sneakoscope 6.2.0 → 6.4.0

package/dist/core/evidence/flagship-proof-graph-validator.js

@@ -1,320 +0,0 @@
-import path from 'node:path';
-import { exists, readJson } from '../fsx.js';
-import { missionDir } from '../mission.js';
-export const FLAGSHIP_PROOF_GRAPH_SCHEMA = 'sks.flagship-proof-graph.v2';
-export const FLAGSHIP_PROOF_GRAPH_V3_SCHEMA = 'sks.flagship-proof-graph.v3';
-export const FLAGSHIP_PROOF_GRAPH_V4_SCHEMA = 'sks.flagship-proof-graph.v4';
-export async function validateFlagshipProofGraph(root, opts = {}) {
-    const missionId = opts.missionId || null;
-    const missionPath = missionId ? missionDir(root, missionId) : null;
-    const routes = opts.routes || ['hooks', 'ux_review', 'ppt_review', 'dfix'];
-    const checks = await Promise.all(routes.map((route) => validateRoute(root, route, missionPath)));
-    const blockers = checks.flatMap((check) => check.blockers || []);
-    return {
-        schema: FLAGSHIP_PROOF_GRAPH_SCHEMA,
-        ok: blockers.length === 0,
-        mission_id: missionId,
-        routes: checks,
-        local_only_policy: checks.every((check) => check.local_only_policy !== 'blocked'),
-        mock_real_cap_enforced: checks.every((check) => check.mock_real_cap !== 'blocked'),
-        blockers
-    };
-}
-export async function validateFlagshipProofGraphV3(root, opts = {}) {
-    const base = await validateFlagshipProofGraph(root, opts);
-    const madSks = await validateReportSet(root, 'mad_sks', [
-        '.sneakoscope/reports/mad-sks-permission-model.json',
-        '.sneakoscope/reports/mad-sks-immutable-harness.json',
-        '.sneakoscope/reports/mad-sks-write-guard.json',
-        '.sneakoscope/reports/mad-sks-audit-proof.json',
-        '.sneakoscope/reports/mad-sks-no-harness-modification.json'
-    ]);
-    const nativeAgentBackend = await validateReportSet(root, 'native_agent_backend', [
-        '.sneakoscope/reports/legacy-multiagent-removal.json',
-        '.sneakoscope/reports/release-native-agent-fixture-check.json'
-    ], { allowIntegrationOptional: true });
-    const codexSyntax = await validateReportSet(root, 'codex_exec_output_schema_actual_syntax', [
-        '.sneakoscope/reports/codex-exec-output-schema-actual-syntax.json'
-    ], { allowIntegrationOptional: true });
-    const releaseFreshness = await validateReportSet(root, 'release_dist_freshness', [
-        '.sneakoscope/reports/dist-build-stamp.json'
-    ]);
-    const routes = [...(base.routes || []), madSks, nativeAgentBackend, codexSyntax, releaseFreshness];
-    const blockers = [
-        ...(base.blockers || []),
-        ...routes.flatMap((route) => route.blockers || [])
-    ];
-    return {
-        schema: FLAGSHIP_PROOF_GRAPH_V3_SCHEMA,
-        ok: blockers.length === 0,
-        mission_id: opts.missionId || null,
-        routes,
-        mad_sks_audit_ledger_linked: madSks.ok === true,
-        immutable_harness_guard_linked: madSks.artifacts.some((artifact) => /immutable-harness/.test(artifact.path) && artifact.present),
-        native_agent_backend_linked: nativeAgentBackend.ok === true,
-        codex_exec_actual_syntax_linked: codexSyntax.ok === true,
-        rollback_plan_required_when_mad_sks_modifies_target: true,
-        local_only_policy: routes.every((route) => route.local_only_policy !== 'blocked'),
-        blockers
-    };
-}
-export async function validateFlagshipProofGraphV4(root, opts = {}) {
-    const v3 = await validateFlagshipProofGraphV3(root, opts);
-    const executorClosure = await validateReportSet(root, 'mad_sks_actual_executor_closure', [
-        '.sneakoscope/reports/mad-sks-actual-executor-blackbox.json',
-        '.sneakoscope/reports/mad-sks-file-write-executor.json',
-        '.sneakoscope/reports/mad-sks-shell-executor.json',
-        '.sneakoscope/reports/mad-sks-package-executor.json',
-        '.sneakoscope/reports/mad-sks-service-executor.json',
