@sema-agent/server 7.50.0 → 7.52.0

package/dist/http/tar.d.ts

@@ -1,17 +0,0 @@
-/**
- * 极小 ustar 写器(workspace 浏览面 #3 的 archive 端点用,[1882]/[1894])。零依赖(仓内 no-SDK 姿势,
- * 同 s3-presign/OTLP 先例)。只写 regular file 条目:512B ustar 头(prefix 155/name 100 拆分)+
- * 内容 512 对齐 + 两块零尾。**不做** PAX/GNU 长名扩展——快照 relPath 超过 prefix+name 可承载
- * (>255 或不可在 "/" 处拆)属病态路径,调用方按 fail-loud 处理(archive 面 422 点名)。
- */
-/** 把 relPath 拆成 ustar 的 (prefix ≤155, name ≤100);不可拆 ⇒ null(调用方 fail-loud)。 */
-export declare function splitTarPath(relPath: string): {
-    prefix: string;
-    name: string;
-} | null;
-export declare function tarHeader(relPath: string, sizeBytes: number, mtimeSec: number): Buffer;
-/** 内容块的 512 对齐尾垫(0 长内容=0 垫)。 */
-export declare function tarPadding(sizeBytes: number): Buffer;
-/** 归档终止:两块 512 零。 */
-export declare const TAR_END: Buffer<ArrayBuffer>;
-//# sourceMappingURL=tar.d.ts.map

package/dist/http/tar.js

@@ -1,53 +0,0 @@
-const BLOCK = 512;
-function octal(n, width) {
-    const s = n.toString(8).padStart(width - 1, "0");
-    return Buffer.from(s + "\0", "ascii");
-}
-export function splitTarPath(relPath) {
-    const bytes = Buffer.byteLength(relPath, "utf8");
-    if (bytes <= 100)
-        return { prefix: "", name: relPath };
-    if (bytes > 255)
-        return null;
-    for (let i = relPath.length - 1; i > 0; i--) {
-        if (relPath[i] !== "/")
-            continue;
-        const prefix = relPath.slice(0, i);
-        const name = relPath.slice(i + 1);
-        if (Buffer.byteLength(name, "utf8") <= 100 && Buffer.byteLength(prefix, "utf8") <= 155 && name.length > 0)
-            return { prefix, name };
-    }
-    return null;
-}
-const USTAR_MAX_SIZE = 8 * 1024 * 1024 * 1024 - 1;
-export function tarHeader(relPath, sizeBytes, mtimeSec) {
-    if (!Number.isFinite(sizeBytes) || sizeBytes < 0 || sizeBytes > USTAR_MAX_SIZE) {
-        throw new Error(`tar: size ${sizeBytes} not representable in a ustar header (12-octal-byte field, max 8GiB-1): ${relPath}`);
-    }
-    const split = splitTarPath(relPath);
-    if (split === null)
-        throw new Error(`tar: path not representable in ustar (must be ≤255 bytes and splittable at "/"): ${relPath}`);
-    const h = Buffer.alloc(BLOCK, 0);
-    h.write(split.name, 0, 100, "utf8");
-    octal(0o644, 8).copy(h, 100);
-    octal(0, 8).copy(h, 108);
-    octal(0, 8).copy(h, 116);
-    octal(sizeBytes, 12).copy(h, 124);
-    octal(Math.max(0, Math.floor(mtimeSec)), 12).copy(h, 136);
-    h.fill(0x20, 148, 156);
-    h.write("0", 156, 1, "ascii");
-    h.write("ustar\0", 257, 6, "ascii");
-    h.write("00", 263, 2, "ascii");
-    h.write(split.prefix, 345, 155, "utf8");
-    let sum = 0;
-    for (const b of h)
-        sum += b;
-    Buffer.from(sum.toString(8).padStart(6, "0") + "\0 ", "ascii").copy(h, 148);
-    return h;
-}
-export function tarPadding(sizeBytes) {
-    const rem = sizeBytes % BLOCK;
-    return Buffer.alloc(rem === 0 ? 0 : BLOCK - rem, 0);
-}
-export const TAR_END = Buffer.alloc(BLOCK * 2, 0);
