@sema-agent/server 7.146.0 → 7.148.0

package/dist/plugins/session-workspace-cell.js

@@ -2,7 +2,7 @@ import { PROJECT_ID_REGEX } from "@sema-agent/core";
 import { z } from "zod";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { assertJsonColumnWritable, createZodColumnReader, decodeJsonColumn, isJsonColumnBodyProblem } from "./sql-json-column.js";
-export const SESSION_META_WORKSPACE_COLUMN = {
+export const SESSION_WORKSPACE_COLUMN = {
     name: "workspace",
     mysql: "workspace JSON NULL",
     pg: "workspace JSONB",
@@ -16,7 +16,7 @@ const SESSION_WORKSPACE_SHAPE = z.object({
 });
 export const readSessionWorkspaceCell = createZodColumnReader(SESSION_WORKSPACE_SHAPE);
 export const SESSION_WORKSPACE_DEGRADED = "server.session-workspace.record-degraded";
-const where = (sessionId) => `session_meta.workspace for session ${sessionId}`;
+const where = (sessionId) => `session_ext.workspace for session ${sessionId}`;
 export function encodeSessionWorkspaceCell(workspace, encode, sessionId) {
     const text = encode(workspace);
     assertJsonColumnWritable(text, readSessionWorkspaceCell, where(sessionId));

package/dist/plugins/shared-memory-store-sql.d.ts

@@ -1,72 +1,3 @@
-/**
- * [ref] — the SQL `SharedMemoryStoreProvider`: the deployment's ORG-scoped shared memory libraries
- * (`memory_list` / `memory_read`), served out of the durable store instead of a BYOM host callback.
- *
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * WHAT THIS IS (and, just as load-bearing, what it is NOT)
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * core's seam is a document-only READ face reached exclusively through two tools. There is no model
- * write channel at all — write governance is the environment's, and the tool face's entire
- * participation in it is relaying each store's `writable` bit verbatim. This module keeps that shape:
- * {@link SqlSharedMemoryStore.snapshot} is the only method core ever calls; the `put*`/`delete*` half
- * is the DEPLOYMENT's admin plane (migrations, an import job, an operator face) and is deliberately
- * NOT reachable from any model-facing surface in this repo.
- *
- * 🔴 ORG PLANE ≠ THE LOCAL MEMORY CHAIN (设计 182 §13). `agent_memory_engine_*` (the [ref]
- * MemoryEngine) and these three tables share NOTHING: no join, no view, no shared row, no shared
- * scope registry. The local chain is an entry-transactional index injection with a write path; this
- * one is a read-only document library. Bridging them in EITHER direction would let harvested private
- * notes leak into a team library (or a team library into a model-writable disk), which is exactly the
- * boundary core's seam doc draws. If a future feature needs both, it composes them ABOVE this layer.
- *
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * AUTHORIZATION (v2/F4) — server-side, injected, never inferred here
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * `SharedMemoryRequestContext` carries the caller's `principal`. Who belongs to `org:acme` is NOT this
- * module's question: it takes a {@link SharedMemoryScopeAuthorizer} and serves exactly the scopes that
- * verdict names. The production binding folds the SAME `OrgMemoryDirectory` instance the memory-policy
- * face and core's admission seam already read (`src/shared-memory-scope-authorizer.ts`), so a process
- * has ONE answer to "who belongs to org:acme".
- *
- * The verdict is a discriminated union on purpose (same 裁定 as org-memory-admission's N3/C5): a
- * directory that CANNOT ANSWER must never collapse into "you belong to nothing". The first renders as
- * `unavailable` ("reads are refused until it is restored" — try again); the second renders as a
- * settled "no memory stores are connected to this session", which teaches the model to give up. Those
- * are opposite instructions and a fail-open collapse between them is a real defect, not a nuance.
- *
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * ORDERING / PAGINATION — why the collations are part of the contract
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * core's cursor vocabulary is "an EXCLUSIVE lower bound over document paths in plain UTF-16 code-unit
- * order", and its paging loop only advances while `nextCursor > windowCursor` **in JavaScript**. So the
- * SQL ordering must agree with JS string comparison or a listing would silently stop early.
- *   · MySQL: the tables are `COLLATE utf8mb4_bin` ⇒ comparison is by code point.
- *   · PG: every string column is `COLLATE "C"` ⇒ comparison is by UTF-8 byte, which for valid UTF-8 is
- *     also code-point order.
- * Code-point order equals UTF-16 code-unit order for every BMP character, and differs ONLY for
- * supplementary-plane characters (U+10000+, whose surrogates sort before U+E000..U+FFFF in UTF-16).
- * Rather than leave that as an invisible "listing silently truncates" hazard, {@link assertDocumentPath}
- * REFUSES a non-BMP path at write time — the divergence is made impossible by construction, loudly, at
- * the one place a human is watching. (Store ids and org scopes are already ASCII-only by their own
- * shape rules, so this is the only column that needed the ruling.)
- *
- * KEYSET, never OFFSET: `WHERE store_id = ? AND path > ?` walks the PRIMARY KEY. An OFFSET pager over a
- * live library both re-scans the prefix on every page and skips rows when a document is inserted mid-walk.
- *
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * 事务与锁
- * ─────────────────────────────────────────────────────────────────────────────────────────────────
- * **四个**写方法(putStore / putDocument / deleteDocument / deleteStore)都是「先读注册行、再按结果写」
- * 的形状,并且都用 `SELECT … FOR UPDATE` 拿同一把行锁,于是彼此串行。判据只有一处:
- * {@link SqlTxConn.begin} 的 `@contract txn.read-semantics` —— 加锁读在两引擎都是当前读,而「当前读」
- * 的前提(TiDB 悲观模式、MySQL 会话级 REPEATABLE READ)是**连接初始化**的结构保证,不是服务器默认值。
- *
- * 本店的**第二道防线**照旧在:`store_id` 的主键唯一性才是最终裁决者,撞键被 {@link isDupKey} 翻成一句
- * 响亮的拒绝(见 putStore)—— 即便某一天读语义出岔,结果也只会是「一方被响亮拒绝」,绝不会是一次静默
- * 的换属主。⚠️ 另一处不可混线的分歧:InnoDB 的加锁读对**不存在的键**取 gap/next-key 锁,TiDB 悲观事务
- * **没有** gap 锁(retention-store 的「先 ON DUPLICATE 造行、再 FOR UPDATE 锁行」就是为它而写)。
- * 「加锁读=当前读」两引擎同真,「gap 锁」只有 InnoDB 有 —— 两条性质不共享一个「同理」。
- */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
 import { type SharedMemoryRequestContext, type SharedMemorySnapshot, type SharedMemoryStoreProvider } from "@sema-agent/core";
@@ -131,6 +62,16 @@ export interface SqlSharedMemoryStoreOptions {
  * This module keeps no copy of the pattern (nor of the `__` ban): the protocol table's namespace separator is core's to spell.
  */
 export declare function assertStoreId(storeId: string): void;
+/**
+ * MINT-side org scope key admission. The rule is core's own judge ({@link isOrgScopeKey}): `org:` plus one segment spelled by core's
+ * `formatOrgScope`. This module keeps no copy of the grammar, and no width bound of its own — core's segment bound is far inside the
+ * `scope_key` column.
+ *
+ * Called only where a key ENTERS a durable row: {@link SqlSharedMemoryStore.putScopeState} and {@link SqlSharedMemoryStore.putStore}.
+ * The other write methods take the key as a FENCE against the owner already registered for the store id ({@link ownedExactly}: a byte-for-byte
+ * match, loud on a miss), so they never judge its shape: a row stored under a key this judge now refuses stays addressable — it can still be
+ * written to and deleted, which is the way out for an operator who must re-home it under a key core accepts.
+ */
 export declare function assertScopeKey(scopeKey: string): void;
 /**
  * WRITE-side document-path admission: core's own judge ({@link isSharedMemoryDocumentPath} — the SAME predicate core's listing

