@sema-agent/server 1.314.0 → 1.316.0

package/dist/http/routes/images.js

@@ -0,0 +1,572 @@
+import { RateLimiter } from "../../observability/rate-limit.js";
+import { redactSecrets, redactDeep } from "../../trace/redact.js";
+import { pgHasUnstorable } from "../../plugins/pg-safe-json.js";
+import { manifestToIndexEntry } from "../../images/manifest.js";
+import { validateBake, buildBakeArgv } from "../../images/bake-validate.js";
+import { streamSseLog } from "../sse-log.js";
+import { sendJson, sendError } from "../send.js";
+import { headerStr, safeEqual, gatedPrincipal, explicitOperatorOk, explicitOperator } from "../principal-gate.js";
+import { scopedIdempotencyKey } from "../idempotency.js";
+export function createImagesLocal(deps) {
+    return { bakeSubmitLimiter: new RateLimiter(deps.config.imageBakes?.submitRateMax ?? 0, (deps.config.imageBakes?.submitRateWindowSec ?? 60) * 1000) };
+}
+export function coarseStatusForState(state) {
+    if (state === "COMPLETE")
+        return "done";
+    if (state === "FAILED" || state === "CANCELLED")
+        return "failed";
+    return "running";
+}
+export function errorCodeForExit(exitCode, cancelled) {
+    if (cancelled)
+        return "cancelled";
+    switch (exitCode) {
+        case 9:
+            return "band-conflict";
+        case 10:
+            return "duplicate";
+        case 124:
+            return "timeout";
+        case 507:
+            return "disk";
+        default:
+            return null;
+    }
+}
+const RUNNER_ERROR_CODES = new Set(["band-conflict", "duplicate", "disk", "timeout", "cancelled"]);
+const SANDBOX_BASE_PROFILE = "sandbox-base";
+export const IMAGE_DIGEST_RE = /^\/v1\/images\/digests\/([^/]+)$/;
+export const IMAGE_PROFILE_RE = /^\/v1\/images\/([^/]+)$/;
+export const BAKE_ID_RE = /^\/v1\/images\/bakes\/([^/]+)$/;
+export const BAKE_EVENTS_RE = /^\/v1\/images\/bakes\/([^/]+)\/events$/;
+export const BAKE_CANCEL_RE = /^\/v1\/images\/bakes\/([^/]+)\/cancel$/;
+export const BAKE_CLAIM_RE = /^\/v1\/images\/bakes\/([^/]+)\/claim$/;
+export const BAKE_INGEST_RE = /^\/v1\/images\/bakes\/([^/]+)\/ingest$/;
+export async function handleImages(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleImagesBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+async function handleImagesBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const { readJson } = ctx.helpers;
+    const { source } = ctx.req;
+    const { bakeSubmitLimiter } = ctx.local.images;
+    if (deps.imageBakes && url.startsWith("/v1/images/bakes")) {
+        const bakes = deps.imageBakes;
+        const idx = deps.imageIndex;
+        const principal = gatedPrincipal(req, deps.config);
+        const operators = deps.config.operatorPrincipals;
+        const explicitOperator = explicitOperatorOk(principal, operators);
+        const cfg = deps.config.imageBakes;
+        const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
+        if (req.method === "POST" && url === "/v1/images/bakes") {
+            if (!explicitOperator) {
+                sendJson(res, 403, { error: "operator only" });
+                return;
+            }
+            const rl = bakeSubmitLimiter.check(`bake:${principal}`);
+            if (!rl.allowed) {
+                res.setHeader("retry-after", String(rl.retryAfterSec));
+                sendJson(res, 429, { error: "bake submission rate exceeded", retryAfterSec: rl.retryAfterSec });
+                return;
+            }
+            const body = (await readJson(req));
+            const v = validateBake(body);
+            if (!v.ok) {
+                sendJson(res, v.status, { error: v.error, ...(v.conflictBands ? { errorCode: "band-conflict", conflictBands: v.conflictBands } : {}) });
+                return;
+            }
+            let effectiveBaseRef;
+            if (v.baseRef) {
+                const baseEntry = idx ? await idx.getByDigest(v.baseRef) : null;
+                if (!baseEntry || baseEntry.status !== "published" || baseEntry.profile !== SANDBOX_BASE_PROFILE) {
+                    sendJson(res, 400, { error: "baseRef is not a known published sandbox-base digest" });
+                    return;
+                }
+                effectiveBaseRef = v.baseRef;
+            }
+            else {
+                effectiveBaseRef = cfg.defaultBaseRef ?? (idx ? (await idx.latestPublished(SANDBOX_BASE_PROFILE, { operator: true }))?.digest ?? null : null);
+            }
+            if (!v.dryRun && !effectiveBaseRef) {