-//# sourceMappingURL=tar.js.map

package/dist/http/workspace-content.d.ts

@@ -1,11 +0,0 @@
-/**
- * design/158 A9 seam —— workspace 文件面的内容类型/二进制判别,从 `http/server.ts` 整段搬出的原文。
- * routes/sessions.ts 的 workspace 腿要用它,所以住在 http/ 叶子里(routes/* 不可值 import server.ts)。
- */
-/** workspace file 面的 content-type(#3,[1894]③):保守扩展名表——只收「浏览器渲染无歧义且
- *  无主动内容」的类型,其余一律 octet-stream(nosniff 恒带;html/svg 等可执行内容**故意**不进表,
- *  agent 产物=不可信,按下载处理)。 */
-export declare function workspaceContentType(relPath: string): string;
-/** 二进制判别([1894]③):首 8KiB 含 NUL 即二进制(git 同判据——快、稳、无误伤 UTF-8)。 */
-export declare function looksBinary(bytes: Uint8Array): boolean;
-//# sourceMappingURL=workspace-content.d.ts.map

package/dist/http/workspace-content.js

@@ -1,20 +0,0 @@
-export function workspaceContentType(relPath) {
-    const base = relPath.slice(relPath.lastIndexOf("/") + 1);
-    const dot = base.lastIndexOf(".");
-    const ext = dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
-    const TABLE = {
-        txt: "text/plain; charset=utf-8", md: "text/plain; charset=utf-8", log: "text/plain; charset=utf-8",
-        json: "application/json; charset=utf-8", csv: "text/csv; charset=utf-8",
-        png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp",
-        pdf: "application/pdf",
-    };
-    return TABLE[ext] ?? "application/octet-stream";
-}
-export function looksBinary(bytes) {
-    const n = Math.min(bytes.byteLength, 8192);
-    for (let i = 0; i < n; i++)
-        if (bytes[i] === 0)
-            return true;
-    return false;
-}
-//# sourceMappingURL=workspace-content.js.map

package/dist/plugins/file-snapshot-store-sql.d.ts

@@ -1,170 +0,0 @@
-/**
- * Durable `FileSnapshotStore` (E19 rewind-files) — SINGLE-FILE DUAL-DIALECT (design/158 A12 定型半场).
- * ONE implementation, TWO dialects; the historical `TiDBFileSnapshotStore` / `PgFileSnapshotStore` class
- * names survive as thin ctor subclasses so every consumer (store-backend.ts, the migration script, the
- * contract/integration/minio-equivalence suites) is untouched.
- *
- * Cross-replica working-tree snapshots keyed by `(scope=sessionId, key=SessionTreeEntry.id)`, the SAME
- * entryId anchor as E18 resume-at. Used for (a) rewind (restore a PAST turn's tree in the same env) and
- * (b) the seamless local↔cloud work-artifact transfer (2c: a snapshot synced to the cloud, restored in the
- * other environment — conversation + files in lockstep).
- *
- * The env-operating + security-critical half (the tree walk + the symlink-neutralizing restore
- * convergence) is core's `captureManifest`/`applyManifest` — REUSED verbatim (re-implementing risks
- * re-introducing the symlink-escape / fail-closed bugs core's dual-review fixed). This store provides ONLY
- * the durable persistence: content-addressed blobs (sha256 → bytes, deduped across all snapshots, via the
- * shared {@link BlobBackend} seam — SQL by default, MinIO when configured) + a per-`(scope,key)` manifest
- * (relPath → blobHash) that stays in SQL either way (`snapshot_manifest`).
