@taskforcehq/taskforce 0.3.168

package/dist/storage/objectStorage.js

@@ -0,0 +1,15 @@
+export function toPublicObjectStorageConfig(config) {
+    if (config.provider !== 'r2' || !config.r2) {
+        return { provider: config.provider };
+    }
+    return {
+        provider: 'r2',
+        r2: {
+            bucket: config.r2.bucket,
+            endpoint: config.r2.endpoint,
+            keyPrefix: config.r2.keyPrefix,
+            signedUploadTtlSeconds: config.r2.signedUploadTtlSeconds,
+            signedDownloadTtlSeconds: config.r2.signedDownloadTtlSeconds
+        }
+    };
+}

package/dist/storage/objectStorageClient.d.ts

@@ -0,0 +1,18 @@
+import type { ResolvedObjectStorageConfig } from './objectStorage.js';
+export interface StoredObject {
+    body: Buffer;
+    contentType: string;
+}
+export declare class ObjectStorageClient {
+    private readonly config;
+    constructor(config: ResolvedObjectStorageConfig);
+    provider(): 'local' | 'r2';
+    keyForRelativePath(relativePath: string): string;
+    putObject(relativePath: string, body: Buffer, contentType: string): Promise<void>;
+    getObject(relativePath: string): Promise<StoredObject | null>;
+    objectExists(relativePath: string): Promise<boolean>;
+    deleteObject(relativePath: string): Promise<boolean>;
+    createSignedGetUrl(relativePath: string, expiresInSeconds: number): string;
+    createSignedPutUrl(relativePath: string, expiresInSeconds: number): string;
+}
+export declare function normalizeTaskDataRelativePath(rawPath: string): string | null;

