@sema-agent/server 1.315.0 → 1.317.0

package/dist/plugins/file-snapshot-store-sql.js

@@ -0,0 +1,210 @@
+import { captureManifest, applyManifest, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
+import { createHash } from "node:crypto";
+import { SqlBlobBackend, sqlBlobSizes } from "./blob-backend.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export class SqlFileSnapshotStore {
+    db;
+    pool;
+    bounds;
+    inFlight = new Set();
+    blobs;
+    onSkippedVanished = undefined;
+    constructor(db, pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        this.db = db;
+        this.pool = pool;
+        this.bounds = bounds;
+        this.blobs = blobBackend ?? new SqlBlobBackend(this.db.dialect, this.pool);
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    async putBlobRow(hash, bytes) {
+        await this.blobs.putBlob(hash, bytes);
+    }
+    async putBlob(hash, bytes) {
+        if (createHash("sha256").update(bytes).digest("hex") !== hash) {
+            return { ok: false, error: { code: "read_failed", message: `putBlob ${hash} fails content-address integrity — nothing stored` } };
+        }
+        try {
+            await this.putBlobRow(hash, bytes);
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `putBlob ${hash} write/upload failed: ${err.message}` } };
+        }
+    }
+    async snapshot(scope, key, env, root, signal) {
+        const flightKey = `${scope}\x00${key}`;
+        if (this.inFlight.has(flightKey))
+            return { ok: true };
+        this.inFlight.add(flightKey);
+        try {
+            if (await this.has(scope, key))
+                return { ok: true };
+            let cap;
+            try {
+                cap = await captureManifest(env, root, this.bounds, signal, async (hash, bytes) => {
+                    await this.putBlobRow(hash, bytes);
+                });
+            }
+            catch (err) {
+                return { ok: false, error: { code: "restore_failed", message: `snapshot blob write failed: ${err.message}` } };
+            }
+            if (!cap.ok)
+                return { ok: false, error: cap.error };
+            if (cap.skippedVanished > 0 && this.onSkippedVanished) {
+                try {
+                    void Promise.resolve(this.onSkippedVanished(cap.skippedVanished)).catch(() => { });
+                }
+                catch { }
+            }
+            await this.tx(async (conn) => {
+                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+                if (exists.rows[0])
+                    return;
+                for (const [relPath, hash] of cap.value) {
+                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
+                }
+            });
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `snapshot persist failed: ${err.message}` } };
+        }
+        finally {
+            this.inFlight.delete(flightKey);
+        }
+    }
+    async importManifest(scope, key, manifest, srcGetBlob) {
+        const flightKey = `${scope}\x00${key}`;
+        if (this.inFlight.has(flightKey))
+            return { ok: true };
+        this.inFlight.add(flightKey);
+        try {
+            if (await this.has(scope, key))
+                return { ok: true };
+            for (const hash of new Set(manifest.values())) {
+                let bytes;
+                try {
+                    bytes = await srcGetBlob(hash);
+                }
+                catch (err) {
+                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fetch failed: ${err.message}` } };
+                }
+                if (!bytes)
+                    return { ok: false, error: { code: "read_failed", message: `missing source blob ${hash}` } };
+                if (createHash("sha256").update(bytes).digest("hex") !== hash) {
+                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fails content-address integrity` } };
+                }
+                await this.putBlobRow(hash, bytes);