-        '.sneakoscope/reports/mad-sks-db-executor.json',
-        '.sneakoscope/reports/mad-sks-rollback-apply.json',
-        '.sneakoscope/reports/mad-sks-live-protected-core-smoke.json',
-        '.sneakoscope/reports/mad-sks-executor-proof-graph.json'
-    ]);
-    const routes = [...(v3.routes || []), executorClosure];
-    const blockers = [
-        ...(v3.blockers || []),
-        ...routes.flatMap((route) => route.blockers || [])
-    ];
-    return {
-        schema: FLAGSHIP_PROOF_GRAPH_V4_SCHEMA,
-        ok: blockers.length === 0,
-        mission_id: opts.missionId || null,
-        routes,
-        mad_sks_actual_executor_closure_linked: executorClosure.ok === true,
-        target_file_write_verified: executorClosure.artifacts.some((artifact) => /file-write-executor/.test(artifact.path) && artifact.ok === true),
-        shell_argv_classifier_verified: executorClosure.artifacts.some((artifact) => /shell-executor/.test(artifact.path) && artifact.ok === true),
-        package_service_db_boundaries_verified: ['package-executor', 'service-executor', 'db-executor'].every((name) => executorClosure.artifacts.some((artifact) => artifact.path.includes(name) && artifact.ok === true)),
-        rollback_apply_verified: executorClosure.artifacts.some((artifact) => /rollback-apply/.test(artifact.path) && artifact.ok === true),
-        live_protected_core_guard_verified: executorClosure.artifacts.some((artifact) => /live-protected-core-smoke/.test(artifact.path) && artifact.ok === true),
-        local_only_policy: routes.every((route) => route.local_only_policy !== 'blocked'),
-        blockers
-    };
-}
-async function validateReportSet(root, route, required, opts = {}) {
-    const artifacts = [];
-    const blockers = [];
-    for (const rel of required) {
-        const file = path.join(root, rel);
-        const present = await exists(file);
-        const parsed = present ? await readJson(file, null) : null;
-        const integrationOptional = opts.allowIntegrationOptional && parsed?.status === 'integration_optional';
-        artifacts.push({
-            path: rel,
-            present,
-            schema: parsed?.schema || null,
-            ok: typeof parsed?.ok === 'boolean' ? parsed.ok : null,
-            status: parsed?.status || null
-        });
-        if (!present)
-            blockers.push(`missing:${route}:${rel}`);
-        if (present && parsed?.ok === false && !integrationOptional)
-            blockers.push(`blocked:${route}:${rel}`);
-    }
-    return {
-        route,
-        artifacts,
-        evidence_index_linked: true,
-        completion_proof_linked: route !== 'release_dist_freshness',
-        trust_report_linked: true,
-        wrongness_linked: true,
-        local_only_policy: 'enforced',
-        ok: blockers.length === 0,
-        blockers
-    };
-}
-async function validateRoute(root, route, missionPath) {
-    const required = requiredArtifacts(route, missionPath);
-    const artifacts = [];
-    const blockers = [];
-    for (const rel of required) {
-        const file = path.isAbsolute(rel) ? rel : path.join(root, rel);
-        const present = await exists(file);
-        const parsed = present ? await readJson(file, null) : null;
-        artifacts.push({
-            path: rel,
-            present,
-            schema: parsed?.schema || null,
-            status: parsed?.status || parsed?.gate || null,
-            ok: typeof parsed?.ok === 'boolean' ? parsed.ok : null,
-            proof_status: proofStatus(parsed),
-            trust_status: trustStatus(parsed),
-            trust_ok: trustOk(parsed),
-            signals: graphSignals(parsed)
-        });
-        if (!present)
-            blockers.push(`missing:${route}:${rel}`);
-        if (present && !artifactIsAcceptable(parsed))
-            blockers.push(`blocked:${route}:${rel}`);
