sneakoscope 4.1.1 → 4.2.1

package/dist/core/mad-db/mad-db-capability.js

@@ -1,48 +1,91 @@
 import path from 'node:path';
-import { appendJsonlBounded, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { appendJsonlBounded, nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
 import { findLatestMission, missionDir } from '../mission.js';
-export const MAD_DB_CAPABILITY_SCHEMA = 'sks.mad-db-capability.v1';
+import { withMadDbLock } from './mad-db-lock.js';
+import { MAD_DB_POLICY } from './mad-db-policy.js';
+export const MAD_DB_CAPABILITY_SCHEMA_V1 = 'sks.mad-db-capability.v1';
+export const MAD_DB_CAPABILITY_SCHEMA = 'sks.mad-db-capability.v2';
 export const MAD_DB_CAPABILITY_FILE = 'mad-db-capability.json';
 export const MAD_DB_ACK = 'I AUTHORIZE ONE-CYCLE DB BREAK-GLASS';
-export const MAD_DB_MAX_TTL_MS = 2 * 60 * 60 * 1000;
+export const MAD_DB_DEFAULT_TTL_MS = MAD_DB_POLICY.ttl.default_ms;
+export const MAD_DB_MAX_TTL_MS = MAD_DB_POLICY.ttl.hard_max_ms;
 export async function createMadDbCapability(root, input) {
     if (input.ack !== MAD_DB_ACK)
         throw new Error('mad_db_ack_phrase_mismatch');
     const createdAt = nowIso();
-    const ttlMs = Math.min(MAD_DB_MAX_TTL_MS, Math.max(1, Math.floor(Number(input.ttlMs || MAD_DB_MAX_TTL_MS))));
+    const ttlMs = Math.min(MAD_DB_MAX_TTL_MS, Math.max(1, Math.floor(Number(input.ttlMs || MAD_DB_DEFAULT_TTL_MS))));
+    const projectRef = String(input.projectRef || process.env.SKS_MAD_DB_PROJECT_REF || process.env.SKS_MAD_DB_E2E_PROJECT_REF || 'fixture-project-ref').trim();
+    const profilePath = input.profilePath || '.sneakoscope/missions/<mission>/mad-db/runtime/codex-mad-db.config.toml';
+    const profileSha256 = input.profileSha256 || sha256(`${input.missionId}:${projectRef}:placeholder-profile`);
     const capability = {
         schema: MAD_DB_CAPABILITY_SCHEMA,
+        revision: 1,
         mission_id: input.missionId,
         cycle_id: input.cycleId || `mad-db-${Date.now().toString(36)}`,
-        enabled: true,
-        created_at: createdAt,
+        project_root_hash: sha256(path.resolve(input.cwd || root)).slice(0, 24),
+        project_ref: projectRef,
+        target_environment: input.targetEnvironment || 'production',
+        allowed_schemas: input.allowedSchemas?.length ? input.allowedSchemas : ['public'],
+        codex_thread_id: input.codexThreadId ?? null,
+        runtime_session_id: input.runtimeSessionId || `mad-db-session-${Date.now().toString(36)}`,
+        operator_intent_hash: sha256(input.operatorIntent || input.ack || 'mad-db').slice(0, 32),
+        operator_ack_hash: sha256(input.ack).slice(0, 32),
+        scope: {
+            sql_plane: 'all_mutations',
+            control_plane: 'deny',
+            operations: input.operations?.length ? input.operations : [...MAD_DB_POLICY.sql_plane_allowed]
+        },
+        transport: {
+            profile_path: profilePath,
+            profile_sha256: profileSha256,
+            server_url_redacted: input.serverUrlRedacted || 'https://mcp.supabase.com/mcp?project_ref=<redacted>&features=database',
+            features: ['database'],
+            write_capable: true
+        },
+        issued_at: createdAt,
         expires_at: new Date(Date.now() + ttlMs).toISOString(),
-        one_cycle_only: true,
-        priority: 'highest',
-        scope: 'all_database_mutations',
-        operator_ack: {
-            phrase: MAD_DB_ACK,
-            accepted_at: createdAt,
-            cwd: path.resolve(input.cwd || process.cwd())
+        closed_at: null,
+        status: input.status || 'issued',
+        counters: {
+            attempts: 0,
+            reserved: 0,
+            succeeded: 0,
+            failed: 0
         },
-        consumed: false,
-        consumed_at: null,
-        consumed_by: null,
-        max_operations: Math.max(1, Math.floor(Number(process.env.SKS_MAD_DB_MAX_OPERATIONS || 20))),
-        operation_count: 0
+        legacy_compat: {
+            one_cycle_only: true,
+            priority: 'highest',
+            scope: 'all_database_mutations'
+        }
     };
     const dir = missionDir(root, input.missionId);
     await writeJsonAtomic(path.join(dir, MAD_DB_CAPABILITY_FILE), capability);
