@sema-agent/server 7.50.0 → 7.52.0

package/dist/plugins/blob-backend.d.ts

@@ -50,7 +50,9 @@ export declare class SqlBlobBackend implements BlobBackend {
     private readonly pool;
     /** Effective per-blob cap: explicit ctor value wins; else tidb=SQL_BLOB_DEFAULT_MAX_BYTES, pg=uncapped. */
     private readonly capBytes;
-    constructor(dialect: "tidb" | "pg", pool: MysqlPool | PgPool, maxBytes?: number);
+    /** Blob-domain table (S-15 blob 域隔离:file-history 域用自己的表,reap/GC 不跨域)。代码内字面量,非用户输入。 */
+    private readonly table;
+    constructor(dialect: "tidb" | "pg", pool: MysqlPool | PgPool, maxBytes?: number, table?: string);
     /** The created_at-refreshing content-addressed upsert — VERBATIM the tidb/pg stores' `putBlobRow`. Refreshes
      *  created_at even on a dedup hit so a re-used/just-written blob is "touched=now" and GC-grace-protected.
      *  (a): an over-cap blob is REJECTED (typed {@link BlobTooLargeError}) BEFORE the driver ever sees the bytes —
@@ -103,7 +105,7 @@ export interface MinioBlobBackendConfig {
  * importManifest content-address check the SQL stores already do.
  */
 /** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
- *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 钉死 restore/session-import
+ *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 卡住 restore/session-import
  *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
  *  注释同口径),远小于病形。send-user-file 与 leader/diffup 同 import 此常量。 */
 export declare const OBJECT_STORE_IO_TIMEOUT_MS = 120000;
@@ -117,9 +119,12 @@ export declare class MinioBlobBackend implements BlobBackend {
      *  path). The file-snapshot stores ALWAYS pass the pool, so the live reference-tracking always has the index. */
     private readonly indexPool?;
     private readonly indexDialect?;
+    /** Blob-domain index table (S-15 域隔离,SqlBlobBackend.table 同款;默认 = E19 纪元的 snapshot_blob)。 */
+    private readonly indexTable;
     constructor(cfg: MinioBlobBackendConfig, index?: {
         dialect: "tidb" | "pg";
         pool: MysqlPool | PgPool;
+        table?: string;
     });
     private objectKey;
     private presign;

package/dist/plugins/blob-backend.js

@@ -27,48 +27,50 @@ export class SqlBlobBackend {
     dialect;
     pool;
     capBytes;
-    constructor(dialect, pool, maxBytes) {
+    table;
+    constructor(dialect, pool, maxBytes, table = "snapshot_blob") {
         this.dialect = dialect;
         this.pool = pool;
         this.capBytes = maxBytes ?? (dialect === "tidb" ? SQL_BLOB_DEFAULT_MAX_BYTES : Number.POSITIVE_INFINITY);
+        this.table = table;
     }
     async putBlob(hash, bytes) {
         if (bytes.byteLength > this.capBytes)
             throw new BlobTooLargeError(bytes.byteLength, this.capBytes);
         if (this.dialect === "tidb") {
-            await this.pool.query("INSERT INTO snapshot_blob (blob_hash, byte_len, bytes, created_at) VALUES (?,?,?,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)", [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
+            await this.pool.query(`INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,?,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`, [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
         }
         else {
-            await this.pool.query("INSERT INTO snapshot_blob (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,$3,$4) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at", [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
+            await this.pool.query(`INSERT INTO ${this.table} (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,$3,$4) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at`, [hash, bytes.byteLength, Buffer.from(bytes), new Date()]);
