@sema-agent/server 1.313.0 → 1.315.0

package/dist/plugins/k8s-exec-protocol.js

@@ -0,0 +1,87 @@
+export function applyPodSpecPatch(pod, patch) {
+    assertHardeningOnly(patch.podSecurityContext, "podSecurityContext");
+    assertHardeningOnly(patch.containerSecurityContext, "containerSecurityContext");
+    if (patch.labels) {
+        const identity = {};
+        for (const k of ["app", "managed-by"]) {
+            const v = pod.metadata.labels?.[k];
+            if (v !== undefined)
+                identity[k] = v;
+        }
+        pod.metadata.labels = { ...pod.metadata.labels, ...patch.labels, ...identity };
+    }
+    const spec = pod.spec;
+    assertVolumesPodLocal(patch.volumes, "volumes");
+    if (patch.volumes?.length)
+        spec.volumes = [...(spec.volumes ?? []), ...patch.volumes];
+    if (patch.podSecurityContext)
+        spec.securityContext = { ...(spec.securityContext ?? {}), ...patch.podSecurityContext };
+    const container = spec.containers?.[0];
+    if (container) {
+        if (patch.volumeMounts?.length)
+            container.volumeMounts = [...(container.volumeMounts ?? []), ...patch.volumeMounts];
+        if (patch.containerSecurityContext)
+            container.securityContext = { ...(container.securityContext ?? {}), ...patch.containerSecurityContext };
+    }
+}
+function assertHardeningOnly(sc, where) {
+    if (!sc)
+        return;
+    const bad = (msg) => {
+        throw new Error(`podSpecPatch.${where} rejected — it may only HARDEN, never weaken isolation: ${msg}`);
+    };
+    if (sc.privileged === true)
+        bad("privileged:true");
+    if (sc.allowPrivilegeEscalation === true)
+        bad("allowPrivilegeEscalation:true");
+    if (sc.readOnlyRootFilesystem === false)
+        bad("readOnlyRootFilesystem:false");
+    if (sc.runAsNonRoot === false)
+        bad("runAsNonRoot:false");
+    if (sc.runAsUser === 0)
+        bad("runAsUser:0 (root)");
+    const caps = sc.capabilities;
+    if (caps && Array.isArray(caps.add) && caps.add.length > 0)
+        bad(`capabilities.add ${JSON.stringify(caps.add)} (a hardening patch may only .drop)`);
+    if (sc.procMount === "Unmasked")
+        bad('procMount:"Unmasked" (re-exposes masked /proc)');
+    const seccomp = sc.seccompProfile;
+    if (seccomp && seccomp.type === "Unconfined")
+        bad('seccompProfile.type:"Unconfined" (disables syscall filtering)');
+}
+function assertVolumesPodLocal(volumes, where) {
+    if (!volumes?.length)
+        return;
+    const POD_LOCAL = new Set(["emptyDir", "configMap", "secret", "projected", "downwardAPI", "ephemeral"]);
+    for (const v of volumes) {
+        const vol = v;
+        const sources = Object.keys(vol).filter((k) => k !== "name");
+        for (const src of sources) {
+            if (!POD_LOCAL.has(src)) {
+                throw new Error(`podSpecPatch.${where} rejected — volume source ${JSON.stringify(src)} is not pod-local (host-backed sources like hostPath/csi/flexVolume cross the Kata VM boundary into the node FS). Allowed: ${[...POD_LOCAL].join("/")}`);
+            }
+        }
+    }
+}
+export function execSocketTlsOptions(ca, insecureTls) {
+    const caList = ca ? [ca] : undefined;
+    return { ca: caList, rejectUnauthorized: !insecureTls, tls: { ca: caList, rejectUnauthorized: !insecureTls } };
+}
+export function exitCodeFromStatus(statusJson) {
+    try {
+        const s = JSON.parse(statusJson);
+        if (s.status === "Success")
+            return { exitCode: 0 };
+        const cause = s.details?.causes?.find((c) => c.reason === "ExitCode");