package/dist/plugins/shared-memory-store-sql.js

@@ -1,11 +1,11 @@
-import { isSharedMemoryDocumentPath, isSharedMemoryStoreId, SHARED_MEMORY_READ_CAP_BYTES, SharedMemoryStoreError, } from "@sema-agent/core";
+import { writeLogText } from "../observability/logger.js";
+import { isOrgScopeKey, isSharedMemoryDocumentPath, isSharedMemoryStoreId, SHARED_MEMORY_READ_CAP_BYTES, SharedMemoryStoreError, } from "@sema-agent/core";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 const isDupKey = isDupKeyError;
 export const SHARED_MEMORY_SCOPE_TABLE = "shared_memory_scope";
 export const SHARED_MEMORY_STORE_TABLE = "shared_memory_store";
 export const SHARED_MEMORY_ENTRY_TABLE = "shared_memory_entry";
-const ORG_SCOPE_RE = /^org:\S{1,185}$/;
 const PATH_MAX_CHARS = 512;
 const DESCRIPTION_MAX_CHARS = 512;
 const DEFAULT_MAX_LIST_LIMIT = 500;
@@ -15,10 +15,14 @@ export function assertStoreId(storeId) {
     }
 }
 export function assertScopeKey(scopeKey) {
-    if (!ORG_SCOPE_RE.test(scopeKey)) {
-        throw new Error(`shared-memory scope key ${JSON.stringify(scopeKey)} is not usable: it must match /^org:\\S{1,185}$/`);
+    if (!isOrgScopeKey(scopeKey)) {
+        throw new Error(`shared-memory scope key ${JSON.stringify(scopeKey)} is not usable: core's org scope key rule refuses it (spell the org with core's formatOrgScope: "org:" plus the name's percent-encoded segment)`);
     }
 }
+function ownedExactly(rows, scopeKey) {
+    const row = rows[0];
+    return row !== undefined && String(row.scope_key) === scopeKey;
+}
 export function assertDocumentPath(path) {
     const refuse = (why) => {
         throw new Error(`shared-memory document path ${JSON.stringify(path)} is not usable: ${why}`);
@@ -78,7 +82,7 @@ async function rollbackPreservingError(conn, primary) {
         await conn.rollback();
     }
     catch (rollbackErr) {
-        console.warn("[shared-memory-store] rollback failed after a failed transaction; reporting the PRIMARY error:", { primary, rollbackErr });
+        writeLogText("stderr", "[shared-memory-store] rollback failed after a failed transaction; reporting the PRIMARY error:", { primary, rollbackErr });
     }
 }
 function storeGone(storeId) {
@@ -267,7 +271,6 @@ export class SqlSharedMemoryStore {
     }
     async putDocument(record) {
         assertStoreId(record.storeId);
-        assertScopeKey(record.scopeKey);
         assertDocumentPath(record.path);
         const sizeBytes = Buffer.byteLength(record.content, "utf8");
         if (sizeBytes > SHARED_MEMORY_READ_CAP_BYTES) {
@@ -278,8 +281,8 @@ export class SqlSharedMemoryStore {
         const conn = await this.db.connect();
         try {
             await conn.begin();
-            const registered = await conn.query(this.q(`SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [record.storeId, record.scopeKey]);
-            if (registered.rows.length === 0) {
+            const registered = await conn.query(this.q(`SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [record.storeId, record.scopeKey]);
+            if (!ownedExactly(registered.rows, record.scopeKey)) {
                 unregistered = true;
                 await conn.rollback();
             }
@@ -303,14 +306,13 @@ export class SqlSharedMemoryStore {
     }
     async deleteDocument(storeId, scopeKey, path) {
         assertStoreId(storeId);
-        assertScopeKey(scopeKey);
         let unregistered = false;
         let deleted = false;
         const conn = await this.db.connect();
         try {
             await conn.begin();
-            const registered = await conn.query(this.q(`SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [storeId, scopeKey]);
-            if (registered.rows.length === 0) {
+            const registered = await conn.query(this.q(`SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [storeId, scopeKey]);
+            if (!ownedExactly(registered.rows, scopeKey)) {
                 unregistered = true;
                 await conn.rollback();
             }
@@ -334,13 +336,12 @@ export class SqlSharedMemoryStore {
     }
     async deleteStore(storeId, scopeKey) {
         assertStoreId(storeId);
-        assertScopeKey(scopeKey);
         let notOwned = false;
         const conn = await this.db.connect();
         try {
             await conn.begin();
-            const owned = await conn.query(this.q(`SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [storeId, scopeKey]);
-            if (owned.rows.length === 0) {
+            const owned = await conn.query(this.q(`SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = ? AND scope_key = ? FOR UPDATE`, `SELECT store_id, scope_key FROM ${SHARED_MEMORY_STORE_TABLE} WHERE store_id = $1 AND scope_key = $2 FOR UPDATE`), [storeId, scopeKey]);
+            if (!ownedExactly(owned.rows, scopeKey)) {
                 notOwned = true;
                 await conn.rollback();
             }