package/dist/storage/objectStorageClient.js

@@ -0,0 +1,301 @@
+import { createHash, createHmac } from 'crypto';
+const AWS_ALGORITHM = 'AWS4-HMAC-SHA256';
+const AWS_SERVICE = 's3';
+const AWS_REGION = 'auto';
+function sha256Hex(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function hmac(key, value) {
+    return createHmac('sha256', key).update(value, 'utf8').digest();
+}
+function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!*'()]/g, (ch) => `%${ch.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function encodeUriPath(pathname) {
+    return pathname
+        .split('/')
+        .map((segment) => encodeRfc3986(segment))
+        .join('/');
+}
+function normalizeRelativePath(rawPath) {
+    const value = String(rawPath || '').trim().replace(/\\/g, '/');
+    if (!value || value.startsWith('/'))
+        return null;
+    const parts = value.split('/').filter(Boolean);
+    if (parts.length === 0)
+        return null;
+    if (parts.some((part) => part === '.' || part === '..'))
+        return null;
+    return parts.join('/');
+}
+function buildObjectKey(config, relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    if (!normalized)
+        throw new Error('Invalid object path.');
+    if (config.provider !== 'r2' || !config.r2?.keyPrefix)
+        return normalized;
+    const prefix = config.r2.keyPrefix.replace(/^\/+|\/+$/g, '');
+    return prefix ? `${prefix}/${normalized}` : normalized;
+}
+function buildCanonicalQuery(searchParams) {
+    const entries = Array.from(searchParams.entries())
+        .map(([key, value]) => [encodeRfc3986(key), encodeRfc3986(value)])
+        .sort((a, b) => (a[0] === b[0] ? a[1].localeCompare(b[1]) : a[0].localeCompare(b[0])));
+    return entries.map(([key, value]) => `${key}=${value}`).join('&');
+}
+function buildSigningKey(secretAccessKey, dateStamp) {
+    const kDate = hmac(`AWS4${secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, AWS_REGION);
+    const kService = hmac(kRegion, AWS_SERVICE);
+    return hmac(kService, 'aws4_request');
+}
+function toDateStamp(amzDate) {
+    return amzDate.slice(0, 8);
+}
+function createAmzDate(now = new Date()) {
+    const iso = now.toISOString();
+    return iso.replace(/[:-]|\.\d{3}/g, '');
+}
+function signRequest(params) {
+    const amzDate = createAmzDate(params.now);
+    const dateStamp = toDateStamp(amzDate);
+    const host = params.url.host;
+    const canonicalUri = encodeUriPath(params.url.pathname);
+    const canonicalQuery = buildCanonicalQuery(params.url.searchParams);
+    const canonicalHeaders = `host:${host}\n` + `x-amz-content-sha256:${params.payloadHash}\n` + `x-amz-date:${amzDate}\n`;
+    const signedHeaders = 'host;x-amz-content-sha256;x-amz-date';
+    const canonicalRequest = [
+        params.method.toUpperCase(),
+        canonicalUri,
+        canonicalQuery,
+        canonicalHeaders,
+        signedHeaders,
+        params.payloadHash
+    ].join('\n');
+    const credentialScope = `${dateStamp}/${AWS_REGION}/${AWS_SERVICE}/aws4_request`;
+    const stringToSign = [
+        AWS_ALGORITHM,
+        amzDate,
+        credentialScope,
+        sha256Hex(canonicalRequest)
+    ].join('\n');
+    const signature = createHmac('sha256', buildSigningKey(params.secretAccessKey, dateStamp))
+        .update(stringToSign, 'utf8')
+        .digest('hex');
+    const authorization = `${AWS_ALGORITHM} Credential=${params.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    return { authorization, amzDate, canonicalQuery };
+}
+export class ObjectStorageClient {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    provider() {
+        return this.config.provider;
+    }
+    keyForRelativePath(relativePath) {
+        return buildObjectKey(this.config, relativePath);
+    }
+    async putObject(relativePath, body, contentType) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const payloadHash = sha256Hex(body);
+        const signed = signRequest({
+            method: 'PUT',
+            url,
+            accessKeyId: this.config.r2.accessKeyId,
+            secretAccessKey: this.config.r2.secretAccessKey,
+            payloadHash
+        });
+        const response = await fetch(url, {
+            method: 'PUT',
+            headers: {
+                'authorization': signed.authorization,
+                'x-amz-date': signed.amzDate,
+                'x-amz-content-sha256': payloadHash,
+                'content-type': contentType
+            },
+            body: new Uint8Array(body)
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Failed to upload object (${response.status}): ${text || response.statusText}`);
+        }
+    }
+    async getObject(relativePath) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const payloadHash = sha256Hex('');
+        const signed = signRequest({
+            method: 'GET',
+            url,
+            accessKeyId: this.config.r2.accessKeyId,
+            secretAccessKey: this.config.r2.secretAccessKey,
+            payloadHash
+        });
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                'authorization': signed.authorization,
+                'x-amz-date': signed.amzDate,
+                'x-amz-content-sha256': payloadHash
+            }
+        });
+        if (response.status === 404)
+            return null;
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Failed to read object (${response.status}): ${text || response.statusText}`);
+        }
+        const contentType = String(response.headers.get('content-type') || 'application/octet-stream');
+        const body = Buffer.from(await response.arrayBuffer());