+        if (cause?.message?.trim()) {
+            const code = Number(cause.message);
+            if (Number.isFinite(code))
+                return { exitCode: code };
+        }
+        return { error: s.message || s.reason || "exec failed without an exit code" };
+    }
+    catch {
+        return { error: `unparseable exec status: ${statusJson.slice(0, 200)}` };
+    }
+}
+//# sourceMappingURL=k8s-exec-protocol.js.map

package/dist/plugins/pg-checkpoint-store.d.ts

@@ -1,34 +1,2 @@
-import type { Pool } from "pg";
-import { type Checkpoint, type CheckpointStore, type CheckpointSummary, type CheckpointToken, type ResumeOutcome, type ResolveExpectation, type ReopenReason } from "@sema-agent/core";
-import { type PendingCheckpoint } from "./tidb-checkpoint-store.js";
-export declare class PgCheckpointStore implements CheckpointStore {
-    private readonly pool;
-    private readonly logger?;
-    constructor(pool: Pool, logger?: {
-        info?(msg: string, meta?: unknown): void;
-    } | undefined);
-    put(token: CheckpointToken, cp: Checkpoint): Promise<void>;
-    get(token: CheckpointToken): Promise<Checkpoint | null>;
-    resolve(token: CheckpointToken, scope: string, outcome: ResumeOutcome, expect?: ResolveExpectation): Promise<boolean>;
-    reopen(token: CheckpointToken, scope: string, reason: ReopenReason): Promise<boolean>;
-    setPendingSteer(token: CheckpointToken, scope: string, steer: {
-        text: string;
-        trusted: boolean;
-    }): Promise<boolean>;
-    expire(token: CheckpointToken, scope: string): Promise<boolean>;
-    reap(scope: string, cutoff: number): Promise<number>;
-    reapExpired(cutoff: number): Promise<number>;
-    listExpiredApprovalGates(cutoff: number, limit?: number): Promise<Array<{
-        sessionId: string;
-        scope: string;
-    }>>;
-    listPending(scope?: string): Promise<PendingCheckpoint[]>;
-    listByScope(scope: string): Promise<CheckpointSummary[]>;
-    findPendingTokenBySession(sessionId: string, scope?: string): Promise<CheckpointToken | null>;
-    peekPendingScope(sessionId: string): Promise<string | null | undefined>;
-    putCtx(sessionId: string, ctx: unknown): Promise<void>;
-    getCtx<T = unknown>(sessionId: string): Promise<T | null>;
-    reapCtx(cutoff: number): Promise<number>;
-    deleteBySession(sessionId: string, owner: string | null): Promise<number>;
-}
+export { PgCheckpointStore } from "./checkpoint-store-sql.js";
 //# sourceMappingURL=pg-checkpoint-store.d.ts.map

package/dist/plugins/pg-checkpoint-store.js

@@ -1,190 +1,2 @@
-import { CheckpointError, validatePendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION } from "@sema-agent/core";
-import { redactDeep } from "../trace/redact.js";
-import { tokenFingerprint } from "./tidb-checkpoint-store.js";
-import { pgProtocolJsonStringify } from "./pg-safe-json.js";
-import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
-const MAX_TOOL_INPUT_CHARS = 8192;
-const TERMINAL_BACKSTOP_MS = Math.max(60_000, Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) || 30 * 86_400_000);
-const TERMINAL_GRACE_MS = 3_600_000;
-const PG_UNIQUE_VIOLATION = "23505";
-function boundedToolInput(args) {
-    if (args === undefined)
-        return null;
-    const redacted = redactDeep(args);
-    const json = JSON.stringify(redacted);
-    if (json === undefined)
-        return null;
-    if (json.length > MAX_TOOL_INPUT_CHARS)
-        return { truncated: true, bytes: json.length };
-    return redacted;
-}
