@sema-agent/server 1.310.0 → 1.312.0

package/dist/main.js

@@ -988,31 +988,80 @@ async function main() {
         requirePrincipal: config.requirePrincipal,
         warn: (msg, fields) => logger.warn(msg, fields),
     });
+    const workflowModelAllowlist = workflowModelAllowlistFor(config);
+    const selfOrchestrationDeps = config.selfOrchestrationEnabled
+        ? {
+            workflowScriptRunner: config.selfOrchestrationWorkerIsolation
+                ? createWorkerHardenedVmRunner()
+                : createHardenedVmRunner(),
+            workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+            workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
+            workflowScriptStore: (() => {
+                const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
+                return {
+                    scopePartitioned: true,
+                    persist: fileStore.persist.bind(fileStore),
+                    load: fileStore.load.bind(fileStore),
+                    resolveName: (name) => resolveCollabWorkflow(name) ?? fileStore.resolveName?.(name),
+                    list: () => listCollabWorkflows(),
+                };
+            })(),
+            onWorkflowAgentSpawn: workflowAgentRegistry
+                ? (handle) => {
+                    const unregister = workflowAgentRegistry.register(handle);
+                    void Promise.resolve(handle.result()).then(unregister, unregister);
+                }
+                : undefined,
+            workflowLimits: config.workflowSizeGuideline ? { sizeGuideline: config.workflowSizeGuideline } : undefined,
+            workflowGovernanceBaseline: {
+                base: config.workflowAgentsReadOnly ? { handsReadOnly: true } : {},
+                worktreeBase: config.workflowAgentsReadOnly ? { handsReadOnly: false } : undefined,
+                workflowModelAllowlist: workflowModelAllowlist ? workflowModelAllowlist : undefined,
+            },
+            workflowCompletionNotifier: {
+                ...(workflowNotifyGate
+                    ? workflowNotifyGate.buildNotifier()
+                    : { notify: (input) => deliverWorkflowCompletion(input) }),
+                ackServed: async (input) => {
+                    if (!workflowCompletionInbox)
+                        return;
+                    try {
+                        const sid = await resolveServedSession(input, runStore ? (id) => runStore.getRun(id) : undefined);
+                        if (sid) {
+                            await workflowCompletionInbox.markTerminalServed(sid, input.runId);
+                            logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
+                        }
+                    }
+                    catch (err) {
+                        logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
+                    }
+                },
+            },
+        }
+        : {};
     const runnerDeps = {
         promptSource,
-        ...(rosterStore ? { rosterStore } : {}),
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(mailboxStore ? { mailboxStore } : {}),
+        rosterStore: rosterStore ? rosterStore : undefined,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        mailboxStore: mailboxStore ? mailboxStore : undefined,
         brain,
         models: config.models,
         roles: config.roles,
         tiers: config.tiers,
         pricing,
         tracer,
-        ...(config.configProvider === "local" ? { hands: { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } } : {}),
-        ...(outcomeSink
-            ? {
-                onTaskOutcome: (o) => {
-                    metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
-                    void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
-                },
-            }
-            : {}),
-        ...(elicitation ? { onElicit: elicitation.elicit } : {}),
-        ...(question ? { onQuestion: question.question } : {}),
-        ...(toolApproval
-            ? { onAsk: (req, signal) => toolApproval.ask(req, signal) }
-            : {}),
+        hands: config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined,
+        onTaskOutcome: outcomeSink
+            ? (o) => {
+                metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
+                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
+            }
+            : undefined,
