@sema-agent/server 1.315.0 → 1.316.0

package/dist/http/sse-log.d.ts

@@ -0,0 +1,25 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface SseLogProvider<E extends {
+    seq: number;
+}> {
+    statusOf(id: string): Promise<{
+        status: string;
+        updatedAt: string;
+    } | null | undefined>;
+    getEvents(id: string, after: number): Promise<E[]>;
+    retainedFrom(id: string): Promise<number>;
+    formatEvent(ev: E): {
+        id: number;
+        event: string;
+        data: unknown;
+    };
+    staleFrame(): {
+        event: string;
+        data: unknown;
+    };
+}
+export declare function streamSseLog<E extends {
+    seq: number;
+}>(req: IncomingMessage, res: ServerResponse, provider: SseLogProvider<E>, id: string, staleMs: number): Promise<void>;
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=sse-log.d.ts.map

package/dist/http/sse-log.js

@@ -0,0 +1,59 @@
+import { sendJson, sseHeaders } from "./send.js";
+export async function streamSseLog(req, res, provider, id, staleMs) {
+    const lastId = Number(req.headers["last-event-id"] ?? new URL(req.url ?? "", "http://x").searchParams.get("from") ?? 0);
+    let from = Number.isFinite(lastId) ? lastId : 0;
+    if (from > 0) {
+        const retainedFrom = await provider.retainedFrom(id);
+        if (retainedFrom > from + 1) {
+            sendJson(res, 416, { error: "resume point evicted past retention", retainedFrom });
+            return;
+        }
+    }
+    sseHeaders(res);
+    let closed = false;
+    req.on("close", () => {
+        closed = true;
+    });
+    const start = Date.now();
+    const MAX_MS = 15 * 60 * 1000;
+    let lastBeat = Date.now();
+    const write = (events) => {
+        for (const ev of events) {
+            const f = provider.formatEvent(ev);
+            res.write(`id: ${f.id}\nevent: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
+            from = ev.seq;
+        }
+    };
+    while (!closed) {
+        const [events, row] = await Promise.all([provider.getEvents(id, from), provider.statusOf(id)]);
+        write(events);
+        if (!row)
+            break;
+        if (row.status !== "running") {
+            write(await provider.getEvents(id, from));
+            break;
+        }
+        const stale = Date.now() - new Date(row.updatedAt).getTime() > staleMs;
+        if (stale && events.length === 0) {
+            const sf = provider.staleFrame();
+            res.write(`event: ${sf.event}\ndata: ${JSON.stringify(sf.data)}\n\n`);
+            break;
+        }
+        if (Date.now() - start > MAX_MS) {
+            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
+            break;
+        }
+        if (events.length === 0) {
+            if (Date.now() - lastBeat > 15_000) {
+                res.write(`event: heartbeat\ndata: {}\n\n`);
+                lastBeat = Date.now();
+            }
+            await sleep(250);
+        }
+    }
+    res.end();
+}
+export function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=sse-log.js.map

package/dist/http/workspace-content.d.ts

@@ -0,0 +1,3 @@
+export declare function workspaceContentType(relPath: string): string;
+export declare function looksBinary(bytes: Uint8Array): boolean;
+//# sourceMappingURL=workspace-content.d.ts.map

package/dist/http/workspace-content.js

@@ -0,0 +1,20 @@
+export function workspaceContentType(relPath) {
+    const base = relPath.slice(relPath.lastIndexOf("/") + 1);
+    const dot = base.lastIndexOf(".");
+    const ext = dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
+    const TABLE = {
+        txt: "text/plain; charset=utf-8", md: "text/plain; charset=utf-8", log: "text/plain; charset=utf-8",
+        json: "application/json; charset=utf-8", csv: "text/csv; charset=utf-8",
+        png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp",
+        pdf: "application/pdf",
+    };
+    return TABLE[ext] ?? "application/octet-stream";
+}
+export function looksBinary(bytes) {
+    const n = Math.min(bytes.byteLength, 8192);
+    for (let i = 0; i < n; i++)
+        if (bytes[i] === 0)
+            return true;
+    return false;
+}
+//# sourceMappingURL=workspace-content.js.map