+                sendJson(res, 503, { error: "no sandbox-base available to build from (set SANDBOX_BASE_REF or publish a sandbox-base image)" });
+                return;
+            }
+            const argv = buildBakeArgv(v, { baseRef: effectiveBaseRef, cacheBase: cfg.cacheBase });
+            const rawIdem = headerStr(req.headers["idempotency-key"]) ?? (typeof body.idempotencyKey === "string" ? body.idempotencyKey : undefined);
+            const idemKey = rawIdem ? scopedIdempotencyKey(rawIdem, source, principal) ?? null : null;
+            const createInput = {
+                profile: v.profile,
+                bands: v.bands,
+                baseRef: effectiveBaseRef,
+                push: v.push,
+                dryRun: v.dryRun,
+                logs: v.logs,
+                argv,
+                idemKey,
+                requestedBy: principal ?? null,
+            };
+            if (!v.dryRun) {
+                const sameArgv = await bakes.findActiveByArgv(argv);
+                if (sameArgv) {
+                    sendJson(res, 202, { bakeId: sameArgv.bakeId, eventsUrl: `/v1/images/bakes/${sameArgv.bakeId}/events`, status: sameArgv.status, state: sameArgv.state });
+                    return;
+                }
+                const r = await bakes.createBakeIfIdle(createInput);
+                if (!r.created) {
+                    const sameNow = await bakes.findActiveByArgv(argv);
+                    if (sameNow) {
+                        sendJson(res, 202, { bakeId: sameNow.bakeId, eventsUrl: `/v1/images/bakes/${sameNow.bakeId}/events`, status: sameNow.status, state: sameNow.state });
+                        return;
+                    }
+                    const busy = await bakes.findActiveAny();
+                    sendJson(res, 409, { error: "a bake is already in progress", ...(busy ? { activeBakeId: busy.bakeId, eventsUrl: `/v1/images/bakes/${busy.bakeId}/events` } : {}) });
+                    return;
+                }
+                sendJson(res, 202, { bakeId: r.bake.bakeId, eventsUrl: `/v1/images/bakes/${r.bake.bakeId}/events`, status: r.bake.status, state: r.bake.state });
+                return;
+            }
+            const { bake } = await bakes.createBake(createInput);
+            sendJson(res, 202, { bakeId: bake.bakeId, eventsUrl: `/v1/images/bakes/${bake.bakeId}/events`, status: bake.status, state: bake.state });
+            return;
+        }
+        const evMatch = req.method === "GET" ? BAKE_EVENTS_RE.exec(url) : null;
+        if (evMatch) {
+            if (!explicitOperator) {
+                sendJson(res, 403, { error: "operator only" });
+                return;
+            }
+            const bakeId = decodeURIComponent(evMatch[1]);
+            const bake = await bakes.getBake(bakeId);
+            if (!bake) {
+                sendJson(res, 404, { error: "bake not found" });
+                return;
+            }
+            await streamBakeEvents(req, res, bakes, bakeId, cfg.staleMs);
+            return;
+        }
+        const cancelMatch = req.method === "POST" ? BAKE_CANCEL_RE.exec(url) : null;
+        if (cancelMatch) {
+            if (!explicitOperator) {
+                sendJson(res, 403, { error: "operator only" });
+                return;
+            }
+            const bakeId = decodeURIComponent(cancelMatch[1]);
+            const bake = await bakes.getBake(bakeId);
+            if (!bake) {
+                sendJson(res, 404, { error: "bake not found" });
+                return;
+            }
+            const flagged = await bakes.requestCancel(bakeId);
+            sendJson(res, 202, { bakeId, cancelRequested: true, note: flagged ? "cancel requested — the runner kills the build at the next heartbeat" : "bake already terminal — cancel is a no-op" });
+            return;
+        }
+        if (req.method === "POST" && url === "/v1/images/bakes/claim") {
+            if (!isRunner) {
+                sendJson(res, 403, { error: "bake-runner only" });
+                return;
+            }
+            const body = (await readJson(req));
+            const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
+            let claimed = null;
+            for (let attempt = 0; attempt < 4 && !claimed; attempt++) {
+                const nextId = await bakes.findNextQueuedId();
+                if (!nextId)
+                    break;
+                claimed = await bakes.claimBake(nextId, runnerId, cfg.leaseMs);
+            }
+            if (!claimed) {
+                res.writeHead(204).end();