package/dist/plugins/shell-sentinel-owner-m48.d.ts

@@ -0,0 +1,20 @@
+/**
+ * 一次性迁移 **M48** 的唯一属主(窗、删法与删后谁接住:窗口见 `plugins/one-time-migrations.ts` 登记表;随 M48 删整个文件)。
+ *
+ * cli ≤ 1.0.70 在本地单用户形下对每次请求自发主体头 `anon:shell-live`,于是那段时间写下的会话行 / run 行 / leader run 行的属主列是这一个字面量
+ * (不是真租户键:它与「不带主体的同一位本地用户」是同一个人的两种写法)。此前属主面表为它留了一格按字面量互认的资格;
+ * 本版起这一格退役 —— 存量行由本迁移改写成无主(`null`),之后它们与任何无主行同读(普通无主行一格),属主读法里不再有字面量。
+ *
+ * **改写的部署形**:「哨兵 ≡ 不带主体的本地单用户」只在没有身份边界的部署(dev-open)上成立 ⇒ 改写只在那里执行。判据 = 部署形表行 `identityBoundary`(只读配置:
+ * `REQUIRE_PRINCIPAL`、service 凭据、鉴权桥 issuer —— 含中心回退、直连门、只读 trace 凭据,任一在 ⇒ 有边界),dev-open 判据 `devOpenDeployment` 读同一行。
+ * 有身份边界的部署上哨兵是一位普通的具名属主,行只对字面相等的主体可见;改成无主 = 过了凭据门的任何主体都够得着 ⇒ 那里零改写、读数 0,行原样(本条照样记完成)。
+ * 读数由调用方读部署形表交进迁移段(`one-time-migrations.ts` 的 `ShellSentinelOwnerInput`),两条腿同读。
+ *
+ * 改写面 = 曾放那一格的读面读属主的那几处:SQL `session_meta` / `task_run` / `leader_run` 的 `owner` 列;local 会话元数据边档那一格的 `owner`、
+ * `FileRunStore` 的 run 行 `owner`(local 没有 leader run 店)。不改的(如实):规则行(存在哨兵键下的规则此前也不对无主体任务生效,改键 = 放宽,不做)、
+ * 收件箱条目 / 问账行 / 检查点 scope(这些读面从没放过那一格)。
+ */
+export declare const SHELL_SENTINEL_OWNER_M48 = "anon:shell-live";
+/** SQL 腿改写 `owner` 列的表(曾放那一格的读面读属主的表;local 腿的对应面见文件头)。 */
+export declare const SHELL_SENTINEL_OWNER_TABLES_M48: readonly ["session_meta", "task_run", "leader_run"];
+//# sourceMappingURL=shell-sentinel-owner-m48.d.ts.map

package/dist/plugins/shell-sentinel-owner-m48.js

@@ -0,0 +1,3 @@
+export const SHELL_SENTINEL_OWNER_M48 = "anon:shell-live";
+export const SHELL_SENTINEL_OWNER_TABLES_M48 = ["session_meta", "task_run", "leader_run"];
+//# sourceMappingURL=shell-sentinel-owner-m48.js.map

package/dist/plugins/snapshot-bucket-presence.d.ts

@@ -20,7 +20,8 @@
  *    `workspace` = k8s 车道的 `config.remoteExec.s3Snapshot.bucket`(`WORKSPACE_SNAPSHOT_BUCKET`,缺省 `workspaces`)—— 车道没开 / 没配对象存储 ⇒ 没有这只桶,不核。
  *    拒句的旋钮名跟着桶走(缺的是哪只桶就只点哪只的旋钮)。公桶 `sema-public` 是运维另配的匿名桶,不在本核之内。
  *  · 运行期的对应臂:工作区 `latest` 指针读答 404 `NoSuchBucket`(同一条「桶不在」判据 `isNoSuchBucketAnswer`)⇒ 那条 run 响亮拒绝,不再读成「空间头一回」
- *    (`remote-env-k8s.ts` `readPointer`)—— 起服核之后桶被删 / 起服核证明不了的部署,在运行期也有一道。
+ *    (`remote-env-k8s.ts` `readPointer`);恢复时归档 GET 答同一只 404 `NoSuchBucket`(pod 原样交回存储的答复,同一只判据读)⇒ 两条车道同拒、同一行
+ *    (`restoreSnapshot`)—— 起服核之后桶被删 / 起服核证明不了的部署,在运行期也有一道。
  */
 import type { ServiceConfig } from "../config-types.js";
 import { type StoreOpenWaitClock } from "./store-open-wait.js";

package/dist/plugins/snapshot-bucket-presence.js

@@ -58,7 +58,7 @@ export async function ensureSnapshotBucket(store, waitMs, logger, clock, role =
 export async function ensureSnapshotBuckets(config, logger) {
     const wanted = [
         ["session", config.snapshotBlobStore],
-        ["workspace", config.remoteExec?.provider === "k8s" ? config.remoteExec.s3Snapshot : undefined],
+        ["workspace", config.remoteExec.provider === "k8s" ? config.remoteExec.s3Snapshot : undefined],
     ];
     for (const [role, store] of wanted) {
         if (store)

