@sema-agent/server 1.313.0 → 1.315.0

package/dist/plugins/tidb-image-bake.js

@@ -1,350 +1,3 @@
-import { uuidv7 } from "@sema-agent/core";
-import { randomBytes } from "node:crypto";
-import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
-import { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS, } from "./store-contracts.js";
+export { TiDBImageBake, SqlImageBake } from "./image-bake-store-sql.js";
 export { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
-function isDupKey(err) {
-    return Boolean(err) && err.code === "ER_DUP_ENTRY";
-}
-function dupKeyName(err) {
-    const msg = String(err?.sqlMessage ?? err?.message ?? "");
-    if (/uq_line/i.test(msg))
-        return "uq_line";
-    if (/PRIMARY/i.test(msg))
-        return "primary";
-    return "other";
-}
-export class TiDBImageBake {
-    pool;
-    poolName;
-    constructor(pool, poolName = "standard") {
-        this.pool = pool;
-        this.poolName = poolName;
-    }
-    async createBake(input) {
-        const bakeId = uuidv7();
-        const now = new Date();
-        try {
-            await this.pool.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
-                "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                "VALUES (?,?,?,?,?,?,?,?,'queued',?,0,?,?,?)", [
-                bakeId,
-                input.profile,
-                input.bands == null ? null : JSON.stringify(input.bands),
-                input.baseRef,
-                input.push ? 1 : 0,
-                input.dryRun ? 1 : 0,
-                input.logs ? 1 : 0,
-                JSON.stringify(input.argv),
-                input.idemKey,
-                input.requestedBy,
-                now,
-                now,
-            ]);
-        }
-        catch (err) {
-            if (isDupKey(err) && input.idemKey) {
-                const existing = await this.getBakeByIdem(input.idemKey);
-                if (existing)
-                    return { created: false, bake: existing };
-            }
-            throw err;
-        }
-        const bake = await this.getBake(bakeId);
-        if (!bake)
-            throw new Error("createBake: row vanished after insert");
-        return { created: true, bake };
-    }
-    async createBakeIfIdle(input) {
-        const bakeId = uuidv7();
-        const now = new Date();
-        const conn = await this.pool.getConnection();
-        let inserted = false;
-        try {
-            await conn.query("BEGIN PESSIMISTIC");
-            await conn.query("INSERT IGNORE INTO image_bake_admit (pool) VALUES (?)", [this.poolName]);
-            await conn.query("SELECT pool FROM image_bake_admit WHERE pool = ? FOR UPDATE", [this.poolName]);
-            const [busyRows] = await conn.query("SELECT 1 FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0 LIMIT 1 FOR UPDATE");
-            if (busyRows.length === 0) {
-                await conn.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
-                    "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                    "VALUES (?,?,?,?,?,?,?,?,'queued',?,0,?,?,?)", [
-                    bakeId,
-                    input.profile,
-                    input.bands == null ? null : JSON.stringify(input.bands),
-                    input.baseRef,
-                    input.push ? 1 : 0,
-                    input.dryRun ? 1 : 0,
-                    input.logs ? 1 : 0,
-                    JSON.stringify(input.argv),
-                    input.idemKey,
-                    input.requestedBy,
-                    now,
-                    now,
-                ]);
-                inserted = true;
-            }
-            await conn.commit();
-        }
-        catch (err) {
-            try {
-                await conn.rollback();
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-        if (!inserted)
-            return { created: false, bake: null };