-export class PgCheckpointStore {
-    pool;
-    logger;
-    constructor(pool, logger) {
-        this.pool = pool;
-        this.logger = logger;
-    }
-    async put(token, cp) {
-        const pa = cp.pendingAction;
-        const version = checkpointVersionOf(cp);
-        const toolInput = boundedToolInput(pa?.args);
-        try {
-            await this.pool.query("INSERT INTO checkpoint (token, scope, session_id, version, status, tool_name, tool_call_id, tool_input, checkpoint, deadline, created_at, terminal_at, gate_kind, bound_input_hash, risk_descriptor) " +
-                "VALUES ($1,$2,$3,$4,'pending',$5,$6,$7::jsonb,$8::jsonb,$9,$10,$11,$12,$13,$14)", [
-                token,
-                cp.scope,
-                cp.sessionId,
-                version,
-                pa?.toolName ?? null,
-                pa?.toolCallId ?? null,
-                toolInput === null ? null : pgProtocolJsonStringify(toolInput, "approval tool_input"),
-                pgProtocolJsonStringify(cp, "checkpoint"),
-                cp.deadline ?? null,
-                cp.createdAt,
-                Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS),
-                cp.gate?.kind ?? null,
-                pa?.boundInputHash ?? null,
-                ((g) => (g?.riskDescriptor ? pgProtocolJsonStringify(g.riskDescriptor, "risk descriptor") : null))(cp.gate),
-            ]);
-        }
-        catch (e) {
-            if (e?.code === PG_UNIQUE_VIOLATION) {
-                throw new CheckpointError("checkpoint.already_exists", `checkpoint token already exists`);
-            }
-            throw e;
-        }
-    }
-    async get(token) {
-        const res = await this.pool.query("SELECT version, status, checkpoint, outcome, reopen_reason, rev, pending_steer FROM checkpoint WHERE token = $1", [token]);
-        const r = res.rows[0];
-        if (!r)
-            return null;
-        const version = Number(r.version);
-        if (version > MAX_SUPPORTED_CHECKPOINT_VERSION) {
-            throw new Error(`checkpoint format version ${version} is newer than this build supports (max ${MAX_SUPPORTED_CHECKPOINT_VERSION}) — upgrade the service to resume it`);
-        }
-        const cp = parseJson(r.checkpoint);
-        cp.status = r.status;
-        const outcomeRaw = parseJson(r.outcome);
-        if (outcomeRaw)
-            cp.resolvedOutcome = winnerFromOutcome(outcomeRaw);
-        cp.reopenReason = r.reopen_reason ?? undefined;
-        cp.rev = r.rev == null ? 0 : Number(r.rev);
-        const steerRaw = parseJson(r.pending_steer);
-        if (steerRaw && cp.state)
-            cp.state.pendingSteer = steerRaw;
-        this.logger?.info?.("checkpoint_get", {
-            tokenFp: tokenFingerprint(token),
-            status: cp.status,
-            version,
-            hasWorkspaceHandle: !!cp.state?.workspaceHandle,
-            snapshotId: cp.state?.workspaceHandle?.snapshotId,
-        });
-        return cp;
-    }
-    async resolve(token, scope, outcome, expect) {
-        const params = [pgProtocolJsonStringify(outcome, "checkpoint outcome"), Date.now(), token, scope];
-        if (expect)
-            params.push(expect.rev);
-        const res = await this.pool.query("UPDATE checkpoint SET status = 'resolved', outcome = $1::jsonb, decided_at = $2, rev = rev + 1, reopen_reason = NULL WHERE token = $3 AND scope = $4 AND status = 'pending'" +
-            (expect ? " AND rev = $5" : ""), params);
-        return (res.rowCount ?? 0) === 1;
-    }
-    async reopen(token, scope, reason) {