+            }
+            await this.tx(async (conn) => {
+                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+                if (exists.rows[0])
+                    return;
+                for (const [relPath, hash] of manifest) {
+                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
+                }
+            });
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `import persist failed: ${err.message}` } };
+        }
+        finally {
+            this.inFlight.delete(flightKey);
+        }
+    }
+    async restore(scope, key, env, root, signal) {
+        try {
+            const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
+            if (rows.length === 0)
+                return { ok: false, error: { code: "not_found", message: `no file snapshot for ${scope}/${key}` } };
+            const manifest = new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
+            return await applyManifest(env, root, this.bounds, signal, manifest, (hash) => this.blobs.getBlob(hash));
+        }
+        catch (err) {
+            return { ok: false, error: { code: "restore_failed", message: `restore blob read failed: ${err.message}` } };
+        }
+    }
+    async has(scope, key) {
+        const { rows } = await this.db.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
+        return Boolean(rows[0]);
+    }
+    async listKeys(scope) {
+        const { rows } = await this.db.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
+        return rows.map((r) => String(r.snap_key));
+    }
+    async exportManifest(scope, key) {
+        const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
+        if (rows.length === 0)
+            return null;
+        return new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
+    }
+    async getBlob(hash) {
+        return this.blobs.getBlob(hash);
+    }
+    async hasBlobs(hashes) {
+        return this.blobs.hasBlobs(hashes);
+    }
+    async blobSizes(hashes) {
+        return sqlBlobSizes(this.db.dialect, this.pool, hashes);
+    }
+    async reap(scope, keepKeys) {
+        return this.tx(async (conn) => {
+            const { rows: keys } = await conn.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
+            const drop = keys.map((k) => String(k.snap_key)).filter((k) => !keepKeys.includes(k));
+            for (const k of drop) {
+                await conn.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "DELETE FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, k]);
+            }
+            return drop.length;
+        });
+    }
+    async deleteBySession(scope) {
+        const { affected } = await this.db.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ?", "DELETE FROM snapshot_manifest WHERE scope = $1"), [scope]);
+        return affected;
+    }
+    async gcOrphanBlobs() {
+        const { rows } = await this.db
+            .query("SELECT blob_hash FROM snapshot_blob WHERE blob_hash NOT IN (SELECT blob_hash FROM snapshot_manifest)")
+            .catch(() => ({ rows: [], affected: 0 }));
+        const orphans = rows.map((r) => String(r.blob_hash));
+        if (orphans.length === 0)
+            return 0;
+        return this.blobs.deleteBlobs(orphans);
+    }
+    async sweepOrphanBlobs() {
+        return this.gcOrphanBlobs();
+    }
+    async tx(fn) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            const out = await fn(conn);
+            await conn.commit();
+            return out;
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+}
+export class TiDBFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        super(mysqlDriver(pool), pool, blobBackend, bounds);
+    }
+}
+export class PgFileSnapshotStore extends SqlFileSnapshotStore {
+    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
+        super(pgDriver(pool), pool, blobBackend, bounds);
+    }
+}
+//# sourceMappingURL=file-snapshot-store-sql.js.map

package/dist/plugins/image-index-sql.d.ts

