@sema-agent/server 1.310.0 → 1.312.0

package/dist/auth-keys.d.ts

@@ -0,0 +1,14 @@
+export interface ApprovalHmacKey {
+    kid: string;
+    key: string;
+    status?: "active" | "retiring";
+}
+export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
+export interface PrincipalJwtKey {
+    kid: string;
+    alg: "EdDSA" | "RS256" | "ES256";
+    key: string;
+    status?: "active" | "retiring";
+}
+export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
+//# sourceMappingURL=auth-keys.d.ts.map

package/dist/auth-keys.js

@@ -0,0 +1,31 @@
+export function parseApprovalHmacKeys(raw) {
+    if (!raw)
+        return [];
+    try {
+        const v = JSON.parse(raw);
+        if (!Array.isArray(v))
+            return [];
+        return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
+    }
+    catch {
+        return [];
+    }
+}
+export function parsePrincipalJwks(raw) {
+    if (!raw)
+        return [];
+    const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
+    try {
+        const v = JSON.parse(raw);
+        if (!Array.isArray(v))
+            return [];
+        return v.filter((k) => {
+            const e = k;
+            return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
+        });
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=auth-keys.js.map

package/dist/brain.d.ts

@@ -1,5 +1,5 @@
 import { type Brain, type BreakerState } from "@sema-agent/core";
-import type { ServiceConfig } from "./config.js";
+import type { ServiceConfig } from "./config-types.js";
 export declare function createBrain(config: ServiceConfig, deps?: {
     fetchImpl?: typeof fetch;
     breakerState?: BreakerState;

package/dist/capabilities/center-prompts.d.ts

@@ -1,31 +1,6 @@
-import { type PromptProvider, type PromptTextDeclaration, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
-export interface EffectiveCenterPrompts {
-    packId: string;
-    contentDigest: string;
-    sections: PromptTextDeclaration[];
-    scenarioOverrides?: Record<string, PromptTextDeclaration[]>;
-}
-export declare function validateCenterPrompts(raw: unknown): {
-    ok: true;
-    value: EffectiveCenterPrompts;
-} | {
-    ok: false;
-    error: string;
-};
-export declare const CORE_ENGINE_VERSION: string;
-export interface PromptsDomainFaces {
-    declarations?: EffectiveCenterPrompts;
-    catalog?: PublishedPromptArtifactEnvelope;
-    identity: string;
-    axes: Array<"declarations" | "catalog">;
-}
-export declare function validatePromptsDomain(raw: unknown): {
-    ok: true;
-    value: PromptsDomainFaces;
-} | {
-    ok: false;
-    error: string;
-};
+import { type PromptProvider, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
+import { type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
+export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION, type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
 export declare function withPromptArtifactBackfill(inner: {
     get(d: string, o: {
         engineVersion: string;