         }
     }
     async getBlob(hash) {
         if (this.dialect === "tidb") {
-            const [rows] = await this.pool.query("SELECT bytes FROM snapshot_blob WHERE blob_hash = ?", [hash]);
+            const [rows] = await this.pool.query(`SELECT bytes FROM ${this.table} WHERE blob_hash = ?`, [hash]);
             return rows[0]?.bytes != null ? new Uint8Array(rows[0].bytes) : undefined;
         }
-        const b = await this.pool.query("SELECT bytes FROM snapshot_blob WHERE blob_hash = $1", [hash]);
+        const b = await this.pool.query(`SELECT bytes FROM ${this.table} WHERE blob_hash = $1`, [hash]);
         return b.rows[0]?.bytes != null ? new Uint8Array(b.rows[0].bytes) : undefined;
     }
     async hasBlobs(hashes) {
-        return sqlHasBlobs(this.dialect, this.pool, hashes);
+        return sqlHasBlobs(this.dialect, this.pool, hashes, this.table);
     }
     async deleteBlobs(hashes) {
-        const deleted = await sqlDeleteIndexRowsPastGrace(this.dialect, this.pool, hashes);
+        const deleted = await sqlDeleteIndexRowsPastGrace(this.dialect, this.pool, hashes, this.table);
         return deleted.length;
     }
 }
-async function sqlHasBlobs(dialect, pool, hashes) {
+async function sqlHasBlobs(dialect, pool, hashes, table = "snapshot_blob") {
     if (hashes.length === 0)
         return new Set();
     const distinct = [...new Set(hashes)];
     if (dialect === "tidb") {
         const ph = distinct.map(() => "?").join(",");
-        const [rows] = await pool.query(`SELECT blob_hash FROM snapshot_blob WHERE blob_hash IN (${ph})`, distinct);
+        const [rows] = await pool.query(`SELECT blob_hash FROM ${table} WHERE blob_hash IN (${ph})`, distinct);
         return new Set(rows.map((r) => String(r.blob_hash)));
     }
     const ph = distinct.map((_, i) => `$${i + 1}`).join(",");
-    const r = await pool.query(`SELECT blob_hash FROM snapshot_blob WHERE blob_hash IN (${ph})`, distinct);
+    const r = await pool.query(`SELECT blob_hash FROM ${table} WHERE blob_hash IN (${ph})`, distinct);
     return new Set(r.rows.map((row) => row.blob_hash));
 }
 export async function sqlBlobSizes(dialect, pool, hashes) {
@@ -94,7 +96,7 @@ export async function sqlBlobSizes(dialect, pool, hashes) {
     }
     return out;
 }
-async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes) {
+async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes, table = "snapshot_blob") {
     if (hashes.length === 0)
         return [];
     const distinct = [...new Set(hashes)];
@@ -102,20 +104,20 @@ async function sqlDeleteIndexRowsPastGrace(dialect, pool, hashes) {
     if (dialect === "tidb") {
         const ph = distinct.map(() => "?").join(",");
         const grace = await pool
-            .query(`SELECT blob_hash FROM snapshot_blob WHERE created_at < ? AND blob_hash IN (${ph})`, [cutoff, ...distinct])
+            .query(`SELECT blob_hash FROM ${table} WHERE created_at < ? AND blob_hash IN (${ph})`, [cutoff, ...distinct])
             .then(([rows]) => rows.map((r) => String(r.blob_hash)))
             .catch(() => []);
         if (grace.length === 0)
             return [];
         const gph = grace.map(() => "?").join(",");
         await pool
-            .query(`DELETE FROM snapshot_blob WHERE created_at < ? AND blob_hash IN (${gph})`, [cutoff, ...grace])
+            .query(`DELETE FROM ${table} WHERE created_at < ? AND blob_hash IN (${gph})`, [cutoff, ...grace])
             .catch(() => undefined);
         return grace;
     }
     const ph = distinct.map((_, i) => `$${i + 2}`).join(",");
     const r = await pool