@@ -0,0 +1,33 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool, PoolClient } from "pg";
+import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
+import { type SqlDriver } from "./sql-driver.js";
+export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, ImageRow, } from "./store-contracts.js";
+export { mapImageRow as mapRow } from "./store-contracts.js";
+export declare const PG_IMAGE_INDEX_SCHEMA: string[];
+export declare function ensureSchema(pool: PgPool | PoolClient): Promise<void>;
+export declare class SqlImageIndex {
+    protected readonly db: SqlDriver;
+    constructor(db: SqlDriver);
+    private q;
+    static idFor(repo: string, digest: string): string;
+    upsert(e: ImageIndexUpsert): Promise<string>;
+    registerBuilding(e: ImageIndexUpsert): Promise<string>;
+    getById(id: string): Promise<ImageIndexEntry | null>;
+    getByDigest(digest: string): Promise<ImageIndexEntry | null>;
+    latestPublished(profile: string, viewer: ImageViewer): Promise<ImageIndexEntry | null>;
+    list(filter: ImageListFilter): Promise<{
+        entries: ImageIndexEntry[];
+        nextCursor: string | null;
+    }>;
+    setStatus(id: string, status: ImageStatus, opts?: {
+        supersedes?: string | null;
+    }): Promise<void>;
+}
+export declare class TiDBImageIndex extends SqlImageIndex {
+    constructor(pool: MySqlPool);
+}
+export declare class PgImageIndex extends SqlImageIndex {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=image-index-sql.d.ts.map

package/dist/plugins/image-index-sql.js

@@ -0,0 +1,328 @@
+import { createHash } from "node:crypto";
+import { pgSafeJsonStringify, pgSanitizeText, pgHasUnstorable, PgUnstorableError } from "./pg-safe-json.js";
+import { mapImageRow as mapRow, } from "./store-contracts.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export { mapImageRow as mapRow } from "./store-contracts.js";
+export const PG_IMAGE_INDEX_SCHEMA = [
+    `CREATE TABLE IF NOT EXISTS sandbox_image_index (
+     id                 VARCHAR(64)  NOT NULL,
+     profile            VARCHAR(64)  NOT NULL,
+     bands              JSONB,
+     repo               VARCHAR(255) NOT NULL,
+     tag                VARCHAR(128) NOT NULL,
+     digest             VARCHAR(80)  NOT NULL,
+     toolchain_versions JSONB,
+     capabilities       JSONB,
+     pod_contract       JSONB,
+     size_bytes         BIGINT,
+     status             VARCHAR(16)  NOT NULL DEFAULT 'building',
+     visibility         VARCHAR(16)  NOT NULL DEFAULT 'public',
+     tenant_id          VARCHAR(64),
+     manifest_sha       VARCHAR(64),
+     recipe_git_sha     VARCHAR(64),
+     generator_version  VARCHAR(32),
+     build_date         TIMESTAMPTZ(3),
+     supersedes         VARCHAR(64),
+     signed             SMALLINT     NOT NULL DEFAULT 0,
+     created_at         TIMESTAMPTZ(3) NOT NULL,
+     updated_at         TIMESTAMPTZ(3) NOT NULL,
+     PRIMARY KEY (id)
+   )`,
+    `CREATE UNIQUE INDEX IF NOT EXISTS uq_repo_digest ON sandbox_image_index (repo, digest)`,
+    `CREATE INDEX IF NOT EXISTS idx_profile_status ON sandbox_image_index (profile, status, visibility)`,
+    `CREATE INDEX IF NOT EXISTS idx_digest ON sandbox_image_index (digest)`,
+    `CREATE INDEX IF NOT EXISTS idx_tenant ON sandbox_image_index (tenant_id, status)`,
+];
+export async function ensureSchema(pool) {
+    for (const stmt of PG_IMAGE_INDEX_SCHEMA)
+        await pool.query(stmt);
+}
+const MAX_LIMIT = 200;
+const DEFAULT_LIMIT = 50;
+function visibilityClauseTidb(viewer) {
+    if (viewer.operator)
+        return { sql: "1=1", params: [] };
+    if (viewer.tenantId)
+        return { sql: "(visibility='public' OR tenant_id=?)", params: [viewer.tenantId] };
+    return { sql: "visibility='public'", params: [] };
+}
+function visibilityClausePg(viewer, startIdx) {
+    if (viewer.operator)
+        return { sql: "1=1", params: [], nextIdx: startIdx };
+    if (viewer.tenantId)
+        return {
+            sql: `(visibility = 'public' OR tenant_id = $${startIdx})`,