package/dist/plugins/sql-driver.d.ts

@@ -21,9 +21,13 @@
  *     ⚠️ The dup-key predicate ITSELF is NOT store-specific and no longer lives at the call sites:
  *     `sql-errors.ts` owns it ([ref] P1-①; 7+ hand-rolled copies had drifted into three different
  *     recognition sets, so the same driver error got opposite verdicts in different stores).
- *   - per-query timeouts: mysql2 takes `{sql, timeout}` while node-pg takes a `QueryConfig` with
- *     `query_timeout`. The counter family (write-behind-counter.ts) needs those and keeps its own
- *     exec; this seam stays on the plain (sql, params) form.
+ *   - per-query timeouts on the POOL form: mysql2 takes `{sql, timeout}` while node-pg takes a `QueryConfig`
+ *     with `query_timeout`. The counter family (write-behind-counter.ts) needs those and keeps its own
+ *     exec; the pool form of this seam stays on the plain (sql, params) form.
+ *     A LENT connection ({@link SqlTxConn.query}) takes one optional per-statement deadline
+ *     ({@link SqlStatementOptions}): past it the statement rejects ({@link SqlStatementDeadlineExceeded}) and the lease
+ *     is destroyed first (its session / transaction state is unknown — it never goes back to the pool; the server
+ *     rolls the open transaction back when the connection closes). Same rule on both dialects, one implementation.
  *
  * ─────────────────────────────────────────────────────────────────────────────────────────────────
  * @contract txn.read-semantics — 本仓「事务里的读看到什么」的**唯一**成文处([ref] / [ref] / [ref])
@@ -111,7 +115,7 @@
  */
 import type { Pool as MySqlPool } from "mysql2/promise";
 import type { Pool as PgPool } from "pg";
-import type { Logger } from "../observability/logger.js";
+import { type Logger } from "../observability/logger.js";
 /**
  * SQL **文本**的语法族(调用方说,不探):`mysql` = MySQL 协议(TiDB / MySQL InnoDB / MariaDB 同一套语句),`pg` = PostgreSQL。
  * 与 `@sema-agent/core-stores-sql` 公面的 `SqlDialect` 同词同集 —— 部署词 / 引擎词都不是它的别名:谁在答是另一轴 {@link SqlEngine}(驱动探)。
@@ -127,8 +131,20 @@ export interface SqlResult {
 export interface SqlExec {
     query(sql: string, params?: unknown[]): Promise<SqlResult>;
 }
+/** Per-statement options of a lent connection's {@link SqlTxConn.query}. */
+export interface SqlStatementOptions {
+    /** The statement rejects ({@link SqlStatementDeadlineExceeded}) if it has not settled within this many ms; the lease is destroyed first. */
+    readonly deadlineMs?: number;
+}
+/** A lent connection's statement did not settle within its deadline: the connection was destroyed (never pooled again), the statement rejected. Typed so callers triage it without reading the message. */
+export declare class SqlStatementDeadlineExceeded extends Error {
+    readonly deadlineMs: number;
+    constructor(deadlineMs: number);
+}
 /** A pooled connection with transaction control (released by the caller in a `finally`). */
 export interface SqlTxConn extends SqlExec {
+    /** {@link SqlExec.query}, with an optional per-statement deadline (see the file header). */
+    query(sql: string, params?: unknown[], opts?: SqlStatementOptions): Promise<SqlResult>;
     /**
      * The ONE transaction verb ([ref]). What its reads see is NOT decided here — it is decided once per
      * pooled connection at initialization and reported by {@link SqlDriver.facts}. Read the
@@ -200,7 +216,7 @@ export interface SqlEngineFacts {
      *    ({@link PACKET_CAP_UNREAD_LANDING_BYTES}), recorded through `recordFailOpen("server.sql.packet-cap-unread")` (a per-hit
      *    count and one warn line naming the reason). Never `null`: on these engines the wall exists, only its size may be unread.
      *  · **`null`** — PostgreSQL: the extended protocol has no statement-size wall.
-     * Its final judge: the SQL snapshot-blob cap (`plugins/blob-backend.ts` `SqlBlobBackend.putBlob`), which borrows the connection
+     * Its final judge: the SQL snapshot-blob cap (`stores-sql/blob-index-sql.ts` `SqlBlobIndex.put`, the SQL-kept arm), which borrows the connection
      * it will write on through {@link connectJudged}, reads this off it ({@link sqlConnectionFacts}), judges, and writes on that
      * same connection — and when it refuses on a connection opened before the DBA raised the wall, that stale connection is
      * replaced and the write judged once more ({@link connectJudged}). On {@link SqlDriver.facts} the value is the most recently
@@ -305,7 +321,7 @@ export interface SqlWallsReading extends SqlWalls {
 }
 /**
  * 一只 SQL 池的**引擎读口**:方言(SQL 文本轴,装配事实,恒在)+ 此刻的引擎事实(`null` = 没建立)。墙的方言只从这里来 —— 与事实同出一只驱动
- * ({@link SqlDriver} 结构上就是它;`facts` 是活的,池重连后随之换)。HTTP 面的读口(`ServiceDeps.sqlEngine`)与店的写前帽(`SqlBlobBackend`)各读本池的这一只。
+ * ({@link SqlDriver} 结构上就是它;`facts` 是活的,池重连后随之换)。HTTP 面的读口(`ServiceDeps.sqlEngine`)与店的写前帽(`SqlBlobIndex`)各读本池的这一只。
  */
 export type SqlEngineReading = Pick<SqlDriver, "dialect" | "facts">;
 /**
@@ -317,7 +333,7 @@ export type SqlEngineReading = Pick<SqlDriver, "dialect" | "facts">;
 export declare const SQL_FACTS_ABSENT_WALLS: SqlWallsReading;
 /**
  * 🔴 **此刻一份写入要装进的墙 —— 唯一判官**。两个读者同调它、不各读 `facts`:提交受理口(`http/request-guards.ts` `refuseSubmitBody`)与 SQL 快照 blob 的缺省帽
- * (`plugins/blob-backend.ts` `sqlBlobCapOf`:店的写前判,读的是**将要执行写入的那条连接**的读口 —— 方言 + 它自己那次初始化的事实;受理口读本池驱动的读口)。输入是一只引擎读口({@link SqlEngineReading}:方言与事实同出),一种读法:
+ * (`stores-sql/blob-index-sql.ts` `sqlBlobCapOf`:店的写前判,读的是**将要执行写入的那条连接**的读口 —— 方言 + 它自己那次初始化的事实;受理口读本池驱动的读口)。输入是一只引擎读口({@link SqlEngineReading}:方言与事实同出),一种读法:
  *  · 读口缺席 = 没有 SQL 后端 ⇒ 没有墙(「忘了给」读不成这一臂:后端交出了 SQL 池而没给读口 ⇒ `createHttpServer` 起服拒,见 `ServiceDeps.sqlEngine`);
  *  · 事实在场 ⇒ 事实里的两位,出处逐墙取事实里记的那一份({@link SqlEngineFacts.wallSources}:读到的 `reported`,读失败退文档缺省的 `assumed`);
  *  · 事实缺席(`null`)⇒ 按读口的方言:PG 没有墙(扩展协议没有这两堵墙 —— 方言事实,不随引擎事实缺席);MySQL 协议 ⇒ {@link SQL_FACTS_ABSENT_WALLS}(两堵都 `assumed`;
@@ -373,7 +389,7 @@ export interface SqlDriver extends SqlExec {
 }
 /**
  * 一条**借出的**连接自己的引擎事实 —— 它的初始化回读到的那一份(包墙 `maxPacketBytes` 是这条连接的会话值)。判一条语句装不装得下的地方
- * 只读这里:借出连接 → 读它的墙 → 判 → 在同一条连接上执行(`plugins/blob-backend.ts` `SqlBlobBackend.putBlob`)。
+ * 只读这里:借出连接 → 读它的墙 → 判 → 在同一条连接上执行(`stores-sql/blob-index-sql.ts` `SqlBlobIndex.put`)。
  * 只认本模块的 `mysqlDriver` / `pgDriver` 的 `connect()` 借出的连接;别的连接(测试替身、包装体)没有经过初始化,墙没人读过 ⇒ **响亮抛**,不猜一个数。
  */
 export declare function sqlConnectionFacts(conn: SqlTxConn): SqlEngineFacts;