-        .query(`DELETE FROM snapshot_blob WHERE created_at < $1 AND blob_hash IN (${ph}) RETURNING blob_hash`, [cutoff, ...distinct])
+        .query(`DELETE FROM ${table} WHERE created_at < $1 AND blob_hash IN (${ph}) RETURNING blob_hash`, [cutoff, ...distinct])
         .catch(() => undefined);
     return (r?.rows ?? []).map((row) => row.blob_hash);
 }
@@ -126,10 +128,12 @@ export class MinioBlobBackend {
     ttl;
     indexPool;
     indexDialect;
+    indexTable;
     constructor(cfg, index) {
         this.cfg = cfg;
         this.keyPrefix = cfg.keyPrefix ?? "blobs/";
         this.ttl = cfg.presignTtlSec ?? 3600;
+        this.indexTable = index?.table ?? "snapshot_blob";
         if (index) {
             this.indexDialect = index.dialect;
             this.indexPool = index.pool;
@@ -159,10 +163,10 @@ export class MinioBlobBackend {
         }
         if (this.indexPool && this.indexDialect) {
             if (this.indexDialect === "tidb") {
-                await this.indexPool.query("INSERT INTO snapshot_blob (blob_hash, byte_len, bytes, created_at) VALUES (?,?,NULL,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)", [hash, bytes.byteLength, new Date()]);
+                await this.indexPool.query(`INSERT INTO ${this.indexTable} (blob_hash, byte_len, bytes, created_at) VALUES (?,?,NULL,?) ON DUPLICATE KEY UPDATE created_at = VALUES(created_at)`, [hash, bytes.byteLength, new Date()]);
             }
             else {
-                await this.indexPool.query("INSERT INTO snapshot_blob (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,NULL,$3) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at", [hash, bytes.byteLength, new Date()]);
+                await this.indexPool.query(`INSERT INTO ${this.indexTable} (blob_hash, byte_len, bytes, created_at) VALUES ($1,$2,NULL,$3) ON CONFLICT (blob_hash) DO UPDATE SET created_at = EXCLUDED.created_at`, [hash, bytes.byteLength, new Date()]);
             }
         }
     }
@@ -188,7 +192,7 @@ export class MinioBlobBackend {
     }
     async hasBlobs(hashes) {
         if (this.indexPool && this.indexDialect)
-            return sqlHasBlobs(this.indexDialect, this.indexPool, hashes);
+            return sqlHasBlobs(this.indexDialect, this.indexPool, hashes, this.indexTable);
         const distinct = [...new Set(hashes)];
         const present = new Set();
         await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (hash) => {
@@ -254,7 +258,7 @@ export class MinioBlobBackend {
             return 0;
         let toDelete;
         if (this.indexPool && this.indexDialect) {
-            toDelete = await sqlDeleteIndexRowsPastGrace(this.indexDialect, this.indexPool, hashes);
+            toDelete = await sqlDeleteIndexRowsPastGrace(this.indexDialect, this.indexPool, hashes, this.indexTable);
         }
         else {
             toDelete = [...new Set(hashes)];

package/dist/plugins/caching-session-store.d.ts

@@ -55,8 +55,12 @@ export declare class CachingSessionStore implements SessionStore {
      *  run per session (→ listSessions `lastRunId`). MUST be forwarded: the local backend's Runner store is THIS cache
      *  wrapper, so without forwarding `noteTaskRun?.()` silently no-ops and lastRunId stays null (review BLOCKER). Pure
      *  pass-through to the inner store's in-mem map — no cache interaction. (TiDB/PG don't implement it → not bound.)
-     *  Return type matches core's `SessionStore.noteTaskRun?(): void | Promise<void>` (review: don't narrow to void). */
-    readonly noteTaskRun?: (sessionId: string, taskId: string) => void | Promise<void>;
+     *  Return type matches core's `SessionStore.noteTaskRun?(): void | Promise<void>` (review: don't narrow to void).