+        return { body, contentType };
+    }
+    async objectExists(relativePath) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const payloadHash = sha256Hex('');
+        const signed = signRequest({
+            method: 'HEAD',
+            url,
+            accessKeyId: this.config.r2.accessKeyId,
+            secretAccessKey: this.config.r2.secretAccessKey,
+            payloadHash
+        });
+        const response = await fetch(url, {
+            method: 'HEAD',
+            headers: {
+                'authorization': signed.authorization,
+                'x-amz-date': signed.amzDate,
+                'x-amz-content-sha256': payloadHash
+            }
+        });
+        if (response.status === 404)
+            return false;
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Failed to check object (${response.status}): ${text || response.statusText}`);
+        }
+        return true;
+    }
+    async deleteObject(relativePath) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const payloadHash = sha256Hex('');
+        const signed = signRequest({
+            method: 'DELETE',
+            url,
+            accessKeyId: this.config.r2.accessKeyId,
+            secretAccessKey: this.config.r2.secretAccessKey,
+            payloadHash
+        });
+        const response = await fetch(url, {
+            method: 'DELETE',
+            headers: {
+                'authorization': signed.authorization,
+                'x-amz-date': signed.amzDate,
+                'x-amz-content-sha256': payloadHash
+            }
+        });
+        if (response.status === 404)
+            return false;
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Failed to delete object (${response.status}): ${text || response.statusText}`);
+        }
+        return true;
+    }
+    createSignedGetUrl(relativePath, expiresInSeconds) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const ttl = Number.isFinite(expiresInSeconds) ? Math.max(1, Math.min(3600, Math.floor(expiresInSeconds))) : 300;
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const amzDate = createAmzDate();
+        const dateStamp = toDateStamp(amzDate);
+        const credentialScope = `${dateStamp}/${AWS_REGION}/${AWS_SERVICE}/aws4_request`;
+        url.searchParams.set('X-Amz-Algorithm', AWS_ALGORITHM);
+        url.searchParams.set('X-Amz-Credential', `${this.config.r2.accessKeyId}/${credentialScope}`);
+        url.searchParams.set('X-Amz-Date', amzDate);
+        url.searchParams.set('X-Amz-Expires', String(ttl));
+        url.searchParams.set('X-Amz-SignedHeaders', 'host');
+        const canonicalUri = encodeUriPath(url.pathname);
+        const canonicalQuery = buildCanonicalQuery(url.searchParams);
+        const canonicalRequest = [
+            'GET',
+            canonicalUri,
+            canonicalQuery,
+            `host:${url.host}\n`,
+            'host',
+            'UNSIGNED-PAYLOAD'
+        ].join('\n');
+        const stringToSign = [
+            AWS_ALGORITHM,
+            amzDate,
+            credentialScope,
+            sha256Hex(canonicalRequest)
+        ].join('\n');
+        const signingKey = buildSigningKey(this.config.r2.secretAccessKey, dateStamp);
+        const signature = createHmac('sha256', signingKey).update(stringToSign, 'utf8').digest('hex');
+        url.searchParams.set('X-Amz-Signature', signature);
+        return url.toString();
+    }
+    createSignedPutUrl(relativePath, expiresInSeconds) {
+        if (this.config.provider !== 'r2' || !this.config.r2) {
+            throw new Error('R2 object storage is not configured.');
+        }
+        const ttl = Number.isFinite(expiresInSeconds) ? Math.max(1, Math.min(3600, Math.floor(expiresInSeconds))) : 600;
+        const key = this.keyForRelativePath(relativePath);
+        const url = new URL(`/${this.config.r2.bucket}/${key}`, this.config.r2.endpoint);
+        const amzDate = createAmzDate();
+        const dateStamp = toDateStamp(amzDate);
+        const credentialScope = `${dateStamp}/${AWS_REGION}/${AWS_SERVICE}/aws4_request`;
+        url.searchParams.set('X-Amz-Algorithm', AWS_ALGORITHM);
+        url.searchParams.set('X-Amz-Credential', `${this.config.r2.accessKeyId}/${credentialScope}`);
+        url.searchParams.set('X-Amz-Date', amzDate);
+        url.searchParams.set('X-Amz-Expires', String(ttl));
+        url.searchParams.set('X-Amz-SignedHeaders', 'host');
+        const canonicalUri = encodeUriPath(url.pathname);
+        const canonicalQuery = buildCanonicalQuery(url.searchParams);
+        const canonicalRequest = [
+            'PUT',
+            canonicalUri,
+            canonicalQuery,
+            `host:${url.host}\n`,
+            'host',
+            'UNSIGNED-PAYLOAD'
+        ].join('\n');
+        const stringToSign = [
+            AWS_ALGORITHM,
+            amzDate,
+            credentialScope,
+            sha256Hex(canonicalRequest)
+        ].join('\n');
+        const signingKey = buildSigningKey(this.config.r2.secretAccessKey, dateStamp);
+        const signature = createHmac('sha256', signingKey).update(stringToSign, 'utf8').digest('hex');
+        url.searchParams.set('X-Amz-Signature', signature);
+        return url.toString();
+    }
+}
+export function normalizeTaskDataRelativePath(rawPath) {
+    const normalized = normalizeRelativePath(rawPath);
+    if (!normalized)
+        return null;
+    const allowedRoots = ['task-data/', 'users/', 'workspaces/', 'system/', 'tmp/', 'quarantine/'];
+    if (!allowedRoots.some((root) => normalized.startsWith(root)))
+        return null;
+    return normalized;
+}