-        for (const blocker of artifactBlockers(parsed))
-            blockers.push(`artifact:${route}:${rel}:${blocker}`);
-    }
-    const evidenceIndexLinked = artifacts.some((item) => /evidence|proof|trust/i.test(item.path) && item.present)
-        || artifacts.some((item) => item.signals.evidence_index_linked);
-    const completionProofLinked = artifacts.some((item) => /completion-proof\.json$/.test(item.path) && item.present)
-        || artifacts.some((item) => item.signals.completion_proof_linked);
-    const trustReportLinked = artifacts.some((item) => /trust-report\.json$/.test(item.path) && item.present)
-        || artifacts.some((item) => item.signals.trust_report_linked);
-    const wrongnessLinked = artifacts.some((item) => item.signals.wrongness_linked);
-    const mockRealBlocked = artifacts.some((item) => item.signals.mock_real_cap === 'blocked');
-    const localOnlyBlocked = artifacts.some((item) => item.signals.local_only_policy === 'blocked');
-    if (!evidenceIndexLinked)
-        blockers.push(`graph:${route}:evidence_index_unlinked`);
-    if (!completionProofLinked)
-        blockers.push(`graph:${route}:completion_proof_unlinked`);
-    if (!trustReportLinked)
-        blockers.push(`graph:${route}:trust_report_unlinked`);
-    if (!wrongnessLinked)
-        blockers.push(`graph:${route}:wrongness_unlinked`);
-    if (mockRealBlocked)
-        blockers.push(`graph:${route}:mock_real_cap_blocked`);
-    if (localOnlyBlocked)
-        blockers.push(`graph:${route}:local_only_policy_blocked`);
-    return {
-        route,
-        artifacts,
-        evidence_index_linked: evidenceIndexLinked,
-        completion_proof_linked: completionProofLinked,
-        trust_report_linked: trustReportLinked,
-        wrongness_linked: wrongnessLinked,
-        mock_real_cap: mockRealBlocked ? 'blocked' : 'enforced',
-        local_only_policy: localOnlyBlocked ? 'blocked' : 'enforced',
-        blockers
-    };
-}
-function graphSignals(parsed = {}) {
-    const proofOk = completionProofStatusOk(proofStatus(parsed));
-    const trustReportOk = trustOk(parsed) === true || trustStatusOk(trustStatus(parsed));
-    return {
-        evidence_index_linked: parsed?.evidence_index_linked === true,
-        completion_proof_linked: parsed?.completion_proof_linked === true
-            || proofOk,
-        trust_report_linked: parsed?.trust_report_linked === true
-            || parsed?.trust_linked === true
-            || trustReportOk,
-        wrongness_linked: parsed?.wrongness_linked === true
-            || parsed?.wrongness_behavior_defined === true,
-        mock_real_cap: mockRealCapSignal(parsed),
-        local_only_policy: localOnlySignal(parsed)
-    };
-}
-function artifactIsAcceptable(parsed = {}) {
-    if (!parsed || typeof parsed !== 'object')
-        return true;
-    if (parsed.ok !== false)
-        return true;
-    const status = String(parsed.status || parsed.gate || '');
-    if (/^integration_optional/.test(status))
-        return true;
-    if (status === 'skipped' && parsed.release_gate === 'release:real-check_only')
-        return true;
-    return false;
-}
-function artifactBlockers(parsed = {}) {
-    if (!parsed || typeof parsed !== 'object')
-        return [];
-    const blockers = Array.isArray(parsed.blockers) ? parsed.blockers.map((blocker) => String(blocker)) : [];
-    if (hasCompletionProofSchema(parsed) && !completionProofStatusOk(proofStatus(parsed))) {
-        blockers.push(`completion_proof_status_${proofStatus(parsed) || 'missing'}`);
-    }
-    if (hasTrustReportSchema(parsed) && !(trustOk(parsed) === true || trustStatusOk(trustStatus(parsed)))) {
-        blockers.push(`trust_report_status_${trustStatus(parsed) || 'missing'}`);
-    }
-    return blockers;
-}
-function hasCompletionProofSchema(parsed = {}) {
-    return parsed?.proof_schema === 'sks.completion-proof.v1'
