@sema-agent/server 1.314.0 → 1.316.0

package/dist/plugins/pg-image-bake.js

@@ -1,421 +1,2 @@
-import { uuidv7 } from "@sema-agent/core";
-import { randomBytes } from "node:crypto";
-import { pgSanitizeText, pgSafeJsonStringify, pgHasUnstorable } from "./pg-safe-json.js";
-import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
-import { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
-export const PG_IMAGE_BAKE_SCHEMA = [
-    `CREATE TABLE IF NOT EXISTS image_bake (
-     bake_id          VARCHAR(64)  NOT NULL,
-     profile          VARCHAR(128) NOT NULL,
-     bands            JSONB        NULL,
-     base_ref         VARCHAR(255) NULL,
-     push             SMALLINT     NOT NULL DEFAULT 0,
-     dry_run          SMALLINT     NOT NULL DEFAULT 0,
-     logs             SMALLINT     NOT NULL DEFAULT 0,
-     argv             JSONB        NOT NULL,
-     status           VARCHAR(16)  NOT NULL,
-     state            VARCHAR(16)  NULL,
-     digest           VARCHAR(255) NULL,
-     repo             VARCHAR(255) NULL,
-     ref              VARCHAR(320) NULL,
-     index_id         VARCHAR(64)  NULL,
-     exit_code        INT          NULL,
-     error            TEXT         NULL,
-     error_code       VARCHAR(32)  NULL,
-     manifest_sha     VARCHAR(64)  NULL,
-     tag              VARCHAR(255) NULL,
-     idem_key         VARCHAR(255) NULL,
-     ingest_secret    VARCHAR(64)  NULL,
-     runner_id        VARCHAR(64)  NULL,
-     lease_until      TIMESTAMPTZ(3) NULL,
-     cancel_requested SMALLINT     NOT NULL DEFAULT 0,
-     requested_by     VARCHAR(128) NULL,
-     created_at       TIMESTAMPTZ(3) NOT NULL,
-     updated_at       TIMESTAMPTZ(3) NOT NULL,
-     PRIMARY KEY (bake_id),
-     CONSTRAINT uq_image_bake_idem UNIQUE (idem_key)
-   )`,
-    `CREATE INDEX IF NOT EXISTS idx_image_bake_status ON image_bake (status)`,
-    `CREATE INDEX IF NOT EXISTS idx_image_bake_created ON image_bake (created_at)`,
-    `CREATE TABLE IF NOT EXISTS image_bake_event (
-     bake_id  VARCHAR(64) NOT NULL,
-     seq      INT         NOT NULL,
-     line_ord INT         NULL,
-     kind     VARCHAR(24) NOT NULL,
-     level    VARCHAR(8)  NULL,
-     data     JSONB       NULL,
-     ts       TIMESTAMPTZ(3) NOT NULL,
-     PRIMARY KEY (bake_id, seq),
-     CONSTRAINT uq_image_bake_event_line UNIQUE (bake_id, line_ord)
-   )`,
-    `CREATE TABLE IF NOT EXISTS image_bake_lease (
-     pool        VARCHAR(32) NOT NULL DEFAULT 'standard',
-     bake_id     VARCHAR(64) NOT NULL,
-     acquired_at TIMESTAMPTZ(3) NOT NULL,
-     expires_at  TIMESTAMPTZ(3) NOT NULL,
-     PRIMARY KEY (pool)
-   )`,
-    `CREATE TABLE IF NOT EXISTS image_bake_admit (
-     pool VARCHAR(32) NOT NULL,
-     PRIMARY KEY (pool)
-   )`,
-];
-export async function ensureSchema(pool, poolName = "standard") {
-    for (const stmt of PG_IMAGE_BAKE_SCHEMA)
-        await pool.query(stmt);
-    await pool.query("INSERT INTO image_bake_admit (pool) VALUES ($1) ON CONFLICT (pool) DO NOTHING", [poolName]);
-}
-function isDupKey(err) {
-    return Boolean(err) && err.code === "23505";
-}
-function dupKeyName(err) {
-    const c = String(err?.constraint ?? "");
-    if (c === "uq_image_bake_event_line")
-        return "uq_line";
-    if (/pkey$/i.test(c))
-        return "primary";
-    return "other";
-}
-export class PgImageBake {
-    pool;
-    poolName;
-    constructor(pool, poolName = "standard") {
-        this.pool = pool;
-        this.poolName = poolName;
-    }
-    async createBake(input) {
-        const bakeId = uuidv7();
-        const now = new Date();
-        try {
-            await this.pool.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
-                "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                "VALUES ($1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,0,$10,$11,$12)", [