package/dist/plugins/approval-store-sql.d.ts

@@ -0,0 +1,52 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool, PoolClient } from "pg";
+import { type SqlDriver } from "./sql-driver.js";
+export type ApprovalStatus = "pending" | "approved" | "denied" | "expired";
+export interface ApprovalRow {
+    id: string;
+    taskId: string | null;
+    sessionId: string | null;
+    owner: string | null;
+    scope: string | null;
+    toolName: string;
+    args: unknown;
+    status: ApprovalStatus;
+    reason: string | null;
+    decidedBy: string | null;
+    createdAt: string;
+    decidedAt: string | null;
+}
+export declare const PG_APPROVAL_SCHEMA: string[];
+export declare function ensureSchema(pool: PgPool | PoolClient): Promise<void>;
+export declare class SqlApprovalStore {
+    protected readonly db: SqlDriver;
+    constructor(db: SqlDriver);
+    private q;
+    private json;
+    createPending(id: string, scope: string | null, ctx: {
+        taskId?: string | null;
+        sessionId?: string | null;
+        owner?: string | null;
+        toolName: string;
+        args: unknown;
+    }): Promise<void>;
+    getStatus(id: string, scope: string | null): Promise<{
+        status: ApprovalStatus;
+        reason: string | null;
+        decidedBy: string | null;
+    } | undefined>;
+    decide(id: string, scope: string | null, decision: "approved" | "denied" | "expired", reason: string | null, decidedBy: string | null): Promise<boolean>;
+    listPending(scope: string | null, owner?: string): Promise<ApprovalRow[]>;
+    get(id: string, scope: string | null): Promise<ApprovalRow | undefined>;
+    getById(id: string): Promise<ApprovalRow | undefined>;
+    listPendingAll(): Promise<ApprovalRow[]>;
+    expireStale(olderThanMs: number): Promise<number>;
+}
+export declare function mapRow(r: Record<string, unknown>): ApprovalRow;
+export declare class TiDBApprovalStore extends SqlApprovalStore {
+    constructor(pool: MySqlPool);
+}
+export declare class PgApprovalStore extends SqlApprovalStore {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=approval-store-sql.d.ts.map

