@sema-agent/server 7.50.0 → 7.51.0

package/dist/plugins/device-store-sql.js

@@ -0,0 +1,574 @@
+import { mysqlDriver, pgDriver, dialectJsonEncoder } from "./sql-driver.js";
+import { isDupKeyError } from "./sql-errors.js";
+import { DEVICE_AUDIT_EVENTS, assertAcquireShape, assertDeviceIdShape, assertDeviceOwnerShape, assertEnrollTokenHashShape, assertIssueTokenShape, assertNewDeviceShape, assertRevokeShape, assertRootSessionIdShape, assertWholeSeconds, parseDeviceAuditEvent, parseDevicePlatformOs, parseDeviceStatus, } from "../device-store.js";
+export const DEVICES_TABLE = "device";
+export const DEVICE_ENROLL_TOKENS_TABLE = "device_enroll_token";
+export const DEVICE_SESSIONS_TABLE = "device_session";
+export const DEVICE_AUDIT_TABLE = "device_audit";
+const UQ_DEVICES_PUBKEY = "uq_device_pubkey";
+const AUDIT_EVENT_CHECK = DEVICE_AUDIT_EVENTS.map((e) => `'${e}'`).join(", ");
+export const TIDB_DEVICE_STATEMENTS = [
+    `CREATE TABLE IF NOT EXISTS ${DEVICES_TABLE} (
+    -- 身份键 = VARBINARY(字节等价);展示/内容列才用 VARCHAR(见文件头注的键列段)。
+    device_id        VARBINARY(64)  NOT NULL,
+    -- O11 复合身份结构列(device-lane-local,不是全局 principal —— ../device-store.ts 头注)。
+    owner_tenant     VARBINARY(190) NOT NULL,
+    owner_subject    VARBINARY(190) NOT NULL,
+    display_name     VARCHAR(255)   NOT NULL DEFAULT '',
+    platform_os      VARCHAR(16)    NOT NULL,
+    platform_arch    VARCHAR(32)    NOT NULL DEFAULT '',
+    -- Ed25519 公钥 b64(44 字符);VARBINARY 因为它参与 UNIQUE 与身份比对。
+    pubkey           VARBINARY(128) NOT NULL,
+    pubkey_rotated_at DATETIME(3)   NULL,
+    -- 设备工作区根:上界取 task-cwd.ts 的 MAX_CWD_CHARS 家族(4096 过宽、1024 是路径的实用上界)。
+    workspace_root   VARCHAR(1024)  NOT NULL,
+    workspace_root_rev BIGINT       NOT NULL DEFAULT 0,
+    status           VARCHAR(16)    NOT NULL DEFAULT 'active',
+    revoked_at       DATETIME(3)    NULL,
+    revoked_by       VARCHAR(190)   NULL,
+    revoke_reason    VARCHAR(512)   NULL,
+    -- presence 投影(durable-first;内存 Hub 只是缓存,#261 教训:fleet-bus 自 declare NOT durable)。
+    conn_epoch       VARCHAR(64)    NULL,
+    replica_id       VARCHAR(128)   NULL,
+    conn_generation  BIGINT         NOT NULL DEFAULT 0,
+    lease_expires_at DATETIME(3)    NULL,
+    connected_at     DATETIME(3)    NULL,
+    last_seen_at     DATETIME(3)    NULL,
+    created_at       DATETIME(3)    NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    rev              BIGINT         NOT NULL DEFAULT 0,
+    PRIMARY KEY (device_id),
+    KEY idx_device_owner (owner_tenant, owner_subject),
+    UNIQUE KEY ${UQ_DEVICES_PUBKEY} (owner_tenant, pubkey)
+  ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS ${DEVICE_ENROLL_TOKENS_TABLE} (
+    -- sha256 hex(64 字符);明文一现,永不落库。
+    token_hash        VARBINARY(128) NOT NULL,
+    target_tenant     VARBINARY(190) NOT NULL,
+    target_subject    VARBINARY(190) NOT NULL,
+    created_by        VARCHAR(190)   NOT NULL,
+    created_at        DATETIME(3)    NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    expires_at        DATETIME(3)    NOT NULL,
+    consumed_at       DATETIME(3)    NULL,
+    consumed_device_id VARBINARY(64) NULL,
+    -- AR-R1-2 的判别位:响应丢失重放(同 pubkey)vs 真重用(异 pubkey),全靠这一列。
+    consumed_pubkey   VARBINARY(128) NULL,
+    rev               BIGINT         NOT NULL DEFAULT 0,
+    PRIMARY KEY (token_hash)
+  ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS ${DEVICE_SESSIONS_TABLE} (
+    -- 键 = 根会话(task-R1-3:后代继承不另绑);一根会话恒一设备(改绑 = 显式动作)。
+    root_session_id VARBINARY(128) NOT NULL,
+    device_id       VARBINARY(64)  NOT NULL,
+    owner_tenant    VARBINARY(190) NOT NULL,
+    owner_subject   VARBINARY(190) NOT NULL,
+    bound_at        DATETIME(3)    NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    rev             BIGINT         NOT NULL DEFAULT 0,
+    PRIMARY KEY (root_session_id),
+    KEY idx_device_session_device (device_id)
+  ) COLLATE utf8mb4_bin`,
+    `CREATE TABLE IF NOT EXISTS ${DEVICE_AUDIT_TABLE} (
+    id            BIGINT AUTO_INCREMENT,