package/dist/plugins/sql-driver.js

@@ -1,7 +1,32 @@
 import { pgSafeJsonStringify, pgProtocolJsonStringify } from "./pg-safe-json.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { errorKindOf } from "../observability/err-text.js";
+import { writeLogText } from "../observability/logger.js";
 import { isConnectionUnusableError } from "./sql-errors.js";
+export class SqlStatementDeadlineExceeded extends Error {
+    deadlineMs;
+    constructor(deadlineMs) {
+        super(`SQL statement did not settle within ${deadlineMs}ms — the connection was destroyed (its transaction rolls back when it closes)`);
+        this.deadlineMs = deadlineMs;
+        this.name = "SqlStatementDeadlineExceeded";
+    }
+}
+function withStatementDeadline(run, opts, destroy) {
+    const deadlineMs = opts?.deadlineMs;
+    if (deadlineMs === undefined)
+        return run();
+    const running = run();
+    running.catch(() => undefined);
+    let timer;
+    const expired = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            destroy();
+            reject(new SqlStatementDeadlineExceeded(deadlineMs));
+        }, deadlineMs);
+        timer.unref?.();
+    });
+    return Promise.race([running, expired]).finally(() => clearTimeout(timer));
+}
 export const TIDB_DEFAULT_TXN_ENTRY_SIZE_LIMIT = 6_291_456;
 export const ROW_WALL_ALLOWANCE_BYTES = { json: 64 * 1024, blob: 1024 };
 export const STATEMENT_ALLOWANCE_BYTES = 1024;
@@ -205,7 +230,7 @@ async function establishSession(session, pooled, c, init) {
         session.facts = null;
         session.connections = new WeakMap();
         if (stale !== null)
-            console.warn(`[sql-driver] connection initialization REFUSED — SQL engine facts invalidated (was: ${stale ? `${stale.engine} ${stale.version} ${stale.isolation} txnMode=${stale.txnMode ?? "-"}` : "<absent>"}). GET /v1/diagnostics/wiring -> sqlEngine and GET /v1/capabilities -> sql now report ABSENT, which is the honest ` +
+            writeLogText("stderr", `[sql-driver] connection initialization REFUSED — SQL engine facts invalidated (was: ${stale ? `${stale.engine} ${stale.version} ${stale.isolation} txnMode=${stale.txnMode ?? "-"}` : "<absent>"}). GET /v1/diagnostics/wiring -> sqlEngine and GET /v1/capabilities -> sql now report ABSENT, which is the honest ` +
                 `reading: this pool cannot currently establish the read semantics every "SELECT … FOR UPDATE" in this repo assumes. Cause: ${err.message}`);
         c.release();
         throw err;
@@ -299,15 +324,20 @@ function leaseOf(raw) {
     if (GUARDED_LEASES.has(raw))
         return raw;
     let destroyed = false;
+    let leaveQueue = () => undefined;
+    const gone = new Promise((resolve) => {
+        leaveQueue = resolve;
+    });
     const destroy = () => {
         if (destroyed)
             return;
         destroyed = true;
+        leaveQueue();
         raw.destroy();
     };
     let turn = Promise.resolve();
     const guard = (run) => {
-        const result = turn.then(async () => {
+        const result = Promise.race([turn, gone]).then(async () => {
             try {
                 return await run();
             }
@@ -388,7 +418,7 @@ export function mysqlDriver(pool) {
             if (broken !== undefined)
                 throw broken.error;
             const conn = {
-                query: (sql, params) => mysqlQuery(c, sql, params),
+                query: (sql, params, opts) => withStatementDeadline(() => mysqlQuery(c, sql, params), opts, () => c.destroy()),
                 begin: () => c.beginTransaction(),
                 commit: () => c.commit(),
                 rollback: () => c.rollback(),
@@ -440,8 +470,14 @@ export function pgDriver(pool) {
             const c = await pool.connect();
             const { facts, initOrdinal } = await establishSession(session, c, c, initPgSession);
             let destroyed = false;
+            const destroy = () => {
+                if (destroyed)
+                    return;
+                destroyed = true;
+                c.release(true);
+            };
             const conn = {
-                query: (sql, params) => pgQuery(c, sql, params),
+                query: (sql, params, opts) => withStatementDeadline(() => pgQuery(c, sql, params), opts, destroy),
                 begin: async () => {
                     await c.query("BEGIN");
                 },
@@ -449,7 +485,8 @@ export function pgDriver(pool) {
                     await c.query("COMMIT");
                 },
                 rollback: async () => {
-                    await c.query("ROLLBACK");
+                    if (!destroyed)
+                        await c.query("ROLLBACK");
                 },
                 release: () => {
                     if (!destroyed)
@@ -461,10 +498,7 @@ export function pgDriver(pool) {
                 facts,
                 initOrdinal,
                 id: typeof pid === "number" ? pid : null,
-                destroy: () => {
-                    destroyed = true;
-                    c.release(true);
-                },
+                destroy,
                 readGlobalPacketWall: async () => null,
             });
             return conn;