+            params: [viewer.tenantId],
+            nextIdx: startIdx + 1,
+        };
+    return { sql: "visibility = 'public'", params: [], nextIdx: startIdx };
+}
+function encodeCursor(e) {
+    return Buffer.from(`${e.createdAt}|${e.id}`, "utf8").toString("base64url");
+}
+function decodeCursor(c) {
+    try {
+        const [createdAt, id] = Buffer.from(c, "base64url").toString("utf8").split("|");
+        if (!createdAt || !id)
+            return null;
+        return { createdAt, id };
+    }
+    catch {
+        return null;
+    }
+}
+function tidbUpsertParams(e, id, now) {
+    return [
+        id, e.profile, JSON.stringify(e.bands ?? []), e.repo, e.tag, e.digest,
+        JSON.stringify(e.toolchainVersions ?? {}), JSON.stringify(e.capabilities ?? {}),
+        JSON.stringify(e.podContract ?? {}), e.sizeBytes,
+        e.status, e.visibility, e.tenantId ?? null, e.manifestSha ?? null, e.recipeGitSha ?? null,
+        e.generatorVersion ?? null, e.buildDate ? new Date(e.buildDate) : null, e.supersedes ?? null,
+        e.signed ? 1 : 0, now, now,
+    ];
+}
+const PG_UPSERT_COLS = "(id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes, " +
+    "status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes, " +
+    "signed, created_at, updated_at)";
+const PG_UPSERT_VALUES = "($1,$2,$3::jsonb,$4,$5,$6,$7::jsonb,$8::jsonb,$9::jsonb,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)";
+function pgUpsertParams(e, id, now) {
+    return [
+        id,
+        pgSanitizeText(e.profile),
+        pgSafeJsonStringify(e.bands ?? []),
+        e.repo,
+        pgSanitizeText(e.tag),
+        e.digest,
+        pgSafeJsonStringify(e.toolchainVersions ?? {}),
+        pgSafeJsonStringify(e.capabilities ?? {}),
+        pgSafeJsonStringify(e.podContract ?? {}),
+        e.sizeBytes,
+        e.status,
+        e.visibility,
+        e.tenantId ?? null,
+        e.manifestSha ?? null,
+        e.recipeGitSha == null ? null : pgSanitizeText(e.recipeGitSha),
+        e.generatorVersion == null ? null : pgSanitizeText(e.generatorVersion),
+        e.buildDate ? new Date(e.buildDate) : null,
+        e.supersedes == null ? null : pgSanitizeText(e.supersedes),
+        e.signed ? 1 : 0,
+        now,
+        now,
+    ];
+}
+export class SqlImageIndex {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    static idFor(repo, digest) {
+        return createHash("sha256").update(`${repo}@${digest}`).digest("hex").slice(0, 64);
+    }
+    async upsert(e) {
+        if (this.db.dialect === "pg") {
+            if (pgHasUnstorable(e.repo))
+                throw new PgUnstorableError("image repo (identity)");
+            if (e.tenantId != null && pgHasUnstorable(e.tenantId))
+                throw new PgUnstorableError("image tenantId (identity)");
+        }
+        const id = SqlImageIndex.idFor(e.repo, e.digest);
+        const now = new Date();
+        await this.db.query(this.q(`INSERT INTO sandbox_image_index
+           (id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes,
+            status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes,
+            signed, created_at, updated_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+         ON DUPLICATE KEY UPDATE
+           profile=VALUES(profile), bands=VALUES(bands), tag=VALUES(tag), toolchain_versions=VALUES(toolchain_versions),
+           capabilities=VALUES(capabilities), pod_contract=VALUES(pod_contract), size_bytes=VALUES(size_bytes),
+           status=VALUES(status), visibility=VALUES(visibility), tenant_id=VALUES(tenant_id),
+           manifest_sha=VALUES(manifest_sha), recipe_git_sha=VALUES(recipe_git_sha),
+           generator_version=VALUES(generator_version), build_date=VALUES(build_date), supersedes=VALUES(supersedes),
+           signed=VALUES(signed), updated_at=VALUES(updated_at)`, `INSERT INTO sandbox_image_index ${PG_UPSERT_COLS}
+         VALUES ${PG_UPSERT_VALUES}
+         ON CONFLICT (id) DO UPDATE SET