-        const res = await this.pool.query("UPDATE checkpoint SET status = 'pending', reopen_reason = $1, rev = rev + 1 WHERE token = $2 AND scope = $3 AND status = 'resolved'", [reason, token, scope]);
-        return (res.rowCount ?? 0) === 1;
-    }
-    async setPendingSteer(token, scope, steer) {
-        const clean = validatePendingSteer(steer);
-        const res = await this.pool.query("UPDATE checkpoint SET pending_steer = $1 WHERE token = $2 AND scope = $3 AND status = 'pending'", [pgProtocolJsonStringify(clean, "pending steer"), token, scope]);
-        return (res.rowCount ?? 0) > 0;
-    }
-    async expire(token, scope) {
-        const res = await this.pool.query("UPDATE checkpoint SET status = 'expired', decided_at = $1 WHERE token = $2 AND scope = $3 AND status = 'pending'", [Date.now(), token, scope]);
-        return (res.rowCount ?? 0) === 1;
-    }
-    async reap(scope, cutoff) {
-        const res = await this.pool.query("UPDATE checkpoint SET status = 'expired', decided_at = $1 WHERE scope = $2 AND status = 'pending' AND deadline IS NOT NULL AND deadline <= $3", [Date.now(), scope, cutoff]);
-        return res.rowCount ?? 0;
-    }
-    async reapExpired(cutoff) {
-        const res = await this.pool.query("UPDATE checkpoint SET status = 'expired', decided_at = $1 " +
-            "WHERE status = 'pending' AND ((deadline IS NOT NULL AND deadline <= $2 AND (gate_kind IS NULL OR gate_kind NOT IN ('human','irreversible_ask') OR COALESCE(tool_name,'') = 'AskUserQuestion')) OR (terminal_at IS NOT NULL AND terminal_at <= $3))", [Date.now(), cutoff, cutoff]);
-        return res.rowCount ?? 0;
-    }
-    async listExpiredApprovalGates(cutoff, limit = 100) {
-        const res = await this.pool.query("SELECT session_id, scope FROM checkpoint WHERE status = 'pending' AND gate_kind IN ('human','irreversible_ask') " +
-            "AND COALESCE(tool_name,'') <> 'AskUserQuestion' AND deadline IS NOT NULL AND deadline <= $1 ORDER BY deadline ASC LIMIT $2", [cutoff, limit]);
-        return res.rows.map((r) => ({ sessionId: String(r.session_id), scope: String(r.scope) }));
-    }
-    async listPending(scope) {
-        const base = "SELECT c.session_id, c.scope, c.tool_name, c.tool_call_id, c.tool_input, c.bound_input_hash, c.risk_descriptor, c.created_at, c.deadline, ta.task_id " +
-            "FROM checkpoint c LEFT JOIN task_active ta ON ta.session_id = c.session_id WHERE c.status='pending'";
-        const res = scope
-            ? await this.pool.query(`${base} AND c.scope=$1 ORDER BY c.created_at ASC`, [scope])
-            : await this.pool.query(`${base} ORDER BY c.created_at ASC`);
-        const out = res.rows.map((r) => {
-            const toolCallId = r.tool_call_id ?? null;
-            return {
-                sessionId: String(r.session_id),
-                scope: String(r.scope),
-                toolName: r.tool_name ?? null,
-                toolCallId,
-                boundCallId: toolCallId,
-                boundInputHash: r.bound_input_hash ?? null,
-                taskId: r.task_id ?? null,
-                input: r.tool_input ?? null,
-                createdAt: Number(r.created_at),
-                deadline: r.deadline == null ? null : Number(r.deadline),
-                riskDescriptor: parseJson(r.risk_descriptor),
-            };
-        });
-        return out.sort((a, b) => (b.riskDescriptor?.severity ?? 0) - (a.riskDescriptor?.severity ?? 0) || a.createdAt - b.createdAt);
-    }
-    async listByScope(scope) {