-        const bake = await this.getBake(bakeId);
-        if (!bake)
-            throw new Error("createBakeIfIdle: row vanished after insert");
-        return { created: true, bake };
-    }
-    async getBake(bakeId) {
-        const [rows] = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE bake_id = ? LIMIT 1`, [bakeId]);
-        return rows[0] ? mapRow(rows[0]) : null;
-    }
-    async getBakeByIdem(idemKey) {
-        const [rows] = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE idem_key = ? LIMIT 1`, [idemKey]);
-        return rows[0] ? mapRow(rows[0]) : null;
-    }
-    async findActiveByArgv(argv) {
-        const [rows] = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND argv = CAST(? AS JSON) ` +
-            "ORDER BY created_at DESC LIMIT 1", [JSON.stringify(argv)]);
-        return rows[0] ? mapRow(rows[0]) : null;
-    }
-    async findActiveAny() {
-        const [rows] = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0 ` +
-            "ORDER BY created_at ASC LIMIT 1", []);
-        return rows[0] ? mapRow(rows[0]) : null;
-    }
-    async findNextQueuedId() {
-        const [rows] = await this.pool.query("SELECT bake_id FROM image_bake WHERE status = 'queued' ORDER BY created_at ASC LIMIT 1", []);
-        return rows[0] ? String(rows[0].bake_id) : null;
-    }
-    async claimBake(bakeId, runnerId, leaseMs) {
-        const conn = await this.pool.getConnection();
-        try {
-            await conn.beginTransaction();
-            const now = new Date();
-            const leaseUntil = new Date(now.getTime() + leaseMs);
-            const ingestSecret = randomBytes(24).toString("hex");
-            const [bakeRes] = await conn.query("UPDATE image_bake SET status='running', state='PENDING', runner_id=?, ingest_secret=?, " +
-                "lease_until=?, updated_at=? WHERE bake_id=? AND status='queued'", [runnerId, ingestSecret, leaseUntil, now, bakeId]);
-            if (bakeRes.affectedRows !== 1) {
-                await conn.rollback();
-                return null;
-            }
-            const [dryRows] = await conn.query("SELECT dry_run FROM image_bake WHERE bake_id=?", [bakeId]);
-            if (Boolean(dryRows[0]?.dry_run)) {
-                await conn.commit();
-                return (await this.getBake(bakeId)) ?? null;
-            }
-            const [leaseRows] = await conn.query("SELECT bake_id, expires_at FROM image_bake_lease WHERE pool=?", [this.poolName]);
-            const cur = leaseRows[0];
-            if (!cur) {
-                try {
-                    await conn.query("INSERT INTO image_bake_lease (pool, bake_id, acquired_at, expires_at) VALUES (?,?,?,?)", [this.poolName, bakeId, now, leaseUntil]);
-                }
-                catch (err) {
-                    if (isDupKey(err)) {
-                        await conn.rollback();
-                        return null;
-                    }
-                    throw err;
-                }
-            }
-            else {
-                if (new Date(cur.expires_at).getTime() >= now.getTime()) {
-                    await conn.rollback();
-                    return null;
-                }
-                const holderId = String(cur.bake_id ?? "");
-                const [holderRows] = await conn.query("SELECT status FROM image_bake WHERE bake_id=?", [holderId]);
-                const holderStatus = String(holderRows[0]?.status ?? "");
-                if (holderStatus === "queued" || holderStatus === "running") {
-                    await conn.rollback();
-                    return null;
-                }
-                const [stealRes] = await conn.query("UPDATE image_bake_lease SET bake_id=?, acquired_at=?, expires_at=? WHERE pool=? AND bake_id=? AND expires_at=?", [bakeId, now, leaseUntil, this.poolName, holderId, cur.expires_at]);
-                if (stealRes.affectedRows === 0) {