- *
- * ── Dialect deltas, kept EXPLICIT ────────────────────────────────────────────────────────────────────
- *   - `?` placeholders vs `$n` on every `snapshot_manifest` statement (exists-check, insert, selects, the
- *     scoped/keyed deletes) — every statement stays written out at the call site via `q()`, never a single
- *     text with a numbering loop.
- *   - result unwrapping (`rows`/`affected`) and transaction control (mysql2 native begin/commit/rollback vs
- *     PG statement form) go through the shared `SqlDriver`/`SqlTxConn` seam (sql-driver.ts) — same
- *     normalization the other A12 collapses use; NOT a store-specific concern.
- *   - the default {@link BlobBackend} (`SqlBlobBackend`) and `blobSizes` (`sqlBlobSizes`) take the RAW pool
- *     + a `"tidb"|"pg"` dialect string directly (blob-backend.ts predates/sits outside this seam — it is a
- *     sibling module, not part of this collapse), so this store keeps BOTH the `SqlDriver` (for its own
- *     `snapshot_manifest` statements) and the raw native pool (to hand to blob-backend.ts unchanged).
- *   - in-flight guard key separator: the TiDB twin used `\x00`, the PG twin used a plain space — NOT a
- *     dialect requirement (this key never leaves the process or touches SQL), just accidental drift.
- *     Harmonized to `\x00` (can't collide with a normal scope/key string) — zero observable behavior change
- *     either way, since the key only dedups concurrent calls on THIS replica within THIS process.
- *   - `gcOrphanBlobs`'s orphan-SET query text is IDENTICAL for both dialects (no placeholders) — kept as one
- *     shared statement, not a `q()` pair.
- */
-import { type FileSnapshotBounds, type FileSnapshotStore, type FileSnapshotResult, type ExecutionEnv } from "@sema-agent/core";
-import type { Pool as MySqlPool } from "mysql2/promise";
-import type { Pool as PgPool } from "pg";
-import { type BlobBackend } from "./blob-backend.js";
-import { type SqlDriver } from "./sql-driver.js";
-/** Dual-dialect durable FileSnapshotStore. See the file header for the dialect-delta ledger. */
-export declare class SqlFileSnapshotStore implements FileSnapshotStore {
-    protected readonly db: SqlDriver;
-    /** The RAW native pool — handed to blob-backend.ts (SqlBlobBackend / sqlBlobSizes), which sits OUTSIDE
-     *  the SqlDriver seam and dialect-switches on its own `"tidb"|"pg"` string. Not used for this class's OWN
-     *  `snapshot_manifest` statements (those go through `db`). */
-    protected readonly pool: MySqlPool | PgPool;
-    protected readonly bounds: FileSnapshotBounds;
-    /** In-flight create-once guard (per process) — mirrors InMemoryFileSnapshotStore: a concurrent 2nd
-     *  snapshot/import of the same (scope,key) on THIS replica is a no-op, not a re-capture. CROSS-REPLICA dup
-     *  is HARMLESS here: the key is an immutable SessionTreeEntry.id (one settled turn → one fixed tree), so
-     *  two replicas capture the SAME relPath→hash rows → restore's Map dedups them identically. (A
-     *  snapshot_header(scope,snap_key) claim row would serialize one winner + drop dup rows — a follow-on
-     *  hardening for if same-session-multi-replica ever happens; v1 is single-replica affinity so it doesn't.) */
-    private readonly inFlight;
-    /** The content-addressed BYTE store (clay 2026-06-26 object-store offload). DEFAULT = the SqlBlobBackend
-     *  over THIS pool — so a MINIO-unset deployment is byte-identical to before this refactor (the
-     *  `snapshot_blob` table). When MinIO is configured the StoreBackend passes a MinioBlobBackend, moving ONLY
-     *  the heavy bytes off-DB; the MANIFEST (snapshot_manifest) + the orphan-reference computation STAY in SQL. */
-    private readonly blobs;