+        onElicit: elicitation ? elicitation.elicit : undefined,
+        onQuestion: question ? question.question : undefined,
+        onAsk: toolApproval
+            ? (req, signal) => toolApproval.ask(req, signal)
+            : undefined,
         autoMode: {
             onBreakerOpen: (info) => {
                 metrics.inc("auto_mode_breaker_open_total");
@@ -1020,84 +1069,32 @@ async function main() {
             },
         },
         sessionStore,
-        ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
-        ...(memoryEngine
-            ? {
-                onMemoryHarvestReport: (report, info) => {
-                    metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
-                    if (report.patches)
-                        metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
-                    if (report.incident)
-                        logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
-                    if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)
-                        memorySyncRunner.trigger("harvest");
-                },
-            }
-            : {}),
+        memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
+        memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
+        onMemoryHarvestReport: memoryEngine
+            ? (report, info) => {
+                metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
+                if (report.patches)
+                    metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
+                if (report.incident)
+                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
+                if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)
+                    memorySyncRunner.trigger("harvest");
+            }
+            : undefined,
         toolResultStore,
-        ...(sessionPolicyStore ? { sessionPolicyStore } : {}),
-        ...(runtimeCapsResolver ? { runtimeCapsResolver } : {}),
-        ...(fileSnapshotStore ? { fileSnapshotStore } : {}),
-        ...(executionEnvFactory ? { executionEnvFactory } : {}),
-        ...(lspManager ? { lspManager } : {}),
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
+        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        executionEnvFactory: executionEnvFactory ? executionEnvFactory : undefined,
+        lspManager: lspManager ? lspManager : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        ...(config.requirePrincipal !== true && !config.projectMemoryDisabled ? { loadProjectMemory: makeLoadProjectMemory({ logger }) } : {}),
-        ...(config.remoteExec?.provider === "host" && config.requirePrincipal !== true && !config.projectMemoryDisabled
-            ? { probeInstructionSources: makeProbeInstructionSources() }
-            : {}),
+        loadProjectMemory: config.requirePrincipal !== true && !config.projectMemoryDisabled ? makeLoadProjectMemory({ logger }) : undefined,
+        probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && !config.projectMemoryDisabled
+            ? makeProbeInstructionSources()
+            : undefined,
         hooks: deploymentHooks,
-        ...(config.selfOrchestrationEnabled
-            ? {
-                workflowScriptRunner: config.selfOrchestrationWorkerIsolation
-                    ? createWorkerHardenedVmRunner()
-                    : createHardenedVmRunner(),
-                ...(workflowRunStore ? { workflowRunStore } : {}),
-                ...(workflowJournalStore ? { workflowJournalStore } : {}),
-                workflowScriptStore: (() => {
-                    const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
-                    return {
-                        scopePartitioned: true,
-                        persist: fileStore.persist.bind(fileStore),
-                        load: fileStore.load.bind(fileStore),
-                        resolveName: (name) => resolveCollabWorkflow(name) ?? fileStore.resolveName?.(name),
-                        list: () => listCollabWorkflows(),
-                    };
-                })(),
-                ...(workflowAgentRegistry
-                    ? {
-                        onWorkflowAgentSpawn: (handle) => {
-                            const unregister = workflowAgentRegistry.register(handle);
-                            void Promise.resolve(handle.result()).then(unregister, unregister);
-                        },
-                    }