-                bakeId,
-                input.profile,
-                input.bands == null ? null : JSON.stringify(input.bands),
-                input.baseRef,
-                input.push ? 1 : 0,
-                input.dryRun ? 1 : 0,
-                input.logs ? 1 : 0,
-                JSON.stringify(input.argv),
-                input.idemKey,
-                input.requestedBy,
-                now,
-                now,
-            ]);
-        }
-        catch (err) {
-            if (isDupKey(err) && input.idemKey) {
-                const existing = await this.getBakeByIdem(input.idemKey);
-                if (existing)
-                    return { created: false, bake: existing };
-            }
-            throw err;
-        }
-        const bake = await this.getBake(bakeId);
-        if (!bake)
-            throw new Error("createBake: row vanished after insert");
-        return { created: true, bake };
-    }
-    async createBakeIfIdle(input) {
-        const bakeId = uuidv7();
-        const now = new Date();
-        const conn = await this.pool.connect();
-        try {
-            await conn.query("BEGIN");
-            await conn.query("INSERT INTO image_bake_admit (pool) VALUES ($1) ON CONFLICT (pool) DO NOTHING", [this.poolName]);
-            await conn.query("SELECT pool FROM image_bake_admit WHERE pool = $1 FOR UPDATE", [this.poolName]);
-            const res = await conn.query("INSERT INTO image_bake (bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, " +
-                "idem_key, cancel_requested, requested_by, created_at, updated_at) " +
-                "SELECT $1,$2,$3::jsonb,$4,$5,$6,$7,$8::jsonb,'queued',$9,0,$10,$11,$12 WHERE NOT EXISTS " +
-                "(SELECT 1 FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0)", [
-                bakeId,
-                input.profile,
-                input.bands == null ? null : JSON.stringify(input.bands),
-                input.baseRef,
-                input.push ? 1 : 0,
-                input.dryRun ? 1 : 0,
-                input.logs ? 1 : 0,
-                JSON.stringify(input.argv),
-                input.idemKey,
-                input.requestedBy,
-                now,
-                now,
-            ]);
-            const inserted = (res.rowCount ?? 0) > 0;
-            await conn.query("COMMIT");
-            if (!inserted)
-                return { created: false, bake: null };
-        }
-        catch (err) {
-            try {
-                await conn.query("ROLLBACK");
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-        const bake = await this.getBake(bakeId);
-        if (!bake)
-            throw new Error("createBakeIfIdle: row vanished after insert");
-        return { created: true, bake };
-    }
-    async getBake(bakeId) {
-        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE bake_id = $1 LIMIT 1`, [bakeId]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async getBakeByIdem(idemKey) {
-        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE idem_key = $1 LIMIT 1`, [idemKey]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async findActiveByArgv(argv) {
-        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND argv = $1::jsonb ` +
-            "ORDER BY created_at DESC LIMIT 1", [JSON.stringify(argv)]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async findActiveAny() {
-        const res = await this.pool.query(`SELECT ${SELECT_COLS} FROM image_bake WHERE status IN ('queued','running') AND dry_run = 0 ` +
-            "ORDER BY created_at ASC LIMIT 1");
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async findNextQueuedId() {