-    /** [805]③a/[806]④: core 1.287's captureManifest counts enumerate→read-window vanished files it TOLERATED
-     *  (E19 fix — skipped, not failed). The count rides ONLY the captureManifest return value; without this
-     *  sink it is silently dropped. Optional observer set by main.ts (metrics face) — never throws into the
-     *  seam. codex F8: the type admits an ASYNC sink (`void | Promise<void>`) — the call site swallows a
-     *  rejected promise too (a bare try/catch only caught sync throws, so an async observer's rejection
-     *  surfaced as an unhandledRejection and could pierce the never-throw posture process-wide). */
-    onSkippedVanished: ((count: number) => void | Promise<void>) | undefined;
-    constructor(db: SqlDriver, 
-    /** The RAW native pool — handed to blob-backend.ts (SqlBlobBackend / sqlBlobSizes), which sits OUTSIDE
-     *  the SqlDriver seam and dialect-switches on its own `"tidb"|"pg"` string. Not used for this class's OWN
-     *  `snapshot_manifest` statements (those go through `db`). */
-    pool: MySqlPool | PgPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
-    /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
-    private q;
-    /** THE ONE content-addressed blob write — the SINGLE source `snapshot()`, `importManifest()`, and the
-     *  `putBlob` seam all funnel through (no drift across the three writers). Routes the bytes through the
-     *  BlobBackend (SQL default or MinIO); the SqlBlobBackend's upsert REFRESHES `created_at` even on a dedup
-     *  hit so a re-used/just-written blob is "touched=now" and GC-grace-protected until a manifest row commits
-     *  (closes the delete-in-use race). */
-    private putBlobRow;
-    /** 2c session-sync PUSH side — upload ONE content-addressed blob to the cloud's snapshot store AHEAD of a
-     *  bundle import (§5 streamed blob negotiation: the local peer PUTs only the blobs the cloud is missing,
-     *  then commits the bundle via importSession, whose getBlob reads the cloud's OWN store). A SERVICE method
-     *  (NOT on core's FileSnapshotStore interface — core was asked, non-blocking; the route feature-detects
-     *  `typeof fs.putBlob`). Reuses {@link putBlobRow} VERBATIM (the SAME created_at-refreshing upsert
-     *  importManifest uses), so a PUT and a concurrent reap can't race: the just-PUT blob's created_at=now
-     *  keeps it inside the GC grace window until the import references it from a manifest. Idempotent
-     *  (content-addressed). The route verifies sha256(bytes)===hash BEFORE this. core 1.142.0 made this a
-     *  fail-closed never-throw seam (Promise<FileSnapshotResult>): a BlobBackend write error (e.g. a
-     *  MinioBlobBackend non-2xx PUT) is caught + encoded as `restore_failed`, NEVER thrown out of the seam. */
-    putBlob(hash: string, bytes: Uint8Array): Promise<FileSnapshotResult>;
-    /** CREATE-ONCE: an entryId's tree is immutable, so a 2nd snapshot for an existing key is a no-op {ok:true}. */
-    snapshot(scope: string, key: string, env: ExecutionEnv, root: string, signal?: AbortSignal): Promise<FileSnapshotResult>;
-    /** 2c session-sync IMPORT side — the inverse of `exportManifest`/`getBlob`: persist a snapshot's content
-     *  (manifest + content-addressed blobs) that was EXPORTED from ANOTHER backend (the local→cloud transfer: a src
-     *  snapshot's manifest+blobs land here as a NEW `(scope,key)`). Unlike `snapshot()` this does NOT walk an env — the
-     *  manifest is given; bytes come from `srcGetBlob(blobHash)`. Mirrors core's InMemory/File `importManifest` fail-closed
-     *  matrix verbatim (core 1.141.0). Reuses snapshot()'s EXACT putBlob (created_at-refreshing upsert, GC-grace-safe)
-     *  + manifest-tx (re-check under txn) patterns.
