import { b as getLogger } from './paths-2M_UxD_H.js';
import { s as safeSaveSessions, a as safeSaveArchive, b as safeAppendLog, c as safeSingleTaskWrite } from './data-safety-central-vmfu_Y4J.js';
import 'node:fs';
import 'node:path';
import 'node:os';
import 'node:events';
import 'node:diagnostics_channel';
import 'fs';
import 'events';
import 'util';
import 'path';
import 'assert';
import 'worker_threads';
import 'module';
import 'node:url';
import 'url';
import 'buffer';
import 'node:module';
import 'node:child_process';
import 'node:crypto';
import 'node:process';
import 'node:async_hooks';
import './sqlite-Dsbe0wec.js';
import './chunk-DDP5xfzh.js';
import './dual-scope-db-ATrwq0LH.js';
import './indexes-aYlULWG3.js';
import './utils-BvHPJOVk.js';
import './conduit-Ca_OFWR_.js';
import './unique-constraint-BM-Apx1H.js';
import './memory-schema-Bi7cChwo.js';
import './agent-registry-BtE5uhMO.js';
import './nexus-sqlite2-DgTuv9BQ.js';
import './nexus-schema2-BEd-ol6e.js';
import './logger-ChCwlV5k.js';
import 'node:sqlite';
import './lock-BoHF25mx.js';
import './index-IVoIz4D5.js';
import 'constants';
import 'stream';
import './json-DXl7iDYg.js';
import 'node:fs/promises';
import './index-Ca4C2M45.js';
import './data-accessor-CVbz8X_7.js';
import './sqlite-data-accessor-C59wZ0zp.js';
import './session-store-OwQWMSf_.js';
import './cross-db-cleanup-C_FLyd-6.js';
import 'node:util';

//#region ../core/dist/store/safety-data-accessor.js
/**
* SafetyDataAccessor - Factory-level safety wrapper for ALL data accessors.
*
* This wrapper ensures that ALL data operations are safety-enabled by default.
* No code path can bypass safety - this is the architectural guarantee.
*
* Key features:
* - Sequence validation before writes
* - Write verification (read-back validation)
* - Automatic git checkpointing
* - Emergency disable via CLEO_DISABLE_SAFETY env var
*
* @task T4745
* @epic T4732
*/
var log = getLogger("data-safety");
/** Check if safety is disabled via environment variable. */
function isSafetyDisabled() {
	return process.env.CLEO_DISABLE_SAFETY === "true";
}
/**
* Safety-enabled DataAccessor wrapper.
*
* Wraps any DataAccessor implementation and automatically applies
* safety checks to all write operations. Read operations pass through.
*
* This class CANNOT be bypassed - it's the only way to get a DataAccessor
* from the factory (unless emergency disable is active).
*/
var SafetyDataAccessor = class {
	/** The underlying accessor being wrapped. */
	inner;
	/** Working directory for operations. */
	cwd;
	/** Safety configuration. */
	config;
	/**
	* Create a SafetyDataAccessor wrapper.
	*
	* @param inner - The DataAccessor to wrap
	* @param cwd - Working directory for path resolution
	* @param config - Optional safety configuration overrides
	*/
	constructor(inner, cwd, config) {
		this.inner = inner;
		this.cwd = cwd;
		this.config = {
			enabled: true,
			verbose: false,
			...config
		};
		if (this.config.verbose) log.debug({ engine: inner.engine }, "SafetyDataAccessor initialized");
	}
	/** The storage engine backing this accessor. */
	get engine() {
		return this.inner.engine;
	}
	/**
	* Log safety operation if verbose mode is enabled.
	*/
	logVerbose(message) {
		if (this.config.verbose) log.debug(message);
	}
	/**
	* Get safety options for data-safety-central operations.