-                    await conn.rollback();
-                    return null;
-                }
-            }
-            const [check] = await conn.query("SELECT bake_id FROM image_bake_lease WHERE pool=?", [this.poolName]);
-            if (String(check[0]?.bake_id ?? "") !== bakeId) {
-                await conn.rollback();
-                return null;
-            }
-            await conn.commit();
-            return (await this.getBake(bakeId)) ?? null;
-        }
-        catch (err) {
-            try {
-                await conn.rollback();
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-    }
-    async appendEvent(bakeId, kind, data, opts = {}) {
-        const lineOrd = opts.lineOrd ?? null;
-        if (lineOrd !== null && (await this.lineOrdExists(bakeId, lineOrd)))
-            return null;
-        const payload = data == null ? null : JSON.stringify(data);
-        for (let attempt = 0; attempt < 50; attempt += 1) {
-            const seq = (await this.maxSeq(bakeId)) + 1;
-            try {
-                await this.pool.query("INSERT INTO image_bake_event (bake_id, seq, line_ord, kind, level, data, ts) VALUES (?,?,?,?,?,?,?)", [bakeId, seq, lineOrd, kind, opts.level ?? null, payload, new Date()]);
-                return seq;
-            }
-            catch (err) {
-                if (!isDupKey(err))
-                    throw err;
-                const which = dupKeyName(err);
-                if (which === "uq_line" && lineOrd !== null)
-                    return null;
-                await new Promise((r) => setTimeout(r, Math.floor(Math.random() * 5)));
-            }
-        }
-        throw new Error(`appendEvent: seq allocation lost the (bake_id,seq) race after retries (bakeId=${bakeId})`);
-    }
-    async lineOrdExists(bakeId, lineOrd) {
-        const [rows] = await this.pool.query("SELECT 1 FROM image_bake_event WHERE bake_id = ? AND line_ord = ? LIMIT 1", [bakeId, lineOrd]);
-        return rows.length > 0;
-    }
-    async maxSeq(bakeId) {
-        const [rows] = await this.pool.query("SELECT MAX(seq) AS m FROM image_bake_event WHERE bake_id = ?", [bakeId]);
-        const m = rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
-    async retainedFrom(bakeId) {
-        const [rows] = await this.pool.query("SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = ?", [bakeId]);
-        const m = rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
-    async getEvents(bakeId, afterSeq) {
-        const [rows] = await this.pool.query("SELECT seq, line_ord, kind, level, data, ts FROM image_bake_event WHERE bake_id = ? AND seq > ? ORDER BY seq ASC", [bakeId, afterSeq]);
-        return rows.map((r) => ({
-            seq: Number(r.seq),
-            lineOrd: r.line_ord === null ? null : Number(r.line_ord),
-            kind: String(r.kind),
-            level: r.level ?? null,
-            data: parseJson(r.data, null),
-            ts: iso(r.ts),
-        }));
-    }
-    async setStatus(bakeId, status) {
-        await this.pool.query("UPDATE image_bake SET status = ?, updated_at = ? WHERE bake_id = ?", [status, new Date(), bakeId]);
-    }
-    async setState(bakeId, state) {
-        await this.pool.query("UPDATE image_bake SET state = ?, updated_at = ? WHERE bake_id = ?", [state, new Date(), bakeId]);
-    }
-    async setTerminal(bakeId, t) {
-        let affectedRows = 0;
-        await this.tx(async (conn) => {
-            const [res] = await conn.query("UPDATE image_bake SET status=?, state=?, digest=?, repo=?, ref=?, index_id=?, exit_code=?, error=?, " +
-                "error_code=?, manifest_sha=?, tag=?, ingest_secret=NULL, updated_at=? WHERE bake_id=? AND status IN ('queued','running')", [
-                t.status,
-                t.state,
-                t.digest ?? null,
-                t.repo ?? null,
-                t.ref ?? null,