+     *  #499(core 5.65 增量批):第三参 = engine runId。绑定用的是 `.bind(inner)`(整函数),运行期本就
+     *  三参全转 —— 这里把**声明**对齐到 core 的三参形,免得读这行类型的人以为缝上只有两参(fork-routing
+     *  的两参形正是在运行期真丢过第三参的那个病,同批修)。内店(LocalSessionStore)今日仍是两参消费,
+     *  runId 落地候 sessions 列表 wire 键的 spec 节拍(见本批提货报告件1b)。 */
+    readonly noteTaskRun?: (sessionId: string, taskId: string, runId?: string) => void | Promise<void>;
     /** Write-once auto-title (SQL twins + local sidecar carry it; pure pass-through). */
     readonly setTitleIfNull?: (sessionId: string, title: string) => Promise<boolean>;
     readonly probeTitle?: (sessionId: string) => Promise<"none" | "untitled" | "titled">;
@@ -85,7 +89,7 @@ export declare class CachingSessionStore implements SessionStore {
     /** [2024](cli 取证)2c session-sync P1d-β — delegated STAGED import seam. 此前 staging 族不在本类的逐方法
      *  转发白名单里 ⇒ 默认部署(SESSION_CACHE_TTL_SEC=300 把真店包进本类)PUSH Phase A 恒 501
      *  `capability.session_store_required`,而 capabilities().sessionSync 谓词三项(backend/exportEntries/
-     *  fileSnapshotStore)都被转发了 ⇒ 照报 true(能力面谎)。转发形:handle 的 `commit` 是唯一写真 id 的
+     *  fileHistoryStore)都被转发了 ⇒ 照报 true(能力面谎)。转发形:handle 的 `commit` 是唯一写真 id 的
      *  时刻,成功后逐出该 id 的暖 handle + S25 指纹(importEntries/replaceEntries 同纪律);`abort` 只丢
      *  staging 行、不碰真 id ⇒ 不逐出。 */
     readonly beginImportStaging?: (realSessionId: string, token: string) => StagingHandle;

package/dist/plugins/checkpoint-store-sql.d.ts

@@ -14,7 +14,7 @@ import { type SqlDriver } from "./sql-driver.js";
  */
 export declare const TERMINAL_BACKSTOP_MS: number;
 /**
- * design/80 D-D (adversarial fix): the crash-safe `terminal_at_ms` backstop must fall STRICTLY AFTER any SLA
+ * design/80 D-D (cross-review fix): the crash-safe `terminal_at_ms` backstop must fall STRICTLY AFTER any SLA
  * `deadline`, never AT it. `terminal_at_ms = max(createdAt+backstop, deadline)` made the two coincide whenever an
  * operator tuned APPROVAL_TERMINAL_BACKSTOP_MS at/below the SLA — and reapExpired's terminal_at_ms-branch (which
  * has NO gate_kind filter) then abort-EXPIRED a human/irreversible_ask gate in the SAME tick the deny-sweep
@@ -116,7 +116,7 @@ export interface PendingCheckpoint {
  *     与同行 `tool_input` 在 mint 就 `redactDeep` 是**同一条**纪律(#209 件4 把 `shadowedRule` 修在读面
  *     是因为那条路的行早已落库、改铸点救不了存量;本键是**新**列,没有存量行要救,修在铸点更彻底:
  *     秘密从此连**落库**都不落,不是落了库再在两条读面各洗一遍)。
- *  3. **脱敏之后**才截长(codex 对抗复审 [medium],验真后修):`redactSecrets` 会**变长**,先按限长校验
+ *  3. **脱敏之后**才截长(codex 交叉复审 [medium],验真后修):`redactSecrets` 会**变长**,先按限长校验