+           profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
+           toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
+           pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
+           status = EXCLUDED.status, visibility = EXCLUDED.visibility, tenant_id = EXCLUDED.tenant_id,
+           manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
+           generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
+           supersedes = EXCLUDED.supersedes, signed = EXCLUDED.signed, updated_at = EXCLUDED.updated_at`), this.db.dialect === "tidb" ? tidbUpsertParams(e, id, now) : pgUpsertParams(e, id, now));
+        return id;
+    }
+    async registerBuilding(e) {
+        if (this.db.dialect === "pg") {
+            if (pgHasUnstorable(e.repo))
+                throw new PgUnstorableError("image repo (identity)");
+            if (e.tenantId != null && pgHasUnstorable(e.tenantId))
+                throw new PgUnstorableError("image tenantId (identity)");
+        }
+        const id = SqlImageIndex.idFor(e.repo, e.digest);
+        const now = new Date();
+        await this.db.query(this.q(`INSERT INTO sandbox_image_index
+           (id, profile, bands, repo, tag, digest, toolchain_versions, capabilities, pod_contract, size_bytes,
+            status, visibility, tenant_id, manifest_sha, recipe_git_sha, generator_version, build_date, supersedes,
+            signed, created_at, updated_at)
+         VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
+         ON DUPLICATE KEY UPDATE
+           profile=VALUES(profile), bands=VALUES(bands), tag=VALUES(tag), toolchain_versions=VALUES(toolchain_versions),
+           capabilities=VALUES(capabilities), pod_contract=VALUES(pod_contract), size_bytes=VALUES(size_bytes),
+           status=IF(sandbox_image_index.status='published', sandbox_image_index.status, VALUES(status)),
+           visibility=IF(sandbox_image_index.status='published', sandbox_image_index.visibility, VALUES(visibility)),
+           tenant_id=IF(sandbox_image_index.status='published', sandbox_image_index.tenant_id, VALUES(tenant_id)),
+           manifest_sha=VALUES(manifest_sha), recipe_git_sha=VALUES(recipe_git_sha),
+           generator_version=VALUES(generator_version), build_date=VALUES(build_date), supersedes=VALUES(supersedes),
+           signed=IF(sandbox_image_index.status='published', sandbox_image_index.signed, VALUES(signed)), updated_at=VALUES(updated_at)`, `INSERT INTO sandbox_image_index ${PG_UPSERT_COLS}
+         VALUES ${PG_UPSERT_VALUES}
+         ON CONFLICT (id) DO UPDATE SET
+           profile = EXCLUDED.profile, bands = EXCLUDED.bands, tag = EXCLUDED.tag,
+           toolchain_versions = EXCLUDED.toolchain_versions, capabilities = EXCLUDED.capabilities,
+           pod_contract = EXCLUDED.pod_contract, size_bytes = EXCLUDED.size_bytes,
+           status = CASE WHEN sandbox_image_index.status = 'published'
+                         THEN sandbox_image_index.status ELSE EXCLUDED.status END,
+           visibility = CASE WHEN sandbox_image_index.status = 'published'
+                             THEN sandbox_image_index.visibility ELSE EXCLUDED.visibility END,
+           tenant_id = CASE WHEN sandbox_image_index.status = 'published'
+                            THEN sandbox_image_index.tenant_id ELSE EXCLUDED.tenant_id END,
+           manifest_sha = EXCLUDED.manifest_sha, recipe_git_sha = EXCLUDED.recipe_git_sha,
+           generator_version = EXCLUDED.generator_version, build_date = EXCLUDED.build_date,
+           supersedes = EXCLUDED.supersedes,
+           signed = CASE WHEN sandbox_image_index.status = 'published'
+                         THEN sandbox_image_index.signed ELSE EXCLUDED.signed END,
+           updated_at = EXCLUDED.updated_at`), this.db.dialect === "tidb" ? tidbUpsertParams(e, id, now) : pgUpsertParams(e, id, now));
+        return id;
+    }