+    at            DATETIME(3)   NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    event         VARCHAR(64)   NOT NULL,
+    device_id     VARBINARY(64) NULL,
+    owner_tenant  VARBINARY(190) NULL,
+    owner_subject VARBINARY(190) NULL,
+    detail        JSON          NULL,
+    PRIMARY KEY (id),
+    KEY idx_device_audit_device (device_id, at),
+    KEY idx_device_audit_event (event, at),
+    -- ⚠️ TiDB 默认不执行 CHECK(见 AUTO_INCREMENT 上方的 AUDIT_EVENT_CHECK 头注);闭集执法在应用层。
+    CONSTRAINT ck_device_audit_event CHECK (event IN (${AUDIT_EVENT_CHECK}))
+  ) COLLATE utf8mb4_bin`,
+];
+export async function ensureTiDBDeviceSchema(pool) {
+    for (const stmt of TIDB_DEVICE_STATEMENTS)
+        await pool.query(stmt);
+}
+export async function ensurePgDeviceSchema(q) {
+    await q(`CREATE TABLE IF NOT EXISTS ${DEVICES_TABLE} (
+    device_id        VARCHAR(64)  COLLATE "C" NOT NULL,
+    owner_tenant     VARCHAR(190) COLLATE "C" NOT NULL,
+    owner_subject    VARCHAR(190) COLLATE "C" NOT NULL,
+    display_name     VARCHAR(255) COLLATE "C" NOT NULL DEFAULT '',
+    platform_os      VARCHAR(16)  COLLATE "C" NOT NULL,
+    platform_arch    VARCHAR(32)  COLLATE "C" NOT NULL DEFAULT '',
+    pubkey           VARCHAR(128) COLLATE "C" NOT NULL,
+    pubkey_rotated_at TIMESTAMPTZ(3),
+    workspace_root   VARCHAR(1024) COLLATE "C" NOT NULL,
+    workspace_root_rev BIGINT     NOT NULL DEFAULT 0,
+    status           VARCHAR(16)  COLLATE "C" NOT NULL DEFAULT 'active',
+    revoked_at       TIMESTAMPTZ(3),
+    revoked_by       VARCHAR(190) COLLATE "C",
+    revoke_reason    VARCHAR(512) COLLATE "C",
+    conn_epoch       VARCHAR(64)  COLLATE "C",
+    replica_id       VARCHAR(128) COLLATE "C",
+    conn_generation  BIGINT       NOT NULL DEFAULT 0,
+    lease_expires_at TIMESTAMPTZ(3),
+    connected_at     TIMESTAMPTZ(3),
+    last_seen_at     TIMESTAMPTZ(3),
+    created_at       TIMESTAMPTZ(3) NOT NULL DEFAULT now(),
+    rev              BIGINT       NOT NULL DEFAULT 0,
+    PRIMARY KEY (device_id),
+    CONSTRAINT ${UQ_DEVICES_PUBKEY} UNIQUE (owner_tenant, pubkey)
+  )`);
+    await q(`CREATE INDEX IF NOT EXISTS idx_device_owner ON ${DEVICES_TABLE} (owner_tenant, owner_subject)`);
+    await q(`CREATE TABLE IF NOT EXISTS ${DEVICE_ENROLL_TOKENS_TABLE} (
+    token_hash        VARCHAR(128) COLLATE "C" NOT NULL,
+    target_tenant     VARCHAR(190) COLLATE "C" NOT NULL,
+    target_subject    VARCHAR(190) COLLATE "C" NOT NULL,
+    created_by        VARCHAR(190) COLLATE "C" NOT NULL,
+    created_at        TIMESTAMPTZ(3) NOT NULL DEFAULT now(),
+    expires_at        TIMESTAMPTZ(3) NOT NULL,
+    consumed_at       TIMESTAMPTZ(3),
+    consumed_device_id VARCHAR(64) COLLATE "C",
+    consumed_pubkey   VARCHAR(128) COLLATE "C",
+    rev               BIGINT       NOT NULL DEFAULT 0,
+    PRIMARY KEY (token_hash)
+  )`);
+    await q(`CREATE TABLE IF NOT EXISTS ${DEVICE_SESSIONS_TABLE} (
+    root_session_id VARCHAR(128) COLLATE "C" NOT NULL,
+    device_id       VARCHAR(64)  COLLATE "C" NOT NULL,
+    owner_tenant    VARCHAR(190) COLLATE "C" NOT NULL,
+    owner_subject   VARCHAR(190) COLLATE "C" NOT NULL,
+    bound_at        TIMESTAMPTZ(3) NOT NULL DEFAULT now(),
+    rev             BIGINT       NOT NULL DEFAULT 0,
+    PRIMARY KEY (root_session_id)
+  )`);
+    await q(`CREATE INDEX IF NOT EXISTS idx_device_session_device ON ${DEVICE_SESSIONS_TABLE} (device_id)`);
+    await q(`CREATE TABLE IF NOT EXISTS ${DEVICE_AUDIT_TABLE} (
+    id            BIGSERIAL    PRIMARY KEY,
+    at            TIMESTAMPTZ(3) NOT NULL DEFAULT now(),
+    event         VARCHAR(64)  COLLATE "C" NOT NULL,
+    device_id     VARCHAR(64)  COLLATE "C",
+    owner_tenant  VARCHAR(190) COLLATE "C",
+    owner_subject VARCHAR(190) COLLATE "C",
+    detail        JSONB,
+    CONSTRAINT ck_device_audit_event CHECK (event IN (${AUDIT_EVENT_CHECK}))
+  )`);
+    await q(`CREATE INDEX IF NOT EXISTS idx_device_audit_device ON ${DEVICE_AUDIT_TABLE} (device_id, at)`);
