.now() - started),
+                error_digest: sha256(redactError(err)).slice(0, 32)
+            };
+        }
+    }
+    async executeSql(sql) {
+        return this.callToolWithFallback(['execute_sql', 'supabase.execute_sql'], [{ query: sql }, { sql }]);
+    }
+    async applyMigration(name, sql) {
+        return this.callToolWithFallback(['apply_migration', 'supabase.apply_migration'], [{ name, query: sql }, { name, sql }]);
+    }
+    async close() {
+        await this.transport?.terminateSession().catch(() => undefined);
+        await this.client?.close().catch(() => undefined);
+        this.client = null;
+        this.transport = null;
+    }
+    async callToolWithFallback(toolNames, argsList) {
+        await this.connect();
+        const inventory = await this.inventory();
+        const tool = toolNames.find((name) => hasTool(inventory.tool_names, name)) || toolNames[0] || '';
+        let lastError = null;
+        for (const args of argsList) {
+            const started = performance.now();
+            try {
+                const result = await this.client.callTool({ name: tool, arguments: args }, undefined, { timeout: this.opts.timeoutMs || 60_000, resetTimeoutOnProgress: true, maxTotalTimeout: 10 * 60_000 });
+                return {
+                    schema: 'sks.mad-db-tool-result.v1',
+                    ok: result.isError !== true,
+                    tool_name: tool,
+                    result_digest: sha256(JSON.stringify(redactToolResult(result))).slice(0, 32),
+                    row_count: extractRowCount(result),
+                    is_error: result.isError === true,
+                    duration_ms: Math.round(performance.now() - started)
+                };
+            }
+            catch (err) {
+                lastError = err;
+            }
+        }
+        return {
+            schema: 'sks.mad-db-tool-result.v1',
+            ok: false,
+            tool_name: tool,
+            result_digest: sha256(redactError(lastError)).slice(0, 32),
+            row_count: null,
+            is_error: true,
+            duration_ms: 0
+        };
+    }
+}
+async function loadMcpSdk() {
+    const dynamicImport = new Function('specifier', 'return import(specifier)');
+    const [{ Client }, { StreamableHTTPClientTransport }] = await Promise.all([
+        dynamicImport('@modelcontextprotocol/sdk/client/index.js'),
+        dynamicImport('@modelcontextprotocol/sdk/client/streamableHttp.js')
+    ]);
+    return { Client, StreamableHTTPClientTransport };
+}
+function hasTool(names, name) {
+    return names.some((candidate) => candidate === name || candidate.endsWith(`.${name}`) || candidate.endsWith(`__${name}`));
+}
+function authHeaders() {
+    const token = process.env.SUPABASE_ACCESS_TOKEN || process.env.SKS_MAD_DB_SUPABASE_ACCESS_TOKEN || '';
+    if (!token)
+        return undefined;
+    return { Authorization: `Bearer ${token}` };
+}
+function redactError(err) {
+    const text = err instanceof Error ? `${err.name}:${err.message}` : String(err);
+    return text.replace(/(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, '$1<redacted>').replace(/(token|password|secret|apikey)=([^&\s]+)/gi, '$1=<redacted>');
+}
+function redactToolResult(value) {
+    if (value == null)
+        return value;
+    if (typeof value === 'string')
+        return value.replace(/(token|password|secret|apikey)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, '$1=<redacted>');
+    if (Array.isArray(value))
+        return value.map(redactToolResult);
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (/token|password|secret|apikey|service_role/i.test(key))
+                out[key] = '<redacted>';
+            else if (/rows|data|records/i.test(key) && Array.isArray(entry))
+                out[key] = `<redacted:${entry.length}:rows>`;
+            else
+                out[key] = redactToolResult(entry);
+        }
+        return out;
+    }
+    return value;
+}
+function extractRowCount(value) {
+    const candidates = [
+        value?.row_count,
+        value?.rowCount,
+        value?.rows_affected,
+        value?.structuredContent?.row_count,
+        value?.structuredContent?.rowCount,
+        value?.structuredContent?.rows_affected
+    ];
+    for (const candidate of candidates) {
+        const n = Number(candidate);
+        if (Number.isFinite(n))
+            return n;
+    }
+    return null;
+}
+//# sourceMappingURL=mad-db-executor.js.map