  *     原文再脱敏会产出超限文本,而 SQL 腿有**回读**(列 → 本函数再跑一遍)、LOCAL 腿没有 ⇒ 同一份素材
  *     两个后端给出不同卡面。顺序反过来之后本函数对自己的输出**幂等**,两条腿同形。完整论证见
  *     `RuleOfferRawSchema` 顶注。

package/dist/plugins/device-store-sql.d.ts

@@ -0,0 +1,130 @@
+/**
+ * device lane 四表持久层(design/device-executor-lane-v2 §6)—— `DeviceStore` 双方言实现
+ * (`TiDBDeviceStore` / `PgDeviceStore`,SINGLE-FILE DUAL-DIALECT,design/158 A12 形:一个
+ * `SqlDeviceStore` 接 `SqlDriver`,两个薄 ctor 子类落方言绑定)。语义真源 = `../device-store.js`
+ * (类型 + 闭集 + InMemory 参照实现),准入链 = `../device-enrollment.js`。
+ *
+ * 四张表:
+ *   · `devices`              —— 设备注册簿 + presence 投影(单设备单活连 ⇒ 1:1,省一次 join,§6 注①)
+ *   · `device_enroll_tokens` —— 一次性 enrollment 凭据(明文一现,落库只有 sha256)
+ *   · `device_sessions`      —— **根会话**↔设备绑定(resume 路由真源,§4.5)
+ *   · `device_audit`         —— 安全轴事件审计(§4.8 标「审计行」的 8 个 event)
+ * 刻意**没有** `device_instructions` 表:指令 pending 表是内存态(§6 注③——指令比 run 短命,落库只会
+ * 造「表里 pending、run 已死」的僵尸行;at-most-once 靠 §5.3 投递边界,不靠指令落库)。
+ *
+ * ── CAS 铁则(与 approval-ask-store-sql.ts 头注同源,写在这里防遗忘)─────────────────────────────
+ * 1. 一切转移带 `WHERE <前态>`,赢 = affected 恰为 1。禁读-改-写两步(TOCTOU 窗口)。
+ * 2. 🔴 MySQL/TiDB `affectedRows` 坑:同值 UPDATE(SET 的新值与当前列逐字节相同)affectedRows=0
+ *    ——**所有** CAS UPDATE 因此必须带一个恒变列(`rev = rev + 1`)。本文件每一条 CAS UPDATE 都带。
+ *    在本店这条尤其致命:心跳续租在「同一毫秒内重复心跳」时 SET 的值可能与当前值相同,没有 rev
+ *    就会被判成「本连接已失权」⇒ 设备被自己的心跳踢下线。
+ * 3. 事务:`SqlDriver.connect()` → `begin()`/`beginPessimistic()` → `query()` → `commit()`,失败
+ *    `rollback()`。**失败臂的回读必须走当前这条 `conn`**(approval 店复审 F1 的真缺陷:走池级 query
+ *    会与自己持有的连接死锁),且**先 rollback 再读**(读到最新已提交视图)。
+ *
+ * ── 方言差异(A12 doctrine:每处显式写在调用点)────────────────────────────────────────────────────
+ *   - `?`(位置序) vs `$n`(显式编号);动态 WHERE(`listAudit`)靠 `ph(dialect, n)` 生成。
+ *   - `INSERT IGNORE` vs `ON CONFLICT (pk) DO NOTHING`(`bindSession` 的首绑 CAS)。
+ *   - `AUTO_INCREMENT` vs `BIGSERIAL`;`JSON` vs `JSONB`(+ `$n::jsonb` 显式 cast)。
+ *   - `KEY …` 内联 vs 独立 `CREATE INDEX IF NOT EXISTS`。
+ *   - 回读名单:PG 用 `UPDATE … RETURNING`,TiDB 无 RETURNING ⇒ 同事务 `UPDATE` 后 `SELECT`。
+ *   - 时长运算:`NOW(3) + INTERVAL ? SECOND` vs `now() + ($n::double precision * INTERVAL '1 second')`。
+ *   - 键列字节等价:MySQL `VARBINARY` vs PG `VARCHAR … COLLATE "C"`(理由见 ../device-store.ts 头注;
+ *     `utf8mb4_bin` **不够**,它仍是 PAD SPACE collation)。
+ *   - VARBINARY 的读回:mysql2 给 **Buffer**,PG 给 string ⇒ 一律过 `bufToStr`(mailbox 真库坑同解)。
+ *
+ * ── 时间列的存取形(§4.6 task-R3-F18「时间权威 = DB」的落地)──────────────────────────────────────
+ * 列是原生 `DATETIME(3)` / `TIMESTAMPTZ(3)`,但**跨边界一律是 epoch 毫秒**:写侧送**时长秒**由 SQL 从
+ * DB 的 now 起算,读侧在 SELECT 里就转成 `*_ms`。