-        const res = await this.pool.query("SELECT bake_id FROM image_bake WHERE status = 'queued' ORDER BY created_at ASC LIMIT 1");
-        return res.rows[0] ? String(res.rows[0].bake_id) : null;
-    }
-    async claimBake(bakeId, runnerId, leaseMs) {
-        const conn = await this.pool.connect();
-        try {
-            await conn.query("BEGIN");
-            const now = new Date();
-            const leaseUntil = new Date(now.getTime() + leaseMs);
-            const ingestSecret = randomBytes(24).toString("hex");
-            const bakeRes = await conn.query("UPDATE image_bake SET status='running', state='PENDING', runner_id=$1, ingest_secret=$2, " +
-                "lease_until=$3, updated_at=$4 WHERE bake_id=$5 AND status='queued'", [runnerId, ingestSecret, leaseUntil, now, bakeId]);
-            if ((bakeRes.rowCount ?? 0) !== 1) {
-                await conn.query("ROLLBACK");
-                return null;
-            }
-            const dryRes = await conn.query("SELECT dry_run FROM image_bake WHERE bake_id=$1", [bakeId]);
-            if (Boolean(dryRes.rows[0]?.dry_run)) {
-                await conn.query("COMMIT");
-                return (await this.getBake(bakeId)) ?? null;
-            }
-            const leaseSel = await conn.query("SELECT bake_id, expires_at FROM image_bake_lease WHERE pool=$1", [this.poolName]);
-            const cur = leaseSel.rows[0];
-            if (!cur) {
-                try {
-                    await conn.query("INSERT INTO image_bake_lease (pool, bake_id, acquired_at, expires_at) VALUES ($1,$2,$3,$4)", [this.poolName, bakeId, now, leaseUntil]);
-                }
-                catch (err) {
-                    if (isDupKey(err)) {
-                        await conn.query("ROLLBACK");
-                        return null;
-                    }
-                    throw err;
-                }
-            }
-            else {
-                if (new Date(cur.expires_at).getTime() >= now.getTime()) {
-                    await conn.query("ROLLBACK");
-                    return null;
-                }
-                const holderId = String(cur.bake_id ?? "");
-                const holderRes = await conn.query("SELECT status FROM image_bake WHERE bake_id=$1", [holderId]);
-                const holderStatus = String(holderRes.rows[0]?.status ?? "");
-                if (holderStatus === "queued" || holderStatus === "running") {
-                    await conn.query("ROLLBACK");
-                    return null;
-                }
-                const stealRes = await conn.query("UPDATE image_bake_lease SET bake_id=$1, acquired_at=$2, expires_at=$3 WHERE pool=$4 AND bake_id=$5 AND expires_at=$6", [bakeId, now, leaseUntil, this.poolName, holderId, cur.expires_at]);
-                if ((stealRes.rowCount ?? 0) === 0) {
-                    await conn.query("ROLLBACK");
-                    return null;
-                }
-            }
-            const check = await conn.query("SELECT bake_id FROM image_bake_lease WHERE pool=$1", [this.poolName]);
-            if (String(check.rows[0]?.bake_id ?? "") !== bakeId) {
-                await conn.query("ROLLBACK");
-                return null;
-            }
-            await conn.query("COMMIT");
-            return (await this.getBake(bakeId)) ?? null;
-        }
-        catch (err) {
-            try {
-                await conn.query("ROLLBACK");
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-    }
-    async appendEvent(bakeId, kind, data, opts = {}) {
-        const lineOrd = opts.lineOrd ?? null;
-        if (lineOrd !== null && (await this.lineOrdExists(bakeId, lineOrd)))
-            return null;
-        const payload = data == null ? null : pgSafeJsonStringify(data);
-        for (let attempt = 0; attempt < 50; attempt += 1) {