-                t.indexId ?? null,
-                t.exitCode ?? null,
-                t.error ?? null,
-                t.errorCode ?? null,
-                t.manifestSha ?? null,
-                t.tag ?? null,
-                new Date(),
-                bakeId,
-            ]);
-            affectedRows = res.affectedRows;
-            await conn.query("DELETE FROM image_bake_lease WHERE pool = ? AND bake_id = ?", [this.poolName, bakeId]);
-        });
-        return affectedRows;
-    }
-    async setIndexId(bakeId, indexId) {
-        const [res] = await this.pool.query("UPDATE image_bake SET index_id = ?, updated_at = ? WHERE bake_id = ? AND status IN ('queued','running')", [indexId, new Date(), bakeId]);
-        return res.affectedRows >= 1;
-    }
-    async heartbeatLease(bakeId, runnerId, leaseMs) {
-        const now = new Date();
-        const leaseUntil = new Date(now.getTime() + leaseMs);
-        const [res] = await this.pool.query("UPDATE image_bake SET lease_until = ?, updated_at = ? WHERE bake_id = ? AND runner_id = ? AND status = 'running'", [leaseUntil, now, bakeId, runnerId]);
-        if (res.affectedRows < 1)
-            return false;
-        const [dryRows] = await this.pool.query("SELECT dry_run FROM image_bake WHERE bake_id = ?", [bakeId]);
-        if (Boolean(dryRows[0]?.dry_run))
-            return true;
-        const [leaseRes] = await this.pool.query("UPDATE image_bake_lease SET expires_at = ? WHERE pool = ? AND bake_id = ?", [leaseUntil, this.poolName, bakeId]);
-        return leaseRes.affectedRows >= 1;
-    }
-    async requestCancel(bakeId) {
-        const [r] = await this.pool.query("UPDATE image_bake SET cancel_requested = 1, updated_at = ? WHERE bake_id = ? AND status IN ('queued','running')", [new Date(), bakeId]);
-        return r.affectedRows > 0;
-    }
-    async isCancelRequested(bakeId) {
-        const [rows] = await this.pool.query("SELECT cancel_requested FROM image_bake WHERE bake_id = ?", [bakeId]);
-        return Boolean(rows[0]?.cancel_requested);
-    }
-    async reapStaleBakes(olderThanMs) {
-        const cutoff = new Date(Date.now() - olderThanMs);
-        const [victims] = await this.pool.query("SELECT bake_id FROM image_bake WHERE status = 'running' AND " +
-            "(lease_until IS NULL OR lease_until < ?) AND updated_at < ?", [cutoff, cutoff]);
-        let reaped = 0;
-        for (const v of victims) {
-            const bakeId = String(v.bake_id);
-            const [res] = await this.pool.query("UPDATE image_bake SET status='failed', state='FAILED', error='bake-runner lost (lease expired)', " +
-                "ingest_secret=NULL, index_id=NULL, updated_at=? WHERE bake_id=? AND status='running'", [new Date(), bakeId]);
-            if (res.affectedRows === 1) {
-                reaped += 1;
-                try {
-                    await this.appendEvent(bakeId, "done", {
-                        status: "FAILED",
-                        digest: null,
-                        repo: null,
-                        ref: null,
-                        indexId: null,
-                        exitCode: null,
-                        error: "bake-runner lost (lease expired)",
-                        errorCode: null,
-                    });
-                }
-                catch {
-                }
-                await this.pool.query("DELETE FROM image_bake_lease WHERE pool = ? AND bake_id = ?", [this.poolName, bakeId]);
-            }
-        }
-        return reaped;
-    }
-    async tx(fn) {
-        const conn = await this.pool.getConnection();
-        try {
-            await conn.beginTransaction();
-            await fn(conn);
-            await conn.commit();
-        }
-        catch (err) {
-            try {
-                await conn.rollback();
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-    }
-}
 //# sourceMappingURL=tidb-image-bake.js.map