-     *
-     *  NEVER-throws + FAIL-CLOSED (the matrix core's dual-review fixed, point-named to the durable twins):
-     *   - CREATE-ONCE: an entryId's tree is immutable → an existing OR in-flight `(scope,key)` is a no-op `{ok:true}`.
-     *   - `srcGetBlob` is a CROSS-BACKEND fetch (remote/IPC) that CAN REJECT (timeout/ECONNRESET/query error) — caught and
-     *     encoded as `read_failed`, NEVER thrown out of the seam.
-     *   - a MISSING blob (`bytes===undefined`) → `read_failed`.
-     *   - content-address INTEGRITY: `sha256(bytes) !== hash` → `read_failed` (a 2c transfer can cross net/IPC; a corrupt
-     *     blob stored under a mismatched hash would let a later restore silently write WRONG bytes — verify, don't trust).
-     *   - ANY blob failure → EARLY-RETURN `{ok:false}` and the manifest tx is NEVER run, so `has()` stays false (no
-     *     half-snapshot). The DISTINCT blobs already staged before the failing one are orphans (no manifest references
-     *     them) — their snapshot_blob INDEX rows are reaped (and, under MinIO, the objects deleted) by the async grace-
-     *     window sweepOrphanBlobs reaper; they never make this `(scope,key)` visible. */
-    importManifest(scope: string, key: string, manifest: Map<string, string>, srcGetBlob: (hash: string) => Promise<Uint8Array | undefined>): Promise<FileSnapshotResult>;
-    /** Converge `root` back to the snapshot (applyManifest: PHASE-1 remove symlinks/strays, PHASE-2 write captured). */
-    restore(scope: string, key: string, env: ExecutionEnv, root: string, signal?: AbortSignal): Promise<FileSnapshotResult>;
-    has(scope: string, key: string): Promise<boolean>;
-    /** 2c session-sync: enumerate every snapshot key (entryId) in a scope — the SAME enumeration reap()
-     *  does (`SELECT DISTINCT snap_key`), exposed so 2c can export a session's full set of file snapshots. */
-    listKeys(scope: string): Promise<string[]>;
-    /** 2c session-sync: the manifest (relPath → blobHash) for one snapshot — to EXPORT its content to another
-     *  backend byte-for-byte (paired with getBlob for content-addressed transfer). Reads the STORED manifest rows (never
-     *  re-hashes). 0 rows = no snapshot (a real snapshot always has ≥1 manifest row) → null (parity with InMemory). */
-    exportManifest(scope: string, key: string): Promise<Map<string, string> | null>;
-    /** 2c session-sync: the content-addressed bytes for `hash` (undefined if absent) — reads via the BlobBackend
-     *  (SQL default or MinIO, where getBlob also verifies content-address integrity). */
-    getBlob(hash: string): Promise<Uint8Array | undefined>;
-    /** The subset of `hashes` already present in the blob store — reads the SQL INDEX (one IN(...) for BOTH backends),
-     *  so the §10 import blob-presence pre-check is a cheap index probe, NOT N full-object getBlob GETs (finding 12). */
-    hasBlobs(hashes: string[]): Promise<Set<string>>;
-    /** workspace 浏览面(#3,[1894]②):per-blob 字节数——读 SQL INDEX 的 byte_len(单 IN 查询;
-     *  MinIO 后端的索引行同带 byte_len,两后端同源)。tree 的 size 投影 + file 面「超限先拒后拉」用。 */
-    blobSizes(hashes: string[]): Promise<Map<string, number>>;
-    /** GC: drop every snapshot in `scope` whose key is NOT in keepKeys. Drops ONLY the SQL manifest rows synchronously —
-     *  the now-unreferenced blobs become ORPHANS (their snapshot_blob INDEX rows survive) and are collected LATER by the
-     *  async sweepOrphanBlobs reaper (NEVER a synchronous external-store delete that could block/fail this reap on a MinIO
-     *  blip — clay 2026-06-26 async-purge design). */
-    reap(scope: string, keepKeys: string[]): Promise<number>;
-    /** E21 purge — drop ALL snapshots for a session (every key). Drops ONLY the SQL manifest rows synchronously → the
-     *  session is immediately gone + its blobs become orphans; the actual MinIO/SQL BYTE deletion is the async
-     *  sweepOrphanBlobs reaper's job (bounded-window EVENTUAL CONSISTENCY satisfies the E21 privacy/compliance "really