-                    : {}),
-                ...(config.workflowSizeGuideline ? { workflowLimits: { sizeGuideline: config.workflowSizeGuideline } } : {}),
-                workflowGovernanceBaseline: {
-                    base: config.workflowAgentsReadOnly ? { handsReadOnly: true } : {},
-                    ...(config.workflowAgentsReadOnly ? { worktreeBase: { handsReadOnly: false } } : {}),
-                    ...((wl) => (wl ? { workflowModelAllowlist: wl } : {}))(workflowModelAllowlistFor(config)),
-                },
-                workflowCompletionNotifier: {
-                    ...(workflowNotifyGate
-                        ? workflowNotifyGate.buildNotifier()
-                        : { notify: (input) => deliverWorkflowCompletion(input) }),
-                    ackServed: async (input) => {
-                        if (!workflowCompletionInbox)
-                            return;
-                        try {
-                            const sid = await resolveServedSession(input, runStore ? (id) => runStore.getRun(id) : undefined);
-                            if (sid) {
-                                await workflowCompletionInbox.markTerminalServed(sid, input.runId);
-                                logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
-                            }
-                        }
-                        catch (err) {
-                            logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
-                        }
-                    },
-                },
-            }
-            : {}),
+        ...selfOrchestrationDeps,
         onError: (err, ctx) => {
             if (ctx.phase === "degraded") {
                 logger.warn("task_degraded", { sessionId: ctx.sessionId, info: String(err) });
@@ -1335,20 +1332,18 @@ async function main() {
     };
     const scenarioDeps = {
         runner, subRunner, model: "default", skills, repoClient, requirePrincipal: config.requirePrincipal,
-        ...(webSearch ? { webSearch } : {}), metrics, logger, webFetchSummarize,
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(checkpointStore ? { checkpointStore } : {}),
-        ...(ensureChildSessionDurable ? { ensureChildSessionDurable } : {}),
+        webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        checkpointStore: checkpointStore ? checkpointStore : undefined,
+        ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
         oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         brandIdentity: config.configProvider === "local",
-        ...(sendUserFileToolSpec
-            ? {
-                subagentExtraTools: subagentSendUserFileExtraTools({
-                    spec: sendUserFileToolSpec,
-                    approvalGate: () => ({ deny: config.approvalDeny, require: config.approvalRequire, neverAuto: config.approvalNeverAuto }),
-                }),
-            }
-            : {}),
+        subagentExtraTools: sendUserFileToolSpec
+            ? subagentSendUserFileExtraTools({
+                spec: sendUserFileToolSpec,
+                approvalGate: () => ({ deny: config.approvalDeny, require: config.approvalRequire, neverAuto: config.approvalNeverAuto }),
+            })
+            : undefined,
     };
     const scenarios = buildScenarios(scenarioDeps);
     const parkedReviveTool = checkpointStore && backgroundAgentStore ? scenarios.default?.({})?.tools.find((t) => t.name === "Agent") : undefined;
@@ -1844,72 +1839,68 @@ async function main() {
         config,
         authorize,
         sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
-        ...(taskAttachmentStore ? { taskAttachmentStore } : {}),
-        ...(backend && backend.kind !== "local" && !config.snapshotBlobStore
-            ? ((cap) => (cap !== undefined ? { snapshotBlobSqlCapBytes: cap } : {}))(config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
-            : {}),
+        taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
+        snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
+            ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
+            : undefined,
         modelReady: () => modelReadyState.ready,
         scenarioDetails,
-        ...(registryJwtVerifier ? { registryJwtVerifier } : {}),
+        registryJwtVerifier: registryJwtVerifier ? registryJwtVerifier : undefined,
         hookWakeBus,
         runStore,
         fleetBus,