package/dist/plugins/approval-store-sql.js

@@ -0,0 +1,119 @@
+import { parseJsonStrict as parseJson, toIsoOrNull as iso } from "./sql-row-helpers.js";
+import { pgProtocolJsonStringify } from "./pg-safe-json.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export const PG_APPROVAL_SCHEMA = [
+    `CREATE TABLE IF NOT EXISTS approval (
+     id          VARCHAR(64)  NOT NULL,
+     task_id     VARCHAR(64),
+     session_id  VARCHAR(64),
+     owner       VARCHAR(190),
+     -- Single-DB fleet scope guard (tenant isolation). NULLABLE on purpose: a NULL-scope row is an untenanted
+     -- run, and every read/decide path matches it with \`scope IS NOT DISTINCT FROM $n\` (the PG twin of TiDB
+     -- \`<=>\`) so NULL matches only NULL and one tenant's scope NEVER matches another's.
+     scope       VARCHAR(190),
+     tool_name   VARCHAR(190) NOT NULL,
+     args        JSONB,
+     status      VARCHAR(16)  NOT NULL,
+     reason      TEXT,
+     decided_by  VARCHAR(190),
+     created_at  TIMESTAMPTZ(3) NOT NULL,
+     decided_at  TIMESTAMPTZ(3),
+     PRIMARY KEY (id)
+   )`,
+    `CREATE INDEX IF NOT EXISTS idx_approval_owner_status ON approval (owner, status)`,
+    `CREATE INDEX IF NOT EXISTS idx_approval_status ON approval (status)`,
+    `CREATE INDEX IF NOT EXISTS idx_approval_scope_status ON approval (scope, status)`,
+];
+export async function ensureSchema(pool) {
+    for (const stmt of PG_APPROVAL_SCHEMA)
+        await pool.query(stmt);
+}
+export class SqlApprovalStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    json(value, label) {
+        return this.db.dialect === "tidb" ? JSON.stringify(value) : pgProtocolJsonStringify(value, label);
+    }
+    async createPending(id, scope, ctx) {
+        await this.db.query(this.q("INSERT INTO approval (id, task_id, session_id, owner, scope, tool_name, args, status, created_at) " +
+            "VALUES (?,?,?,?,?,?,?,'pending',?)", "INSERT INTO approval (id, task_id, session_id, owner, scope, tool_name, args, status, created_at) " +
+            "VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,'pending',$8)"), [
+            id,
+            ctx.taskId ?? null,
+            ctx.sessionId ?? null,
+            ctx.owner ?? null,
+            scope,
+            ctx.toolName,
+            ctx.args == null ? null : this.json(ctx.args, "approval args"),
+            new Date(),
+        ]);
+    }
+    async getStatus(id, scope) {
+        const { rows } = await this.db.query(this.q("SELECT status, reason, decided_by FROM approval WHERE id = ? AND scope <=> ?", "SELECT status, reason, decided_by FROM approval WHERE id = $1 AND scope IS NOT DISTINCT FROM $2"), [id, scope]);
+        const r = rows[0];
+        if (!r)
+            return undefined;
+        return { status: r.status, reason: r.reason ?? null, decidedBy: r.decided_by ?? null };
+    }
+    async decide(id, scope, decision, reason, decidedBy) {
+        const res = await this.db.query(this.q("UPDATE approval SET status = ?, reason = ?, decided_by = ?, decided_at = ? WHERE id = ? AND scope <=> ? AND status = 'pending'", "UPDATE approval SET status = $1, reason = $2, decided_by = $3, decided_at = $4 WHERE id = $5 AND scope IS NOT DISTINCT FROM $6 AND status = 'pending'"), [decision, reason, decidedBy, new Date(), id, scope]);
+        return res.affected === 1;
+    }
+    async listPending(scope, owner) {
+        const { rows } = owner
+            ? await this.db.query(this.q("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? AND owner = ? ORDER BY created_at ASC", "SELECT * FROM approval WHERE status = 'pending' AND scope IS NOT DISTINCT FROM $1 AND owner = $2 ORDER BY created_at ASC"), [scope, owner])
+            : await this.db.query(this.q("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? ORDER BY created_at ASC", "SELECT * FROM approval WHERE status = 'pending' AND scope IS NOT DISTINCT FROM $1 ORDER BY created_at ASC"), [scope]);
+        return rows.map(mapRow);
+    }
+    async get(id, scope) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM approval WHERE id = ? AND scope <=> ?", "SELECT * FROM approval WHERE id = $1 AND scope IS NOT DISTINCT FROM $2"), [id, scope]);
+        return rows[0] ? mapRow(rows[0]) : undefined;
+    }
+    async getById(id) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM approval WHERE id = ?", "SELECT * FROM approval WHERE id = $1"), [id]);
+        return rows[0] ? mapRow(rows[0]) : undefined;
+    }
+    async listPendingAll() {
+        const { rows } = await this.db.query("SELECT * FROM approval WHERE status = 'pending' ORDER BY created_at ASC");
+        return rows.map(mapRow);
+    }
+    async expireStale(olderThanMs) {
+        const cutoff = new Date(Date.now() - olderThanMs);
+        const res = await this.db.query(this.q("UPDATE approval SET status = 'expired', reason = 'timed out before decision', decided_at = ? " +
+            "WHERE status = 'pending' AND created_at < ?", "UPDATE approval SET status = 'expired', reason = 'timed out before decision', decided_at = $1 " +
+            "WHERE status = 'pending' AND created_at < $2"), [new Date(), cutoff]);
+        return res.affected;
+    }
+}
+export function mapRow(r) {
+    return {
+        id: String(r.id),
+        taskId: r.task_id ?? null,
+        sessionId: r.session_id ?? null,
+        owner: r.owner ?? null,
+        scope: r.scope ?? null,
+        toolName: String(r.tool_name),
+        args: parseJson(r.args),
+        status: r.status,
+        reason: r.reason ?? null,
+        decidedBy: r.decided_by ?? null,
+        createdAt: iso(r.created_at),
+        decidedAt: iso(r.decided_at),
+    };
+}
+export class TiDBApprovalStore extends SqlApprovalStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgApprovalStore extends SqlApprovalStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=approval-store-sql.js.map