package/dist/storage/objectStorageConfig.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedObjectStorageConfig } from './objectStorage.js';
+export declare function resolveObjectStorageConfigFromEnv(env?: NodeJS.ProcessEnv): ResolvedObjectStorageConfig;

package/dist/storage/objectStorageConfig.js

@@ -0,0 +1,45 @@
+function readProvider(env) {
+    const raw = String(env.TASKFORCE_OBJECT_STORAGE_PROVIDER || env.TASKFORCE_STORAGE_PROVIDER || '').trim().toLowerCase();
+    if (raw === 'r2')
+        return 'r2';
+    return 'local';
+}
+function readPositiveInteger(value, fallback) {
+    const parsed = Number.parseInt(String(value || '').trim(), 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return fallback;
+    return parsed;
+}
+function readRequired(env, key) {
+    const value = String(env[key] || '').trim();
+    if (!value) {
+        throw new Error(`[Taskforce] ${key} is required when object storage provider is r2.`);
+    }
+    return value;
+}
+export function resolveObjectStorageConfigFromEnv(env = process.env) {
+    const provider = readProvider(env);
+    if (provider !== 'r2')
+        return { provider: 'local' };
+    const accountId = readRequired(env, 'R2_ACCOUNT_ID');
+    const bucket = readRequired(env, 'R2_BUCKET');
+    const accessKeyId = readRequired(env, 'R2_ACCESS_KEY_ID');
+    const secretAccessKey = readRequired(env, 'R2_SECRET_ACCESS_KEY');
+    const endpoint = String(env.R2_ENDPOINT || '').trim() || `https://${accountId}.r2.cloudflarestorage.com`;
+    const keyPrefix = String(env.R2_KEY_PREFIX || 'taskforce').trim() || 'taskforce';
+    const signedUploadTtlSeconds = readPositiveInteger(env.R2_SIGNED_UPLOAD_TTL_SECONDS, 600);
+    const signedDownloadTtlSeconds = readPositiveInteger(env.R2_SIGNED_DOWNLOAD_TTL_SECONDS, 300);
+    return {
+        provider: 'r2',
+        r2: {
+            accountId,
+            bucket,
+            endpoint,
+            accessKeyId,
+            secretAccessKey,
+            keyPrefix,
+            signedUploadTtlSeconds,
+            signedDownloadTtlSeconds
+        }
+    };
+}

package/dist/storage/postgresAdapter.d.ts

@@ -0,0 +1,20 @@
+import type { DatabaseAdapter, DatabaseStatement } from './databaseAdapter.js';
+export declare class PostgresAdapter implements DatabaseAdapter {
+    readonly provider: "postgres";
+    readonly open = true;
+    private readonly worker;
+    private readonly encoder;
+    private readonly decoder;
+    private txId;
+    constructor(connectionString?: string);
+    private callWorker;
+    private query;
+    private bindParams;
+    prepare(sql: string): DatabaseStatement;
+    exec(sql: string): void;
+    transaction<T extends (...args: any[]) => any>(fn: T): T;
+    pragma(name: string, options?: {
+        simple?: boolean;
+    }): unknown;
+    close(): void;
+}