package/dist/plugins/sql-errors.d.ts

@@ -15,6 +15,8 @@
  * 件事的两种写法**,任一在场即可判定 —— 认并集不会造出假阳性,而认单键会漏掉任何只保留另一个键的
  * 形(驱动版本差异、代理/包装层、序列化往返)。这正是收编前两个真漏判的成因,门钉在
  * `test/sql-dup-key-single-source.test.ts`。
+ * 同一条道理的最后一种形:错误对象**不是驱动原错**(调用方递进来的 query 包装把键丢了、只剩 `message`)⇒ 另有一只**宽读法** {@link isDupKeyErrorOfWrappedQuery},
+ * 只给吃这种 query 函数的站点(`ensureIndex`)用;持驱动原错的店走严格读法,不按散文改判。两只读法都住在这里(站点不自带文案正则),钉同一个文件。
  *
  * ## 为什么是 `Reflect.get` 而不是属性访问/展开
  * 驱动错误类在某些版本把这两个键挂在**原型链**上:`{...err}` 只拷自有可枚举键,会**静默**丢掉它们,
@@ -36,12 +38,19 @@ export declare const MYSQL_ER_DUP_ENTRY_ERRNO = 1062;
 export declare const MYSQL_ER_DUP_ENTRY_CODE = "ER_DUP_ENTRY";
 /** PostgreSQL `unique_violation` 的 SQLSTATE。 */
 export declare const PG_UNIQUE_VIOLATION_SQLSTATE = "23505";
-/** MySQL/TiDB 的唯一键冲突:`code === "ER_DUP_ENTRY"` **或** `errno === 1062`(同一件事的两种写法)。 */
+/** MySQL/TiDB 的唯一键冲突:`code === "ER_DUP_ENTRY"` **或** `errno === 1062`(同一件事的两种写法)。只读结构化归因键,不读 `message` 散文。 */
 export declare function isMysqlDupKeyError(err: unknown): boolean;
 /** PostgreSQL 的唯一键冲突:SQLSTATE `23505`(node-pg 挂在 `code` 上)。 */
 export declare function isPgUniqueViolation(err: unknown): boolean;
 /** 方言分派口——双方言店的调用形(`isDupKeyError(this.db.dialect, e)`)。 */
 export declare function isDupKeyError(dialect: SqlDialect, err: unknown): boolean;
+/**
+ * **宽读法**:{@link isDupKeyError} 之外,MySQL 协议另认 `message` 里的 `Duplicate entry` 句子 —— 给**错误对象不是驱动原错**的站点用:`ensureIndex` 吃调用方递进来的 `query`
+ * 函数(`IndexQueryFn`),那层包装可能把结构化键丢了(或写成 `null`)、给句子加前缀,只剩 `message`。持驱动原错的店(十余处,走 {@link isDupKeyError})**不**用它:
+ * 它们拿得到带 `code` / `errno` 的原错,按散文改判会把一句碰巧带这两个词的非唯一键错读成「已存在」(例:`mark` 的 `existed` 回执)。
+ * 宽读法 ⊇ 严格读法;PG 臂没有散文臂(只认 SQLSTATE `23505`)。散文臂只住在这里 —— 站点不自带文案正则。
+ */
+export declare function isDupKeyErrorOfWrappedQuery(dialect: SqlDialect, err: unknown): boolean;
 /** PostgreSQL `undefined_column` 的 SQLSTATE。⚠️ 与 `42P01`(`undefined_table`)刻意分开。 */
 export declare const PG_UNDEFINED_COLUMN_SQLSTATE = "42703";
 /** MySQL/TiDB `ER_BAD_FIELD_ERROR`(未知列)的数字 errno。 */
@@ -193,23 +202,44 @@ export declare function isConnectionFaultError(err: unknown): boolean;
  * **部署错配类故障**的识别表(闭集;逐行登记「为什么」)—— 到库的连接是好的、语句也是对的,是这套库的形与本部署的要求不符:**重试注定失败**,修表 / 授权之前什么都不会变
  * (与连接类互为反面:那一类是「什么都不改稍后再试可能成」)。读者:整仓一只判官 `plugins/store-fault.ts` 的 `storeFaultClassOf` 的 `deployment` 一词 ——
  * 文件历史店的折点与会话同步拉取口(`503 state.file_history_unreadable`)据它判 `permanence: "terminal"`;审批队列读口并入「此刻读不出」的 503;各读者各自表态,**不在自己那里写码**。
+ * 起服建表(`session-ext-table.ts` 的 `ensureSessionExtTableMysql`)问的也是这一只:「库确定拒了这条 DDL」= 本表认得 ⇒ 当场拒启;认不出 ⇒ 原样上抛、开库等待窗重试 —— 不自带第二份分类。
+ * 建外键被库确定拒的十码(1005 / 1215 / 1821 / 1822 / 1824 / 1825 / 1826 / 3734 / 3780 / 6125)只可能出在建表 / 改表上,读写路径上的读者见不到它们 —— 加进本表对那几处零变化。
+ * **为什么按码逐个登记、不按语义区段判**:MySQL 错误参考里这一族的 SQLSTATE 一律是 `HY000`(与一切未分类的服务端错误同一格,SQLSTATE 不分类);errno 也不成连续区段 ——
+ * 1821–1826 / 3734 / 3780 / 6125 之间夹着同族而**不属于**建表形不符的码(运行期的 1451 / 1452 / 3008、删列改列的 1828–1834、删父表的 3730),按区段或 `ER_FK_` 前缀判会把它们一并收进来;