+                return;
+            }
+            sendJson(res, 200, claimResponse(claimed));
+            return;
+        }
+        const claimMatch = req.method === "POST" ? BAKE_CLAIM_RE.exec(url) : null;
+        if (claimMatch) {
+            if (!isRunner) {
+                sendJson(res, 403, { error: "bake-runner only" });
+                return;
+            }
+            const bakeId = decodeURIComponent(claimMatch[1]);
+            const body = (await readJson(req));
+            const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
+            const claimed = await bakes.claimBake(bakeId, runnerId, cfg.leaseMs);
+            if (!claimed) {
+                sendJson(res, 409, { error: "bake not claimable (already claimed or the build lease is held)" });
+                return;
+            }
+            sendJson(res, 200, claimResponse(claimed));
+            return;
+        }
+        const ingestMatch = req.method === "POST" ? BAKE_INGEST_RE.exec(url) : null;
+        if (ingestMatch) {
+            if (!isRunner) {
+                sendJson(res, 403, { error: "bake-runner only" });
+                return;
+            }
+            const bakeId = decodeURIComponent(ingestMatch[1]);
+            const bake = await bakes.getBake(bakeId);
+            if (!bake) {
+                sendJson(res, 404, { error: "bake not found" });
+                return;
+            }
+            const presented = headerStr(req.headers["x-bake-ingest-secret"]);
+            if (!bake.ingestSecret || !presented || !safeEqual(presented, bake.ingestSecret)) {
+                sendJson(res, 403, { error: "invalid ingest secret" });
+                return;
+            }
+            const line = (await readJson(req));
+            if (line.event === "heartbeat") {
+                const fresh = await bakes.getBake(bakeId);
+                if (!fresh || fresh.status !== "running") {
+                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
+                    return;
+                }
+                const ok = bake.runnerId ? await bakes.heartbeatLease(bakeId, bake.runnerId, cfg.leaseMs) : false;
+                if (!ok) {
+                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested });
+                    return;
+                }
+                sendJson(res, 200, { accepted: true, leaseValid: true, cancelRequested: fresh.cancelRequested });
+                return;
+            }
+            const fresh = await bakes.getBake(bakeId);
+            if (!fresh || fresh.status !== "running") {
+                sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
+                return;
+            }
+            if (fresh.runnerId) {
+                await bakes.heartbeatLease(bakeId, fresh.runnerId, cfg.leaseMs).catch(() => undefined);
+            }
+            const result = await ingestBakeLine(bakes, idx, fresh, line, cfg.registry);
+            const after = await bakes.getBake(bakeId);
+            sendJson(res, result.status, { ...result.body, cancelRequested: after?.cancelRequested ?? false, leaseValid: true });
+            return;
+        }
+        const idMatch = req.method === "GET" ? BAKE_ID_RE.exec(url) : null;
+        if (idMatch) {
+            if (!explicitOperator) {
+                sendJson(res, 403, { error: "operator only" });
+                return;
+            }
+            const bakeId = decodeURIComponent(idMatch[1]);
+            const bake = await bakes.getBake(bakeId);
+            if (!bake) {
+                sendJson(res, 404, { error: "bake not found" });
+                return;
+            }
+            sendJson(res, 200, { bake: bakeView(bake) });
+            return;
+        }
+        sendJson(res, 404, { error: "not found" });
+        return;
+    }
+    if (deps.imageIndex && url.startsWith("/v1/images")) {
+        const idx = deps.imageIndex;
+        const principal = gatedPrincipal(req, deps.config);
+        const operator = explicitOperator(principal, deps.config.operatorPrincipals);
+        const viewer = { operator, tenantId: principal ?? null };
+        const q = new URL(req.url ?? "", "http://x").searchParams;
+        if (req.method === "GET" && url === "/v1/images") {
+            const limRaw = q.get("limit");
+            const { entries, nextCursor } = await idx.list({
+                ...viewer,
+                profile: q.get("profile") ?? undefined,
+                status: q.get("status") ?? undefined,