package/dist/core/mad-db/mad-db-ledger.js

@@ -23,7 +23,7 @@ export async function appendMadDbOperationLifecycle(root, missionId, input) {
         tool_name: input.toolName || null,
         sql_hash: input.sqlHash || null,
         destructive: input.destructive === true,
-        result_status: input.resultStatus || 'unknown_pending_tool_result',
+        result_status: input.resultStatus || 'pending_tool_result',
         row_count: input.rowCount ?? null,
         error: input.error || null
     });

package/dist/core/mad-db/mad-db-lock.js

@@ -0,0 +1,40 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+export async function withMadDbLock(root, missionId, name, fn) {
+    const dir = path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'locks');
+    await ensureDir(dir);
+    const lockDir = path.join(dir, `${safeName(name)}.lock`);
+    const deadline = Date.now() + 10_000;
+    while (true) {
+        try {
+            await fs.mkdir(lockDir);
+            await writeJsonAtomic(path.join(lockDir, 'owner.json'), {
+                schema: 'sks.mad-db-lock.v1',
+                pid: process.pid,
+                name,
+                acquired_at: nowIso()
+            });
+            break;
+        }
+        catch (err) {
+            if (Date.now() > deadline)
+                throw new Error(`mad_db_lock_timeout:${name}`);
+            await sleep(25 + Math.floor(Math.random() * 25));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        await fs.rm(lockDir, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function safeName(value) {
+    return value.replace(/[^a-z0-9_.-]+/gi, '_').slice(0, 80) || 'lock';
+}
+//# sourceMappingURL=mad-db-lock.js.map