-    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), { ts: nowIso(), type: 'capability.created', mission_id: capability.mission_id, cycle_id: capability.cycle_id, expires_at: capability.expires_at });
+    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), {
+        ts: nowIso(),
+        type: 'capability.created',
+        schema: capability.schema,
+        mission_id: capability.mission_id,
+        cycle_id: capability.cycle_id,
+        project_ref_hash: sha256(capability.project_ref).slice(0, 16),
+        runtime_session_id: capability.runtime_session_id,
+        expires_at: capability.expires_at,
+        status: capability.status
+    });
     return capability;
 }
 export async function readMadDbCapability(root, missionId) {
-    const capability = await readJson(path.join(missionDir(root, missionId), MAD_DB_CAPABILITY_FILE), null);
-    return capability?.schema === MAD_DB_CAPABILITY_SCHEMA ? capability : null;
+    const value = await readJson(path.join(missionDir(root, missionId), MAD_DB_CAPABILITY_FILE), null);
+    if (value?.schema === MAD_DB_CAPABILITY_SCHEMA)
+        return value;
+    if (value?.schema === MAD_DB_CAPABILITY_SCHEMA_V1)
+        return migrateV1Capability(value, missionId);
+    return null;
 }
 export async function resolveMadDbMissionId(root, state = {}, explicitMissionId = null) {
     if (explicitMissionId && explicitMissionId !== 'latest')
         return explicitMissionId;
+    if (state?.mad_db_capability_mission_id)
+        return String(state.mad_db_capability_mission_id);
     if (state?.mission_id)
         return String(state.mission_id);
     return findLatestMission(root);
@@ -51,74 +94,160 @@ export function isMadDbCapabilityActive(capability, nowMs = Date.now()) {
     if (!capability)
         return false;
     const expires = Date.parse(capability.expires_at || '');
-    return capability.enabled === true
-        && capability.consumed !== true
-        && capability.one_cycle_only === true
-        && Number(capability.operation_count || 0) < Number(capability.max_operations || 20)
+    return capability.schema === MAD_DB_CAPABILITY_SCHEMA
+        && ['transport_ready', 'active'].includes(capability.status)
+        && Boolean(capability.project_ref)
+        && capability.transport?.write_capable === true
+        && capability.transport?.features?.[0] === 'database'
         && Number.isFinite(expires)
         && expires > nowMs;
 }
+export async function activateMadDbCapability(root, missionId) {
+    return updateMadDbCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: capability.status === 'issued' ? 'active' : capability.status
+    }));
+}
+export async function markMadDbTransportReady(root, missionId) {
+    return updateMadDbCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: capability.status === 'issued' ? 'transport_ready' : capability.status
+    }));
+}
+export async function updateMadDbCapabilityCounters(root, missionId, delta) {
+    return updateMadDbCapability(root, missionId, (capability) => ({
+        ...capability,
+        counters: {
+            attempts: capability.counters.attempts + Number(delta.attemptsDelta || 0),
+            reserved: capability.counters.reserved + Number(delta.reservedDelta || 0),
+            succeeded: capability.counters.succeeded + Number(delta.succeededDelta || 0),
+            failed: capability.counters.failed + Number(delta.failedDelta || 0)
+        }
+    }));
+}
+export async function updateMadDbCapability(root, missionId, mutator) {
+    return withMadDbLock(root, missionId, 'capability', async () => {
+        const current = await readMadDbCapability(root, missionId);
+        if (!current)
+            return null;
+        const next = mutator(current);
+        const updated = {
+            ...next,
+            revision: Number(current.revision || 0) + 1
+        };
+        await writeJsonAtomic(path.join(missionDir(root, missionId), MAD_DB_CAPABILITY_FILE), updated);
+        await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
+            ts: nowIso(),
+            type: 'capability.updated',
+            mission_id: missionId,
+            cycle_id: updated.cycle_id,