+                capability: q.get("capability") ?? undefined,
+                latestOnly: q.get("latest") === "true",
+                limit: limRaw ? Number(limRaw) : undefined,
+                cursor: q.get("cursor") ?? undefined,
+            });
+            sendJson(res, 200, { images: entries, nextCursor });
+            return;
+        }
+        if (req.method === "POST" && url === "/v1/images/select") {
+            const body = (await readJson(req));
+            const profile = typeof body.profile === "string" ? body.profile : "";
+            if (!profile) {
+                sendJson(res, 400, { error: "profile is required" });
+                return;
+            }
+            const entry = await idx.latestPublished(profile, viewer);
+            if (!entry) {
+                sendJson(res, 404, { error: `no published image for profile '${profile}' visible to this principal` });
+                return;
+            }
+            const needed = Array.isArray(body.capabilitiesNeeded)
+                ? body.capabilitiesNeeded.filter((c) => typeof c === "string")
+                : [];
+            const caps = entry.capabilities;
+            const missing = needed.filter((c) => !caps[c]);
+            if (missing.length > 0) {
+                sendJson(res, 409, { error: "capabilities not satisfied by the image", missing });
+                return;
+            }
+            sendJson(res, 200, {
+                profile: entry.profile,
+                digest: entry.digest,
+                repo: entry.repo,
+                ref: `${entry.repo}@${entry.digest}`,
+                podContract: entry.podContract,
+                capabilities: entry.capabilities,
+                manifestSha: entry.manifestSha,
+            });
+            return;
+        }
+        if (req.method === "POST" && url === "/v1/images/register") {
+            if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+                sendJson(res, 403, { error: "operator only" });
+                return;
+            }
+            const b = (await readJson(req));
+            if (typeof b.profile !== "string" || typeof b.repo !== "string" || typeof b.digest !== "string") {
+                sendJson(res, 400, { error: "profile, repo, digest are required" });
+                return;
+            }
+            const id = await idx.registerBuilding({
+                profile: b.profile,
+                bands: Array.isArray(b.bands) ? b.bands : [],
+                repo: b.repo,
+                tag: typeof b.tag === "string" ? b.tag : "",
+                digest: b.digest,
+                toolchainVersions: b.toolchainVersions ?? {},
+                capabilities: b.capabilities ?? {},
+                podContract: b.podContract ?? {},
+                sizeBytes: typeof b.sizeBytes === "number" ? b.sizeBytes : null,
+                status: (typeof b.status === "string" ? b.status : "building"),
+                visibility: b.visibility === "tenant" ? "tenant" : "public",
+                tenantId: typeof b.tenantId === "string" ? b.tenantId : null,
+                manifestSha: typeof b.manifestSha === "string" ? b.manifestSha : null,
+                recipeGitSha: typeof b.recipeGitSha === "string" ? b.recipeGitSha : null,
+                generatorVersion: typeof b.generatorVersion === "string" ? b.generatorVersion : null,
+                buildDate: typeof b.buildDate === "string" ? b.buildDate : null,
+                supersedes: typeof b.supersedes === "string" ? b.supersedes : null,
+                signed: b.signed === true,
+            });
+            sendJson(res, 200, { id });
+            return;
+        }
+        const digMatch = req.method === "GET" ? IMAGE_DIGEST_RE.exec(url) : null;
+        if (digMatch) {
+            const entry = await idx.getByDigest(decodeURIComponent(digMatch[1]));
+            if (!entry || (!viewer.operator && entry.visibility === "tenant" && entry.tenantId !== viewer.tenantId)) {
+                sendJson(res, 404, { error: "not found" });
+                return;
+            }
+            sendJson(res, 200, { image: entry });
+            return;
+        }
+        const profMatch = req.method === "GET" ? IMAGE_PROFILE_RE.exec(url) : null;
+        if (profMatch) {
+            const entry = await idx.latestPublished(decodeURIComponent(profMatch[1]), viewer);
+            if (!entry) {
+                sendJson(res, 404, { error: "not found" });
+                return;
+            }
+            sendJson(res, 200, { image: entry });