-            const seq = (await this.maxSeq(bakeId)) + 1;
-            try {
-                await this.pool.query("INSERT INTO image_bake_event (bake_id, seq, line_ord, kind, level, data, ts) VALUES ($1,$2,$3,$4,$5,$6::jsonb,$7)", [bakeId, seq, lineOrd, kind, opts.level ?? null, payload, new Date()]);
-                return seq;
-            }
-            catch (err) {
-                if (!isDupKey(err))
-                    throw err;
-                const which = dupKeyName(err);
-                if (which === "uq_line" && lineOrd !== null)
-                    return null;
-                await new Promise((r) => setTimeout(r, Math.floor(Math.random() * 5)));
-            }
-        }
-        throw new Error(`appendEvent: seq allocation lost the (bake_id,seq) race after retries (bakeId=${bakeId})`);
-    }
-    async lineOrdExists(bakeId, lineOrd) {
-        const res = await this.pool.query("SELECT 1 FROM image_bake_event WHERE bake_id = $1 AND line_ord = $2 LIMIT 1", [bakeId, lineOrd]);
-        return (res.rowCount ?? 0) > 0;
-    }
-    async maxSeq(bakeId) {
-        const res = await this.pool.query("SELECT MAX(seq) AS m FROM image_bake_event WHERE bake_id = $1", [bakeId]);
-        const m = res.rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
-    async retainedFrom(bakeId) {
-        const res = await this.pool.query("SELECT MIN(seq) AS m FROM image_bake_event WHERE bake_id = $1", [bakeId]);
-        const m = res.rows[0]?.m;
-        return m == null ? 0 : Number(m);
-    }
-    async getEvents(bakeId, afterSeq) {
-        const res = await this.pool.query("SELECT seq, line_ord, kind, level, data, ts FROM image_bake_event WHERE bake_id = $1 AND seq > $2 ORDER BY seq ASC", [bakeId, afterSeq]);
-        return res.rows.map((r) => ({
-            seq: Number(r.seq),
-            lineOrd: r.line_ord === null ? null : Number(r.line_ord),
-            kind: String(r.kind),
-            level: r.level ?? null,
-            data: parseJson(r.data, null),
-            ts: iso(r.ts),
-        }));
-    }
-    async setStatus(bakeId, status) {
-        await this.pool.query("UPDATE image_bake SET status = $1, updated_at = $2 WHERE bake_id = $3", [
-            status,
-            new Date(),
-            bakeId,
-        ]);
-    }
-    async setState(bakeId, state) {
-        await this.pool.query("UPDATE image_bake SET state = $1, updated_at = $2 WHERE bake_id = $3", [
-            state,
-            new Date(),
-            bakeId,
-        ]);
-    }
-    async setTerminal(bakeId, t) {
-        let affectedRows = 0;
-        await this.tx(async (conn) => {
-            const invalidIdentity = (t.digest != null && pgHasUnstorable(t.digest)) ||
-                (t.manifestSha != null && pgHasUnstorable(t.manifestSha)) ||
-                (t.repo != null && pgHasUnstorable(t.repo)) ||
-                (t.ref != null && pgHasUnstorable(t.ref));
-            const res = await conn.query("UPDATE image_bake SET status=$1, state=$2, digest=$3, repo=$4, ref=$5, index_id=$6, exit_code=$7, error=$8, " +
-                "error_code=$9, manifest_sha=$10, tag=$11, ingest_secret=NULL, updated_at=$12 WHERE bake_id=$13 AND status IN ('queued','running')", [
-                invalidIdentity ? "failed" : t.status,
-                t.state,
-                invalidIdentity ? null : t.digest ?? null,
-                invalidIdentity ? null : t.repo ?? null,
-                invalidIdentity ? null : t.ref ?? null,
-                t.indexId ?? null,
-                t.exitCode ?? null,
-                t.error == null ? null : pgSanitizeText(t.error),
-                t.errorCode == null ? null : pgSanitizeText(t.errorCode),
-                invalidIdentity ? null : t.manifestSha ?? null,
-                t.tag == null ? null : pgSanitizeText(t.tag),