-     *  delete the bytes" requirement WITHOUT a fragile synchronous object-store delete on the purge path). Scoped by sessionId. */
-    deleteBySession(scope: string): Promise<number>;
-    /** Content-addressed blobs are shared across snapshots → GC only those NO manifest references. The orphan-hash SET is
-     *  computed from the `snapshot_blob` INDEX in SQL (reference tracking stays in the DB — works for BOTH the SQL backend
-     *  AND MinIO, whose index rows are kept bytes-NULL); the BlobBackend's deleteBlobs applies the grace window (a just-
-     *  written blob a concurrent in-flight snapshot needs is never delete-in-use) and, for MinIO, deletes the objects.
-     *  Returns the count ACTUALLY deleted (the grace-passed subset deleteBlobs reports — NOT the pre-grace orphan count,
-     *  finding 13). Called ONLY from the async sweepOrphanBlobs reaper (never the synchronous purge path).
-     *
-     *  The orphan-SET query text is IDENTICAL for both dialects (no placeholders) — a single shared statement, not a `q()`
-     *  pair. A query error degrades to "zero orphans this sweep" (both twins already treated it that way — the reaper
-     *  retries next tick, so under-collecting once is harmless; never surfaced as a hard failure). */
-    private gcOrphanBlobs;
-    /** 2c session-sync DoS bound + the ASYNC byte-GC for reap/deleteBySession orphans — GLOBALLY GC grace-passed
-     *  orphan blobs (standalone PUTs never imported AND the blobs a purge/reap left orphaned). The driver is the main.ts
-     *  reaper (scheduled, error-tolerant: a per-object MinIO delete failure is skipped + retried next sweep → bounded-
-     *  window eventual consistency). Reuses {@link gcOrphanBlobs} VERBATIM; returns the count actually deleted this sweep. */
-    sweepOrphanBlobs(): Promise<number>;
-    /** Run statements atomically; rolls back on failure. */
-    private tx;
-}
-/** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
-export declare class TiDBFileSnapshotStore extends SqlFileSnapshotStore {
-    constructor(pool: MySqlPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
-}
-/** PostgreSQL binding — historical class name + ctor shape preserved. */
-export declare class PgFileSnapshotStore extends SqlFileSnapshotStore {
-    constructor(pool: PgPool, blobBackend?: BlobBackend, bounds?: FileSnapshotBounds);
-}
-//# sourceMappingURL=file-snapshot-store-sql.d.ts.map

package/dist/plugins/file-snapshot-store-sql.js

@@ -1,213 +0,0 @@
-import { captureManifest, applyManifest, DEFAULT_SNAPSHOT_BOUNDS } from "@sema-agent/core";
-import { createHash } from "node:crypto";
-import { SqlBlobBackend, sqlBlobSizes } from "./blob-backend.js";
-import { mysqlDriver, pgDriver } from "./sql-driver.js";
-export class SqlFileSnapshotStore {
-    db;
-    pool;
-    bounds;
-    inFlight = new Set();
-    blobs;
-    onSkippedVanished = undefined;
-    constructor(db, pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
-        this.db = db;
-        this.pool = pool;
-        this.bounds = bounds;
-        this.blobs = blobBackend ?? new SqlBlobBackend(this.db.dialect, this.pool);
-    }
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
-    }
-    async putBlobRow(hash, bytes) {
-        await this.blobs.putBlob(hash, bytes);
-    }
-    async putBlob(hash, bytes) {
-        if (createHash("sha256").update(bytes).digest("hex") !== hash) {
-            return { ok: false, error: { code: "read_failed", message: `putBlob ${hash} fails content-address integrity — nothing stored` } };
-        }
-        try {
-            await this.putBlobRow(hash, bytes);
-            return { ok: true };
-        }
-        catch (err) {
-            return { ok: false, error: { code: "restore_failed", message: `putBlob ${hash} write/upload failed: ${err.message}` } };
-        }
-    }
-    async snapshot(scope, key, env, root, signal) {