+            return;
+        }
+    }
+    miss.fell = true;
+}
+async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
+    await streamSseLog(req, res, {
+        statusOf: async (id) => {
+            const bake = await bakes.getBake(id);
+            return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
+        },
+        getEvents: (id, after) => bakes.getEvents(id, after),
+        retainedFrom: (id) => bakes.retainedFrom(id),
+        formatEvent: (ev) => ({
+            id: ev.seq,
+            event: ev.kind,
+            data: { kind: ev.kind, seq: ev.seq, ts: ev.ts, ...(ev.level ? { level: ev.level } : {}), ...(ev.data ?? {}) },
+        }),
+        staleFrame: () => ({ event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } }),
+    }, bakeId, staleMs);
+}
+function bakeView(b) {
+    return {
+        bakeId: b.bakeId,
+        status: b.status,
+        state: b.state,
+        profile: b.profile,
+        bands: b.bands,
+        baseRef: b.baseRef,
+        push: b.push,
+        dryRun: b.dryRun,
+        logs: b.logs,
+        digest: b.digest,
+        repo: b.repo,
+        ref: b.ref,
+        indexId: b.indexId,
+        exitCode: b.exitCode,
+        error: b.error,
+        errorCode: b.errorCode,
+        manifestSha: b.manifestSha,
+        tag: b.tag,
+        requestedBy: b.requestedBy,
+        createdAt: b.createdAt,
+        updatedAt: b.updatedAt,
+    };
+}
+function claimResponse(claimed) {
+    return {
+        bakeId: claimed.bakeId,
+        argv: claimed.argv,
+        push: claimed.push,
+        dryRun: claimed.dryRun,
+        logs: claimed.logs,
+        profile: claimed.profile,
+        bands: claimed.bands,
+        ingestSecret: claimed.ingestSecret,
+        leaseUntil: claimed.leaseUntil,
+    };
+}
+async function ingestBakeLine(bakes, idx, bake, line, registry) {
+    const bakeId = bake.bakeId;
+    const event = typeof line.event === "string" ? line.event : "";
+    const lineOrd = typeof line.lineOrd === "number" ? line.lineOrd : typeof line.line_ord === "number" ? line.line_ord : null;
+    if (event !== "done") {
+        if (event === "state") {
+            const state = typeof line.state === "string" ? line.state : null;
+            if (state)
+                await bakes.setState(bakeId, state);
+            const seq = await bakes.appendEvent(bakeId, "state", { state }, { lineOrd });
+            return { status: 200, body: { accepted: true, seq } };
+        }
+        const kind = event === "manifest" ? "manifest" : event;
+        const level = event === "log" && line.level === "raw" ? "raw" : null;
+        const { event: _e, lineOrd: _lo, line_ord: _li, ...data } = line;
+        const seq = await bakes.appendEvent(bakeId, kind, redactDeep(data), { lineOrd, level });
+        return { status: 200, body: { accepted: true, seq } };
+    }
+    const doneStatus = typeof line.status === "string" ? line.status : "FAILED";
+    const exitCode = typeof line.exitCode === "number" ? line.exitCode : doneStatus === "COMPLETE" ? 0 : null;
+    const cancelled = doneStatus === "CANCELLED";
+    const errorText = typeof line.error === "string" ? redactSecrets(line.error) : null;
+    const tag = typeof line.tag === "string" ? line.tag : bake.tag;
+    let digest = typeof line.digest === "string" && line.digest.length > 0 ? line.digest : null;
+    let indexId = bake.indexId;
+    let repo = bake.repo;
+    let ref = bake.ref;
+    let manifestSha = bake.manifestSha;
+    let finalStatus = doneStatus;
+    let finalError = errorText;
+    let finalExit = exitCode;
+    let registerDowngraded = false;
+    const registerSteps = [];
+    if (doneStatus === "COMPLETE" && digest && idx) {
+        const manifestBody = (line.manifestBody ?? line.manifest);
+        const fresh = await bakes.getBake(bakeId);
+        const nonTerminal = !!fresh && (fresh.status === "queued" || fresh.status === "running");
+        if (manifestBody && typeof manifestBody === "object" && nonTerminal) {
+            const profile = bake.profile && bake.profile !== "custom" ? bake.profile : (manifestBody.profile && manifestBody.profile !== "custom" ? manifestBody.profile : "custom");
+            repo = registry ? `${registry}/${profile}` : `sema-images/${profile}`;
+            manifestSha = typeof line.manifestSha === "string" ? line.manifestSha : (typeof line.manifest?.sha256 === "string" ? String(line.manifest.sha256) : bake.manifestSha);
+            if (pgHasUnstorable(digest) || pgHasUnstorable(repo) || pgHasUnstorable(manifestSha)) {