-                new Date(),
-                bakeId,
-            ]);
-            affectedRows = res.rowCount ?? 0;
-            await conn.query("DELETE FROM image_bake_lease WHERE pool = $1 AND bake_id = $2", [this.poolName, bakeId]);
-        });
-        return affectedRows;
-    }
-    async setIndexId(bakeId, indexId) {
-        const res = await this.pool.query("UPDATE image_bake SET index_id = $1, updated_at = $2 WHERE bake_id = $3 AND status IN ('queued','running')", [indexId, new Date(), bakeId]);
-        return (res.rowCount ?? 0) >= 1;
-    }
-    async heartbeatLease(bakeId, runnerId, leaseMs) {
-        const now = new Date();
-        const leaseUntil = new Date(now.getTime() + leaseMs);
-        const res = await this.pool.query("UPDATE image_bake SET lease_until = $1, updated_at = $2 WHERE bake_id = $3 AND runner_id = $4 AND status = 'running'", [leaseUntil, now, bakeId, runnerId]);
-        if ((res.rowCount ?? 0) < 1)
-            return false;
-        const dryRes = await this.pool.query("SELECT dry_run FROM image_bake WHERE bake_id = $1", [bakeId]);
-        if (Boolean(dryRes.rows[0]?.dry_run))
-            return true;
-        const leaseRes = await this.pool.query("UPDATE image_bake_lease SET expires_at = $1 WHERE pool = $2 AND bake_id = $3", [leaseUntil, this.poolName, bakeId]);
-        return (leaseRes.rowCount ?? 0) >= 1;
-    }
-    async requestCancel(bakeId) {
-        const res = await this.pool.query("UPDATE image_bake SET cancel_requested = 1, updated_at = $1 WHERE bake_id = $2 AND status IN ('queued','running')", [new Date(), bakeId]);
-        return (res.rowCount ?? 0) > 0;
-    }
-    async isCancelRequested(bakeId) {
-        const res = await this.pool.query("SELECT cancel_requested FROM image_bake WHERE bake_id = $1", [bakeId]);
-        return Boolean(res.rows[0]?.cancel_requested);
-    }
-    async reapStaleBakes(olderThanMs) {
-        const cutoff = new Date(Date.now() - olderThanMs);
-        const victimsRes = await this.pool.query("SELECT bake_id FROM image_bake WHERE status = 'running' AND " +
-            "(lease_until IS NULL OR lease_until < $1) AND updated_at < $2", [cutoff, cutoff]);
-        let reaped = 0;
-        for (const v of victimsRes.rows) {
-            const bakeId = String(v.bake_id);
-            const res = await this.pool.query("UPDATE image_bake SET status='failed', state='FAILED', error='bake-runner lost (lease expired)', " +
-                "ingest_secret=NULL, index_id=NULL, updated_at=$1 WHERE bake_id=$2 AND status='running'", [new Date(), bakeId]);
-            if ((res.rowCount ?? 0) === 1) {
-                reaped += 1;
-                try {
-                    await this.appendEvent(bakeId, "done", {
-                        status: "FAILED",
-                        digest: null,
-                        repo: null,
-                        ref: null,
-                        indexId: null,
-                        exitCode: null,
-                        error: "bake-runner lost (lease expired)",
-                        errorCode: null,
-                    });
-                }
-                catch {
-                }
-                await this.pool.query("DELETE FROM image_bake_lease WHERE pool = $1 AND bake_id = $2", [this.poolName, bakeId]);
-            }
-        }
-        return reaped;
-    }
-    async tx(fn) {
-        const conn = await this.pool.connect();
-        try {
-            await conn.query("BEGIN");
-            await fn(conn);
-            await conn.query("COMMIT");
-        }
-        catch (err) {
-            try {
-                await conn.query("ROLLBACK");
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-    }
-}
+export { PgImageBake, PG_IMAGE_BAKE_SCHEMA, ensurePgImageBakeSchema as ensureSchema } from "./image-bake-store-sql.js";