+    await q(`CREATE INDEX IF NOT EXISTS idx_device_audit_event ON ${DEVICE_AUDIT_TABLE} (event, at)`);
+}
+const ms = (dialect, col, alias) => dialect === "tidb" ? `ROUND(UNIX_TIMESTAMP(${col}) * 1000) AS ${alias}` : `(EXTRACT(EPOCH FROM ${col}) * 1000)::bigint AS ${alias}`;
+const NOW = (dialect) => (dialect === "tidb" ? "NOW(3)" : "now()");
+const nowPlusSeconds = (dialect, placeholder) => dialect === "tidb" ? `NOW(3) + INTERVAL ${placeholder} SECOND` : `now() + (${placeholder}::double precision * INTERVAL '1 second')`;
+function deviceCols(dialect) {
+    return [
+        "device_id",
+        "owner_tenant",
+        "owner_subject",
+        "display_name",
+        "platform_os",
+        "platform_arch",
+        "pubkey",
+        ms(dialect, "pubkey_rotated_at", "pubkey_rotated_at_ms"),
+        "workspace_root",
+        "workspace_root_rev",
+        "status",
+        ms(dialect, "revoked_at", "revoked_at_ms"),
+        "revoked_by",
+        "revoke_reason",
+        "conn_epoch",
+        "replica_id",
+        "conn_generation",
+        ms(dialect, "lease_expires_at", "lease_expires_at_ms"),
+        ms(dialect, "connected_at", "connected_at_ms"),
+        ms(dialect, "last_seen_at", "last_seen_at_ms"),
+        ms(dialect, "created_at", "created_at_ms"),
+        "rev",
+    ].join(", ");
+}
+function onlineCol(dialect) {
+    return `(CASE WHEN status = 'active' AND lease_expires_at IS NOT NULL AND lease_expires_at > ${NOW(dialect)} THEN 1 ELSE 0 END) AS online`;
+}
+function tokenCols(dialect) {
+    return [
+        "token_hash",
+        "target_tenant",
+        "target_subject",
+        "created_by",
+        ms(dialect, "created_at", "created_at_ms"),
+        ms(dialect, "expires_at", "expires_at_ms"),
+        ms(dialect, "consumed_at", "consumed_at_ms"),
+        "consumed_device_id",
+        "consumed_pubkey",
+        "rev",
+    ].join(", ");
+}
+function sessionCols(dialect) {
+    return ["root_session_id", "device_id", "owner_tenant", "owner_subject", ms(dialect, "bound_at", "bound_at_ms"), "rev"].join(", ");
+}
+function auditCols(dialect) {
+    return ["id", ms(dialect, "at", "at_ms"), "event", "device_id", "owner_tenant", "owner_subject", "detail"].join(", ");
+}
+function bufToStr(v) {
+    return Buffer.isBuffer(v) ? v.toString("utf8") : String(v);
+}
+function strOrNull(v) {
+    return v === null || v === undefined ? null : bufToStr(v);
+}
+function numOrNull(v) {
+    return v === null || v === undefined ? null : Number(v);
+}
+function mapDeviceRow(r) {
+    return {
+        deviceId: bufToStr(r.device_id),
+        owner: { tenant: bufToStr(r.owner_tenant), subject: bufToStr(r.owner_subject) },
+        displayName: bufToStr(r.display_name),
+        platformOs: parseDevicePlatformOs(bufToStr(r.platform_os)),
+        platformArch: bufToStr(r.platform_arch),
+        pubkey: bufToStr(r.pubkey),
+        pubkeyRotatedAtMs: numOrNull(r.pubkey_rotated_at_ms),
+        workspaceRoot: bufToStr(r.workspace_root),
+        workspaceRootRev: Number(r.workspace_root_rev),
+        status: parseDeviceStatus(bufToStr(r.status)),
+        revokedAtMs: numOrNull(r.revoked_at_ms),
+        revokedBy: strOrNull(r.revoked_by),
+        revokeReason: strOrNull(r.revoke_reason),
+        connEpoch: strOrNull(r.conn_epoch),
+        replicaId: strOrNull(r.replica_id),
+        connGeneration: Number(r.conn_generation),
+        leaseExpiresAtMs: numOrNull(r.lease_expires_at_ms),
+        connectedAtMs: numOrNull(r.connected_at_ms),
+        lastSeenAtMs: numOrNull(r.last_seen_at_ms),
+        createdAtMs: Number(r.created_at_ms),
+        rev: Number(r.rev),
+    };
+}
+function mapTokenRow(r) {
+    return {
+        tokenHash: bufToStr(r.token_hash),
+        target: { tenant: bufToStr(r.target_tenant), subject: bufToStr(r.target_subject) },
+        createdBy: bufToStr(r.created_by),
+        createdAtMs: Number(r.created_at_ms),
+        expiresAtMs: Number(r.expires_at_ms),
+        consumedAtMs: numOrNull(r.consumed_at_ms),