package/dist/plugins/web-search.d.ts

@@ -17,11 +17,12 @@ export interface WebSearchOpts {
     blockedDomains?: string[];
 }
 export type WebSearchFn = (query: string, signal?: AbortSignal, opts?: WebSearchOpts) => Promise<WebSearchResult[]>;
-export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
-export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): {
+export interface WebSearchBackend {
     search: WebSearchFn;
     maxResults: number;
-};
+}
+export declare function setWebSearchBadPayloadObserver(fn: ((provider: string) => void) | undefined): void;
+export declare function createWebSearchBackend(cfg: WebSearchBackendConfig): WebSearchBackend;
 export declare function webSearchConfigFromEnv(env?: NodeJS.ProcessEnv): WebSearchBackendConfig | undefined;
 export declare function webSearchConfigFromSettings(raw: unknown): WebSearchBackendConfig | undefined;
 //# sourceMappingURL=web-search.d.ts.map

package/dist/plugins/write-behind-counter.d.ts

@@ -1,4 +1,5 @@
-import type { Pool } from "mysql2/promise";
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
 export interface CounterTable {
     table: string;
     keyCol: string;
@@ -13,7 +14,9 @@ export interface CounterDegradeInfo {
 }
 export type CounterDegradeHook = (info: CounterDegradeInfo) => void;
 export declare const DEFAULT_COUNTER_QUERY_TIMEOUT_MS = 30000;
-export declare class WriteBehindCounter {
+type CounterDialect = "tidb" | "pg";
+export declare class SqlWriteBehindCounter {
+    private readonly dialect;
     private readonly pool;
     private readonly t;
     private readonly windowMs;
@@ -26,7 +29,8 @@ export declare class WriteBehindCounter {
     private flushing;
     private flushStartedAt;
     private failStreak;
-    constructor(pool: Pool, t: CounterTable, windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook | undefined, queryTimeoutMs?: number);
+    constructor(dialect: CounterDialect, pool: MySqlPool | PgPool, t: CounterTable, windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook | undefined, queryTimeoutMs?: number);
+    private exec;
     private bump;
     bucket(): number;
     private rk;
@@ -40,4 +44,11 @@ export declare class WriteBehindCounter {
     startRefresh(intervalMs?: number): this;
     stop(): void;
 }
+export declare class WriteBehindCounter extends SqlWriteBehindCounter {
+    constructor(pool: MySqlPool, t: CounterTable, windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook, queryTimeoutMs?: number);
+}
+export declare class PgWriteBehindCounter extends SqlWriteBehindCounter {
+    constructor(pool: PgPool, t: CounterTable, windowMs: number, now?: () => number, onDegraded?: CounterDegradeHook, queryTimeoutMs?: number);
+}
+export {};
 //# sourceMappingURL=write-behind-counter.d.ts.map

package/dist/plugins/write-behind-counter.js

@@ -1,6 +1,7 @@
 const SEP = "\u0000";
 export const DEFAULT_COUNTER_QUERY_TIMEOUT_MS = 30_000;
-export class WriteBehindCounter {
+export class SqlWriteBehindCounter {
+    dialect;
     pool;
     t;
     windowMs;
@@ -13,7 +14,8 @@ export class WriteBehindCounter {
     flushing = false;
     flushStartedAt = 0;
     failStreak = new Map();
-    constructor(pool, t, windowMs, now = () => Date.now(), onDegraded, queryTimeoutMs = DEFAULT_COUNTER_QUERY_TIMEOUT_MS) {
+    constructor(dialect, pool, t, windowMs, now = () => Date.now(), onDegraded, queryTimeoutMs = DEFAULT_COUNTER_QUERY_TIMEOUT_MS) {
+        this.dialect = dialect;
         this.pool = pool;
         this.t = t;
         this.windowMs = windowMs;
@@ -21,6 +23,17 @@ export class WriteBehindCounter {
         this.onDegraded = onDegraded;
         this.queryTimeoutMs = queryTimeoutMs;
     }
+    async exec(sql, params) {
+        if (this.dialect === "tidb") {
+            const [r] = (await this.pool.query({ sql, timeout: this.queryTimeoutMs }, params));
+            if (Array.isArray(r))
+                return { rows: r, affected: 0 };
+            return { rows: [], affected: Number(r?.affectedRows ?? 0) };