 //# sourceMappingURL=pg-image-bake.js.map

package/dist/plugins/pg-image-index.d.ts

@@ -1,23 +1,3 @@
-import type { Pool, PoolClient } from "pg";
-import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
+export { PgImageIndex, PG_IMAGE_INDEX_SCHEMA, ensureSchema } from "./image-index-sql.js";
 export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, } from "./store-contracts.js";
-export declare const PG_IMAGE_INDEX_SCHEMA: string[];
-export declare function ensureSchema(pool: Pool | PoolClient): Promise<void>;
-export declare class PgImageIndex {
-    private readonly pool;
-    constructor(pool: Pool);
-    static idFor(repo: string, digest: string): string;
-    upsert(e: ImageIndexUpsert): Promise<string>;
-    registerBuilding(e: ImageIndexUpsert): Promise<string>;
-    getById(id: string): Promise<ImageIndexEntry | null>;
-    getByDigest(digest: string): Promise<ImageIndexEntry | null>;
-    latestPublished(profile: string, viewer: ImageViewer): Promise<ImageIndexEntry | null>;
-    list(filter: ImageListFilter): Promise<{
-        entries: ImageIndexEntry[];
-        nextCursor: string | null;
-    }>;
-    setStatus(id: string, status: ImageStatus, opts?: {
-        supersedes?: string | null;
-    }): Promise<void>;
-}
 //# sourceMappingURL=pg-image-index.d.ts.map

package/dist/plugins/pg-image-index.js

@@ -1,218 +1,2 @@
-import { createHash } from "node:crypto";
-import { pgSafeJsonStringify, pgSanitizeText, pgHasUnstorable, PgUnstorableError } from "./pg-safe-json.js";
-import { mapImageRow as mapRow, } from "./store-contracts.js";
-export const PG_IMAGE_INDEX_SCHEMA = [
-    `CREATE TABLE IF NOT EXISTS sandbox_image_index (
-     id                 VARCHAR(64)  NOT NULL,
-     profile            VARCHAR(64)  NOT NULL,
-     bands              JSONB,
-     repo               VARCHAR(255) NOT NULL,
-     tag                VARCHAR(128) NOT NULL,
-     digest             VARCHAR(80)  NOT NULL,
-     toolchain_versions JSONB,
-     capabilities       JSONB,
-     pod_contract       JSONB,
-     size_bytes         BIGINT,
-     status             VARCHAR(16)  NOT NULL DEFAULT 'building',
-     visibility         VARCHAR(16)  NOT NULL DEFAULT 'public',
-     tenant_id          VARCHAR(64),
-     manifest_sha       VARCHAR(64),
-     recipe_git_sha     VARCHAR(64),
-     generator_version  VARCHAR(32),
-     build_date         TIMESTAMPTZ(3),
-     supersedes         VARCHAR(64),
-     signed             SMALLINT     NOT NULL DEFAULT 0,
-     created_at         TIMESTAMPTZ(3) NOT NULL,
-     updated_at         TIMESTAMPTZ(3) NOT NULL,
-     PRIMARY KEY (id)
-   )`,
-    `CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_digest ON sandbox_image_index (repo, digest)`,
-    `CREATE INDEX IF NOT EXISTS idx_profile_status ON sandbox_image_index (profile, status, visibility)`,
-    `CREATE INDEX IF NOT EXISTS idx_digest ON sandbox_image_index (digest)`,
-    `CREATE INDEX IF NOT EXISTS idx_tenant ON sandbox_image_index (tenant_id, status)`,
-];
-export async function ensureSchema(pool) {
-    for (const stmt of PG_IMAGE_INDEX_SCHEMA)
-        await pool.query(stmt);
-}
-const MAX_LIMIT = 200;
-const DEFAULT_LIMIT = 50;
-function visibilityClause(viewer, startIdx) {
-    if (viewer.operator)
-        return { sql: "1=1", params: [], nextIdx: startIdx };
-    if (viewer.tenantId)
-        return {
-            sql: `(visibility = 'public' OR tenant_id = $${startIdx})`,
-            params: [viewer.tenantId],
-            nextIdx: startIdx + 1,
-        };
-    return { sql: "visibility = 'public'", params: [], nextIdx: startIdx };
-}
-function encodeCursor(e) {
-    return Buffer.from(`${e.createdAt}|${e.id}`, "utf8").toString("base64url");
-}
-function decodeCursor(c) {