+        consumedDeviceId: strOrNull(r.consumed_device_id),
+        consumedPubkey: strOrNull(r.consumed_pubkey),
+        rev: Number(r.rev),
+    };
+}
+function mapSessionRow(r) {
+    return {
+        rootSessionId: bufToStr(r.root_session_id),
+        deviceId: bufToStr(r.device_id),
+        owner: { tenant: bufToStr(r.owner_tenant), subject: bufToStr(r.owner_subject) },
+        boundAtMs: Number(r.bound_at_ms),
+        rev: Number(r.rev),
+    };
+}
+function parseJsonColumn(v) {
+    return JSON.parse(v);
+}
+function mapAuditRow(r) {
+    const tenant = strOrNull(r.owner_tenant);
+    const subject = strOrNull(r.owner_subject);
+    const rawDetail = r.detail;
+    return {
+        id: Number(r.id),
+        atMs: Number(r.at_ms),
+        event: parseDeviceAuditEvent(bufToStr(r.event)),
+        deviceId: strOrNull(r.device_id),
+        owner: tenant !== null && subject !== null ? { tenant, subject } : null,
+        detail: rawDetail === null || rawDetail === undefined ? null : typeof rawDetail === "string" ? parseJsonColumn(rawDetail) : rawDetail,
+    };
+}
+function ph(dialect, n) {
+    return dialect === "tidb" ? "?" : `$${n}`;
+}
+function dupKeyName(dialect, err) {
+    if (dialect === "tidb") {
+        const msg = String(err?.sqlMessage ?? err?.message ?? "");
+        if (new RegExp(UQ_DEVICES_PUBKEY, "i").test(msg))
+            return "pubkey";
+        if (/PRIMARY/i.test(msg))
+            return "primary";
+        return "other";
+    }
+    const c = String(err?.constraint ?? "");
+    if (c === UQ_DEVICES_PUBKEY)
+        return "pubkey";
+    if (/pkey$/i.test(c))
+        return "primary";
+    return "other";
+}
+export class SqlDeviceStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    json(value) {
+        return dialectJsonEncoder(this.db.dialect)(value);
+    }
+    async issueEnrollToken(input) {
+        assertIssueTokenShape(input);
+        try {
+            await this.db.query(this.q(`INSERT INTO ${DEVICE_ENROLL_TOKENS_TABLE} (token_hash, target_tenant, target_subject, created_by, created_at, expires_at, consumed_at, consumed_device_id, consumed_pubkey, rev)
+           VALUES (?, ?, ?, ?, NOW(3), ${nowPlusSeconds("tidb", "?")}, NULL, NULL, NULL, 0)`, `INSERT INTO ${DEVICE_ENROLL_TOKENS_TABLE} (token_hash, target_tenant, target_subject, created_by, created_at, expires_at, consumed_at, consumed_device_id, consumed_pubkey, rev)
+           VALUES ($1, $2, $3, $4, now(), ${nowPlusSeconds("pg", "$5")}, NULL, NULL, NULL, 0)`), [input.tokenHash, input.target.tenant, input.target.subject, input.createdBy, input.ttlSeconds]);
+        }
+        catch (err) {
+            if (!isDupKeyError(this.db.dialect, err))
+                throw err;
+            throw new Error("device-store: enrollment token hash already exists (a token hash is minted once)");
+        }
+        const row = await this.getEnrollToken(input.tokenHash);
+        if (!row)
+            throw new Error("device-store: enrollment token vanished immediately after insert");
+        return row;
+    }
+    async getEnrollToken(tokenHash) {
+        assertEnrollTokenHashShape(tokenHash);
+        const { rows } = await this.db.query(this.q(`SELECT ${tokenCols("tidb")} FROM ${DEVICE_ENROLL_TOKENS_TABLE} WHERE token_hash = ?`, `SELECT ${tokenCols("pg")} FROM ${DEVICE_ENROLL_TOKENS_TABLE} WHERE token_hash = $1`), [tokenHash]);
+        return rows[0] ? mapTokenRow(rows[0]) : null;
+    }
+    async consumeEnrollToken(input) {
+        assertEnrollTokenHashShape(input.tokenHash);
+        assertDeviceOwnerShape(input.requester);
+        assertNewDeviceShape(input.device);
+        if (input.device.owner.tenant !== input.requester.tenant || input.device.owner.subject !== input.requester.subject) {
+            return { outcome: "principal_mismatch" };
+        }
+        const conn = await this.db.connect();
+        try {
+            await conn.beginPessimistic();
+            const cas = await conn.query(this.q(`UPDATE ${DEVICE_ENROLL_TOKENS_TABLE} SET consumed_at = NOW(3), consumed_device_id = ?, consumed_pubkey = ?, rev = rev + 1