package/dist/plugins/breaker-state-sql.d.ts

@@ -0,0 +1,29 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool, PoolClient } from "pg";
+import type { BreakerSnapshot, BreakerState } from "@sema-agent/core";
+import { type SqlDriver } from "./sql-driver.js";
+export declare const PG_BREAKER_STATE_SCHEMA: string[];
+export declare function ensureSchema(pool: PgPool | PoolClient): Promise<void>;
+export declare class SqlBreakerState implements BreakerState {
+    protected readonly db: SqlDriver;
+    private readonly onWriteFail?;
+    private cache;
+    private timer?;
+    private readonly pending;
+    private writeFailStreak;
+    constructor(db: SqlDriver, onWriteFail?: ((streak: number) => void) | undefined);
+    private q;
+    get(key: string): BreakerSnapshot | undefined;
+    set(key: string, snap: BreakerSnapshot): void;
+    private writeThrough;
+    refresh(): Promise<void>;
+    startRefresh(intervalMs?: number): this;
+    stop(): void;
+}
+export declare class TiDBBreakerState extends SqlBreakerState {
+    constructor(pool: MySqlPool, onWriteFail?: (streak: number) => void);
+}
+export declare class PgBreakerState extends SqlBreakerState {
+    constructor(pool: PgPool, onWriteFail?: (streak: number) => void);
+}
+//# sourceMappingURL=breaker-state-sql.d.ts.map

package/dist/plugins/breaker-state-sql.js

@@ -0,0 +1,104 @@
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export const PG_BREAKER_STATE_SCHEMA = [
+    `CREATE TABLE IF NOT EXISTS circuit_breaker (
+     breaker_key VARCHAR(190)   NOT NULL,
+     phase       VARCHAR(16)    NOT NULL,
+     failures    INTEGER        NOT NULL DEFAULT 0,
+     opened_at   TIMESTAMPTZ(3),
+     updated_at  TIMESTAMPTZ(3) NOT NULL,
+     PRIMARY KEY (breaker_key)
+   )`,
+];
+export async function ensureSchema(pool) {
+    for (const stmt of PG_BREAKER_STATE_SCHEMA)
+        await pool.query(stmt);
+}
+export class SqlBreakerState {
+    db;
+    onWriteFail;
+    cache = new Map();
+    timer;
+    pending = new Set();
+    writeFailStreak = 0;
+    constructor(db, onWriteFail) {
+        this.db = db;
+        this.onWriteFail = onWriteFail;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    get(key) {
+        return this.cache.get(key);
+    }
+    set(key, snap) {
+        this.cache.set(key, snap);
+        this.pending.add(key);
+        void this.writeThrough(key, snap);
+    }
+    async writeThrough(key, snap) {
+        try {
+            await this.db.query(this.q("INSERT INTO circuit_breaker (breaker_key, phase, failures, opened_at, updated_at) VALUES (?,?,?,?,?) " +
+                "ON DUPLICATE KEY UPDATE phase=VALUES(phase), failures=VALUES(failures), opened_at=VALUES(opened_at), updated_at=VALUES(updated_at)", "INSERT INTO circuit_breaker (breaker_key, phase, failures, opened_at, updated_at) VALUES ($1,$2,$3,$4,$5) " +
+                "ON CONFLICT (breaker_key) DO UPDATE SET phase=EXCLUDED.phase, failures=EXCLUDED.failures, opened_at=EXCLUDED.opened_at, updated_at=EXCLUDED.updated_at"), [key, snap.phase, snap.failures, snap.openedAt != null ? new Date(snap.openedAt) : null, new Date()]);
+            this.pending.delete(key);
+            if (this.writeFailStreak > 0) {
+                this.writeFailStreak = 0;
+                try {
+                    this.onWriteFail?.(0);
+                }
+                catch { }
+            }
+        }
+        catch {
+            try {
+                this.onWriteFail?.(++this.writeFailStreak);
+            }
+            catch { }
+        }
+    }
+    async refresh() {
+        try {
+            const pendingAtStart = new Set(this.pending);
+            const guarded = (key) => this.pending.has(key) || pendingAtStart.has(key);
+            const { rows } = await this.db.query("SELECT breaker_key, phase, failures, opened_at FROM circuit_breaker");
+            const seen = new Set();
+            for (const r of rows) {
+                const key = String(r.breaker_key);
+                seen.add(key);
+                if (guarded(key))
+                    continue;
+                this.cache.set(key, {
+                    phase: r.phase,
+                    failures: Number(r.failures),
+                    openedAt: r.opened_at != null ? new Date(r.opened_at).getTime() : undefined,
+                });
+            }
+            for (const key of this.cache.keys())
+                if (!seen.has(key) && !guarded(key))
+                    this.cache.delete(key);
+        }
+        catch {
+        }
+    }
+    startRefresh(intervalMs = 5_000) {
+        this.timer ??= setInterval(() => void this.refresh(), intervalMs);
+        this.timer.unref?.();
+        return this;
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+    }
+}
+export class TiDBBreakerState extends SqlBreakerState {
+    constructor(pool, onWriteFail) {
+        super(mysqlDriver(pool), onWriteFail);
+    }
+}
+export class PgBreakerState extends SqlBreakerState {
+    constructor(pool, onWriteFail) {
+        super(pgDriver(pool), onWriteFail);
+    }
+}
+//# sourceMappingURL=breaker-state-sql.js.map