+    async getById(id) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM sandbox_image_index WHERE id=? LIMIT 1", "SELECT * FROM sandbox_image_index WHERE id = $1 LIMIT 1"), [id]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async getByDigest(digest) {
+        const { rows } = await this.db.query(this.q("SELECT * FROM sandbox_image_index WHERE digest=? ORDER BY updated_at DESC LIMIT 1", "SELECT * FROM sandbox_image_index WHERE digest = $1 ORDER BY updated_at DESC LIMIT 1"), [digest]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async latestPublished(profile, viewer) {
+        if (this.db.dialect === "tidb") {
+            const vis = visibilityClauseTidb(viewer);
+            const { rows } = await this.db.query(`SELECT * FROM sandbox_image_index
+          WHERE profile=? AND status='published' AND ${vis.sql}
+          ORDER BY (build_date IS NULL), build_date DESC, created_at DESC LIMIT 1`, [profile, ...vis.params]);
+            return rows[0] ? mapRow(rows[0]) : null;
+        }
+        const vis = visibilityClausePg(viewer, 2);
+        const { rows } = await this.db.query(`SELECT * FROM sandbox_image_index
+        WHERE profile = $1 AND status = 'published' AND ${vis.sql}
+        ORDER BY build_date DESC NULLS LAST, created_at DESC LIMIT 1`, [profile, ...vis.params]);
+        return rows[0] ? mapRow(rows[0]) : null;
+    }
+    async list(filter) {
+        const limit = Math.min(Math.max(1, filter.limit ?? DEFAULT_LIMIT), MAX_LIMIT);
+        let rawRows;
+        if (this.db.dialect === "tidb") {
+            const vis = visibilityClauseTidb(filter);
+            const where = [vis.sql];
+            const params = [...vis.params];
+            if (filter.profile) {
+                where.push("profile=?");
+                params.push(filter.profile);
+            }
+            if (filter.status) {
+                where.push("status=?");
+                params.push(filter.status);
+            }
+            if (filter.capability) {
+                where.push("JSON_EXTRACT(capabilities, ?) = true");
+                params.push(`$.${filter.capability}`);
+            }
+            if (filter.cursor) {
+                const c = decodeCursor(filter.cursor);
+                if (c) {
+                    where.push("(created_at < ? OR (created_at = ? AND id < ?))");
+                    params.push(new Date(c.createdAt), new Date(c.createdAt), c.id);
+                }
+            }
+            const sql = `SELECT * FROM sandbox_image_index WHERE ${where.join(" AND ")} ` +
+                `ORDER BY created_at DESC, id DESC LIMIT ?`;
+            const { rows } = await this.db.query(sql, [...params, limit + 1]);
+            rawRows = rows;
+        }
+        else {
+            const vis = visibilityClausePg(filter, 1);
+            const where = [vis.sql];
+            const params = [...vis.params];
+            let idx = vis.nextIdx;
+            if (filter.profile) {
+                where.push(`profile = $${idx++}`);
+                params.push(filter.profile);
+            }
+            if (filter.status) {
+                where.push(`status = $${idx++}`);
+                params.push(filter.status);
+            }
+            if (filter.capability) {
+                where.push(`capabilities -> $${idx++} = 'true'::jsonb`);
+                params.push(filter.capability);
+            }
+            if (filter.cursor) {
+                const c = decodeCursor(filter.cursor);
+                if (c) {
+                    where.push(`(created_at < $${idx} OR (created_at = $${idx + 1} AND id < $${idx + 2}))`);
+                    params.push(new Date(c.createdAt), new Date(c.createdAt), c.id);
+                    idx += 3;
+                }
+            }
+            const sql = `SELECT * FROM sandbox_image_index WHERE ${where.join(" AND ")} ` +
+                `ORDER BY created_at DESC, id DESC LIMIT $${idx}`;
+            params.push(limit + 1);
+            const { rows } = await this.db.query(sql, params);
+            rawRows = rows;
+        }
+        let entries = rawRows.map(mapRow);