+        }
+        const q = { text: sql, values: params, query_timeout: this.queryTimeoutMs };
+        const res = await this.pool.query(q);
+        return { rows: (res.rows ?? []), affected: res.rowCount ?? 0 };
+    }
     bump(kind, failed, error) {
         if (!this.onDegraded)
             return;
@@ -72,6 +85,11 @@ export class WriteBehindCounter {
     }
     async flushOnce() {
         const { table, keyCol, valCol } = this.t;
+        const sql = this.dialect === "tidb"
+            ? `INSERT INTO ${table} (${keyCol}, window_bucket, ${valCol}, updated_at) VALUES (?,?,?,?) ` +
+                `ON DUPLICATE KEY UPDATE ${valCol} = ${valCol} + VALUES(${valCol}), updated_at = VALUES(updated_at)`
+            : `INSERT INTO ${table} (${keyCol}, window_bucket, ${valCol}, updated_at) VALUES ($1,$2,$3,$4) ` +
+                `ON CONFLICT (${keyCol}, window_bucket) DO UPDATE SET ${valCol} = ${table}.${valCol} + EXCLUDED.${valCol}, updated_at = EXCLUDED.updated_at`;
         let attempted = false;
         let failure;
         let hadFailure = false;
@@ -83,11 +101,7 @@ export class WriteBehindCounter {
             const windowBucket = Number(rk.slice(sep + 1));
             attempted = true;
             try {
-                await this.pool.query({
-                    sql: `INSERT INTO ${table} (${keyCol}, window_bucket, ${valCol}, updated_at) VALUES (?,?,?,?) ` +
-                        `ON DUPLICATE KEY UPDATE ${valCol} = ${valCol} + VALUES(${valCol}), updated_at = VALUES(updated_at)`,
-                    timeout: this.queryTimeoutMs,
-                }, [key, windowBucket, delta, new Date()]);
+                await this.exec(sql, [key, windowBucket, delta, new Date()]);
                 const remaining = (this.pendingDelta.get(rk) ?? 0) - delta;
                 if (remaining > 0)
                     this.pendingDelta.set(rk, remaining);
@@ -108,10 +122,11 @@ export class WriteBehindCounter {
         const { table, keyCol, valCol } = this.t;
         const b = this.bucket();
         try {
-            const [rows] = await this.pool.query({ sql: `SELECT ${keyCol}, ${valCol} FROM ${table} WHERE window_bucket = ?`, timeout: this.queryTimeoutMs }, [b]);
+            const { rows } = await this.exec(this.dialect === "tidb"
+                ? `SELECT ${keyCol}, ${valCol} FROM ${table} WHERE window_bucket = ?`
+                : `SELECT ${keyCol}, ${valCol} FROM ${table} WHERE window_bucket = $1`, [b]);
             const next = new Map();
-            for (const r of rows) {
-                const row = r;
+            for (const row of rows) {
                 next.set(`${String(row[keyCol])}${SEP}${b}`, Number(row[valCol]));
             }
             this.fleetTotal = next;
@@ -123,8 +138,10 @@ export class WriteBehindCounter {
     }
     async reap() {
         try {
-            const [res] = await this.pool.query({ sql: `DELETE FROM ${this.t.table} WHERE window_bucket < ?`, timeout: this.queryTimeoutMs }, [this.bucket()]);
-            return res.affectedRows;
+            const { affected } = await this.exec(this.dialect === "tidb"
+                ? `DELETE FROM ${this.t.table} WHERE window_bucket < ?`
+                : `DELETE FROM ${this.t.table} WHERE window_bucket < $1`, [this.bucket()]);
+            return affected;
         }
         catch {
             return 0;
@@ -141,4 +158,14 @@ export class WriteBehindCounter {
         this.timer = undefined;
     }
 }
+export class WriteBehindCounter extends SqlWriteBehindCounter {
+    constructor(pool, t, windowMs, now, onDegraded, queryTimeoutMs) {
+        super("tidb", pool, t, windowMs, now, onDegraded, queryTimeoutMs);
+    }
+}
+export class PgWriteBehindCounter extends SqlWriteBehindCounter {
+    constructor(pool, t, windowMs, now, onDegraded, queryTimeoutMs) {
+        super("pg", pool, t, windowMs, now, onDegraded, queryTimeoutMs);
+    }
+}
 //# sourceMappingURL=write-behind-counter.js.map