+            WHERE token_hash = ? AND consumed_at IS NULL AND expires_at > NOW(3) AND target_tenant = ? AND target_subject = ?`, `UPDATE ${DEVICE_ENROLL_TOKENS_TABLE} SET consumed_at = now(), consumed_device_id = $1, consumed_pubkey = $2, rev = rev + 1
+            WHERE token_hash = $3 AND consumed_at IS NULL AND expires_at > now() AND target_tenant = $4 AND target_subject = $5`), [input.device.deviceId, input.device.pubkey, input.tokenHash, input.requester.tenant, input.requester.subject]);
+            if (cas.affected === 1) {
+                try {
+                    await conn.query(this.q(`INSERT INTO ${DEVICES_TABLE} (device_id, owner_tenant, owner_subject, display_name, platform_os, platform_arch, pubkey, workspace_root, workspace_root_rev, status, conn_generation, created_at, rev)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, 'active', 0, NOW(3), 0)`, `INSERT INTO ${DEVICES_TABLE} (device_id, owner_tenant, owner_subject, display_name, platform_os, platform_arch, pubkey, workspace_root, workspace_root_rev, status, conn_generation, created_at, rev)
+               VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 0, 'active', 0, now(), 0)`), [
+                        input.device.deviceId,
+                        input.device.owner.tenant,
+                        input.device.owner.subject,
+                        input.device.displayName ?? "",
+                        input.device.platformOs,
+                        input.device.platformArch ?? "",
+                        input.device.pubkey,
+                        input.device.workspaceRoot,
+                    ]);
+                }
+                catch (err) {
+                    await conn.rollback();
+                    if (!isDupKeyError(this.db.dialect, err))
+                        throw err;
+                    const which = dupKeyName(this.db.dialect, err);
+                    if (which !== "pubkey")
+                        throw err;
+                    return { outcome: "pubkey_taken" };
+                }
+                await this.insertAuditOn(conn, { event: "device_enrolled", deviceId: input.device.deviceId, owner: input.device.owner, detail: { platformOs: input.device.platformOs } });
+                await conn.commit();
+                const device = await this.readDeviceOn(conn, input.device.deviceId);
+                if (!device)
+                    throw new Error("device-store: enrolled device vanished immediately after commit");
+                return { outcome: "enrolled", device };
+            }
+            await conn.rollback();
+            const { rows } = await conn.query(this.q(`SELECT ${tokenCols("tidb")} FROM ${DEVICE_ENROLL_TOKENS_TABLE} WHERE token_hash = ?`, `SELECT ${tokenCols("pg")} FROM ${DEVICE_ENROLL_TOKENS_TABLE} WHERE token_hash = $1`), [input.tokenHash]);
+            const token = rows[0] ? mapTokenRow(rows[0]) : null;
+            if (!token)
+                return { outcome: "unknown_token" };
+            if (token.target.tenant !== input.requester.tenant || token.target.subject !== input.requester.subject)
+                return { outcome: "principal_mismatch" };
+            if (token.consumedAtMs !== null) {
+                if (token.consumedPubkey !== input.device.pubkey)
+                    return { outcome: "token_reuse" };
+                const device = token.consumedDeviceId ? await this.readDeviceOn(conn, token.consumedDeviceId) : null;
+                return { outcome: "replayed", device };
+            }
+            return { outcome: "expired" };
+        }
+        catch (err) {
+            await conn.rollback().catch(() => undefined);
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async readDeviceOn(conn, deviceId) {
+        const { rows } = await conn.query(this.q(`SELECT ${deviceCols("tidb")} FROM ${DEVICES_TABLE} WHERE device_id = ?`, `SELECT ${deviceCols("pg")} FROM ${DEVICES_TABLE} WHERE device_id = $1`), [deviceId]);