-        const flightKey = `${scope}\x00${key}`;
-        if (this.inFlight.has(flightKey))
-            return { ok: true };
-        this.inFlight.add(flightKey);
-        try {
-            if (await this.has(scope, key))
-                return { ok: true };
-            let cap;
-            try {
-                cap = await captureManifest(env, root, this.bounds, signal, async (hash, bytes) => {
-                    await this.putBlobRow(hash, bytes);
-                });
-            }
-            catch (err) {
-                return { ok: false, error: { code: "restore_failed", message: `snapshot blob write failed: ${err.message}` } };
-            }
-            if (!cap.ok)
-                return { ok: false, error: cap.error };
-            if (cap.skippedVanished > 0 && this.onSkippedVanished) {
-                try {
-                    void Promise.resolve(this.onSkippedVanished(cap.skippedVanished)).catch(() => { });
-                }
-                catch { }
-            }
-            await this.tx(async (conn) => {
-                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
-                if (exists.rows[0])
-                    return;
-                for (const [relPath, hash] of cap.value) {
-                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
-                }
-            });
-            return { ok: true };
-        }
-        catch (err) {
-            return { ok: false, error: { code: "restore_failed", message: `snapshot persist failed: ${err.message}` } };
-        }
-        finally {
-            this.inFlight.delete(flightKey);
-        }
-    }
-    async importManifest(scope, key, manifest, srcGetBlob) {
-        const flightKey = `${scope}\x00${key}`;
-        if (this.inFlight.has(flightKey))
-            return { ok: true };
-        this.inFlight.add(flightKey);
-        try {
-            if (await this.has(scope, key))
-                return { ok: true };
-            for (const hash of new Set(manifest.values())) {
-                if (hash === "" || hash === "." || hash === ".." || !/^[A-Za-z0-9_.-]+$/.test(hash)) {
-                    return { ok: false, error: { code: "read_failed", message: `unsafe blob hash ${JSON.stringify(hash)}` } };
-                }
-                let bytes;
-                try {
-                    bytes = await srcGetBlob(hash);
-                }
-                catch (err) {
-                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fetch failed: ${err.message}` } };
-                }
-                if (!bytes)
-                    return { ok: false, error: { code: "read_failed", message: `missing source blob ${hash}` } };
-                if (createHash("sha256").update(bytes).digest("hex") !== hash) {
-                    return { ok: false, error: { code: "read_failed", message: `source blob ${hash} fails content-address integrity` } };
-                }
-                await this.putBlobRow(hash, bytes);
-            }
-            await this.tx(async (conn) => {
-                const exists = await conn.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
-                if (exists.rows[0])
-                    return;
-                for (const [relPath, hash] of manifest) {
-                    await conn.query(this.q("INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES (?,?,?,?)", "INSERT INTO snapshot_manifest (scope, snap_key, rel_path, blob_hash) VALUES ($1,$2,$3,$4)"), [scope, key, relPath, hash]);
-                }
-            });
-            return { ok: true };
-        }
-        catch (err) {
-            return { ok: false, error: { code: "restore_failed", message: `import persist failed: ${err.message}` } };
-        }
-        finally {
-            this.inFlight.delete(flightKey);
-        }
-    }
-    async restore(scope, key, env, root, signal) {
-        try {
-            const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