package/dist/storage/postgresAdapter.js

@@ -0,0 +1,204 @@
+import { TextDecoder, TextEncoder } from 'util';
+import { Worker } from 'worker_threads';
+const RESPONSE_STATUS_INDEX = 0;
+const RESPONSE_LENGTH_INDEX = 1;
+const RESPONSE_READY = 1;
+const RESPONSE_INITIAL = 0;
+const RESPONSE_TIMEOUT_MS = 20_000;
+const RESPONSE_BUFFER_BYTES = 2 * 1024 * 1024;
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function replaceQMarkParams(sql, params) {
+    let index = 0;
+    const text = sql.replace(/\?/g, () => {
+        index += 1;
+        return `$${index}`;
+    });
+    return { text, values: params };
+}
+function replaceNamedParams(sql, params) {
+    const values = [];
+    const keyToIndex = new Map();
+    const text = sql.replace(/@([a-zA-Z_][a-zA-Z0-9_]*)/g, (_match, key) => {
+        if (!keyToIndex.has(key)) {
+            keyToIndex.set(key, values.length + 1);
+            values.push(params[key]);
+        }
+        return `$${keyToIndex.get(key)}`;
+    });
+    return { text, values };
+}
+function translateInsertOrReplace(sql) {
+    const match = sql.match(/INSERT\s+OR\s+REPLACE\s+INTO\s+([a-zA-Z_][a-zA-Z0-9_]*)\s*\(([\s\S]*?)\)\s*VALUES\s*\(([\s\S]*?)\)/i);
+    if (!match)
+        return sql;
+    const table = match[1];
+    const columns = match[2].split(',').map((c) => c.trim()).filter(Boolean);
+    if (columns.length === 0)
+        return sql.replace(/INSERT\s+OR\s+REPLACE/i, 'INSERT');
+    const updateColumns = columns.filter((c) => c !== 'id');
+    const updateClause = updateColumns.length === 0
+        ? 'NOTHING'
+        : `UPDATE SET ${updateColumns.map((c) => `${c} = EXCLUDED.${c}`).join(', ')}`;
+    return sql.replace(/INSERT\s+OR\s+REPLACE\s+INTO[\s\S]*?\)\s*VALUES\s*\([\s\S]*?\)/i, `INSERT INTO ${table} (${columns.join(', ')}) VALUES (${match[3]}) ON CONFLICT (id) DO ${updateClause}`);
+}
+function normalizeSchemaSql(sql) {
+    return sql
+        .replace(/\bBOOLEAN\b/gi, 'INTEGER')
+        .replace(/\bTRUE\b/gi, '1')
+        .replace(/\bFALSE\b/gi, '0');
+}
+function parsePragmaTableInfo(sql) {
+    const match = sql.trim().match(/^PRAGMA\s+table_info\((['"]?)([a-zA-Z_][a-zA-Z0-9_]*)\1\)\s*;?$/i);
+    return match?.[2] || null;
+}
+function toRowCount(result) {
+    return typeof result.rowCount === 'number' ? result.rowCount : 0;
+}
+export class PostgresAdapter {
+    provider = 'postgres';
+    open = true;
+    worker;
+    encoder = new TextEncoder();
+    decoder = new TextDecoder();
+    txId = null;
+    constructor(connectionString) {
+        if (!connectionString || !connectionString.trim()) {
+            throw new Error('[Taskforce] Postgres adapter requires a non-empty connection string.');
+        }
+        this.worker = new Worker(new URL('./postgresWorker.js', import.meta.url), {
+            workerData: {
+                connectionString
+            }
+        });
+    }
+    callWorker(payload) {
+        const statusBuffer = new SharedArrayBuffer(8);
+        const status = new Int32Array(statusBuffer);
+        status[RESPONSE_STATUS_INDEX] = RESPONSE_INITIAL;
+        status[RESPONSE_LENGTH_INDEX] = 0;
+        const responseBuffer = new SharedArrayBuffer(RESPONSE_BUFFER_BYTES);
+        const responseBytes = new Uint8Array(responseBuffer);
+        this.worker.postMessage({
+            payload,
+            statusBuffer,
+            responseBuffer
+        });
+        const waitResult = Atomics.wait(status, RESPONSE_STATUS_INDEX, RESPONSE_INITIAL, RESPONSE_TIMEOUT_MS);
+        if (waitResult === 'timed-out') {
+            throw new Error('[Taskforce] Postgres worker timed out.');
+        }
+        const responseLength = status[RESPONSE_LENGTH_INDEX];
+        if (!Number.isFinite(responseLength) || responseLength <= 0 || responseLength > RESPONSE_BUFFER_BYTES) {
+            throw new Error('[Taskforce] Invalid Postgres worker response.');
+        }
+        const body = this.decoder.decode(responseBytes.subarray(0, responseLength));