+            revision: updated.revision,
+            status: updated.status,
+            counters: updated.counters
+        });
+        return updated;
+    });
+}
 export async function recordMadDbOperation(root, missionId, input = {}) {
     const capability = await readMadDbCapability(root, missionId);
-    if (!isMadDbCapabilityActive(capability))
-        return capability;
-    const operationCount = Number(capability.operation_count || 0) + 1;
-    const maxOperations = Math.max(1, Number(capability.max_operations || 20));
-    const updated = {
-        ...capability,
-        operation_count: operationCount,
-        max_operations: maxOperations
-    };
-    const dir = missionDir(root, missionId);
-    await writeJsonAtomic(path.join(dir, MAD_DB_CAPABILITY_FILE), updated);
-    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), {
+    if (!capability)
+        return null;
+    await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
         ts: nowIso(),
-        type: 'db_operation.counted',
+        type: 'db_operation.legacy_recorded',
         mission_id: missionId,
-        cycle_id: updated.cycle_id,
+        cycle_id: capability.cycle_id,
         operation_id: input.operationId || null,
         tool_name: input.toolName || null,
-        sql_hash: input.sqlHash || null,
-        operation_count: operationCount,
-        max_operations: maxOperations
+        sql_hash: input.sqlHash || null
     });
-    if (operationCount >= maxOperations) {
-        return consumeMadDbCapability(root, missionId, { consumedBy: 'db-safety-checkDbOperation', reason: 'mad_db_max_operations_reached' });
-    }
-    return updated;
+    return capability;
 }
 export async function consumeMadDbCapability(root, missionId, input = {}) {
-    const capability = await readMadDbCapability(root, missionId);
-    if (!capability || capability.consumed === true)
-        return capability;
-    const consumed = {
-        ...capability,
-        consumed: true,
-        consumed_at: nowIso(),
-        consumed_by: input.consumedBy || input.reason || 'db-safety-policy-resolver'
-    };
-    const dir = missionDir(root, missionId);
-    await writeJsonAtomic(path.join(dir, MAD_DB_CAPABILITY_FILE), consumed);
-    await writeJsonAtomic(path.join(dir, 'mad-db-capability.consumed.json'), consumed);
-    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), { ts: nowIso(), type: 'capability.consumed', mission_id: missionId, cycle_id: consumed.cycle_id, consumed_by: consumed.consumed_by });
-    return consumed;
+    return closeMadDbCycle(root, missionId, '', input.consumedBy || input.reason || 'mad_db_cycle_closed');
 }
-export async function closeMadDbCycle(root, missionId, cycleId) {
-    const capability = await readMadDbCapability(root, missionId);
-    if (!capability || capability.cycle_id !== cycleId)
-        return capability;
-    if (capability.consumed === true)
-        return capability;
-    return consumeMadDbCapability(root, missionId, { consumedBy: 'mad-db-cycle-close', reason: 'mad_db_cycle_closed' });
+export async function closeMadDbCycle(root, missionId, cycleId = '', reason = 'mad_db_cycle_closed') {
+    const closed = await updateMadDbCapability(root, missionId, (capability) => {
+        if (cycleId && capability.cycle_id !== cycleId)
+            return capability;
+        return {
+            ...capability,
+            status: capability.status === 'revoked' ? 'revoked' : 'closed',
+            closed_at: nowIso()
+        };
+    });
+    if (closed) {
+        await writeJsonAtomic(path.join(missionDir(root, missionId), 'mad-db-capability.closed.json'), {
+            schema: closed.schema,
+            mission_id: closed.mission_id,
+            cycle_id: closed.cycle_id,
+            closed_at: closed.closed_at,
+            close_reason: reason,
+            counters: closed.counters,
+            project_ref_hash: sha256(closed.project_ref).slice(0, 16)
+        });
+    }
+    return closed;
 }
 export async function revokeMadDbCapability(root, missionId, reason = 'operator_revoked') {
-    const capability = await readMadDbCapability(root, missionId);
-    if (!capability)
-        return null;