         workflowsCapable,
-        ...(resumeAnchorStore ? { resumeAnchorStore } : {}),
-        ...(approvalExemptionStore ? { approvalExemptionStore } : {}),
-        ...(sessionTitler ? { sessionTitler } : {}),
-        ...(sessionPolicyStore ? { sessionPolicyStore } : {}),
-        ...(fileSnapshotStore ? { fileSnapshotStore } : {}),
-        ...(backend ? { backend } : {}),
-        ...(principalCaps
-            ? { sessionMirrorRuling: async (p) => (await principalCaps.executionRuling(p))?.sessionMirror }
-            : {}),
+        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
+        approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
+        sessionTitler: sessionTitler ? sessionTitler : undefined,
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        backend: backend ? backend : undefined,
+        sessionMirrorRuling: principalCaps
+            ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
+            : undefined,
         approvalStore,
         checkpointStore,
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(parkedReviveTool ? { parkedReviveTool } : {}),
-        ...(parkedReviveInheritedGate ? { parkedReviveInheritedGate } : {}),
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        parkedReviveTool: parkedReviveTool ? parkedReviveTool : undefined,
+        parkedReviveInheritedGate: parkedReviveInheritedGate ? parkedReviveInheritedGate : undefined,
         imageIndex,
         imageBakes,
         leaderEndpoint,
-        ...(workflowRunStore ? { workflowRunStore } : {}),
-        ...(workflowJournalStore ? { workflowJournalStore } : {}),
-        ...(workflowAgentRegistry ? { workflowAgentRegistry } : {}),
+        workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+        workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
+        workflowAgentRegistry: workflowAgentRegistry ? workflowAgentRegistry : undefined,
         subagentSteerRegistry,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
-        ...(workflowCompletionInbox ? { workflowCompletionInbox } : {}),
+        workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined,
         sessionAudit,
         sessionStorage: ownerAware,
-        ...(sessionWatchRegistry
-            ? {
-                sessionWatch: sessionWatchRegistry,
-                sessionEventsMaxConnections: posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000),
-            }
-            : {}),
-        ...(purgeSession ? { purgeSession } : {}),
+        sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined,
+        sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
+        purgeSession: purgeSession ? purgeSession : undefined,
         instrumentDegenerate,
         planCacheProbe,
         modelUsage: modelUsageTracker,
         promptManifests: promptManifestTracker,
-        ...(elicitation ? { elicitation } : {}),
-        ...(question ? { question } : {}),
-        ...(toolApproval ? { toolApproval } : {}),
-        ...(sendUserFileEmitter ? { sendUserFile: sendUserFileEmitter } : {}),
-        ...(sendFileLedger ? { sendFileLedger } : {}),
+        elicitation: elicitation ? elicitation : undefined,
+        question: question ? question : undefined,
+        toolApproval: toolApproval ? toolApproval : undefined,
+        sendUserFile: sendUserFileEmitter ? sendUserFileEmitter : undefined,
+        sendFileLedger: sendFileLedger ? sendFileLedger : undefined,
         instanceId,
         logger,
         metrics,
         rateLimiter,
         costQuota,
-        ...(fleetLease ? { fleetLease } : {}),
+        fleetLease: fleetLease ? fleetLease : undefined,
         sideQueryAccounting,
-        ...(outcomeSink ? { outcomeSink } : {}),
-        ...(memoryExportBackend ? { memoryExport: (scope) => exportMemoryScope(memoryExportBackend, scope) } : {}),
-        ...(memoryExportBackend && memorySyncCursors
-            ? { memorySync: (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq) }
-            : {}),
+        outcomeSink: outcomeSink ? outcomeSink : undefined,
+        memoryExport: memoryExportBackend ? (scope) => exportMemoryScope(memoryExportBackend, scope) : undefined,
+        memorySync: memoryExportBackend && memorySyncCursors
+            ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
+            : undefined,
         capabilities: {
             version: serviceVersion(),
             scenarios: Object.keys(scenarios),