-        || parsed?.artifacts?.proof_schema === 'sks.completion-proof.v1'
-        || parsed?.proof?.schema === 'sks.completion-proof.v1';
-}
-function hasTrustReportSchema(parsed = {}) {
-    return parsed?.trust_schema === 'sks.trust-report.v1'
-        || parsed?.artifacts?.trust_schema === 'sks.trust-report.v1'
-        || parsed?.trust?.schema === 'sks.trust-report.v1';
-}
-function proofStatus(parsed = {}) {
-    return parsed?.proof_status || parsed?.artifacts?.proof_status || parsed?.proof?.status || null;
-}
-function trustStatus(parsed = {}) {
-    return parsed?.trust_status || parsed?.artifacts?.trust_status || parsed?.trust?.status || null;
-}
-function trustOk(parsed = {}) {
-    if (typeof parsed?.trust_ok === 'boolean')
-        return parsed.trust_ok;
-    if (typeof parsed?.artifacts?.trust_ok === 'boolean')
-        return parsed.artifacts.trust_ok;
-    if (typeof parsed?.trust?.ok === 'boolean')
-        return parsed.trust.ok;
-    return null;
-}
-function completionProofStatusOk(status) {
-    return ['verified', 'verified_partial'].includes(String(status || ''));
-}
-function trustStatusOk(status) {
-    return ['verified', 'verified_partial'].includes(String(status || ''));
-}
-function mockRealCapSignal(value) {
-    if (value?.mock_fake_not_verified_real === false)
-        return 'blocked';
-    let blocked = false;
-    walk(value, (node) => {
-        if (node && typeof node === 'object') {
-            if (node.mock === true && node.real_generated === true)
-                blocked = true;
-            if (node.fake_adapter === true && node.real_generated === true)
-                blocked = true;
-        }
-    });
-    return blocked ? 'blocked' : 'enforced';
-}
-function localOnlySignal(value) {
-    let blocked = false;
-    walk(value, (node) => {
-        if (!node || typeof node !== 'object')
-            return;
-        for (const [key, child] of Object.entries(node)) {
-            if ((key === 'local_only' || key === 'local_only_policy' || key === 'local_only_artifact_policy' || key === 'deck_local_only')
-                && child === false) {
-                blocked = true;
-            }
-        }
-    });
-    return blocked ? 'blocked' : 'enforced';
-}
-function walk(value, visit) {
-    visit(value);
-    if (Array.isArray(value)) {
-        for (const item of value)
-            walk(item, visit);
-        return;
-    }
-    if (value && typeof value === 'object') {
-        for (const child of Object.values(value))
-            walk(child, visit);
-    }
-}
-function requiredArtifacts(route, missionPath) {
-    if (missionPath) {
-        if (route === 'ppt_review')
-            return [
-                path.join(missionPath, 'ppt-deck-inventory.json'),
-                path.join(missionPath, 'ppt-slide-export-ledger.json'),
-                path.join(missionPath, 'ppt-slide-callout-ledger.json'),
-                path.join(missionPath, 'ppt-slide-issue-ledger.json'),
-                path.join(missionPath, 'ppt-deck-issue-ledger.json'),
-                path.join(missionPath, 'completion-proof.json'),
-                path.join(missionPath, 'trust-report.json')
-            ];
-        return [path.join(missionPath, 'completion-proof.json')];
-    }
-    if (route === 'hooks')
-        return ['.sneakoscope/reports/codex-hook-parity-1.14.1.json', '.sneakoscope/reports/evidence-flagship-coverage.json'];
-    if (route === 'ppt_review')
-        return ['.sneakoscope/reports/ppt-full-e2e-blackbox.json', '.sneakoscope/reports/evidence-flagship-coverage.json'];
-    if (route === 'ux_review')
-        return ['.sneakoscope/reports/real-imagegen-smoke-1.14.1.json', '.sneakoscope/reports/evidence-flagship-coverage.json'];
-    if (route === 'dfix')
-        return ['.sneakoscope/reports/evidence-flagship-coverage.json'];
-    return [];
-}