-        const res = await this.pool.query("SELECT checkpoint, status FROM checkpoint WHERE status = 'pending' AND scope = $1 ORDER BY created_at ASC LIMIT 500", [scope]);
-        const out = [];
-        for (const r of res.rows) {
-            const cp = parseJson(r.checkpoint);
-            if (!cp)
-                continue;
-            cp.status = r.status;
-            out.push(summarizeCheckpoint(cp));
-        }
-        return out;
-    }
-    async findPendingTokenBySession(sessionId, scope) {
-        const res = scope
-            ? await this.pool.query("SELECT token FROM checkpoint WHERE session_id=$1 AND scope=$2 AND status='pending' LIMIT 1", [sessionId, scope])
-            : await this.pool.query("SELECT token FROM checkpoint WHERE session_id=$1 AND status='pending' LIMIT 1", [sessionId]);
-        return res.rows[0] ? String(res.rows[0].token) : null;
-    }
-    async peekPendingScope(sessionId) {
-        const res = await this.pool.query("SELECT scope FROM checkpoint WHERE session_id=$1 AND status='pending' LIMIT 1", [sessionId]);
-        if (!res.rows[0])
-            return undefined;
-        return res.rows[0].scope ?? null;
-    }
-    async putCtx(sessionId, ctx) {
-        await this.pool.query("INSERT INTO checkpoint_ctx (session_id, ctx, updated_at) VALUES ($1,$2::jsonb,$3) " +
-            "ON CONFLICT (session_id) DO UPDATE SET ctx = EXCLUDED.ctx, updated_at = EXCLUDED.updated_at", [sessionId, pgProtocolJsonStringify(ctx, "checkpoint ctx"), Date.now()]);
-    }
-    async getCtx(sessionId) {
-        const res = await this.pool.query("SELECT ctx FROM checkpoint_ctx WHERE session_id=$1", [sessionId]);
-        return res.rows[0] ? parseJson(res.rows[0].ctx) : null;
-    }
-    async reapCtx(cutoff) {
-        const res = await this.pool.query("DELETE FROM checkpoint_ctx WHERE updated_at < $1 " +
-            "AND session_id NOT IN (SELECT session_id FROM checkpoint WHERE status='pending') " +
-            "AND session_id NOT IN (SELECT session_id FROM task_active)", [cutoff]);
-        return res.rowCount ?? 0;
-    }
-    async deleteBySession(sessionId, owner) {
-        const ownerGuard = "EXISTS (SELECT 1 FROM session_meta sm WHERE sm.session_id = $1 AND sm.owner IS NOT DISTINCT FROM $2)";
-        const res = await this.pool.query(`DELETE FROM checkpoint WHERE session_id = $1 AND ${ownerGuard}`, [sessionId, owner]);
-        await this.pool.query(`DELETE FROM checkpoint_ctx WHERE session_id = $1 AND ${ownerGuard}`, [sessionId, owner]);
-        return res.rowCount ?? 0;
-    }
-}
+export { PgCheckpointStore } from "./checkpoint-store-sql.js";
 //# sourceMappingURL=pg-checkpoint-store.js.map

package/dist/plugins/pg-cost-quota.js

@@ -1,151 +1,11 @@
-import { DEFAULT_COUNTER_QUERY_TIMEOUT_MS } from "./write-behind-counter.js";
-const SEP = "\u0000";
-class PgWriteBehindCounter {
-    pool;
-    windowMs;
-    now;
-    onDegraded;
-    queryTimeoutMs;
-    pendingDelta = new Map();
-    fleetTotal = new Map();
-    timer;
-    flushing = false;
-    flushStartedAt = 0;
-    failStreak = new Map();
-    constructor(pool, windowMs, now = () => Date.now(), onDegraded, queryTimeoutMs = DEFAULT_COUNTER_QUERY_TIMEOUT_MS) {
-        this.pool = pool;
-        this.windowMs = windowMs;
-        this.now = now;
-        this.onDegraded = onDegraded;
-        this.queryTimeoutMs = queryTimeoutMs;
-    }
-    bump(kind, failed, error) {
-        if (!this.onDegraded)
-            return;
-        const prev = this.failStreak.get(kind) ?? 0;
-        if (!failed && prev === 0)