	*/
	getSafetyOptions() {
		return {
			verify: this.config.enabled,
			checkpoint: this.config.enabled,
			validateSequence: this.config.enabled,
			strict: this.config.enabled
		};
	}
	async loadArchive() {
		this.logVerbose("Loading ArchiveFile (pass-through)");
		return this.inner.loadArchive();
	}
	async loadSessions() {
		this.logVerbose("Loading sessions (pass-through)");
		return this.inner.loadSessions();
	}
	async saveSessions(data) {
		this.logVerbose(`Saving sessions with ${data.length} sessions`);
		await safeSaveSessions(this.inner, data, this.cwd, this.getSafetyOptions());
	}
	async saveArchive(data) {
		this.logVerbose(`Saving ArchiveFile with ${data.archivedTasks?.length ?? 0} tasks`);
		await safeSaveArchive(this.inner, data, this.cwd, this.getSafetyOptions());
	}
	async appendLog(entry) {
		this.logVerbose("Appending log entry");
		await safeAppendLog(this.inner, entry, this.cwd, this.getSafetyOptions());
	}
	async upsertSingleTask(task) {
		this.logVerbose(`Upserting single task ${task.id}`);
		await safeSingleTaskWrite(this.inner, task.id, () => this.inner.upsertSingleTask(task), this.cwd, this.getSafetyOptions());
	}
	async archiveSingleTask(taskId, fields) {
		this.logVerbose(`Archiving single task ${taskId}`);
		await safeSingleTaskWrite(this.inner, taskId, () => this.inner.archiveSingleTask(taskId, fields), this.cwd, this.getSafetyOptions());
	}
	async removeSingleTask(taskId) {
		this.logVerbose(`Removing single task ${taskId}`);
		await safeSingleTaskWrite(this.inner, taskId, () => this.inner.removeSingleTask(taskId), this.cwd, this.getSafetyOptions());
	}
	async loadSingleTask(taskId) {
		return this.inner.loadSingleTask(taskId);
	}
	async addRelation(taskId, relatedTo, relationType, reason) {
		await this.inner.addRelation(taskId, relatedTo, relationType, reason);
	}
	async removeRelation(taskId, relatedTo, relationType) {
		await this.inner.removeRelation(taskId, relatedTo, relationType);
	}
	async getAcRows(taskId) {
		return this.inner.getAcRows(taskId);
	}
	async getAcBindings(acIds) {
		return this.inner.getAcBindings(acIds);
	}
	async getMetaValue(key) {
		return this.inner.getMetaValue(key);
	}
	async setMetaValue(key, value) {
		return this.inner.setMetaValue(key, value);
	}
	async getSchemaVersion() {
		return this.inner.getSchemaVersion();
	}
	async queryTasks(filters) {
		return this.inner.queryTasks(filters);
	}
	async queryAuditLog(query) {
		return this.inner.queryAuditLog(query);
	}
	async countTasks(filters) {
		return this.inner.countTasks(filters);
	}
	async getChildren(parentId) {
		return this.inner.getChildren(parentId);
	}
	async countChildren(parentId) {
		return this.inner.countChildren(parentId);
	}
	async countActiveChildren(parentId) {
		return this.inner.countActiveChildren(parentId);
	}
	async getAncestorChain(taskId) {
		return this.inner.getAncestorChain(taskId);
	}
	async getSubtree(rootId) {
		return this.inner.getSubtree(rootId);
	}
	async getDependents(taskId) {
		return this.inner.getDependents(taskId);
	}
	async getDependencyChain(taskId) {
		return this.inner.getDependencyChain(taskId);
	}
	async taskExists(taskId) {
		return this.inner.taskExists(taskId);
	}
	async loadTasks(taskIds) {
		return this.inner.loadTasks(taskIds);
	}
	async updateTaskFields(taskId, fields) {
		this.logVerbose(`Updating fields on task ${taskId}`);
		await safeSingleTaskWrite(this.inner, taskId, () => this.inner.updateTaskFields(taskId, fields), this.cwd, this.getSafetyOptions());
	}
	async getNextPosition(parentId) {
		return this.inner.getNextPosition(parentId);
	}
	async shiftPositions(parentId, fromPosition, delta) {
		return this.inner.shiftPositions(parentId, fromPosition, delta);
	}
	async transaction(fn) {
		this.logVerbose("Starting transaction");
		return this.inner.transaction(fn);
	}
	async getActiveSession() {
		return this.inner.getActiveSession();
	}
	async resolveCurrentSession() {
		return this.inner.resolveCurrentSession();
	}
	async upsertSingleSession(session) {
		return this.inner.upsertSingleSession(session);
	}
	async removeSingleSession(sessionId) {
		return this.inner.removeSingleSession(sessionId);
	}
	async listAgentInstances(filters) {
		return this.inner.listAgentInstances(filters);
	}
	async getAgentInstance(agentId) {
		return this.inner.getAgentInstance(agentId);
	}
	async claimTask(taskId, agentId) {
		return this.inner.claimTask(taskId, agentId);
	}
	async unclaimTask(taskId) {
		return this.inner.unclaimTask(taskId);
	}
	async close() {
		this.logVerbose("Closing accessor");
		await this.inner.close();
	}
};
/**
* Wrap a DataAccessor with safety.
*
* This is the internal factory helper that wraps any accessor
* with the SafetyDataAccessor wrapper.
*
* @param accessor - The accessor to wrap
* @param cwd - Working directory
* @returns SafetyDataAccessor wrapping the input
*/
function wrapWithSafety(accessor, cwd) {
	if (isSafetyDisabled()) {
		log.warn("Safety disabled - emergency mode (CLEO_DISABLE_SAFETY=true). Data integrity checks bypassed.");
		return accessor;
	}
	return new SafetyDataAccessor(accessor, cwd);
}

export { wrapWithSafety };
//# sourceMappingURL=safety-data-accessor-Bs_jU8n-.js.map