package/dist/core/mad-db/mad-db-operation-store.js

@@ -0,0 +1,140 @@
+import path from 'node:path';
+import { ensureDir, nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
+import { missionDir } from '../mission.js';
+import { appendMadDbLedgerEvent } from './mad-db-ledger.js';
+import { withMadDbLock } from './mad-db-lock.js';
+import { updateMadDbCapabilityCounters } from './mad-db-capability.js';
+export async function reserveMadDbOperation(input) {
+    return withMadDbLock(input.root, input.missionId, `operation-${safeKey(input.toolCallId)}`, async () => {
+        const file = operationFile(input.root, input.missionId, input.toolCallId);
+        const existing = await readJson(file, null);
+        if (existing?.schema === 'sks.mad-db-operation.v2') {
+            return { operation: existing, reused: true, capability: input.capability };
+        }
+        const operationId = `mad-db-op-${sha256(`${input.missionId}:${input.capability.cycle_id}:${input.toolCallId}`).slice(0, 16)}`;
+        const operation = {
+            schema: 'sks.mad-db-operation.v2',
+            operation_id: operationId,
+            tool_call_id: input.toolCallId,
+            mission_id: input.missionId,
+            cycle_id: input.capability.cycle_id,
+            project_ref_hash: sha256(input.capability.project_ref).slice(0, 16),
+            tool_name: input.toolName,
+            sql_sha256: input.sql ? sha256(input.sql) : null,
+            migration_name: input.migrationName || null,
+            operation_classes: input.operationClasses,
+            state: 'reserved',
+            attempt: 1,
+            started_at: null,
+            finished_at: null,
+            result_digest: null,
+            verification_artifact: null,
+            error_code: null
+        };
+        await ensureDir(path.dirname(file));
+        await writeJsonAtomic(file, operation);
+        const capability = await updateMadDbCapabilityCounters(input.root, input.missionId, {
+            attemptsDelta: 1,
+            reservedDelta: 1
+        });
+        await appendMadDbLedgerEvent(input.root, input.missionId, {
+            type: 'db_operation.reserved',
+            operation_id: operation.operation_id,
+            tool_call_id: operation.tool_call_id,
+            cycle_id: operation.cycle_id,
+            tool_name: operation.tool_name,
+            sql_sha256: operation.sql_sha256,
+            operation_classes: operation.operation_classes
+        });
+        return { operation, reused: false, capability: capability || input.capability };
+    });
+}
+export async function transitionMadDbOperation(input) {
+    return withMadDbLock(input.root, input.missionId, `operation-${safeKey(input.toolCallId)}`, async () => {
+        const file = operationFile(input.root, input.missionId, input.toolCallId);
+        const existing = await readJson(file, null);
+        if (!existing)
+            return null;
+        const terminalSuccess = input.state === 'succeeded' || input.state === 'verified';
+        const terminalFailure = input.state === 'failed' || input.state === 'verification_failed' || input.state === 'unknown';
+        const updated = {
+            ...existing,
+            state: input.state,
+            started_at: existing.started_at || (input.state === 'started' ? nowIso() : existing.started_at),
+            finished_at: terminalSuccess || terminalFailure ? nowIso() : existing.finished_at,
+            result_digest: input.result === undefined ? existing.result_digest : sha256(safeResultDigestInput(input.result)).slice(0, 32),
+            verification_artifact: input.verificationArtifact || existing.verification_artifact,
+            error_code: input.errorCode || existing.error_code
+        };
+        await writeJsonAtomic(file, updated);
+        if (input.state === 'succeeded')
+            await updateMadDbCapabilityCounters(input.root, input.missionId, { succeededDelta: 1 });
+        if (input.state === 'failed')
+            await updateMadDbCapabilityCounters(input.root, input.missionId, { failedDelta: 1 });
+        await appendMadDbLedgerEvent(input.root, input.missionId, {
+            type: `db_operation.${input.state}`,
+            operation_id: updated.operation_id,
+            tool_call_id: updated.tool_call_id,
+            cycle_id: updated.cycle_id,
+            tool_name: updated.tool_name,
+            result_digest: updated.result_digest,
+            verification_artifact: updated.verification_artifact,
+            error_code: updated.error_code
+        });
+        return updated;
+    });
+}
+export function extractCanonicalToolCallId(payload = {}) {
+    const candidates = [
+        payload.tool_call_id,
+        payload.toolCallId,
+        payload.call_id,
+        payload.callId,
+        payload.id,
+        payload.request_id,
+        payload.requestId,
+        payload.tool?.id,
+        payload.tool?.call_id,
+        payload.metadata?.tool_call_id,
+        payload.context?.tool_call_id
+    ];
+    const found = candidates.find((value) => typeof value === 'string' && value.trim());
+    return found ? String(found).trim() : null;
+}
+export function operationFile(root, missionId, toolCallId) {
+    return path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'operations', `${safeKey(toolCallId)}.json`);
+}
+function safeKey(value) {
+    return sha256(value).slice(0, 24);
+}
+function safeResultDigestInput(value) {
+    try {
+        return JSON.stringify(redactSensitive(value));
+    }
+    catch {
+        return String(value);
+    }
+}
+function redactSensitive(value, depth = 0) {
+    if (depth > 8 || value == null)
+        return value;
+    if (typeof value === 'string') {
+        return value.replace(/(access_token|refresh_token|password|apikey|service_role|secret)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, '$1=<redacted>');
+    }
+    if (Array.isArray(value))
+        return value.map((entry) => redactSensitive(entry, depth + 1));
+    if (typeof value === 'object') {
+        const out = {};
+        for (const [key, entry] of Object.entries(value)) {
+            if (/token|password|secret|apikey|service_role/i.test(key))
+                out[key] = '<redacted>';
+            else if (/rows|data|records/i.test(key) && Array.isArray(entry))
+                out[key] = `<redacted:${entry.length}:rows>`;
+            else
+                out[key] = redactSensitive(entry, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=mad-db-operation-store.js.map