package/dist/capabilities/center-prompts.js

@@ -1,111 +1,6 @@
-import { createHash } from "node:crypto";
-import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { verifyPromptArtifact } from "@sema-agent/core";
-const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
-const SLOTS = new Set(["identity", "scenario", "behavior"]);
-const HASH_RE = /^sha256:[0-9a-f]{64}$/;
-function declarationIssue(d, where) {
-    if (d === null || typeof d !== "object")
-        return `${where}: declaration is not an object`;
-    const o = d;
-    if (typeof o.id !== "string" || o.id.length === 0 || o.id.length > 128 || !ID_RE.test(o.id))
-        return `${where}: bad id`;
-    if (o.id.startsWith("core/"))
-        return `${where}: id in the reserved core/ namespace`;
-    if (typeof o.slot !== "string" || !SLOTS.has(o.slot))
-        return `${where}: bad slot`;
-    if (typeof o.text !== "string" || o.text.length === 0)
-        return `${where}: text must be a non-empty string`;
-    if (typeof o.contentHash !== "string" || !HASH_RE.test(o.contentHash))
-        return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
-    const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
-    if (o.contentHash !== expected)
-        return `${where}: contentHash does not match sha256(text) — stale or tampered declaration`;
-    return undefined;
-}
-export function validateCenterPrompts(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const p = raw;
-    if (typeof p.packId !== "string" || !/^center:[0-9a-f]{12}$/.test(p.packId))
-        return { ok: false, error: "bad packId form (center:<digest12>)" };
-    if (typeof p.contentDigest !== "string" || !HASH_RE.test(p.contentDigest))
-        return { ok: false, error: "bad contentDigest form" };
-    const arrayIssue = (decls, where) => {
-        if (!Array.isArray(decls))
-            return `${where} is not an array`;
-        if (decls.length === 0)
-            return `${where} is empty (an empty replacement set is not a v1 semantic — omit the key instead)`;
-        const seen = new Set();
-        for (let i = 0; i < decls.length; i++) {
-            const issue = declarationIssue(decls[i], `${where}[${i}]`);
-            if (issue)
-                return issue;
-            const id = decls[i].id;
-            if (seen.has(id))
-                return `${where}[${i}]: duplicate id "${id}" (core composer throws on duplicates)`;
-            seen.add(id);
-        }
-        return undefined;
-    };
-    const sectionsIssue = arrayIssue(p.sections, "sections");
-    if (sectionsIssue)
-        return { ok: false, error: sectionsIssue };
-    if (p.scenarioOverrides !== undefined) {
-        if (p.scenarioOverrides === null || typeof p.scenarioOverrides !== "object" || Array.isArray(p.scenarioOverrides)) {
-            return { ok: false, error: "scenarioOverrides is not an object" };
-        }
-        for (const [name, decls] of Object.entries(p.scenarioOverrides)) {
-            const issue = arrayIssue(decls, `scenarioOverrides[${name}]`);
-            if (issue)
-                return { ok: false, error: issue };
-        }
-    }
-    return { ok: true, value: raw };
-}
-export const CORE_ENGINE_VERSION = (() => {
-    try {
-        const entry = createRequire(import.meta.url).resolve("@sema-agent/core");
-        return JSON.parse(readFileSync(join(dirname(entry), "..", "package.json"), "utf8")).version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-})();
-export function validatePromptsDomain(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const w = raw;
-    if (w.schemaVersion === undefined) {
-        const legacy = validateCenterPrompts(raw);
-        if (!legacy.ok)
-            return legacy;
-        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
-    }
-    if (w.schemaVersion !== 1)
-        return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };
-    if (w.declarations === undefined && w.catalog === undefined)
-        return { ok: false, error: "dual-axis prompts carries neither axis (at least one of declarations|catalog required)" };
-    const value = { identity: "", axes: [] };
-    if (w.declarations !== undefined) {
-        const d = validateCenterPrompts(w.declarations);
-        if (!d.ok)
-            return { ok: false, error: `declarations axis: ${d.error}` };
-        value.declarations = d.value;
-        value.axes.push("declarations");
-    }
-    if (w.catalog !== undefined) {
-        const c = verifyPromptArtifact(w.catalog, { engineVersion: CORE_ENGINE_VERSION });
-        if (!c.ok)
-            return { ok: false, error: `catalog axis: ${c.code}: ${c.reason}` };
-        value.catalog = w.catalog;
-        value.axes.push("catalog");
-    }
-    value.identity = `${value.declarations?.contentDigest ?? "-"}+${value.catalog?.artifact.artifactDigest ?? "-"}`;
-    return { ok: true, value };
-}
+import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 export function withPromptArtifactBackfill(inner, fetchRaw, log) {
     const inFlight = new Map();
     return {

package/dist/capabilities/select-environment-tool.d.ts

@@ -1,6 +1,6 @@
 import type { ToolSpec } from "@sema-agent/core";
 import { type SandboxImageResolver } from "../per-task-image.js";
-import type { ImageViewer, ImageIndexEntry, ImageListFilter } from "../plugins/tidb-image-index.js";
+import type { ImageViewer, ImageIndexEntry, ImageListFilter } from "../plugins/store-contracts.js";
 export interface EnvironmentCatalog extends SandboxImageResolver {
     list(filter: ImageListFilter): Promise<{
         entries: ImageIndexEntry[];

package/dist/config-lkg.js

@@ -2,7 +2,7 @@ import { promises as fs } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
-import { validatePromptsDomain } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain } from "./prompts-domain-validate.js";
 export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }

package/dist/config-types.d.ts

@@ -0,0 +1,306 @@
+import type { SealedKeyPoison } from "./sealed-key.js";
+import type { McpServerSpec, Model, ModelRoles } from "@sema-agent/core";
+import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+import type { ElicitationThrottle } from "./elicitation.js";
+import type { InfraCostRates } from "./finance/cost-taxonomy.js";
+import type { Autonomy, CommandRule } from "./runtime-governance.js";
+export interface ScopedMcpServer {
+    scenarios: string[];
+    spec: McpServerSpec;
+}
+export interface ImageBakeConfig {
+    enabled: boolean;
+    runnerPrincipal: string;
+    registry: string | null;
+    cacheBase: string | null;
+    defaultBaseRef: string | null;
+    leaseMs: number;
+    staleMs: number;
+    submitRateMax: number;
+    submitRateWindowSec: number;
+}
+export interface ServiceConfig {
+    port: number;
+    gatewayBaseUrl: string;
+    gatewayApiKey?: string;
+    gatewayFallbackUrls: string[];
+    anthropic?: {
+        apiKey?: string;
+        authToken?: string;
+        baseUrl?: string;
+        version?: string;
+        cacheBreakpoints: boolean;
+        maxRetries: number;
+    };
+    resilience: {
+        connectTimeoutMs: number;
+        firstTokenTimeoutMs: number;
+        idleTimeoutMs: number;
+        circuitBreaker: boolean;
+        failureThreshold: number;
+        cooldownMs: number;
+    };
+    model: Model;
+    models: Record<string, Model>;
+    modelApiKeyEnv: Record<string, string>;
+    modelApiKeys: Record<string, string | SealedKeyPoison>;
+    modelQuotaWeights: Record<string, number>;
+    tiers: Record<string, string>;
+    projects: Record<string, {
+        displayName?: string;
+        gitRemotes?: string[];
+        defaultScopes?: string[];
+    }>;
+    roles: ModelRoles;
+    sessionBackend: "memory" | "tidb" | "auto";
+    sessionCacheTtlSec: number;
+    rewindSnapshotMaxMb?: number;
+    memoryEngineEnabled: boolean;
+    memoryEngineDir?: string;
+    memoryEngineRemoteLaneAllowed: boolean;
+    memoryScope?: string;
+    memorySync?: {
+        url: string;
+        token: string;
+        scope: string;
+        maxPushEntries?: number;
+        maxPullEntries?: number;
+    };
+    remoteExec?: {
+        provider: "e2b";
+        apiKey: string;
+        template?: string;
+        timeoutMs?: number;
+        livenessMs?: number;
+        allowInternetAccess?: boolean;
+        sandboxEnv?: Record<string, string>;
+        mountPath?: string;
+    } | {
+        provider: "k8s";
+        image: string;
+        apiUrl?: string;
+        token?: string;
+        caCert?: string;
+        insecureTls?: boolean;
+        namespace?: string;
+        runtimeClass?: string;
+        mountPath?: string;
+        timeoutMs?: number;
+        memory?: string;
+        cpu?: string;
+        s3Snapshot?: {
+            endpoint: string;
+            bucket: string;
+            accessKey: string;
+            secretKey: string;
+            region?: string;
+            keyPrefix?: string;
+            presignTtlSec?: number;
+        };
+    } | {
+        provider: "ssh";
+        host: string;
+        port?: number;
+        username: string;
+        privateKey: string;
+        mountPath?: string;
+    } | {
+        provider: "adb";
+        serial: string;
+        adbPath?: string;
+        mountPath?: string;
+    } | {
+        provider: "host";
+        workspaceBase?: string;
+        commandTimeoutMs?: number;
+    } | {
+        provider: "local-docker";
+        image: string;
+        mountPath?: string;
+        dockerPath?: string;
+        dockerHost?: string;
+        memory?: string;
+        cpus?: number;
+        pidsLimit?: number;
+        dropAllCaps?: boolean;
+        network?: "none" | "bridge" | "host";
+        commandTimeoutMs?: number;
+        env?: Record<string, string>;
+    };
+    worktreeIsolation?: {
+        repoRoot: string;
+        allowedRoots?: string[];
+        commit?: string;
+    };
+    mcpServers?: ScopedMcpServer[];
+    tidb?: {
+        host: string;
+        port: number;
+        user: string;
+        password: string;
+        database: string;
+        connectionLimit?: number;
+    };
+    dbBackend: "mysql" | "pg" | "local" | "memory";
+    dbBackendExplicit: boolean;
+    localDataRoot?: string;
+    pg?: {
+        host: string;
+        port: number;
+        user: string;
+        password: string;
+        database: string;
+        connectionLimit?: number;
+    };
+    dbQueryTimeoutMs?: number;
+    snapshotBlobStore?: {
+        endpoint: string;
+        bucket: string;
+        accessKey: string;
+        secretKey: string;