-    try {
-        const [createdAt, id] = Buffer.from(c, "base64url").toString("utf8").split("|");
-        if (!createdAt || !id)
-            return null;
-        return { createdAt, id };
-    }
-    catch {
-        return null;
-    }
-}
-const UPSERT_COLS = "(id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes, " +
-    "status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes, " +
-    "signed, created_at, updated_at)";
-const UPSERT_VALUES = "($1,$2,$3::jsonb,$4,$5,$6,$7::jsonb,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)";
-function upsertParams(e, id, now) {
-    return [
-        id,
-        pgSanitizeText(e.profile),
-        pgSafeJsonStringify(e.bands ?? []),
-        e.repo,
-        pgSanitizeText(e.tag),
-        e.digest,
-        pgSafeJsonStringify(e.toolchainVersions ?? {}),
-        pgSafeJsonStringify(e.capabilities ?? {}),
-        pgSafeJsonStringify(e.podContract ?? {}),
-        e.sizeBytes,
-        e.status,
-        e.visibility,
-        e.tenantId ?? null,
-        e.manifestSha ?? null,
-        e.recipeGitSha == null ? null : pgSanitizeText(e.recipeGitSha),
-        e.generatorVersion == null ? null : pgSanitizeText(e.generatorVersion),
-        e.buildDate ? new Date(e.buildDate) : null,
-        e.supersedes == null ? null : pgSanitizeText(e.supersedes),
-        e.signed ? 1 : 0,
-        now,
-        now,
-    ];
-}
-export class PgImageIndex {
-    pool;
-    constructor(pool) {
-        this.pool = pool;
-    }
-    static idFor(repo, digest) {
-        return createHash("sha256").update(`${repo}@${digest}`).digest("hex").slice(0, 64);
-    }
-    async upsert(e) {
-        if (pgHasUnstorable(e.repo))
-            throw new PgUnstorableError("image repo (identity)");
-        if (e.tenantId != null && pgHasUnstorable(e.tenantId))
-            throw new PgUnstorableError("image tenantId (identity)");
-        const id = PgImageIndex.idFor(e.repo, e.digest);
-        const now = new Date();
-        await this.pool.query(`INSERT INTO sandbox_image_index ${UPSERT_COLS}
-       VALUES ${UPSERT_VALUES}
-       ON CONFLICT (id) DO UPDATE SET
-         profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
-         toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
-         pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
-         status = EXCLUDED.status, visibility = EXCLUDED.visibility, tenant_id = EXCLUDED.tenant_id,
-         manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
-         generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
-         supersedes = EXCLUDED.supersedes, signed = EXCLUDED.signed, updated_at = EXCLUDED.updated_at`, upsertParams(e, id, now));
-        return id;
-    }
-    async registerBuilding(e) {
-        if (pgHasUnstorable(e.repo))
-            throw new PgUnstorableError("image repo (identity)");
-        if (e.tenantId != null && pgHasUnstorable(e.tenantId))
-            throw new PgUnstorableError("image tenantId (identity)");
-        const id = PgImageIndex.idFor(e.repo, e.digest);
-        const now = new Date();
-        await this.pool.query(`INSERT INTO sandbox_image_index ${UPSERT_COLS}
-       VALUES ${UPSERT_VALUES}
-       ON CONFLICT (id) DO UPDATE SET
-         profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
-         toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
-         pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
-         status = CASE WHEN sandbox_image_index.status = 'published'
-                       THEN sandbox_image_index.status ELSE EXCLUDED.status END,
-         visibility = CASE WHEN sandbox_image_index.status = 'published'
-                           THEN sandbox_image_index.visibility ELSE EXCLUDED.visibility END,
-         tenant_id = CASE WHEN sandbox_image_index.status = 'published'