-            if (rows.length === 0)
-                return { ok: false, error: { code: "not_found", message: `no file snapshot for ${scope}/${key}` } };
-            const manifest = new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
-            return await applyManifest(env, root, this.bounds, signal, manifest, (hash) => this.blobs.getBlob(hash));
-        }
-        catch (err) {
-            return { ok: false, error: { code: "restore_failed", message: `restore blob read failed: ${err.message}` } };
-        }
-    }
-    async has(scope, key) {
-        const { rows } = await this.db.query(this.q("SELECT 1 FROM snapshot_manifest WHERE scope = ? AND snap_key = ? LIMIT 1", "SELECT 1 FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2 LIMIT 1"), [scope, key]);
-        return Boolean(rows[0]);
-    }
-    async listKeys(scope) {
-        const { rows } = await this.db.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
-        return rows.map((r) => String(r.snap_key));
-    }
-    async exportManifest(scope, key) {
-        const { rows } = await this.db.query(this.q("SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "SELECT rel_path, blob_hash FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, key]);
-        if (rows.length === 0)
-            return null;
-        return new Map(rows.map((r) => [String(r.rel_path), String(r.blob_hash)]));
-    }
-    async getBlob(hash) {
-        return this.blobs.getBlob(hash);
-    }
-    async hasBlobs(hashes) {
-        return this.blobs.hasBlobs(hashes);
-    }
-    async blobSizes(hashes) {
-        return sqlBlobSizes(this.db.dialect, this.pool, hashes);
-    }
-    async reap(scope, keepKeys) {
-        return this.tx(async (conn) => {
-            const { rows: keys } = await conn.query(this.q("SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = ?", "SELECT DISTINCT snap_key FROM snapshot_manifest WHERE scope = $1"), [scope]);
-            const drop = keys.map((k) => String(k.snap_key)).filter((k) => !keepKeys.includes(k));
-            for (const k of drop) {
-                await conn.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ? AND snap_key = ?", "DELETE FROM snapshot_manifest WHERE scope = $1 AND snap_key = $2"), [scope, k]);
-            }
-            return drop.length;
-        });
-    }
-    async deleteBySession(scope) {
-        const { affected } = await this.db.query(this.q("DELETE FROM snapshot_manifest WHERE scope = ?", "DELETE FROM snapshot_manifest WHERE scope = $1"), [scope]);
-        return affected;
-    }
-    async gcOrphanBlobs() {
-        const { rows } = await this.db
-            .query("SELECT blob_hash FROM snapshot_blob WHERE blob_hash NOT IN (SELECT blob_hash FROM snapshot_manifest)")
-            .catch(() => ({ rows: [], affected: 0 }));
-        const orphans = rows.map((r) => String(r.blob_hash));
-        if (orphans.length === 0)
-            return 0;
-        return this.blobs.deleteBlobs(orphans);
-    }
-    async sweepOrphanBlobs() {
-        return this.gcOrphanBlobs();
-    }
-    async tx(fn) {
-        const conn = await this.db.connect();
-        try {
-            await conn.begin();
-            const out = await fn(conn);
-            await conn.commit();
-            return out;
-        }
-        catch (err) {
-            try {
-                await conn.rollback();
-            }
-            catch {
-            }
-            throw err;
-        }
-        finally {
-            conn.release();
-        }
-    }
-}
-export class TiDBFileSnapshotStore extends SqlFileSnapshotStore {
-    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
-        super(mysqlDriver(pool), pool, blobBackend, bounds);
-    }
-}
-export class PgFileSnapshotStore extends SqlFileSnapshotStore {
-    constructor(pool, blobBackend, bounds = DEFAULT_SNAPSHOT_BOUNDS) {
-        super(pgDriver(pool), pool, blobBackend, bounds);
-    }
-}
-//# sourceMappingURL=file-snapshot-store-sql.js.map