-            return;
-        const next = failed ? prev + 1 : 0;
-        this.failStreak.set(kind, next);
-        try {
-            this.onDegraded({ table: "cost_quota", kind, streak: next, prevStreak: prev, ...(failed && error !== undefined ? { error: error instanceof Error ? error.message : String(error) } : {}) });
-        }
-        catch {
-        }
-    }
-    bucket() {
-        return Math.floor(this.now() / this.windowMs);
-    }
-    rk(key) {
-        return `${key}${SEP}${this.bucket()}`;
-    }
-    used(key) {
-        const rk = this.rk(key);
-        return (this.fleetTotal.get(rk) ?? 0) + (this.pendingDelta.get(rk) ?? 0);
-    }
-    addLocal(key, n) {
-        if (n <= 0)
-            return;
-        const rk = this.rk(key);
-        this.pendingDelta.set(rk, (this.pendingDelta.get(rk) ?? 0) + n);
-    }
-    retryAfterSec() {
-        return Math.ceil(((this.bucket() + 1) * this.windowMs - this.now()) / 1000);
-    }
-    async flush() {
-        if (this.flushing) {
-            if (this.now() - this.flushStartedAt > 60_000)
-                this.bump("stalled", true, "flush round stalled >60s (hung query?)");
-            return;
-        }
-        this.flushing = true;
-        this.flushStartedAt = this.now();
-        try {
-            await this.flushOnce();
-        }
-        finally {
-            this.flushing = false;
-            this.bump("stalled", false);
-        }
-    }
-    async flushOnce() {
-        let attempted = false;
-        let failure;
-        let hadFailure = false;
-        for (const [rk, delta] of [...this.pendingDelta]) {
-            if (delta <= 0)
-                continue;
-            const sep = rk.lastIndexOf(SEP);
-            const key = rk.slice(0, sep);
-            const windowBucket = Number(rk.slice(sep + 1));
-            attempted = true;
-            try {
-                const q = {
-                    text: "INSERT INTO cost_quota (scope_key, window_bucket, micro, updated_at) VALUES ($1,$2,$3,$4) " +
-                        "ON CONFLICT (scope_key, window_bucket) DO UPDATE SET micro = cost_quota.micro + EXCLUDED.micro, updated_at = EXCLUDED.updated_at",
-                    values: [key, windowBucket, delta, new Date()],
-                    query_timeout: this.queryTimeoutMs,
-                };
-                await this.pool.query(q);
-                const remaining = (this.pendingDelta.get(rk) ?? 0) - delta;
-                if (remaining > 0)
-                    this.pendingDelta.set(rk, remaining);
-                else
-                    this.pendingDelta.delete(rk);
-            }
-            catch (err) {
-                hadFailure = true;
-                failure = err;
-            }
-        }
-        if (attempted)
-            this.bump("flush", hadFailure, failure);
-        await this.refresh();
-        await this.reap();
-    }
-    async refresh() {
-        const b = this.bucket();
-        try {
-            const q = { text: "SELECT scope_key, micro FROM cost_quota WHERE window_bucket = $1", values: [b], query_timeout: this.queryTimeoutMs };
-            const res = await this.pool.query(q);
-            const next = new Map();
-            for (const r of res.rows) {
-                next.set(`${String(r.scope_key)}${SEP}${b}`, Number(r.micro));
-            }
-            this.fleetTotal = next;
-            this.bump("refresh", false);
-        }
-        catch (err) {
-            this.bump("refresh", true, err);
-        }
-    }
-    async reap() {
-        try {