-                          THEN sandbox_image_index.tenant_id ELSE EXCLUDED.tenant_id END,
-         manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
-         generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
-         supersedes = EXCLUDED.supersedes,
-         signed = CASE WHEN sandbox_image_index.status = 'published'
-                       THEN sandbox_image_index.signed ELSE EXCLUDED.signed END,
-         updated_at = EXCLUDED.updated_at`, upsertParams(e, id, now));
-        return id;
-    }
-    async getById(id) {
-        const res = await this.pool.query("SELECT * FROM sandbox_image_index WHERE id = $1 LIMIT 1", [id]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async getByDigest(digest) {
-        const res = await this.pool.query("SELECT * FROM sandbox_image_index WHERE digest = $1 ORDER BY updated_at DESC LIMIT 1", [digest]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async latestPublished(profile, viewer) {
-        const vis = visibilityClause(viewer, 2);
-        const res = await this.pool.query(`SELECT * FROM sandbox_image_index
-        WHERE profile = $1 AND status = 'published' AND ${vis.sql}
-        ORDER BY build_date DESC NULLS LAST, created_at DESC LIMIT 1`, [profile, ...vis.params]);
-        return res.rows[0] ? mapRow(res.rows[0]) : null;
-    }
-    async list(filter) {
-        const limit = Math.min(Math.max(1, filter.limit ?? DEFAULT_LIMIT), MAX_LIMIT);
-        const vis = visibilityClause(filter, 1);
-        const where = [vis.sql];
-        const params = [...vis.params];
-        let idx = vis.nextIdx;
-        if (filter.profile) {
-            where.push(`profile = $${idx++}`);
-            params.push(filter.profile);
-        }
-        if (filter.status) {
-            where.push(`status = $${idx++}`);
-            params.push(filter.status);
-        }
-        if (filter.capability) {
-            where.push(`capabilities -> $${idx++} = 'true'::jsonb`);
-            params.push(filter.capability);
-        }
-        if (filter.cursor) {
-            const c = decodeCursor(filter.cursor);
-            if (c) {
-                where.push(`(created_at < $${idx} OR (created_at = $${idx + 1} AND id < $${idx + 2}))`);
-                params.push(new Date(c.createdAt), new Date(c.createdAt), c.id);
-                idx += 3;
-            }
-        }
-        const sql = `SELECT * FROM sandbox_image_index WHERE ${where.join(" AND ")} ` +
-            `ORDER BY created_at DESC, id DESC LIMIT $${idx}`;
-        params.push(limit + 1);
-        const res = await this.pool.query(sql, params);
-        let entries = res.rows.map(mapRow);
-        let nextCursor = null;
-        if (entries.length > limit) {
-            entries = entries.slice(0, limit);
-            const last = entries[entries.length - 1];
-            nextCursor = encodeCursor({ createdAt: last.createdAt, id: last.id });
-        }
-        if (filter.latestOnly) {
-            const seen = new Set();
-            entries = entries.filter((e) => (seen.has(e.profile) ? false : (seen.add(e.profile), true)));
-        }
-        return { entries, nextCursor };
-    }
-    async setStatus(id, status, opts) {
-        const sets = ["status = $1", "updated_at = $2"];
-        const params = [status, new Date()];
-        let idx = 3;
-        if (opts && "supersedes" in opts) {
-            sets.push(`supersedes = $${idx++}`);
-            params.push(opts.supersedes ?? null);
-        }
-        params.push(id);
-        await this.pool.query(`UPDATE sandbox_image_index SET ${sets.join(", ")} WHERE id = $${idx}`, params);
-    }
-}
+export { PgImageIndex, PG_IMAGE_INDEX_SCHEMA, ensureSchema } from "./image-index-sql.js";
 //# sourceMappingURL=pg-image-index.js.map