-//# sourceMappingURL=flagship-proof-graph-validator.js.map

package/dist/core/hooks-runtime/team-digest.js

@@ -1,85 +0,0 @@
-import path from 'node:path';
-import { readJson, readText } from '../fsx.js';
-import { missionDir } from '../mission.js';
-const TEAM_DIGEST_MAX_EVENTS = 4;
-const TEAM_DIGEST_MESSAGE_CHARS = 180;
-const TEAM_DIGEST_CONTEXT_CHARS = 1600;
-const TEAM_DIGEST_SYSTEM_CHARS = 260;
-export async function teamLiveDigest(root, state = {}) {
-    if (!isTeamState(state) || !state.mission_id)
-        return null;
-    const id = String(state.mission_id);
-    const dir = missionDir(root, id);
-    const dashboard = await readJson(path.join(dir, 'team-dashboard.json'), null).catch(() => null);
-    const transcript = await readText(path.join(dir, 'team-transcript.jsonl'), '').catch(() => '');
-    let events = transcript.split(/\n/).filter(Boolean).slice(-TEAM_DIGEST_MAX_EVENTS * 3).map(parseTeamTranscriptLine).filter(Boolean);
-    let source = 'team-transcript.jsonl';
-    if (!events.length) {
-        const live = await readText(path.join(dir, 'team-live.md'), '').catch(() => '');
-        events = live.split(/\n/).filter((line) => /^- \d{4}-\d{2}-\d{2}T/.test(line.trim())).slice(-TEAM_DIGEST_MAX_EVENTS).map(parseTeamLiveLine).filter(Boolean);
-        source = 'team-live.md';
-    }
-    if (!events.length) {
-        events = dashboard?.latest_messages || [];
-        source = 'team-dashboard.json';
-    }
-    events = normalizeTeamEvents(events).slice(-TEAM_DIGEST_MAX_EVENTS);
-    if (!events.length)
-        return null;
-    const phase = oneLine(state.phase || dashboard?.phase || 'TEAM', 48);
-    const lines = events.map(formatTeamDigestEvent);
-    const context = boundText([
-        `SKS Team live digest: mission ${id}, phase ${phase}, source ${source}.`,
-        `Open live view with: sks team watch ${id}`,
-        'Recent events:',
-        ...lines.map((line) => `- ${line}`)
-    ].join('\n'), TEAM_DIGEST_CONTEXT_CHARS);
-    const system = boundText(`SKS Team live: ${lines.at(-1) || `${id} ${phase}`}`, TEAM_DIGEST_SYSTEM_CHARS);
-    return { context, system };
-}
-function isTeamState(state = {}) {
-    const values = [state.mode, state.route, state.route_command, state.stop_gate].map((value) => String(value || '').toLowerCase());
-    return values.some((value) => value === 'team' || value === '$team' || value.includes('team-gate'));
-}
-function normalizeTeamEvents(events = []) {
-    return events.map((event) => ({
-        ts: String(event?.ts || ''),
-        agent: oneLine(event?.agent || 'unknown', 40),
-        phase: oneLine(event?.phase || 'general', 48),
-        message: oneLine(event?.message || '', TEAM_DIGEST_MESSAGE_CHARS)
-    })).filter((event) => event.message);
-}
-function parseTeamTranscriptLine(line) {
-    try {
-        return JSON.parse(line);
-    }
-    catch {
-        return null;
-    }
-}
-function parseTeamLiveLine(line) {
-    const match = String(line || '').trim().match(/^-\s+(\S+)\s+\[([^\]]+)\]\s+([^:]+):\s*(.*)$/);
-    if (!match)
-        return null;
-    return { ts: match[1], phase: match[2], agent: match[3], message: match[4] };
-}
-function formatTeamDigestEvent(event) {
-    const ts = shortIsoTime(event.ts);
-    return `${ts} [${event.phase}] ${event.agent}: ${event.message}`;
-}
-function shortIsoTime(ts) {
-    return String(ts || '').replace(/^\d{4}-\d{2}-\d{2}T/, '').replace(/\.\d{3}Z$/, 'Z') || 'recent';
-}
-function oneLine(value, limit) {
-    return boundText(String(value || '').replace(/\s+/g, ' ').trim(), limit);
-}
-function boundText(value, limit) {
-    const text = String(value || '');
-    if (text.length <= limit)
-        return text;
-    return `${text.slice(0, Math.max(0, limit - 1)).trimEnd()}…`;
-}
-export function joinSystemMessages(...parts) {
-    return boundText(parts.filter(Boolean).join(' | '), 420);
-}