+ * 而 mysql2 的码表是旧的(6125 没有符号,`code` 缺席),所以数字 `errno` 是必认的键。出处按码写在各行的 `why` 里:判据是码,不是散文。
+ * **唯一一行按内层号分:1005(建表被存储引擎拒)是包装码** —— 库答的消息模板 `Can't create table '%s' (errno: %d - %s)` 的**内层**号才是成因:150(外键形不成)/ 121(约束名已占)是确定拒,
+ * 28(盘满)等资源类清了盘重试即成。外层 SQLSTATE 恒 `HY000`、驱动不把内层号挂成字段 ⇒ 没有语义 / 结构化的键可判,只能读库自己的消息模板:这一行带 `innerErrnos`,
+ * 判据 = 外层码(`code` / `errno` 任一)是 1005 ∧ 消息是以 `Can't create table ` 开头、以 `(errno: <数字>…)` 收尾的整句 ∧ 内层号在 `innerErrnos` 里;读不出 / 不在册 /
+ * 外层不是这一码 ⇒ 不是(认不出一律不是;失败方向 = 进开库等待窗重试,不当场拒)。其余各行整码判、不读消息。
  *
  * 识别集 = 本表一张,按归因键登记:`code`(字符串)与 MySQL 协议的数字 `errno`(两键是同一件事的两种写法,代理 / 序列化往返可能只留一个;同本文件其余谓词的姿势)。
  * **与连接类互斥**:本表的任何一码都不在 {@link CONNECTION_FAULT_ERRORS} / {@link MYSQL_CONNECTION_UNUSABLE_ERRORS} 的识别集里,反之亦然(`test/store-fault-judge.test.ts` 钉两个方向)—— 同一只错只落一个词。
  *
- * **不在表里**(认不出一律不是;本批只收缺表与权限拒两形,其余是登记在案的未收项,不是「已裁定不判」):缺列(1054 / `42703`:升级前置断言 `assert*Schema` 族有自己的判据与出路)、
- * 认证类拒连(MySQL 1045、PG `28xxx`:凭据 / 白名单)、库级与列级的权限拒(MySQL 1044 / 1143)、TiDB 自己的忙 / 区域不可用一族(同连接类表的登记)。
+ * **不在表里**(认不出一律不是;今天收缺表、权限拒与外键建不成三形,其余是登记在案的未收项,不是「已裁定不判」):缺列(1054 / `42703`:升级前置断言 `assert*Schema` 族有自己的判据与出路)、
+ * 认证类拒连(MySQL 1045、PG `28xxx`:凭据 / 白名单)、库级与列级的权限拒(MySQL 1044 / 1143)、语法错(1064:多半是我方的语句,不是库的形)、
+ * TiDB 自己的忙 / 区域不可用 / 结构变更冲突一族(9001 / 9005 / 8028,同连接类表的登记)、锁等待超时(1205)、
+ * 外键的运行期拒(1451 / 1452 / 3008:行违反外键 / 级联深度,出在读写路径上、不是库的形)、`ER_FK_FAIL_ADD_SYSTEM`(1823:写系统表失败,成因混着字典写入失败而非逐因都是形不符 —— 推断,未读实现,故不登记)。
  */
 export declare const DEPLOYMENT_FAULT_ERRORS: ReadonlyArray<{
     readonly code: string;
     readonly errno?: number;
+    readonly innerErrnos?: readonly number[];
     readonly why: string;
 }>;
 /**
- * 「这个错误**是**部署错配类故障吗」—— {@link DEPLOYMENT_FAULT_ERRORS} 的唯一判据(识别集与排除项见该表头注)。纯谓词、不抛;认不出的一律不是。
- * 只读被抛出的**这一只**对象身上的结构化字段(`code` 字符串 / `errno` 数字),不沿 `cause` 链找、不读散文里的在册词。
+ * 「这个错误**是**部署错配类故障吗」—— {@link DEPLOYMENT_FAULT_ERRORS} 的唯一判据(识别集与排除项见该表头注)。纯谓词;认不出的一律不是。
+ * 整码行只读被抛出的**这一只**对象身上的结构化字段(`code` 字符串 / `errno` 数字),不沿 `cause` 链找、不读散文里的在册词;唯一例外是包装码 1005:外层码在册之后还要读库自己的
+ * 消息模板里的内层号(头注),内层号不在册 / 读不出 ⇒ 不是。
  */
 export declare function isDeploymentFaultError(err: unknown): boolean;
+/**
+ * 库对一条语句的**答**里的原码,读成一小段(起服拒句读库答的唯一读法 —— `session-ext-table.ts` 的建表拒与 `store-backend.ts` 的开库拒同读这一只,不各写各的):
+ *  · MySQL 协议:`errno <数字> <符号>, SQLSTATE <五位>`(`errno` / `code` / `sqlState` 三格,哪一格不在就缺哪一格;mysql2 的码表没有新号时 `code` 缺席,只剩 errno;只有符号没有 errno ⇒ `code <符号>`);
+ *  · PostgreSQL:SQLSTATE 就挂在 `code` 上(node-pg),没有 errno / sqlState 键 ⇒ `SQLSTATE <五位>`。
+ * 只读被抛出的这一只对象身上的结构化字段、不读散文;每一格过闭字符形(数字 / `[A-Za-z0-9_]{1,64}` / 五位 SQLSTATE),形不对的格不进句子 —— 句子里不会出现驱动交来的任意串。
+ * 一格都读不到 ⇒ `undefined`(拒句不加这一段)。读字段经本文件同一只 `keyOf`(与本文件其余谓词同一读法:驱动错对象是普通对象,没有读取时才抛的访问器 / 代理那种形;真遇上就原样上抛,不在这里吞)。
+ */
+export declare function databaseAnswerCodesOf(dialect: SqlDialect, err: unknown): string | undefined;
 /**
  * 检查点店的两笔写(续跑输入 `putCtx` / 停驻行 `put`)被引擎以「一行装不下」拒 ⇒ **这一只**带码错误(码 `store.row_too_large`),不以裸驱动错上抛
  * (其余店写今天仍是各自的驱动错 —— 未收,登记在案)。