package/dist/plugins/file-snapshot-store-sql.d.ts

@@ -0,0 +1,38 @@
+import { type FileSnapshotBounds, type FileSnapshotStore, type FileSnapshotResult, type ExecutionEnv } from "@sema-agent/core";
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import { type BlobBackend } from "./blob-backend.js";
+import { type SqlDriver } from "./sql-driver.js";
+export declare class SqlFileSnapshotStore implements FileSnapshotStore {
+    protected readonly db: SqlDriver;
+    protected readonly pool: MySqlPool | PgPool;
+    protected readonly bounds: FileSnapshotBounds;
+    private readonly inFlight;
+    private readonly blobs;
+    onSkippedVanished: ((count: number) => void | Promise<void>) | undefined;
+    constructor(db: SqlDriver, pool: MySqlPool | PgPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
+    private q;
+    private putBlobRow;
+    putBlob(hash: string, bytes: Uint8Array): Promise<FileSnapshotResult>;
+    snapshot(scope: string, key: string, env: ExecutionEnv, root: string, signal?: AbortSignal): Promise<FileSnapshotResult>;
+    importManifest(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: (hash: string) => Promise<Uint8Array | undefined>): Promise<FileSnapshotResult>;
+    restore(scope: string, key: string, env: ExecutionEnv, root: string, signal?: AbortSignal): Promise<FileSnapshotResult>;
+    has(scope: string, key: string): Promise<boolean>;
+    listKeys(scope: string): Promise<string[]>;
+    exportManifest(scope: string, key: string): Promise<Map<string, string> | null>;
+    getBlob(hash: string): Promise<Uint8Array | undefined>;
+    hasBlobs(hashes: string[]): Promise<Set<string>>;
+    blobSizes(hashes: string[]): Promise<Map<string, number>>;
+    reap(scope: string, keepKeys: string[]): Promise<number>;
+    deleteBySession(scope: string): Promise<number>;
+    private gcOrphanBlobs;
+    sweepOrphanBlobs(): Promise<number>;
+    private tx;
+}
+export declare class TiDBFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool: MySqlPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
+}
+export declare class PgFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool: PgPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
+}
+//# sourceMappingURL=file-snapshot-store-sql.d.ts.map