package/dist/principal-jwt.d.ts

@@ -0,0 +1,44 @@
+import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
+    iss: string;
+    aud: string;
+    nowSec?: number;
+    skewSec?: number;
+    maxTtlSec?: number;
+}): {
+    sub: string;
+    bnd?: string;
+} | null;
+export declare function approvalBnd(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+}): string;
+export declare function verifyDirectDoorProof(proof: {
+    jwt?: string;
+    mac?: string;
+    kid?: string;
+}, envelope: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+    reason?: string | null;
+}, config: {
+    principalJwtPubkeys: PrincipalJwtKey[];
+    principalJwtIss?: string;
+    principalJwtAud?: string;
+    principalJwtMaxTtlSec?: number;
+    approvalHmacKeys: ApprovalHmacKey[];
+}, opts?: {
+    actionBinding?: boolean;
+}): {
+    ok: true;
+    principal: string;
+} | {
+    ok: false;
+    status: number;
+    errorCode: string;
+    error: string;
+};
+//# sourceMappingURL=principal-jwt.d.ts.map

package/dist/principal-jwt.js

@@ -0,0 +1,95 @@
+import { createHash, createPublicKey, verify as cryptoVerify } from "node:crypto";
+import { verifyApprovalHmac } from "./approval-hmac.js";
+function b64urlToBuf(s) {
+    return Buffer.from(s, "base64url");
+}
+function verifyJwsSignature(alg, signingInput, sig, pub) {
+    try {
+        if (alg === "EdDSA")
+            return cryptoVerify(null, signingInput, pub, sig);
+        if (alg === "RS256")
+            return cryptoVerify("sha256", signingInput, pub, sig);
+        if (alg === "ES256")
+            return cryptoVerify("sha256", signingInput, { key: pub, dsaEncoding: "ieee-p1363" }, sig);
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyPrincipalJwt(token, keys, expect) {
+    if (keys.length === 0)
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [h, p, s] = parts;
+    let header;
+    let payload;
+    let sig;
+    try {
+        header = JSON.parse(b64urlToBuf(h).toString("utf8"));
+        payload = JSON.parse(b64urlToBuf(p).toString("utf8"));
+        sig = b64urlToBuf(s);
+    }
+    catch {
+        return null;
+    }
+    if (typeof header !== "object" || header === null || typeof payload !== "object" || payload === null)
+        return null;
+    if (typeof header.alg !== "string" || typeof header.kid !== "string" || sig.length === 0)
+        return null;
+    const key = keys.find((k) => k.kid === header.kid);
+    if (!key || key.alg !== header.alg)
+        return null;
+    let pub;
+    try {
+        pub = createPublicKey(key.key);
+    }
+    catch {
+        return null;
+    }
+    const signingInput = Buffer.from(`${h}.${p}`, "utf8");
+    if (!verifyJwsSignature(key.alg, signingInput, sig, pub))
+        return null;
+    if (payload.iss !== expect.iss)
+        return null;
+    const aud = payload.aud;
+    const audOk = aud === expect.aud || (Array.isArray(aud) && aud.includes(expect.aud));
+    if (!audOk)
+        return null;
+    if (typeof payload.sub !== "string" || payload.sub.length === 0)
+        return null;
+    const now = expect.nowSec ?? Math.floor(Date.now() / 1000);
+    const skew = expect.skewSec ?? 30;
+    if (typeof payload.exp !== "number" || payload.exp + skew < now)
+        return null;
+    if (payload.nbf !== undefined && (typeof payload.nbf !== "number" || payload.nbf - skew > now))
+        return null;
+    if (expect.maxTtlSec && payload.exp - now > expect.maxTtlSec + skew)
+        return null;
+    const bnd = typeof payload.cnf?.bnd === "string" ? payload.cnf.bnd : undefined;
+    return { sub: payload.sub, bnd };
+}
+export function approvalBnd(env) {
+    return createHash("sha256").update(JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null])).digest("hex");
+}
+export function verifyDirectDoorProof(proof, envelope, config, opts) {
+    const actionBinding = opts?.actionBinding ?? true;
+    if (!proof.jwt)
+        return { ok: false, status: 401, errorCode: "principal_unverified", error: "direct door requires a signed principal token (X-Approval-Principal-Token)" };
+    const verified = verifyPrincipalJwt(proof.jwt, config.principalJwtPubkeys, { iss: config.principalJwtIss ?? "\0", aud: config.principalJwtAud ?? "\0", maxTtlSec: config.principalJwtMaxTtlSec });
+    if (!verified)
+        return { ok: false, status: 401, errorCode: "principal_unverified", error: "principal token failed verification" };
+    if (actionBinding && !envelope.boundInputHash)
+        return { ok: false, status: 400, errorCode: "approval_mac_required", error: "direct door requires boundInputHash (the bound action) in the body" };
+    if (verified.bnd !== approvalBnd(envelope))
+        return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
+    if (!proof.mac)
+        return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
+    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision, reason: envelope.reason ?? null }, proof.mac, proof.kid, config.approvalHmacKeys);
+    if (!ok)
+        return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
+    return { ok: true, principal: verified.sub };
+}
+//# sourceMappingURL=principal-jwt.js.map

package/dist/question.d.ts

@@ -17,13 +17,14 @@ export interface QuestionThrottle {
     ttlMs: number;
 }
 export declare const DEFAULT_QUESTION_THROTTLE: QuestionThrottle;
-export declare function parseQuestionAnswer(body: unknown): {
+export declare function parseQuestionResponse(body: unknown): {
     ok: true;
     value: QuestionAnswer;
 } | {
     ok: false;
     error: string;
 };
+export declare const parseQuestionAnswer: typeof parseQuestionResponse;
 export declare class QuestionCoordinator {
     private readonly als;
     private readonly pending;