+ * 🔴 为什么不让驱动把时间戳解成 JS `Date` 再比:①mysql2 按**进程**时区解析 DATETIME,DB 会话时区与
+ * Node 时区不同即整体偏移几小时(而这条偏移落在「租约还有效吗」上就是双主);②`Date.now()` 一旦进入
+ * 判据,副本时钟落后即越租。两条都在 SELECT 表达式里就地关掉。
+ */
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import { type SqlDriver } from "./sql-driver.js";
+import { type AcquireConnectionInput, type AcquireConnectionResult, type AppendAuditInput, type BindSessionInput, type BindSessionResult, type ConsumeEnrollTokenInput, type ConsumeEnrollTokenResult, type DeviceAdmissionView, type DeviceAuditRow, type DeviceEnrollTokenRow, type DeviceOwner, type DeviceRow, type DeviceSessionRow, type DeviceStore, type HeartbeatConnectionInput, type IssueEnrollTokenInput, type ListAuditFilter, type RevokeDeviceInput, type RevokeDeviceResult } from "../device-store.js";
+/**
+ * ── 命名(**落库一律单数**,与设计稿的复数形不同)──────────────────────────────────────────────────
+ * design v2 §6 的 DDL 写的是 `devices` / `device_sessions` / `device_enrollment_tokens`(复数),但本仓有一条
+ * 常驻机器门:`test/schema-naming-invariants.test.ts` 判据① —— 建表的表名必须在 `TABLE_VOCABULARY` 闭集里
+ * **且词表全是单数形**。#270 车1 的 `retention_hold` / `retention_tombstone` 是同一处先例(那份设计稿同样
+ * 写的复数,落库单数)。所以四张表落库名为 `device` / `device_session` / `device_enroll_token` /
+ * `device_audit`,**表结构与设计稿逐列一致**,只有名字随仓规。新表 = 先进词表再建。
+ */
+export declare const DEVICES_TABLE = "device";
+export declare const DEVICE_ENROLL_TOKENS_TABLE = "device_enroll_token";
+export declare const DEVICE_SESSIONS_TABLE = "device_session";
+export declare const DEVICE_AUDIT_TABLE = "device_audit";
+export declare const TIDB_DEVICE_STATEMENTS: readonly string[];
+/** {@link TIDB_DEVICE_STATEMENTS} 的遍历壳(集成测试用;生产装配由中央 ensureSchema 展开同一份数组)。 */
+export declare function ensureTiDBDeviceSchema(pool: MySqlPool): Promise<void>;
+type PgQuery = (sql: string, params?: unknown[]) => Promise<unknown>;
+export declare function ensurePgDeviceSchema(q: PgQuery): Promise<void>;
+export declare class SqlDeviceStore implements DeviceStore {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    private json;
+    issueEnrollToken(input: IssueEnrollTokenInput): Promise<DeviceEnrollTokenRow>;
+    getEnrollToken(tokenHash: string): Promise<DeviceEnrollTokenRow | null>;
+    /**
+     * §6 注册协议 —— **单事务**:消费 CAS + INSERT devices + 审计行一起提交。
+     *
+     * 谓词四件(缺一即 affected=0):`consumed_at IS NULL`(一次性)、`expires_at > NOW(3)`(TTL,DB 钟)、
+     * `target_tenant/target_subject` 等值(绑定 principal)。affected=0 的**理由**靠回滚后的回读判别 ——
+     * 顺序刻意是「先 principal 后消费态」:token 不是你的就连「它被没被用过」都不告诉你。
+     */