+        return rows[0] ? mapDeviceRow(rows[0]) : null;
+    }
+    async readDeviceForAdmission(deviceId, owner) {
+        assertDeviceIdShape(deviceId);
+        assertDeviceOwnerShape(owner);
+        const { rows } = await this.db.query(this.q(`SELECT ${deviceCols("tidb")}, ${onlineCol("tidb")} FROM ${DEVICES_TABLE} WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ?`, `SELECT ${deviceCols("pg")}, ${onlineCol("pg")} FROM ${DEVICES_TABLE} WHERE device_id = $1 AND owner_tenant = $2 AND owner_subject = $3`), [deviceId, owner.tenant, owner.subject]);
+        const r = rows[0];
+        return r ? { row: mapDeviceRow(r), online: Number(r.online) === 1 } : null;
+    }
+    async getDeviceUnscoped(deviceId) {
+        assertDeviceIdShape(deviceId);
+        const { rows } = await this.db.query(this.q(`SELECT ${deviceCols("tidb")} FROM ${DEVICES_TABLE} WHERE device_id = ?`, `SELECT ${deviceCols("pg")} FROM ${DEVICES_TABLE} WHERE device_id = $1`), [deviceId]);
+        return rows[0] ? mapDeviceRow(rows[0]) : null;
+    }
+    async listDevicesByOwner(owner) {
+        assertDeviceOwnerShape(owner);
+        const { rows } = await this.db.query(this.q(`SELECT ${deviceCols("tidb")} FROM ${DEVICES_TABLE} WHERE owner_tenant = ? AND owner_subject = ? ORDER BY device_id ASC`, `SELECT ${deviceCols("pg")} FROM ${DEVICES_TABLE} WHERE owner_tenant = $1 AND owner_subject = $2 ORDER BY device_id ASC`), [owner.tenant, owner.subject]);
+        return rows.map(mapDeviceRow);
+    }
+    async revokeDevice(input) {
+        assertRevokeShape(input);
+        const conn = await this.db.connect();
+        try {
+            await conn.beginPessimistic();
+            const cas = await conn.query(this.q(`UPDATE ${DEVICES_TABLE} SET status = 'revoked', revoked_at = NOW(3), revoked_by = ?, revoke_reason = ?, lease_expires_at = NULL, conn_generation = conn_generation + 1, rev = rev + 1
+            WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ? AND status = 'active'`, `UPDATE ${DEVICES_TABLE} SET status = 'revoked', revoked_at = now(), revoked_by = $1, revoke_reason = $2, lease_expires_at = NULL, conn_generation = conn_generation + 1, rev = rev + 1
+            WHERE device_id = $3 AND owner_tenant = $4 AND owner_subject = $5 AND status = 'active'`), [input.revokedBy, input.reason ?? null, input.deviceId, input.owner.tenant, input.owner.subject]);
+            if (cas.affected === 1) {
+                await this.insertAuditOn(conn, { event: "device_revoked", deviceId: input.deviceId, owner: input.owner, detail: { revokedBy: input.revokedBy, reason: input.reason ?? null } });
+                await conn.commit();
+                const row = await this.readDeviceOn(conn, input.deviceId);
+                if (!row)
+                    throw new Error("device-store: revoked device vanished immediately after commit");
+                return { outcome: "revoked", row };
+            }
+            await conn.rollback();
+            const { rows } = await conn.query(this.q(`SELECT ${deviceCols("tidb")} FROM ${DEVICES_TABLE} WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ?`, `SELECT ${deviceCols("pg")} FROM ${DEVICES_TABLE} WHERE device_id = $1 AND owner_tenant = $2 AND owner_subject = $3`), [input.deviceId, input.owner.tenant, input.owner.subject]);
+            if (!rows[0])
+                return { outcome: "not_found" };
+            return { outcome: "already_revoked", row: mapDeviceRow(rows[0]) };
+        }
+        catch (err) {
+            await conn.rollback().catch(() => undefined);
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async acquireConnection(input) {
+        assertAcquireShape(input);
+        const conn = await this.db.connect();
+        try {
+            await conn.beginPessimistic();
+            const cas = await conn.query(this.q(`UPDATE ${DEVICES_TABLE} SET conn_generation = conn_generation + 1, conn_epoch = ?, replica_id = ?, lease_expires_at = ${nowPlusSeconds("tidb", "?")}, connected_at = NOW(3), last_seen_at = NOW(3), rev = rev + 1