+                indexId = null;
+                registerSteps.push({ step: "register", status: "skipped", reason: "identity fields contained unstorable bytes" });
+            }
+            else {
+                registerSteps.push({ step: "register", status: "running" });
+                try {
+                    const entry = manifestToIndexEntry(manifestBody, { repo, digest, status: "building", manifestSha, sizeBytes: manifestBody.sizeBytes ?? null, signed: false });
+                    entry.visibility = "public";
+                    entry.tenantId = null;
+                    indexId = await idx.registerBuilding(entry);
+                    ref = `${repo}@${digest}`;
+                    const bound = await bakes.setIndexId(bakeId, indexId);
+                    if (!bound)
+                        indexId = null;
+                    registerSteps.push({ step: "register", status: "ok" });
+                }
+                catch (err) {
+                    indexId = null;
+                    ref = `${repo}@${digest}`;
+                    finalStatus = "FAILED";
+                    registerDowngraded = true;
+                    finalExit = exitCode ?? 0;
+                    finalError = redactSecrets(`index register failed after a COMPLETE build (built-but-unregistered partial): ${String(err?.message ?? err)}`);
+                    registerSteps.push({ step: "register", status: "fail", reason: "index register failed (TiDB?)" });
+                }
+            }
+        }
+    }
+    const suppliedCode = typeof line.errorCode === "string" && RUNNER_ERROR_CODES.has(line.errorCode)
+        ? line.errorCode
+        : undefined;
+    const errorCode = cancelled
+        ? "cancelled"
+        : suppliedCode !== undefined && !registerDowngraded
+            ? suppliedCode
+            : errorCodeForExit(finalExit, cancelled);
+    const conflictBands = errorCode === "band-conflict" && Array.isArray(line.conflictBands)
+        ? line.conflictBands.filter((b) => typeof b === "string")
+        : null;
+    const identityInvalid = (typeof digest === "string" && pgHasUnstorable(digest)) ||
+        (typeof repo === "string" && pgHasUnstorable(repo)) ||
+        (typeof ref === "string" && pgHasUnstorable(ref)) ||
+        (typeof manifestSha === "string" && pgHasUnstorable(manifestSha));
+    if (identityInvalid) {
+        finalStatus = "FAILED";
+        digest = null;
+        repo = null;
+        ref = null;
+        manifestSha = null;
+        indexId = null;
+        finalError = finalError ? `${finalError}; identity fields contained unstorable bytes` : "terminal frame identity fields contained unstorable bytes";
+    }
+    const finalState = (finalStatus === "COMPLETE" ? "COMPLETE" : finalStatus === "CANCELLED" ? "CANCELLED" : "FAILED");
+    const coarse = coarseStatusForState(finalState);
+    let affectedRows = 0;
+    const terminal = {
+        status: coarse === "done" ? "done" : "failed",
+        state: finalState,
+        digest,
+        repo,
+        ref,
+        indexId,
+        exitCode: finalExit,
+        error: finalError,
+        errorCode,
+        manifestSha,
+        tag,
+    };
+    let lastErr;
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        try {
+            affectedRows = await bakes.setTerminal(bakeId, terminal);
+            lastErr = undefined;
+            break;
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    if (lastErr !== undefined) {
+        return { status: 200, body: { accepted: true, terminal: false, needsFlip: true } };
+    }
+    if (affectedRows >= 1) {
+        for (const s of registerSteps)
+            await bakes.appendEvent(bakeId, "step", s);
+        await bakes.appendEvent(bakeId, "done", {
+            status: finalStatus,
+            digest,
+            repo,
+            ref,
+            indexId,
+            tag,
+            manifestSha,
+            sizeBytes: typeof line.sizeBytes === "number" ? line.sizeBytes : null,
+            exitCode: finalExit,
+            error: finalError,
+            errorCode,
+            ...(conflictBands ? { conflictBands } : {}),
+        }, { lineOrd });
+    }
+    return { status: 200, body: { accepted: true, terminal: affectedRows >= 1, indexId } };
+}
+//# sourceMappingURL=images.js.map

package/dist/http/routes/memory-policy.d.ts

@@ -0,0 +1,4 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RouteCtx } from "../route-ctx.js";