-//# sourceMappingURL=team-digest.js.map

package/dist/core/mad-db/mad-db-capability.js

@@ -1,253 +0,0 @@
-import path from 'node:path';
-import { appendJsonlBounded, nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
-import { findLatestMission, missionDir } from '../mission.js';
-import { withMadDbLock } from './mad-db-lock.js';
-import { MAD_DB_POLICY } from './mad-db-policy.js';
-export const MAD_DB_CAPABILITY_SCHEMA_V1 = 'sks.mad-db-capability.v1';
-export const MAD_DB_CAPABILITY_SCHEMA = 'sks.mad-db-capability.v2';
-export const MAD_DB_CAPABILITY_FILE = 'mad-db-capability.json';
-export const MAD_DB_ACK = 'I AUTHORIZE ONE-CYCLE DB BREAK-GLASS';
-export const MAD_DB_DEFAULT_TTL_MS = MAD_DB_POLICY.ttl.default_ms;
-export const MAD_DB_MAX_TTL_MS = MAD_DB_POLICY.ttl.hard_max_ms;
-export async function createMadDbCapability(root, input) {
-    if (input.ack !== MAD_DB_ACK)
-        throw new Error('mad_db_ack_phrase_mismatch');
-    const createdAt = nowIso();
-    const ttlMs = Math.min(MAD_DB_MAX_TTL_MS, Math.max(1, Math.floor(Number(input.ttlMs || MAD_DB_DEFAULT_TTL_MS))));
-    const projectRef = String(input.projectRef || process.env.SKS_MAD_DB_PROJECT_REF || process.env.SKS_MAD_DB_E2E_PROJECT_REF || 'fixture-project-ref').trim();
-    const profilePath = input.profilePath || '.sneakoscope/missions/<mission>/mad-db/runtime/codex-mad-db.config.toml';
-    const profileSha256 = input.profileSha256 || sha256(`${input.missionId}:${projectRef}:placeholder-profile`);
-    const capability = {
-        schema: MAD_DB_CAPABILITY_SCHEMA,
-        revision: 1,
-        mission_id: input.missionId,
-        cycle_id: input.cycleId || `mad-db-${Date.now().toString(36)}`,
-        project_root_hash: sha256(path.resolve(input.cwd || root)).slice(0, 24),
-        project_ref: projectRef,
-        target_environment: input.targetEnvironment || 'production',
-        allowed_schemas: input.allowedSchemas?.length ? input.allowedSchemas : ['public'],
-        codex_thread_id: input.codexThreadId ?? null,
-        runtime_session_id: input.runtimeSessionId || `mad-db-session-${Date.now().toString(36)}`,
-        operator_intent_hash: sha256(input.operatorIntent || input.ack || 'mad-db').slice(0, 32),
-        operator_ack_hash: sha256(input.ack).slice(0, 32),
-        scope: {
-            sql_plane: 'all_mutations',
-            control_plane: 'deny',
-            operations: input.operations?.length ? input.operations : [...MAD_DB_POLICY.sql_plane_allowed]
-        },
-        transport: {
-            profile_path: profilePath,
-            profile_sha256: profileSha256,
-            server_url_redacted: input.serverUrlRedacted || 'https://mcp.supabase.com/mcp?project_ref=<redacted>&features=database',
-            features: ['database'],
-            write_capable: true
-        },
-        issued_at: createdAt,
-        expires_at: new Date(Date.now() + ttlMs).toISOString(),
-        closed_at: null,
-        status: input.status || 'issued',
-        counters: {
-            attempts: 0,
-            reserved: 0,
-            succeeded: 0,
-            failed: 0
-        },
-        legacy_compat: {
-            one_cycle_only: true,
-            priority: 'highest',
-            scope: 'all_database_mutations'
-        }
-    };
-    const dir = missionDir(root, input.missionId);
-    await writeJsonAtomic(path.join(dir, MAD_DB_CAPABILITY_FILE), capability);
-    await appendJsonlBounded(path.join(dir, 'mad-db-ledger.jsonl'), {
-        ts: nowIso(),
-        type: 'capability.created',
-        schema: capability.schema,
-        mission_id: capability.mission_id,
-        cycle_id: capability.cycle_id,
-        project_ref_hash: sha256(capability.project_ref).slice(0, 16),
-        runtime_session_id: capability.runtime_session_id,
-        expires_at: capability.expires_at,
-        status: capability.status
-    });