package/dist/per-task-image.d.ts

@@ -1,11 +1,11 @@
-import type { ImageViewer, ImageIndexEntry } from "./plugins/tidb-image-index.js";
+import type { ImageViewer, ImageIndexEntry } from "./plugins/store-contracts.js";
 export interface SandboxImageResolver {
     latestPublished(profile: string, viewer: ImageViewer): Promise<Pick<ImageIndexEntry, "repo" | "digest" | "capabilities"> | null>;
 }
 export type SandboxImageResolution = {
     ok: true;
     ref: string;
-    capabilities?: import("./plugins/tidb-image-index.js").ImageCapabilities;
+    capabilities?: import("./plugins/store-contracts.js").ImageCapabilities;
 } | {
     ok: false;
     status: number;

package/dist/plugins/file-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./tidb-run-store.js";
+import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
 import type { RunStoreCheckpointProbe } from "./memory-run-store.js";
 export declare class FileRunStore {
     private readonly runsDir;

package/dist/plugins/local-session-store.d.ts

@@ -1,6 +1,6 @@
 import { type AcquiredSession, type SessionStore, type SessionRepo, type SessionTreeEntry } from "@sema-agent/core";
-import type { SessionSummary } from "./tidb-run-store.js";
-import { type StagingHandle } from "../session-sync.js";
+import type { SessionSummary } from "./store-contracts.js";
+import { type StagingHandle } from "../session-sync-kernel.js";
 export declare class LocalSessionStore implements SessionStore {
     private readonly repo;
     private readonly pending;

package/dist/plugins/local-session-store.js

@@ -2,7 +2,7 @@ import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { SessionError, validateEntriesForImport } from "@sema-agent/core";
 import { identicalIdsAlsoIdenticalContent } from "../session-sync-content.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, } from "../session-sync.js";
+import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, } from "../session-sync-kernel.js";
 const ownerEq = (a, b) => (a ?? null) === (b ?? null);
 const isNotFound = (e) => e instanceof SessionError && e.code === "not_found";
 function userText(entry) {

package/dist/plugins/memory-run-store.d.ts

@@ -1,6 +1,6 @@
 import { type UsageRow } from "../usage-analytics.js";
 import type { TaskResult, TaskStatus } from "@sema-agent/core";
-import type { RunRecord, SessionSummary, RunEvent } from "./tidb-run-store.js";
+import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
 export interface RunStoreCheckpointProbe {
     hasPending(sessionId: string): Promise<boolean>;
     hasExpired(sessionId: string): Promise<boolean>;

package/dist/plugins/pg-approval-store.js

@@ -1,4 +1,4 @@
-import {} from "./tidb-approval-store.js";
+import { mapRow } from "./tidb-approval-store.js";
 import { pgProtocolJsonStringify } from "./pg-safe-json.js";
 export const PG_APPROVAL_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS approval (
@@ -27,16 +27,6 @@ export async function ensureSchema(pool) {
     for (const stmt of PG_APPROVAL_SCHEMA)
         await pool.query(stmt);
 }
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
-function iso(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : String(v);
-}
 export class PgApprovalStore {
     pool;
     constructor(pool) {
@@ -91,20 +81,4 @@ export class PgApprovalStore {
         return res.rowCount ?? 0;
     }
 }
-function mapRow(r) {
-    return {
-        id: String(r.id),
-        taskId: r.task_id ?? null,
-        sessionId: r.session_id ?? null,
-        owner: r.owner ?? null,
-        scope: r.scope ?? null,
-        toolName: String(r.tool_name),
-        args: parseJson(r.args),
-        status: r.status,
-        reason: r.reason ?? null,
-        decidedBy: r.decided_by ?? null,
-        createdAt: iso(r.created_at),
-        decidedAt: iso(r.decided_at),
-    };
-}
 //# sourceMappingURL=pg-approval-store.js.map

package/dist/plugins/pg-checkpoint-store.js

@@ -2,15 +2,11 @@ import { CheckpointError, validatePendingSteer, checkpointVersionOf, winnerFromO
 import { redactDeep } from "../trace/redact.js";
 import { tokenFingerprint } from "./tidb-checkpoint-store.js";
 import { pgProtocolJsonStringify } from "./pg-safe-json.js";
+import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 const TERMINAL_BACKSTOP_MS = Math.max(60_000, Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) || 30 * 86_400_000);
 const TERMINAL_GRACE_MS = 3_600_000;
 const PG_UNIQUE_VIOLATION = "23505";
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
 function boundedToolInput(args) {
     if (args === undefined)
         return null;