-    const revoked = { ...capability, enabled: false, revoked_at: nowIso(), revoke_reason: reason };
-    const dir = missionDir(root, missionId);
-    await writeJsonAtomic(path.join(dir, MAD_DB_CAPABILITY_FILE), revoked);
-    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), { ts: nowIso(), type: 'capability.revoked', mission_id: missionId, cycle_id: capability.cycle_id, reason });
+    const revoked = await updateMadDbCapability(root, missionId, (capability) => ({
+        ...capability,
+        status: 'revoked',
+        closed_at: nowIso()
+    }));
+    if (revoked) {
+        await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
+            ts: nowIso(),
+            type: 'capability.revoked',
+            mission_id: missionId,
+            cycle_id: revoked.cycle_id,
+            reason
+        });
+    }
     return revoked;
 }
+function migrateV1Capability(value, missionId) {
+    const projectRef = process.env.SKS_MAD_DB_PROJECT_REF || process.env.SKS_MAD_DB_E2E_PROJECT_REF || 'legacy-v1-missing-project-ref';
+    return {
+        schema: MAD_DB_CAPABILITY_SCHEMA,
+        revision: 0,
+        mission_id: String(value.mission_id || missionId),
+        cycle_id: String(value.cycle_id || `mad-db-${Date.now().toString(36)}`),
+        project_root_hash: sha256(String(value.operator_ack?.cwd || process.cwd())).slice(0, 24),
+        project_ref: projectRef,
+        target_environment: 'production',
+        allowed_schemas: ['public'],
+        codex_thread_id: null,
+        runtime_session_id: `legacy-v1-${Date.now().toString(36)}`,
+        operator_intent_hash: sha256('legacy-v1-migrated').slice(0, 32),
+        operator_ack_hash: sha256(MAD_DB_ACK).slice(0, 32),
+        scope: {
+            sql_plane: 'all_mutations',
+            control_plane: 'deny',
+            operations: [...MAD_DB_POLICY.sql_plane_allowed]
+        },
+        transport: {
+            profile_path: '.sneakoscope/missions/<mission>/mad-db/runtime/codex-mad-db.config.toml',
+            profile_sha256: sha256('legacy-v1-missing-profile'),
+            server_url_redacted: 'https://mcp.supabase.com/mcp?project_ref=<legacy-redacted>&features=database',
+            features: ['database'],
+            write_capable: true
+        },
+        issued_at: String(value.created_at || nowIso()),
+        expires_at: String(value.expires_at || new Date(Date.now() - 1000).toISOString()),
+        closed_at: value.consumed ? String(value.consumed_at || nowIso()) : null,
+        status: value.enabled === false ? 'revoked' : value.consumed ? 'closed' : 'quarantined',
+        counters: {
+            attempts: Number(value.operation_count || 0),
+            reserved: Number(value.operation_count || 0),
+            succeeded: 0,
+            failed: 0
+        },
+        legacy_compat: {
+            one_cycle_only: true,
+            priority: 'highest',
+            scope: 'all_database_mutations'
+        }
+    };
+}
 //# sourceMappingURL=mad-db-capability.js.map

package/dist/core/mad-db/mad-db-coordinator.js

@@ -0,0 +1,287 @@
+import path from 'node:path';
+import { createMission, missionDir, setCurrent } from '../mission.js';
+import { nowIso, readJson, readText, sha256, writeJsonAtomic } from '../fsx.js';
+import { createMadDbCapability, activateMadDbCapability, closeMadDbCycle, MAD_DB_ACK, markMadDbTransportReady, readMadDbCapability } from './mad-db-capability.js';
+import { MadDbMcpExecutor } from './mad-db-executor.js';
+import { createMadDbRuntimeProfile, closeMadDbRuntimeProfile, redactedRuntimeProfile } from './mad-db-runtime-profile.js';
+import { reserveMadDbOperation, transitionMadDbOperation } from './mad-db-operation-store.js';
+import { readBackCheck, runReadBackChecks } from './mad-db-postconditions.js';
+import { madDbOperationClassesFromClassification } from './mad-db-policy.js';
+import { projectRootHash, resolveMadDbTarget } from './mad-db-target.js';
+import { classifySql } from '../db-safety.js';
+export async function prepareMadDbMission(input) {
+    const target = await resolveMadDbTarget(input.root, { args: input.args || [] });
+    const { id, dir } = await createMission(input.root, { mode: 'mad-db', prompt: input.task || 'MadDB SQL-plane execution' });