+    consumeEnrollToken(input: ConsumeEnrollTokenInput): Promise<ConsumeEnrollTokenResult>;
+    /** 事务内/持连接期间的设备回读(见 consumeEnrollToken 的 F2 注:此期间**禁**走池级读)。 */
+    private readDeviceOn;
+    readDeviceForAdmission(deviceId: string, owner: DeviceOwner): Promise<DeviceAdmissionView | null>;
+    getDeviceUnscoped(deviceId: string): Promise<DeviceRow | null>;
+    listDevicesByOwner(owner: DeviceOwner): Promise<DeviceRow[]>;
+    /**
+     * 吊销 = 终态 CAS(`status='active'` 前态)+ **租约作废 + 世代推进**(§8-R4 在途语义):
+     * 世代一推,在途连接的每一次带世代谓词的写(心跳/结果帧入账)当场影响 0 行 ⇒ 设备侧立即失权。
+     */
+    revokeDevice(input: RevokeDeviceInput): Promise<RevokeDeviceResult>;
+    /**
+     * 连接建立 = 带 expiry 的租约 CAS。谓词 `lease_expires_at IS NULL OR <= NOW(3)`:**活租约恒不被撕**
+     * (§5.2 单活连不变量;`DEVICE_SUPERSEDE=stale_only` 的语义就在这一句),过期租约才可被新连夺取。
+     * 赢家 `conn_generation` 单调 +1,后续所有写都带这个世代谓词。
+     */
+    acquireConnection(input: AcquireConnectionInput): Promise<AcquireConnectionResult>;
+    /**
+     * 心跳续租 —— 谓词 = **世代等值 + active**。影响 0 行 = 本连接已失权(被顶替 / 被吊销)⇒ 调用方
+     * 主动断开(§4.6 步 2)。
+     *
+     * 🔴 允许续一条**已过期但没被别人夺走**的租约(generation 未变 ⇒ 排他性仍在本连接手上);夺租者
+     * 一旦成功,generation 就变了,这条心跳当场 0 行。`rev = rev + 1` 是 CAS 铁则②:同毫秒重复心跳的
+     * SET 值可能与当前逐字节相同,没有它 MySQL 会把「成功」报成 affectedRows=0。
+     */
+    heartbeatConnection(input: HeartbeatConnectionInput): Promise<boolean>;
+    releaseConnection(deviceId: string, generation: number): Promise<boolean>;
+    /**
+     * §4.3.2 首绑写协议 —— **单事务**:设备校验(active ∧ owner)与 `INSERT IGNORE` 在一个事务里。
+     *
+     * 🔴 `beginPessimistic` + `FOR UPDATE`:设备行必须是**当前读**。快照读下,一次与吊销并发的绑定会
+     * 读到「还 active」的旧版本,于是把 session 绑到一台**刚被吊销**的设备上(sql-driver.ts 头注点名的
+     * double-admit 形)。
+     * 并发首绑:`INSERT IGNORE` / `ON CONFLICT DO NOTHING` 的 affected 是引擎对「谁赢」的权威回答;
+     * 输家回读既有行 —— 同 deviceId = 幂等成功,异 deviceId = `conflict`(无未定义态)。
+     */
+    bindSession(input: BindSessionInput): Promise<BindSessionResult>;
+    getSessionBinding(rootSessionId: string): Promise<DeviceSessionRow | null>;
+    deleteByRootSession(rootSessionId: string): Promise<number>;
+    appendAudit(input: AppendAuditInput): Promise<void>;
+    /** 审计写的**唯一**语句(池级与事务内共用;`SqlExec` 是两者的公共面)。 */
+    private insertAuditOn;
+    listAudit(filter?: ListAuditFilter): Promise<DeviceAuditRow[]>;
+}
+/** 方言绑定薄壳(A12 形:ctor 收池,行为全在基类)。 */
+export declare class TiDBDeviceStore extends SqlDeviceStore {
+    constructor(pool: MySqlPool);
+}
+export declare class PgDeviceStore extends SqlDeviceStore {
+    constructor(pool: PgPool);
+}
+export {};
+//# sourceMappingURL=device-store-sql.d.ts.map