+        const parsed = JSON.parse(body);
+        if (!parsed.ok) {
+            throw new Error(parsed.error || 'Unknown Postgres worker error');
+        }
+        return parsed;
+    }
+    query(sql, values = []) {
+        const response = this.callWorker({
+            op: 'query',
+            sql,
+            values,
+            txId: this.txId || undefined
+        });
+        return response.result || { rows: [], rowCount: 0 };
+    }
+    bindParams(sql, params) {
+        const translated = translateInsertOrReplace(sql);
+        if (params.length === 1 && isPlainObject(params[0])) {
+            return replaceNamedParams(translated, params[0]);
+        }
+        return replaceQMarkParams(translated, params);
+    }
+    prepare(sql) {
+        const pragmaTable = parsePragmaTableInfo(sql);
+        if (pragmaTable) {
+            return {
+                run: () => ({ changes: 0 }),
+                get: () => {
+                    const row = this.query(`SELECT column_name AS name
+                         FROM information_schema.columns
+                         WHERE table_schema = 'public' AND table_name = $1
+                         ORDER BY ordinal_position
+                         LIMIT 1`, [pragmaTable]).rows[0];
+                    return row || undefined;
+                },
+                all: () => this.query(`SELECT column_name AS name
+                     FROM information_schema.columns
+                     WHERE table_schema = 'public' AND table_name = $1
+                     ORDER BY ordinal_position`, [pragmaTable]).rows
+            };
+        }
+        return {
+            run: (...params) => {
+                const { text, values } = this.bindParams(sql, params);
+                const result = this.query(text, values);
+                return { changes: toRowCount(result) };
+            },
+            get: (...params) => {
+                const { text, values } = this.bindParams(sql, params);
+                const result = this.query(text, values);
+                return result.rows[0] || undefined;
+            },
+            all: (...params) => {
+                const { text, values } = this.bindParams(sql, params);
+                return this.query(text, values).rows;
+            }
+        };
+    }
+    exec(sql) {
+        const normalized = normalizeSchemaSql(sql);
+        this.query(normalized, []);
+    }
+    transaction(fn) {
+        const wrapped = ((...args) => {
+            if (this.txId) {
+                return fn(...args);
+            }
+            const txId = `tx-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+            this.callWorker({ op: 'begin', txId });
+            this.txId = txId;
+            try {
+                const value = fn(...args);
+                this.callWorker({ op: 'commit', txId });
+                return value;
+            }
+            catch (error) {
+                try {
+                    this.callWorker({ op: 'rollback', txId });
+                }
+                catch {
+                    // Best effort rollback.
+                }
+                throw error;
+            }
+            finally {
+                this.txId = null;
+            }
+        });
+        return wrapped;
+    }
+    pragma(name, options) {
+        const normalized = String(name || '').trim().toLowerCase();
+        if (normalized === 'data_version') {
+            const row = this.query('SELECT EXTRACT(EPOCH FROM now())::bigint AS version').rows[0];
+            const version = Number(row?.version || 0);
+            return options?.simple ? version : [{ data_version: version }];
+        }
+        return options?.simple ? null : [];
+    }
+    close() {
+        try {
+            this.callWorker({ op: 'close' });
+        }
+        finally {
+            this.worker.terminate();
+        }
+    }
+}

package/dist/storage/postgresWorker.d.ts

@@ -0,0 +1 @@
+export {};