package/dist/plugins/sql-errors.js

@@ -15,6 +15,15 @@ export function isPgUniqueViolation(err) {
 export function isDupKeyError(dialect, err) {
     return dialect === "mysql" ? isMysqlDupKeyError(err) : isPgUniqueViolation(err);
 }
+const MYSQL_ER_DUP_ENTRY_SENTENCE = /duplicate entry/i;
+export function isDupKeyErrorOfWrappedQuery(dialect, err) {
+    if (isDupKeyError(dialect, err))
+        return true;
+    if (dialect !== "mysql")
+        return false;
+    const message = keyOf(err, "message");
+    return typeof message === "string" && MYSQL_ER_DUP_ENTRY_SENTENCE.test(message);
+}
 export const PG_UNDEFINED_COLUMN_SQLSTATE = "42703";
 export const MYSQL_ER_BAD_FIELD_ERRNO = 1054;
 export const MYSQL_ER_BAD_FIELD_CODE = "ER_BAD_FIELD_ERROR";
@@ -148,15 +157,58 @@ export const DEPLOYMENT_FAULT_ERRORS = [
     { code: "42501", why: "PG insufficient_privilege(权限拒:库账号缺这张表 / 这类语句的授权 —— 授权之前重试注定失败)" },
     { code: "ER_NO_SUCH_TABLE", errno: 1146, why: "MySQL 协议(MySQL / MariaDB / TiDB)缺表:同 PG `42P01`" },
     { code: "ER_TABLEACCESS_DENIED_ERROR", errno: 1142, why: "MySQL 协议表级权限拒:库账号对这张表缺这类语句的授权,同 PG `42501`" },
+    { code: "ER_FK_INCOMPATIBLE_COLUMNS", errno: 3780, why: "MySQL 协议外键两侧列不相容(类型 / 字符集 / 排序规则对不上):被引表的形与外键要求不符,重试同一句仍不相容。出处:MySQL 9.0 错误参考 3780;TiDB `ErrFKIncompatibleColumns`" },
+    { code: "ER_CANNOT_ADD_FOREIGN", errno: 1215, why: "MySQL 协议加不上外键(统称码,如被引表不是 InnoDB):库的形不收这条约束,改表之前重试注定失败。出处:MySQL 9.0 错误参考 1215;TiDB `ErrCannotAddForeign`" },
+    { code: "ER_FK_NO_INDEX_CHILD", errno: 1821, why: "MySQL 协议外键的子表侧(建表句里的这张)缺索引:建表句的形不符,重试同一句仍被拒。出处:MySQL 9.0 错误参考 1821;TiDB `ErrFkNoIndexChild`;MariaDB 1800–1899 页同号" },
+    { code: "ER_FK_NO_INDEX_PARENT", errno: 1822, why: "MySQL 协议外键的被引列上缺索引:被引表的形不符,建索引之前重试注定失败。出处:MySQL 9.0 错误参考 1822;TiDB `ErrForeignKeyNoIndexInParent`;MariaDB 1800–1899 页同号" },
+    { code: "ER_FK_CANNOT_OPEN_PARENT", errno: 1824, why: "MySQL 协议外键的被引表打不开(库答「Failed to open the referenced table」;被引表不是 InnoDB 时 9.x 以此码拒,真库读数见 db 组钉):改引擎之前重试注定失败。出处:MySQL 9.0 错误参考 1824;TiDB `ErrForeignKeyCannotOpenParent`;MariaDB 1800–1899 页同号" },
+    { code: "ER_FK_INCORRECT_OPTION", errno: 1825, why: "MySQL 协议外键的选项在这张表上不成立(库答「Incorrect options in FOREIGN KEY constraint」):建表句的形不符,重试同一句仍被拒。出处:MySQL 9.0 错误参考 1825;TiDB `ErrFkIncorrectOption`;MariaDB 1800–1899 页同号" },
+    { code: "ER_FK_DUP_NAME", errno: 1826, why: "MySQL 协议外键约束名重复(库答「Duplicate foreign key constraint name」):改掉占用同名的那一只之前重试注定失败。出处:MySQL 9.0 错误参考 1826;TiDB `ErrFkDupName`;MariaDB 1800–1899 页同号" },
+    { code: "ER_FK_NO_COLUMN_PARENT", errno: 3734, why: "MySQL 协议外键的被引表上没有被引的那一列:被引表的形不符,补列之前重试注定失败。出处:MySQL 9.0 错误参考 3734;TiDB `ErrForeignKeyNoColumnInParent`" },
+    { code: "ER_FK_NO_UNIQUE_INDEX_PARENT", errno: 6125, why: "MySQL 协议外键的被引列上没有唯一键(库答「Missing unique key」;被引表无主键时 9.x 以此码拒,真库读数见 db 组钉):加主键 / 唯一键之前重试注定失败。出处:MySQL 9.0 错误参考 6125(mysql2 的码表没有这一号,驱动错的 `code` 缺席,按 errno 认;TiDB 无此号)" },
+    { code: "ER_CANT_CREATE_TABLE", errno: 1005, innerErrnos: [150, 121], why: "MySQL 协议建表被存储引擎拒(包装码,只认内层错误号 150 外键形不成 / 121 约束名已占:修库之前重试同一句仍被拒;28 盘满等资源类清盘后重试即成,不是确定拒,见头注)。出处:MySQL 9.0 错误参考 1005(消息模板 `Can't create table '%s' (errno: %d - %s)`,参考页注明消息里的 errno 150 = 外键形不成);TiDB `ErrCantCreateTable`" },
 ];
-const DEPLOYMENT_FAULT_CODES = new Set(DEPLOYMENT_FAULT_ERRORS.map((r) => r.code));
-const DEPLOYMENT_FAULT_ERRNOS = new Set(DEPLOYMENT_FAULT_ERRORS.flatMap((r) => (r.errno === undefined ? [] : [r.errno])));
+const WHOLE_CODE_ROWS = DEPLOYMENT_FAULT_ERRORS.filter((r) => r.innerErrnos === undefined);
+const DEPLOYMENT_FAULT_CODES = new Set(WHOLE_CODE_ROWS.map((r) => r.code));
+const DEPLOYMENT_FAULT_ERRNOS = new Set(WHOLE_CODE_ROWS.flatMap((r) => (r.errno === undefined ? [] : [r.errno])));
+const INNER_DISCRIMINATED_ROWS = DEPLOYMENT_FAULT_ERRORS.flatMap((r) => (r.innerErrnos === undefined ? [] : [{ ...r, innerErrnos: r.innerErrnos }]));
+const CREATE_TABLE_REFUSAL_SENTENCE = /^Can't create table (?:`[^`]*`(?:\.`[^`]*`)?|'[^']*') \(errno: (\d{1,5})(?: [^()]*)?\)\s*$/;
+function engineInnerErrnoOf(err) {
+    const said = keyOf(err, "sqlMessage");
+    const text = typeof said === "string" ? said : keyOf(err, "message");
+    if (typeof text !== "string" || text.length > 2000)
+        return undefined;
+    const m = CREATE_TABLE_REFUSAL_SENTENCE.exec(text);
+    return m === null ? undefined : Number(m[1]);
+}
 export function isDeploymentFaultError(err) {
     if (err === null || typeof err !== "object")
         return false;
     const code = keyOf(err, "code");
     const errno = keyOf(err, "errno");
-    return (typeof code === "string" && DEPLOYMENT_FAULT_CODES.has(code)) || (typeof errno === "number" && DEPLOYMENT_FAULT_ERRNOS.has(errno));
+    if ((typeof code === "string" && DEPLOYMENT_FAULT_CODES.has(code)) || (typeof errno === "number" && DEPLOYMENT_FAULT_ERRNOS.has(errno)))
+        return true;
+    const wrapper = INNER_DISCRIMINATED_ROWS.find((r) => (typeof code === "string" && code === r.code) || (typeof errno === "number" && errno === r.errno));
+    if (wrapper === undefined)
+        return false;
+    const inner = engineInnerErrnoOf(err);
+    return inner !== undefined && wrapper.innerErrnos.includes(inner);
+}
+export function databaseAnswerCodesOf(dialect, err) {
+    const code = keyOf(err, "code");
+    const symbol = typeof code === "string" && /^[A-Za-z0-9_]{1,64}$/.test(code) ? code : undefined;
+    if (dialect === "pg")
+        return symbol !== undefined && /^[0-9A-Z]{5}$/.test(symbol) ? `SQLSTATE ${symbol}` : undefined;
+    const errno = keyOf(err, "errno");
+    const sqlState = keyOf(err, "sqlState");
+    const parts = [];
+    if (typeof errno === "number" && Number.isInteger(errno))
+        parts.push(symbol !== undefined ? `errno ${errno} ${symbol}` : `errno ${errno}`);
+    else if (symbol !== undefined)
+        parts.push(`code ${symbol}`);
+    if (typeof sqlState === "string" && /^[0-9A-Za-z]{5}$/.test(sqlState))
+        parts.push(`SQLSTATE ${sqlState}`);
+    return parts.length === 0 ? undefined : parts.join(", ");
 }
 export class StoreRowTooLargeError extends Error {
     row;