-    return capability;
-}
-export async function readMadDbCapability(root, missionId) {
-    const value = await readJson(path.join(missionDir(root, missionId), MAD_DB_CAPABILITY_FILE), null);
-    if (value?.schema === MAD_DB_CAPABILITY_SCHEMA)
-        return value;
-    if (value?.schema === MAD_DB_CAPABILITY_SCHEMA_V1)
-        return migrateV1Capability(value, missionId);
-    return null;
-}
-export async function resolveMadDbMissionId(root, state = {}, explicitMissionId = null) {
-    if (explicitMissionId && explicitMissionId !== 'latest')
-        return explicitMissionId;
-    if (state?.mad_db_capability_mission_id)
-        return String(state.mad_db_capability_mission_id);
-    if (state?.mission_id)
-        return String(state.mission_id);
-    return findLatestMission(root, { mode: 'mad-db' });
-}
-export function isMadDbCapabilityActive(capability, nowMs = Date.now()) {
-    if (!capability)
-        return false;
-    const expires = Date.parse(capability.expires_at || '');
-    return capability.schema === MAD_DB_CAPABILITY_SCHEMA
-        && ['transport_ready', 'active'].includes(capability.status)
-        && Boolean(capability.project_ref)
-        && capability.transport?.write_capable === true
-        && capability.transport?.features?.[0] === 'database'
-        && Number.isFinite(expires)
-        && expires > nowMs;
-}
-export async function activateMadDbCapability(root, missionId) {
-    return updateMadDbCapability(root, missionId, (capability) => ({
-        ...capability,
-        status: capability.status === 'issued' ? 'active' : capability.status
-    }));
-}
-export async function markMadDbTransportReady(root, missionId) {
-    return updateMadDbCapability(root, missionId, (capability) => ({
-        ...capability,
-        status: capability.status === 'issued' ? 'transport_ready' : capability.status
-    }));
-}
-export async function updateMadDbCapabilityCounters(root, missionId, delta) {
-    return updateMadDbCapability(root, missionId, (capability) => ({
-        ...capability,
-        counters: {
-            attempts: capability.counters.attempts + Number(delta.attemptsDelta || 0),
-            reserved: capability.counters.reserved + Number(delta.reservedDelta || 0),
-            succeeded: capability.counters.succeeded + Number(delta.succeededDelta || 0),
-            failed: capability.counters.failed + Number(delta.failedDelta || 0)
-        }
-    }));
-}
-export async function updateMadDbCapability(root, missionId, mutator) {
-    return withMadDbLock(root, missionId, 'capability', async () => {
-        const current = await readMadDbCapability(root, missionId);
-        if (!current)
-            return null;
-        const next = mutator(current);
-        const updated = {
-            ...next,
-            revision: Number(current.revision || 0) + 1
-        };
-        await writeJsonAtomic(path.join(missionDir(root, missionId), MAD_DB_CAPABILITY_FILE), updated);
-        await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
-            ts: nowIso(),
-            type: 'capability.updated',
-            mission_id: missionId,
-            cycle_id: updated.cycle_id,
-            revision: updated.revision,
-            status: updated.status,
-            counters: updated.counters
-        });
-        return updated;
-    });
-}
-export async function recordMadDbOperation(root, missionId, input = {}) {
-    const capability = await readMadDbCapability(root, missionId);
-    if (!capability)
-        return null;
-    await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
-        ts: nowIso(),
-        type: 'db_operation.legacy_recorded',
-        mission_id: missionId,
-        cycle_id: capability.cycle_id,
-        operation_id: input.operationId || null,
-        tool_name: input.toolName || null,
-        sql_hash: input.sqlHash || null
-    });