+    const cycleId = `mad-db-${Date.now().toString(36)}`;
+    const runtimeSessionId = input.runtimeSessionId || `mad-db-session-${Date.now().toString(36)}`;
+    const blockers = [...target.blockers];
+    let profile;
+    if (!target.project_ref) {
+        profile = await createMadDbRuntimeProfile({ root: input.root, missionId: id, cycleId, projectRef: 'missing-project-ref', runtimeSessionId });
+    }
+    else {
+        profile = await createMadDbRuntimeProfile({ root: input.root, missionId: id, cycleId, projectRef: target.project_ref, runtimeSessionId });
+    }
+    const capability = await createMadDbCapability(input.root, {
+        missionId: id,
+        ack: MAD_DB_ACK,
+        cwd: input.root,
+        cycleId,
+        projectRef: target.project_ref || 'missing-project-ref',
+        targetEnvironment: target.target_environment,
+        allowedSchemas: target.allowed_schemas,
+        runtimeSessionId,
+        operatorIntent: input.task,
+        profilePath: profile.profile_path,
+        profileSha256: profile.profile_sha256,
+        serverUrlRedacted: profile.server_url_redacted,
+        operations: [...madDbOperationClassesFromClassification(classifySql(input.task))],
+        status: blockers.length ? 'quarantined' : 'transport_ready'
+    });
+    let toolInventory = null;
+    if (input.verifyTools && !blockers.length) {
+        const executor = new MadDbMcpExecutor(profile);
+        toolInventory = await executor.inventory();
+        await executor.close();
+        await writeJsonAtomic(path.join(dir, 'mad-db', 'runtime', 'tool-inventory.json'), toolInventory);
+        if (!toolInventory.ok)
+            blockers.push('mad_db_execute_sql_or_apply_migration_unavailable');
+        else
+            await markMadDbTransportReady(input.root, id);
+    }
+    await writeJsonAtomic(path.join(dir, 'route-context.json'), {
+        route: 'MadDB',
+        command: '$MAD-DB',
+        mode: 'MADDB',
+        task: input.task,
+        target: { ...target, project_ref: target.project_ref ? `<hash:${target.project_ref_hash}>` : null },
+        capability_file: 'mad-db-capability.json',
+        runtime_profile_manifest: 'mad-db/runtime/runtime-profile-manifest.json',
+        tool_inventory: toolInventory ? 'mad-db/runtime/tool-inventory.json' : null
+    });
+    await writeJsonAtomic(path.join(dir, 'mad-db-gate.json'), {
+        schema: 'sks.mad-db-gate.v1',
+        passed: false,
+        mad_db_capability_active: !blockers.length,
+        sql_plane_all_mutations_allowed: !blockers.length,
+        control_plane_denied: true,
+        mission_id: id,
+        cycle_id: cycleId,
+        blockers,
+        created_at: nowIso()
+    });
+    await setCurrent(input.root, {
+        mission_id: id,
+        mad_db_capability_mission_id: id,
+        route: 'MadDB',
+        route_command: '$MAD-DB',
+        mode: 'MADDB',
+        phase: blockers.length ? 'MADDB_BLOCKED' : 'MADDB_SQL_PLANE_CAPABILITY_ACTIVE',
+        questions_allowed: false,
+        implementation_allowed: !blockers.length,
+        mad_db_active: !blockers.length,
+        mad_db_cycle_id: cycleId,
+        mad_db_runtime_session_id: runtimeSessionId,
+        mad_db_profile_sha256: profile.profile_sha256,
+        mad_db_capability_file: 'mad-db-capability.json',
+        stop_gate: 'mad-db-gate.json',
+        prompt: input.task
+    });
+    return {
+        schema: 'sks.mad-db-prepared-mission.v1',
+        ok: blockers.length === 0,
+        mission_id: id,
+        cycle_id: cycleId,
+        target,
+        capability,
+        runtime_profile: redactedRuntimeProfile(profile),
+        tool_inventory: toolInventory,
+        blockers
+    };
+}
+export async function runMadDbCycle(input) {
+    const timings = {};
+    const start = Date.now();
+    const prepared = await prepareMadDbMission({ root: input.root, task: input.task, args: input.args || [], verifyTools: false });
+    timings.prepare_ms = Date.now() - start;
+    const profile = await recreateProfileFromPrepared(input.root, prepared);
+    const executor = new MadDbMcpExecutor(profile);
+    let inventory = null;
+    let execution = null;