package/dist/plugins/file-snapshot-store-sql.js

@@ -0,0 +1,210 @@
+import { captureManifest, applyManifest, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
+import { createHash } from "node:crypto";
+import { SqlBlobBackend, sqlBlobSizes } from "./blob-backend.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export class SqlFileSnapshotStore {
+    db;
+    pool;
+    bounds;
+    inFlight = new Set();
+    blobs;
+    onSkippedVanished = undefined;
+    constructor(db, pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        this.db = db;
+        this.pool = pool;
+        this.bounds = bounds;
+        this.blobs = blobBackend ?? new SqlBlobBackend(this.db.dialect, this.pool);
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async putBlobRow(hash, bytes) {
+        await this.blobs.putBlob(hash, bytes);
+    }
+    async putBlob(hash, bytes) {
+        if (createHash("sha256").update(bytes).digest("hex") !== hash) {
+            return { ok: false, error: { code: "read_failed", message: `putBlob ${hash} fails content-address integrity — nothing stored` } };
+        }
+        try {
+            await this.putBlobRow(hash, bytes);
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `putBlob ${hash} write/upload failed: ${err.message}` } };
+        }
+    }
+    async snapshot(scope, key, env, root, signal) {
+        const flightKey = `${scope}\x00${key}`;
+        if (this.inFlight.has(flightKey))
+            return { ok: true };
+        this.inFlight.add(flightKey);
+        try {
+            if (await this.has(scope, key))
+                return { ok: true };
+            let cap;
+            try {
+                cap = await captureManifest(env, root, this.bounds, signal, async (hash, bytes) => {
+                    await this.putBlobRow(hash, bytes);
+                });
+            }
+            catch (err) {
+                return { ok: false, error: { code: "restore_failed", message: `snapshot blob write failed: ${err.message}` } };
+            }
+            if (!cap.ok)
+                return { ok: false, error: cap.error };
+            if (cap.skippedVanished > 0 && this.onSkippedVanished) {
+                try {
+                    void Promise.resolve(this.onSkippedVanished(cap.skippedVanished)).catch(() => { });
+                }
+                catch { }
+            }
+            await this.tx(async (conn) => {
+                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+                if (exists.rows[0])
+                    return;
+                for (const [relPath, hash] of cap.value) {
+                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
+                }
+            });
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `snapshot persist failed: ${err.message}` } };
+        }
+        finally {
+            this.inFlight.delete(flightKey);
+        }
+    }
+    async importManifest(scope, key, manifest, srcGetBlob) {
+        const flightKey = `${scope}\x00${key}`;
+        if (this.inFlight.has(flightKey))
+            return { ok: true };
+        this.inFlight.add(flightKey);
+        try {
+            if (await this.has(scope, key))
+                return { ok: true };
+            for (const hash of new Set(manifest.values())) {
+                let bytes;
+                try {
+                    bytes = await srcGetBlob(hash);
+                }
+                catch (err) {
+                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fetch failed: ${err.message}` } };
+                }
+                if (!bytes)
+                    return { ok: false, error: { code: "read_failed", message: `missing source blob ${hash}` } };
+                if (createHash("sha256").update(bytes).digest("hex") !== hash) {
+                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fails content-address integrity` } };
+                }
+                await this.putBlobRow(hash, bytes);
+            }
+            await this.tx(async (conn) => {
+                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+                if (exists.rows[0])
+                    return;
+                for (const [relPath, hash] of manifest) {
+                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
+                }
+            });
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `import persist failed: ${err.message}` } };
+        }
+        finally {
+            this.inFlight.delete(flightKey);
+        }
+    }
+    async restore(scope, key, env, root, signal) {
+        try {
+            const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
+            if (rows.length === 0)
+                return { ok: false, error: { code: "not_found", message: `no file snapshot for ${scope}/${key}` } };
+            const manifest = new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
+            return await applyManifest(env, root, this.bounds, signal, manifest, (hash) => this.blobs.getBlob(hash));
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `restore blob read failed: ${err.message}` } };
+        }
+    }
+    async has(scope, key) {
+        const { rows } = await this.db.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+        return Boolean(rows[0]);
+    }
+    async listKeys(scope) {
+        const { rows } = await this.db.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
+        return rows.map((r) => String(r.snap_key));
+    }
+    async exportManifest(scope, key) {
+        const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
+        if (rows.length === 0)
+            return null;
+        return new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
+    }
+    async getBlob(hash) {
+        return this.blobs.getBlob(hash);
+    }
+    async hasBlobs(hashes) {
+        return this.blobs.hasBlobs(hashes);
+    }
+    async blobSizes(hashes) {
+        return sqlBlobSizes(this.db.dialect, this.pool, hashes);
+    }
+    async reap(scope, keepKeys) {
+        return this.tx(async (conn) => {
+            const { rows: keys } = await conn.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
+            const drop = keys.map((k) => String(k.snap_key)).filter((k) => !keepKeys.includes(k));
+            for (const k of drop) {
+                await conn.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "DELETE FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, k]);
+            }
+            return drop.length;
+        });
+    }
+    async deleteBySession(scope) {
+        const { affected } = await this.db.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ?", "DELETE FROM snapshot_manifest WHERE scope = $1"), [scope]);
+        return affected;
+    }
+    async gcOrphanBlobs() {
+        const { rows } = await this.db
+            .query("SELECT blob_hash FROM snapshot_blob WHERE blob_hash NOT IN (SELECT blob_hash FROM snapshot_manifest)")
+            .catch(() => ({ rows: [], affected: 0 }));
+        const orphans = rows.map((r) => String(r.blob_hash));
+        if (orphans.length === 0)
+            return 0;
+        return this.blobs.deleteBlobs(orphans);
+    }
+    async sweepOrphanBlobs() {
+        return this.gcOrphanBlobs();
+    }
+    async tx(fn) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            const out = await fn(conn);
+            await conn.commit();
+            return out;
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+}
+export class TiDBFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        super(mysqlDriver(pool), pool, blobBackend, bounds);
+    }
+}
+export class PgFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        super(pgDriver(pool), pool, blobBackend, bounds);
+    }
+}
+//# sourceMappingURL=file-snapshot-store-sql.js.map