+        let nextCursor = null;
+        if (entries.length > limit) {
+            entries = entries.slice(0, limit);
+            const last = entries[entries.length - 1];
+            nextCursor = encodeCursor({ createdAt: last.createdAt, id: last.id });
+        }
+        if (filter.latestOnly) {
+            const seen = new Set();
+            entries = entries.filter((e) => (seen.has(e.profile) ? false : (seen.add(e.profile), true)));
+        }
+        return { entries, nextCursor };
+    }
+    async setStatus(id, status, opts) {
+        if (this.db.dialect === "tidb") {
+            const sets = ["status=?", "updated_at=?"];
+            const params = [status, new Date()];
+            if (opts && "supersedes" in opts) {
+                sets.push("supersedes=?");
+                params.push(opts.supersedes ?? null);
+            }
+            params.push(id);
+            await this.db.query(`UPDATE sandbox_image_index SET ${sets.join(", ")} WHERE id=?`, params);
+            return;
+        }
+        const sets = ["status = $1", "updated_at = $2"];
+        const params = [status, new Date()];
+        let idx = 3;
+        if (opts && "supersedes" in opts) {
+            sets.push(`supersedes = $${idx++}`);
+            params.push(opts.supersedes ?? null);
+        }
+        params.push(id);
+        await this.db.query(`UPDATE sandbox_image_index SET ${sets.join(", ")} WHERE id = $${idx}`, params);
+    }
+}
+export class TiDBImageIndex extends SqlImageIndex {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgImageIndex extends SqlImageIndex {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=image-index-sql.js.map

package/dist/plugins/outcome-ledger-sql.d.ts

@@ -0,0 +1,70 @@
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool, PoolClient } from "pg";
+import type { TaskOutcome as CoreTaskOutcome } from "@sema-agent/core";
+import { type SqlDriver } from "./sql-driver.js";
+export interface MechanicalOutcome {
+    route?: "single" | "fanout";
+    workerCount?: number;
+    oraclePassed?: number;
+    oracleTotal?: number;
+    assembleExit?: number;
+    lintExit?: number;
+    mergeOk?: boolean;
+    replanTriggers?: string[];
+    costMicroUsd?: number;
+    turns?: number;
+}
+export interface LlmAssistedOutcome {
+    stuckEvents?: number;
+    verifier?: {
+        verdict: string;
+        confidence: number;
+    };
+}
+export interface SignatureInputs {
+    taskType?: string;
+    toolset?: string[];
+    targetLang?: string;
+    moduleCount?: number;
+    tag?: string;
+}
+export type RunStatus = "completed-graded" | "infra-aborted";
+export interface TaskOutcome {
+    taskId?: string;
+    model: string;
+    runStatus?: RunStatus;
+    signatureInputs: SignatureInputs;
+    mechanical: MechanicalOutcome;
+    llmAssisted?: LlmAssistedOutcome;
+    core?: unknown;
+}
+export declare function taskSignature(s: SignatureInputs): string;
+export declare function deriveOutcome(m: MechanicalOutcome, runStatus?: RunStatus): "pass" | "partial" | "fail" | "aborted";
+export declare function coreOutcomeToLedgerRow(o: CoreTaskOutcome): TaskOutcome;
+export declare const PG_OUTCOME_LEDGER_SCHEMA: string[];
+export declare function ensurePgOutcomeLedgerSchema(pool: PgPool | PoolClient): Promise<void>;
+export declare class SqlOutcomeLedger {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    private json;
+    record(o: TaskOutcome): Promise<string>;
+    recordCore(o: CoreTaskOutcome): Promise<void>;
+    summary(opts?: {
+        taskSignature?: string;
+        includeAborted?: boolean;
+    }): Promise<Array<{
+        taskSignature: string;
+        model: string;
+        n: number;
+        passRate: number;
+        meanCostMicroUsd: number;
+    }>>;
+}
+export declare class TiDBOutcomeLedger extends SqlOutcomeLedger {
+    constructor(pool: MySqlPool);
+}
+export declare class PgOutcomeLedger extends SqlOutcomeLedger {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=outcome-ledger-sql.d.ts.map