+    let operation = null;
+    let readBack = null;
+    const blockers = [...prepared.blockers];
+    try {
+        const connectStart = Date.now();
+        inventory = await executor.inventory();
+        timings.mcp_connect_ms = Date.now() - connectStart;
+        await writeJsonAtomic(path.join(missionDir(input.root, prepared.mission_id), 'mad-db', 'runtime', 'tool-inventory.json'), inventory);
+        if (!inventory.ok) {
+            blockers.push('mad_db_execute_sql_or_apply_migration_unavailable');
+            throw new Error('mad_db_tool_inventory_failed');
+        }
+        await activateMadDbCapability(input.root, prepared.mission_id);
+        const sql = await resolveSqlInput(input);
+        if (!sql) {
+            blockers.push('mad_db_sql_missing_for_execution');
+            throw new Error('mad_db_sql_missing_for_execution');
+        }
+        const classification = classifySql(sql);
+        const toolName = input.action === 'apply-migration' ? 'apply_migration' : 'execute_sql';
+        const toolCallId = `cli-${input.action}-${sha256(`${prepared.mission_id}:${sql}:${Date.now()}`).slice(0, 16)}`;
+        const reservation = await reserveMadDbOperation({
+            root: input.root,
+            missionId: prepared.mission_id,
+            capability: prepared.capability,
+            toolCallId,
+            toolName,
+            sql,
+            migrationName: input.migrationName || null,
+            operationClasses: madDbOperationClassesFromClassification({ ...classification, toolName })
+        });
+        await transitionMadDbOperation({ root: input.root, missionId: prepared.mission_id, toolCallId, state: 'started' });
+        const execStart = Date.now();
+        execution = input.action === 'apply-migration'
+            ? await executor.applyMigration(input.migrationName || `mad_db_${Date.now()}`, sql)
+            : await executor.executeSql(sql);
+        timings.execution_ms = Date.now() - execStart;
+        operation = await transitionMadDbOperation({
+            root: input.root,
+            missionId: prepared.mission_id,
+            toolCallId,
+            state: execution.ok ? 'succeeded' : 'failed',
+            result: execution
+        });
+        if (!execution.ok)
+            blockers.push('mad_db_tool_execution_failed');
+        if (execution.ok && input.verifySql) {
+            const verifyStart = Date.now();
+            readBack = await runReadBackChecks({
+                root: input.root,
+                missionId: prepared.mission_id,
+                executor,
+                checks: [readBackCheck('operator_verify_sql', input.verifySql)]
+            });
+            timings.verification_ms = Date.now() - verifyStart;
+            if (!readBack.ok)
+                blockers.push('mad_db_read_back_verification_failed');
+            if (operation) {
+                operation = await transitionMadDbOperation({
+                    root: input.root,
+                    missionId: prepared.mission_id,
+                    toolCallId,
+                    state: readBack.ok ? 'verified' : 'verification_failed',
+                    verificationArtifact: readBack.proof_path || null
+                }) || operation;
+            }
+        }
+    }
+    catch (err) {
+        if (!blockers.length)
+            blockers.push(err instanceof Error ? err.message : String(err));
+    }
+    finally {
+        await executor.close();
+    }
+    const closeStart = Date.now();
+    const restoration = await closeMadDbRuntimeProfile({ root: input.root, missionId: prepared.mission_id, profile, reason: 'mad_db_cycle_finally' });
+    await closeMadDbCycle(input.root, prepared.mission_id, prepared.cycle_id, 'mad_db_cycle_finally');
+    timings.close_ms = Date.now() - closeStart;
+    timings.total_ms = Date.now() - start;
+    const result = {
+        schema: 'sks.mad-db-cycle-result.v1',
+        ok: blockers.length === 0 && execution?.ok === true && restoration.ok,
+        mission_id: prepared.mission_id,
+        cycle_id: prepared.cycle_id,
+        action: input.action,
+        target: prepared.target,
+        tool_inventory: inventory,
+        execution,
+        operation,