+            WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ? AND status = 'active' AND (lease_expires_at IS NULL OR lease_expires_at <= NOW(3))`, `UPDATE ${DEVICES_TABLE} SET conn_generation = conn_generation + 1, conn_epoch = $1, replica_id = $2, lease_expires_at = ${nowPlusSeconds("pg", "$3")}, connected_at = now(), last_seen_at = now(), rev = rev + 1
+            WHERE device_id = $4 AND owner_tenant = $5 AND owner_subject = $6 AND status = 'active' AND (lease_expires_at IS NULL OR lease_expires_at <= now())`), [input.connEpoch, input.replicaId, input.leaseSeconds, input.deviceId, input.owner.tenant, input.owner.subject]);
+            const { rows } = await conn.query(this.q(`SELECT conn_generation, status FROM ${DEVICES_TABLE} WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ? FOR UPDATE`, `SELECT conn_generation, status FROM ${DEVICES_TABLE} WHERE device_id = $1 AND owner_tenant = $2 AND owner_subject = $3 FOR UPDATE`), [input.deviceId, input.owner.tenant, input.owner.subject]);
+            await conn.commit();
+            if (cas.affected === 1)
+                return { outcome: "acquired", generation: Number(rows[0]?.conn_generation) };
+            if (!rows[0])
+                return { outcome: "device_not_found" };
+            if (parseDeviceStatus(bufToStr(rows[0].status)) !== "active")
+                return { outcome: "device_revoked" };
+            return { outcome: "attached_elsewhere", generation: Number(rows[0].conn_generation) };
+        }
+        catch (err) {
+            await conn.rollback().catch(() => undefined);
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async heartbeatConnection(input) {
+        assertDeviceIdShape(input.deviceId);
+        assertWholeSeconds("leaseSeconds", input.leaseSeconds);
+        const res = await this.db.query(this.q(`UPDATE ${DEVICES_TABLE} SET last_seen_at = NOW(3), lease_expires_at = ${nowPlusSeconds("tidb", "?")}, rev = rev + 1 WHERE device_id = ? AND conn_generation = ? AND status = 'active'`, `UPDATE ${DEVICES_TABLE} SET last_seen_at = now(), lease_expires_at = ${nowPlusSeconds("pg", "$1")}, rev = rev + 1 WHERE device_id = $2 AND conn_generation = $3 AND status = 'active'`), [input.leaseSeconds, input.deviceId, input.generation]);
+        return res.affected === 1;
+    }
+    async releaseConnection(deviceId, generation) {
+        assertDeviceIdShape(deviceId);
+        const res = await this.db.query(this.q(`UPDATE ${DEVICES_TABLE} SET lease_expires_at = NULL, rev = rev + 1 WHERE device_id = ? AND conn_generation = ?`, `UPDATE ${DEVICES_TABLE} SET lease_expires_at = NULL, rev = rev + 1 WHERE device_id = $1 AND conn_generation = $2`), [deviceId, generation]);
+        return res.affected === 1;
+    }
+    async bindSession(input) {
+        assertRootSessionIdShape(input.rootSessionId);
+        assertDeviceIdShape(input.deviceId);
+        assertDeviceOwnerShape(input.owner);
+        const conn = await this.db.connect();
+        try {
+            await conn.beginPessimistic();
+            const dev = await conn.query(this.q(`SELECT status FROM ${DEVICES_TABLE} WHERE device_id = ? AND owner_tenant = ? AND owner_subject = ? FOR UPDATE`, `SELECT status FROM ${DEVICES_TABLE} WHERE device_id = $1 AND owner_tenant = $2 AND owner_subject = $3 FOR UPDATE`), [input.deviceId, input.owner.tenant, input.owner.subject]);
+            if (!dev.rows[0]) {
+                await conn.rollback();
+                return { outcome: "device_not_found" };
+            }
+            if (parseDeviceStatus(bufToStr(dev.rows[0].status)) !== "active") {
+                await conn.rollback();
+                return { outcome: "device_revoked" };
+            }
+            const ins = await conn.query(this.q(`INSERT IGNORE INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES (?, ?, ?, ?, NOW(3), 0)`, `INSERT INTO ${DEVICE_SESSIONS_TABLE} (root_session_id, device_id, owner_tenant, owner_subject, bound_at, rev) VALUES ($1, $2, $3, $4, now(), 0) ON CONFLICT (root_session_id) DO NOTHING`), [input.rootSessionId, input.deviceId, input.owner.tenant, input.owner.subject]);