-    return capability;
-}
-export async function consumeMadDbCapability(root, missionId, input = {}) {
-    return closeMadDbCycle(root, missionId, '', input.consumedBy || input.reason || 'mad_db_cycle_closed');
-}
-export async function closeMadDbCycle(root, missionId, cycleId = '', reason = 'mad_db_cycle_closed') {
-    const closed = await updateMadDbCapability(root, missionId, (capability) => {
-        if (cycleId && capability.cycle_id !== cycleId)
-            return capability;
-        return {
-            ...capability,
-            status: capability.status === 'revoked' ? 'revoked' : 'closed',
-            closed_at: nowIso()
-        };
-    });
-    if (closed) {
-        await writeJsonAtomic(path.join(missionDir(root, missionId), 'mad-db-capability.closed.json'), {
-            schema: closed.schema,
-            mission_id: closed.mission_id,
-            cycle_id: closed.cycle_id,
-            closed_at: closed.closed_at,
-            close_reason: reason,
-            counters: closed.counters,
-            project_ref_hash: sha256(closed.project_ref).slice(0, 16)
-        });
-    }
-    return closed;
-}
-export async function revokeMadDbCapability(root, missionId, reason = 'operator_revoked') {
-    const revoked = await updateMadDbCapability(root, missionId, (capability) => ({
-        ...capability,
-        status: 'revoked',
-        closed_at: nowIso()
-    }));
-    if (revoked) {
-        await appendJsonlBounded(path.join(missionDir(root, missionId), 'mad-db-ledger.jsonl'), {
-            ts: nowIso(),
-            type: 'capability.revoked',
-            mission_id: missionId,
-            cycle_id: revoked.cycle_id,
-            reason
-        });
-    }
-    return revoked;
-}
-function migrateV1Capability(value, missionId) {
-    const projectRef = process.env.SKS_MAD_DB_PROJECT_REF || process.env.SKS_MAD_DB_E2E_PROJECT_REF || 'legacy-v1-missing-project-ref';
-    return {
-        schema: MAD_DB_CAPABILITY_SCHEMA,
-        revision: 0,
-        mission_id: String(value.mission_id || missionId),
-        cycle_id: String(value.cycle_id || `mad-db-${Date.now().toString(36)}`),
-        project_root_hash: sha256(String(value.operator_ack?.cwd || process.cwd())).slice(0, 24),
-        project_ref: projectRef,
-        target_environment: 'production',
-        allowed_schemas: ['public'],
-        codex_thread_id: null,
-        runtime_session_id: `legacy-v1-${Date.now().toString(36)}`,
-        operator_intent_hash: sha256('legacy-v1-migrated').slice(0, 32),
-        operator_ack_hash: sha256(MAD_DB_ACK).slice(0, 32),
-        scope: {
-            sql_plane: 'all_mutations',
-            control_plane: 'deny',
-            operations: [...MAD_DB_POLICY.sql_plane_allowed]
-        },
-        transport: {
-            profile_path: '.sneakoscope/missions/<mission>/mad-db/runtime/codex-mad-db.config.toml',
-            profile_sha256: sha256('legacy-v1-missing-profile'),
-            server_url_redacted: 'https://mcp.supabase.com/mcp?project_ref=<legacy-redacted>&features=database',
-            features: ['database'],
-            write_capable: true
-        },
-        issued_at: String(value.created_at || nowIso()),
-        expires_at: String(value.expires_at || new Date(Date.now() - 1000).toISOString()),
-        closed_at: value.consumed ? String(value.consumed_at || nowIso()) : null,
-        status: value.enabled === false ? 'revoked' : value.consumed ? 'closed' : 'quarantined',
-        counters: {
-            attempts: Number(value.operation_count || 0),
-            reserved: Number(value.operation_count || 0),
-            succeeded: 0,
-            failed: 0
-        },
-        legacy_compat: {
-            one_cycle_only: true,
-            priority: 'highest',
-            scope: 'all_database_mutations'
-        }
-    };
-}
-//# sourceMappingURL=mad-db-capability.js.map