+export declare function handleMemoryPolicy(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+//# sourceMappingURL=memory-policy.d.ts.map

package/dist/http/routes/memory-policy.js

@@ -0,0 +1,105 @@
+import { formatUserScope } from "@sema-agent/core";
+import { parseMemorySyncRequest } from "../../memory-sync.js";
+import { sendJson, sendError } from "../send.js";
+import { gatedPrincipal, explicitOperatorOk } from "../principal-gate.js";
+export async function handleMemoryPolicy(req, res, url, ctx) {
+    const miss = { fell: false };
+    await handleMemoryPolicyBody(req, res, url, ctx, miss);
+    return !miss.fell;
+}
+async function handleMemoryPolicyBody(req, res, url, ctx, miss) {
+    const { deps } = ctx;
+    const { readJson } = ctx.helpers;
+    if (url === "/v1/memory/export" && req.method === "GET") {
+        const principal = gatedPrincipal(req, deps.config);
+        if (!principal) {
+            sendJson(res, 401, { error: "unauthorized" });
+            return;
+        }
+        if (deps.config.memoryEngineBackend === "file" || !deps.memoryExport) {
+            sendJson(res, 501, { error: "memory export requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)" });
+            return;
+        }
+        const scope = new URL(req.url ?? "", "http://x").searchParams.get("scope");
+        if (!scope) {
+            sendJson(res, 400, { error: "missing ?scope=<key>" });
+            return;
+        }
+        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            sendJson(res, 404, { error: "not found" });
+            return;
+        }
+        try {
+            const entries = await deps.memoryExport(scope);
+            sendJson(res, 200, { scope, exportedAt: new Date().toISOString(), entries });
+        }
+        catch (err) {
+            deps.logger?.warn?.("memory_export_failed", { scope, err: String(err) });
+            sendJson(res, 500, { error: "memory export failed" });
+        }
+        return;
+    }
+    if (req.method === "POST" && url.startsWith("/v1/memory/sync/")) {
+        const principal = gatedPrincipal(req, deps.config);
+        if (!principal) {
+            sendJson(res, 401, { error: "unauthorized" });
+            return;
+        }
+        if (deps.config.memoryEngineBackend === "file" || !deps.memorySync) {
+            sendJson(res, 501, { error: "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)" });
+            return;
+        }
+        let scope;
+        try {
+            scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
+        }
+        catch {
+            sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope", { code: "memory_sync_invalid_scope" });
+            return;
+        }
+        if (scope.length === 0) {
+            sendError(res, 400, "memory_sync_invalid_scope", "missing :scope", { code: "memory_sync_invalid_scope" });
+            return;
+        }
+        if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
+            sendJson(res, 404, { error: "not found" });
+            return;
+        }
+        const body = await readJson(req);
+        const parsed = parseMemorySyncRequest(body, scope);
+        if (!parsed.ok) {
+            sendError(res, 422, "memory_sync_invalid_body", parsed.error, { code: "memory_sync_invalid_body" });
+            return;
+        }
+        try {
+            const out = await deps.memorySync(scope, parsed.value);
+            sendJson(res, 200, out);
+        }
+        catch (err) {
+            deps.logger?.warn?.("memory_sync_failed", { scope, peer: parsed.value.peer, err: String(err) });
+            sendJson(res, 500, { error: "memory sync failed" });
+        }
+        return;
+    }
+    if (url === "/v1/policy" && req.method === "GET") {
+        const principal = gatedPrincipal(req, deps.config);
+        if (deps.config.requirePrincipal && !principal) {
+            sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
+            return;
+        }
+        sendJson(res, 200, {
+            autonomy: deps.config.autonomy ?? null,
+            commandPolicy: deps.config.commandPolicy ?? [],
+            approvalRequire: deps.config.approvalRequire,
+            limits: {
+                maxTaskCostUsd: deps.config.maxTaskCostUsd,
+                maxTaskTokens: deps.config.maxTaskTokens,
+                maxPrincipalCostUsd: deps.config.maxPrincipalCostUsd,
+                costQuotaWindowSec: deps.config.costQuotaWindowSec,
+            },
+        });
+        return;
+    }
+    miss.fell = true;
+}
+//# sourceMappingURL=memory-policy.js.map