-            const q = { text: "DELETE FROM cost_quota WHERE window_bucket < $1", values: [this.bucket()], query_timeout: this.queryTimeoutMs };
-            const res = await this.pool.query(q);
-            return res.rowCount ?? 0;
-        }
-        catch {
-            return 0;
-        }
-    }
-    startRefresh(intervalMs = 5_000) {
-        this.timer ??= setInterval(() => void this.flush(), intervalMs);
-        this.timer.unref?.();
-        return this;
-    }
-    stop() {
-        if (this.timer)
-            clearInterval(this.timer);
-        this.timer = undefined;
-    }
-}
+import { PgWriteBehindCounter } from "./write-behind-counter.js";
+const COST_QUOTA_TABLE = { table: "cost_quota", keyCol: "scope_key", valCol: "micro" };
 export class PgCostQuota {
     limitMicroUsd;
     counter;
     constructor(pool, limitMicroUsd, windowMs, now, onDegraded, queryTimeoutMs) {
         this.limitMicroUsd = limitMicroUsd;
-        this.counter = new PgWriteBehindCounter(pool, windowMs, now, onDegraded, queryTimeoutMs);
+        this.counter = new PgWriteBehindCounter(pool, COST_QUOTA_TABLE, windowMs, now, onDegraded, queryTimeoutMs);
     }
     check(scopeKey) {
         const used = this.counter.used(scopeKey);

package/dist/plugins/pg-image-bake.d.ts

@@ -1,42 +1,3 @@
-import type { Pool, PoolClient } from "pg";
-import type { BakeStatus, BakeState, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal } from "./store-contracts.js";
+export { PgImageBake, PG_IMAGE_BAKE_SCHEMA, ensurePgImageBakeSchema as ensureSchema } from "./image-bake-store-sql.js";
 export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, } from "./store-contracts.js";
-export declare const PG_IMAGE_BAKE_SCHEMA: string[];
-export declare function ensureSchema(pool: Pool | PoolClient, poolName?: string): Promise<void>;
-export declare class PgImageBake {
-    private readonly pool;
-    private readonly poolName;
-    constructor(pool: Pool, poolName?: string);
-    createBake(input: CreateBakeInput): Promise<{
-        created: boolean;
-        bake: BakeRecord;
-    }>;
-    createBakeIfIdle(input: CreateBakeInput): Promise<{
-        created: boolean;
-        bake: BakeRecord | null;
-    }>;
-    getBake(bakeId: string): Promise<BakeRecord | null>;
-    getBakeByIdem(idemKey: string): Promise<BakeRecord | null>;
-    findActiveByArgv(argv: string[]): Promise<BakeRecord | null>;
-    findActiveAny(): Promise<BakeRecord | null>;
-    findNextQueuedId(): Promise<string | null>;
-    claimBake(bakeId: string, runnerId: string, leaseMs: number): Promise<BakeRecord | null>;
-    appendEvent(bakeId: string, kind: string, data: unknown, opts?: {
-        lineOrd?: number | null;
-        level?: string | null;
-    }): Promise<number | null>;
-    private lineOrdExists;
-    maxSeq(bakeId: string): Promise<number>;
-    retainedFrom(bakeId: string): Promise<number>;
-    getEvents(bakeId: string, afterSeq: number): Promise<BakeEvent[]>;
-    setStatus(bakeId: string, status: BakeStatus): Promise<void>;
-    setState(bakeId: string, state: BakeState): Promise<void>;
-    setTerminal(bakeId: string, t: BakeTerminal): Promise<number>;
-    setIndexId(bakeId: string, indexId: string): Promise<boolean>;
-    heartbeatLease(bakeId: string, runnerId: string, leaseMs: number): Promise<boolean>;
-    requestCancel(bakeId: string): Promise<boolean>;
-    isCancelRequested(bakeId: string): Promise<boolean>;
-    reapStaleBakes(olderThanMs: number): Promise<number>;
-    private tx;
-}
 //# sourceMappingURL=pg-image-bake.d.ts.map