+        region?: string;
+        keyPrefix?: string;
+        presignTtlSec?: number;
+    };
+    snapshotBlobSqlMaxBytes?: number;
+    snapshotBlobAllowSql: boolean;
+    pluginsAllowHosts: string[];
+    bindHost?: string;
+    attachmentOrphanGraceMs: number;
+    workspaceFileMaxBytes: number;
+    sendUserFile?: {
+        endpoint: string;
+        publicEndpoint?: string;
+        publicBucket: string;
+        privateBucket: string;
+        privateKeyPrefix: string;
+        sandboxPutEndpoint?: string;
+        accessKey: string;
+        secretKey: string;
+        region?: string;
+        defaultTtlSec: number;
+    };
+    authToken?: string;
+    authTokens: Record<string, string>;
+    allowUnauthedWrites?: boolean;
+    metricsToken?: string;
+    traceToken?: string;
+    corsOrigins: string[];
+    attachmentMaxBytes: number;
+    attachmentMimeAllowlist?: string[];
+    attachmentUnboundTtlMs: number;
+    principalHeader: string;
+    requirePrincipal: boolean;
+    autonomy?: Autonomy;
+    commandPolicy?: CommandRule[];
+    approvalRequire: string[];
+    operatorPrincipals: string[];
+    approvalDeny: string[];
+    approvalPollMs: number;
+    durableApproval: boolean;
+    resourceSuspend: boolean;
+    resourceSuspendTtlSec: number;
+    approvalAutoBudget: number;
+    approvalNeverAuto: string[];
+    approvalHmacKeys: ApprovalHmacKey[];
+    directApprovalDoor: boolean;
+    principalJwtPubkeys: PrincipalJwtKey[];
+    principalJwtIss?: string;
+    principalJwtAud?: string;
+    principalJwtMaxTtlSec: number;
+    directDoorActive: boolean;
+    infraCostRates: InfraCostRates;
+    leaderEnabled: boolean;
+    leaderFanoutEnabled: boolean;
+    routerEnabled: boolean;
+    selfOrchestrationEnabled: boolean;
+    forkEnabled: boolean;
+    experimentalObserverAgents: boolean;
+    selfOrchestrationModels: string[];
+    selfOrchestrationWorkerIsolation: boolean;
+    workflowRunStoreBackend: "auto" | "file" | "memory";
+    workflowOrphanGraceMs: number;
+    schedulerEnabled: boolean;
+    projectMemoryDisabled: boolean;
+    schedulerStorePath?: string;
+    configBootFetchBudgetMs: number;
+    schedulerSessionWakeup: boolean;
+    planModeEnabled: boolean;
+    workflowJournalRetentionMs: number;
+    workflowRunRetentionMs: number;
+    backgroundAgentRetentionMs: number;
+    backgroundAgentStaleRunningMs: number;
+    backgroundAgentParkClaimStaleMs: number;
+    rosterRetentionMs: number;
+    scratchpadSweepTtlMs: number;
+    sandboxPkgSource?: string;
+    sessionAutoTitle: boolean;
+    selectEnvironmentTool: boolean;
+    envFactsEnabled: boolean;
+    sensitiveWritePatterns: string[];
+    manualModeShellGate?: "always" | "classify";
+    toolDeferLongtail: boolean;
+    lspEnabled: boolean;
+    lspHostEnabled: boolean;
+    drainGraceMs: number;
+    sighupIdleGraceMs: number;
+    mcpElicitation: {
+        enabled: boolean;
+        throttle: ElicitationThrottle;
+    };
+    askQuestionEnabled: boolean;
+    toolApprovalEnabled: boolean;
+    workflowAgentsReadOnly: boolean;
+    imageBakes: ImageBakeConfig;
+    toolTrace: boolean;
+    traceThinking: boolean;
+    logLevel: "debug" | "info" | "warn" | "error";
+    rateLimitPerMin: number;
+    maxTaskCostUsd: number;
+    maxTaskTokens: number;
+    maxPrincipalCostUsd: number;
+    costQuotaWindowSec: number;
+    degrade?: {
+        to: string;
+        atCostFraction: number;
+        reactive: boolean;
+        downgradeOn?: ("rate_limit" | "breaker_open")[];
+        toSupportsImages: boolean;
+    };
+    cascadeLadder: string[];
+    otel?: {
+        endpoint: string;
+        intervalMs: number;
+        serviceName: string;
+        headers: Record<string, string>;
+    };
+    approvalTimeoutSec: number;
+    reapIntervalSec: number;
+    toolResultTtlSec: number;
+    runStaleSec: number;
+    syncImportLeaseStaleSec: number;
+    gitApiBaseUrl?: string;
+    gitApiToken?: string;
+    memoryEngineBackend: "file" | "pg" | "tidb";
+    workflowSizeGuideline?: "small" | "medium" | "large" | "unrestricted";
+    defaultScenario: string;
+    skillsDir: string;
+    oaApiBaseUrl?: string;
+    oaServiceToken?: string;
+    oaIssue?: {
+        baseUrl: string;
+        owner: string;
+        repo: string;
+        token: string;
+        defaultLabels?: number[];
+    };
+    configCenter?: {
+        baseUrl: string;
+        token: string;
+        dryRun: boolean;
+        worker?: string;
+    };
+    configProvider?: string;
+    configLocalDir?: string;
+}
+//# sourceMappingURL=config-types.d.ts.map

package/dist/config-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=config-types.js.map