+            const { rows } = await conn.query(this.q(`SELECT ${sessionCols("tidb")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = ? FOR UPDATE`, `SELECT ${sessionCols("pg")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = $1 FOR UPDATE`), [input.rootSessionId]);
+            await conn.commit();
+            const row = rows[0] ? mapSessionRow(rows[0]) : null;
+            if (!row)
+                throw new Error("device-store: session binding vanished immediately after insert");
+            if (ins.affected === 1)
+                return { outcome: "bound", row };
+            const same = row.deviceId === input.deviceId && row.owner.tenant === input.owner.tenant && row.owner.subject === input.owner.subject;
+            return { outcome: same ? "idempotent" : "conflict", row };
+        }
+        catch (err) {
+            await conn.rollback().catch(() => undefined);
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async getSessionBinding(rootSessionId) {
+        assertRootSessionIdShape(rootSessionId);
+        const { rows } = await this.db.query(this.q(`SELECT ${sessionCols("tidb")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = ?`, `SELECT ${sessionCols("pg")} FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = $1`), [rootSessionId]);
+        return rows[0] ? mapSessionRow(rows[0]) : null;
+    }
+    async deleteByRootSession(rootSessionId) {
+        assertRootSessionIdShape(rootSessionId);
+        const res = await this.db.query(this.q(`DELETE FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = ?`, `DELETE FROM ${DEVICE_SESSIONS_TABLE} WHERE root_session_id = $1`), [rootSessionId]);
+        return res.affected;
+    }
+    async appendAudit(input) {
+        await this.insertAuditOn(this.db, input);
+    }
+    async insertAuditOn(exec, input) {
+        if (input.deviceId != null)
+            assertDeviceIdShape(input.deviceId);
+        if (input.owner)
+            assertDeviceOwnerShape(input.owner);
+        await exec.query(this.q(`INSERT INTO ${DEVICE_AUDIT_TABLE} (at, event, device_id, owner_tenant, owner_subject, detail) VALUES (NOW(3), ?, ?, ?, ?, ?)`, `INSERT INTO ${DEVICE_AUDIT_TABLE} (at, event, device_id, owner_tenant, owner_subject, detail) VALUES (now(), $1, $2, $3, $4, $5::jsonb)`), [input.event, input.deviceId ?? null, input.owner?.tenant ?? null, input.owner?.subject ?? null, input.detail === undefined ? null : this.json(input.detail)]);
+    }
+    async listAudit(filter) {
+        const dialect = this.db.dialect;
+        const where = [];
+        const params = [];
+        if (filter?.deviceId !== undefined) {
+            assertDeviceIdShape(filter.deviceId);
+            params.push(filter.deviceId);
+            where.push(`device_id = ${ph(dialect, params.length)}`);
+        }
+        if (filter?.event !== undefined) {
+            params.push(filter.event);
+            where.push(`event = ${ph(dialect, params.length)}`);
+        }
+        if (filter?.owner !== undefined) {
+            assertDeviceOwnerShape(filter.owner);
+            params.push(filter.owner.tenant);
+            const t = ph(dialect, params.length);
+            params.push(filter.owner.subject);
+            where.push(`owner_tenant = ${t} AND owner_subject = ${ph(dialect, params.length)}`);
+        }
+        const limit = Math.max(1, Math.min(1000, filter?.limit ?? 100));
+        params.push(limit);
+        const { rows } = await this.db.query(`SELECT ${auditCols(dialect)} FROM ${DEVICE_AUDIT_TABLE}${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY at ASC, id ASC LIMIT ${ph(dialect, params.length)}`, params);
+        return rows.map(mapAuditRow);
+    }
+}
+export class TiDBDeviceStore extends SqlDeviceStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgDeviceStore extends SqlDeviceStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=device-store-sql.js.map