+        read_back: readBack,
+        read_only_restoration: restoration,
+        capability_closed: true,
+        timings_ms: timings,
+        blockers: restoration.ok ? blockers : [...blockers, ...restoration.blockers]
+    };
+    await writeJsonAtomic(path.join(missionDir(input.root, prepared.mission_id), 'mad-db-result.json'), redactCycleResult(result));
+    await clearMadDbCurrentState(input.root, prepared.mission_id, result.ok, restoration);
+    return result;
+}
+async function clearMadDbCurrentState(root, missionId, ok, restoration) {
+    const currentPath = path.join(root, '.sneakoscope', 'state', 'current.json');
+    const current = await readJson(currentPath, {});
+    if (current.mission_id !== missionId && current.mad_db_capability_mission_id !== missionId)
+        return;
+    await setCurrent(root, {
+        phase: ok ? 'MADDB_CLOSED' : 'MADDB_FAILED_CLOSED',
+        implementation_allowed: false,
+        mad_db_active: false,
+        mad_db_runtime_session_id: null,
+        mad_db_profile_sha256: null,
+        mad_db_read_only_restored: restoration.ok,
+        mad_db_closed_at: nowIso(),
+        mad_db_last_result_file: 'mad-db-result.json'
+    });
+}
+function redactCycleResult(result) {
+    return {
+        ...result,
+        target: {
+            ...result.target,
+            project_ref: result.target.project_ref ? '<redacted>' : null
+        }
+    };
+}
+async function resolveSqlInput(input) {
+    if (input.sql)
+        return input.sql;
+    if (input.migrationFile)
+        return readText(path.resolve(input.migrationFile), '');
+    const trimmed = String(input.task || '').trim();
+    return /^(select|with|show|explain|describe|insert|update|delete|drop|truncate|alter|create|grant|revoke)\b/i.test(trimmed) ? trimmed : null;
+}
+async function recreateProfileFromPrepared(root, prepared) {
+    const projectRef = prepared.target.project_ref || 'missing-project-ref';
+    return {
+        schema: 'sks.mad-db-runtime-profile.v1',
+        mission_id: prepared.mission_id,
+        cycle_id: prepared.cycle_id,
+        runtime_session_id: prepared.capability.runtime_session_id,
+        project_ref_hash: sha256(projectRef).slice(0, 16),
+        profile_path: prepared.runtime_profile.profile_path,
+        profile_sha256: prepared.runtime_profile.profile_sha256,
+        server_url_redacted: prepared.runtime_profile.server_url_redacted,
+        server_url: `https://mcp.supabase.com/mcp?project_ref=${encodeURIComponent(projectRef)}&features=database`,
+        features: ['database'],
+        write_capable: true,
+        normal_config_hash_before: prepared.runtime_profile.normal_config_hash_before,
+        created_at: prepared.runtime_profile.created_at
+    };
+}
+export async function madDbRouteIdentityProof(root, missionId) {
+    const capability = await readMadDbCapability(root, missionId);
+    const state = await readJson(path.join(root, '.sneakoscope', 'state', 'current.json'), {});
+    const profile = await readJson(path.join(missionDir(root, missionId), 'mad-db', 'runtime', 'runtime-profile-manifest.json'), null);
+    const sameMission = Boolean(capability && capability.mission_id === missionId && state?.mission_id === missionId);
+    return {
+        schema: 'sks.mad-db-route-identity-proof.v1',
+        ok: sameMission && state?.route === 'MadDB' && state?.route_command === '$MAD-DB',
+        mission_id: missionId,
+        capability_mission_id: capability?.mission_id || null,
+        same_mission: sameMission,
+        route: state?.route || null,
+        route_command: state?.route_command || null,
+        cycle_id: capability?.cycle_id || null,
+        project_root_hash: await projectRootHash(root),
+        runtime_profile: profile,
+        blockers: [
+            ...(capability ? [] : ['capability_missing']),
+            ...(profile ? [] : ['runtime_profile_manifest_missing']),
+            ...(sameMission ? [] : ['mission_binding_mismatch']),
+            ...(state?.route === 'MadDB' ? [] : ['route_state_not_maddb']),
+            ...(state?.route_command === '$MAD-DB' ? [] : ['route_command_not_maddb'])
+        ]
+    };
+}
+//# sourceMappingURL=mad-db-coordinator.js.map