package/dist/plugins/pg-image-bake.d.ts

@@ -1,6 +1,6 @@
 import type { Pool, PoolClient } from "pg";
-import type { BakeStatus, BakeState, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal } from "./tidb-image-bake.js";
-export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, } from "./tidb-image-bake.js";
+import type { BakeStatus, BakeState, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal } from "./store-contracts.js";
+export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, } from "./store-contracts.js";
 export declare const PG_IMAGE_BAKE_SCHEMA: string[];
 export declare function ensureSchema(pool: Pool | PoolClient, poolName?: string): Promise<void>;
 export declare class PgImageBake {

package/dist/plugins/pg-image-bake.js

@@ -1,6 +1,8 @@
 import { uuidv7 } from "@sema-agent/core";
 import { randomBytes } from "node:crypto";
 import { pgSanitizeText, pgSafeJsonStringify, pgHasUnstorable } from "./pg-safe-json.js";
+import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
+import { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
 export const PG_IMAGE_BAKE_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS image_bake (
      bake_id          VARCHAR(64)  NOT NULL,
@@ -74,60 +76,6 @@ function dupKeyName(err) {
         return "primary";
     return "other";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
-function isoOrNull(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function parseJson(v, fallback) {
-    if (v == null)
-        return fallback;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return fallback;
-    }
-}
-function mapRow(r) {
-    return {
-        bakeId: r.bake_id,
-        profile: r.profile,
-        bands: r.bands == null ? null : parseJson(r.bands, []),
-        baseRef: r.base_ref,
-        push: !!r.push,
-        dryRun: !!r.dry_run,
-        logs: !!r.logs,
-        argv: parseJson(r.argv, []),
-        status: r.status,
-        state: r.state ?? null,
-        digest: r.digest,
-        repo: r.repo,
-        ref: r.ref,
-        indexId: r.index_id,
-        exitCode: r.exit_code === null ? null : Number(r.exit_code),
-        error: r.error,
-        errorCode: r.error_code ?? null,
-        manifestSha: r.manifest_sha,
-        tag: r.tag,
-        idemKey: r.idem_key,
-        ingestSecret: r.ingest_secret,
-        runnerId: r.runner_id,
-        leaseUntil: isoOrNull(r.lease_until),
-        cancelRequested: !!r.cancel_requested,
-        requestedBy: r.requested_by,
-        createdAt: iso(r.created_at),
-        updatedAt: iso(r.updated_at),
-    };
-}
-const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
-    "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
-    "cancel_requested, requested_by, created_at, updated_at";
 export class PgImageBake {
     pool;
     poolName;

package/dist/plugins/pg-image-index.d.ts

@@ -1,6 +1,6 @@
 import type { Pool, PoolClient } from "pg";
-import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./tidb-image-index.js";
-export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, } from "./tidb-image-index.js";
+import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
+export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, } from "./store-contracts.js";
 export declare const PG_IMAGE_INDEX_SCHEMA: string[];
 export declare function ensureSchema(pool: Pool | PoolClient): Promise<void>;
 export declare class PgImageIndex {

package/dist/plugins/pg-image-index.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { pgSafeJsonStringify, pgSanitizeText, pgHasUnstorable, PgUnstorableError } from "./pg-safe-json.js";
-import {} from "./tidb-image-index.js";
+import { mapImageRow as mapRow, } from "./store-contracts.js";
 export const PG_IMAGE_INDEX_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS sandbox_image_index (
      id                 VARCHAR(64)  NOT NULL,
@@ -37,49 +37,6 @@ export async function ensureSchema(pool) {
 }
 const MAX_LIMIT = 200;
 const DEFAULT_LIMIT = 50;
-function asJson(v, fallback) {
-    if (v === null || v === undefined)
-        return fallback;
-    if (typeof v === "string") {
-        try {
-            return JSON.parse(v);
-        }
-        catch {
-            return fallback;
-        }
-    }
-    return v;
-}
-function iso(v) {
-    if (v === null || v === undefined)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function mapRow(r) {
-    return {
-        id: r.id,
-        profile: r.profile,
-        bands: asJson(r.bands, []),
-        repo: r.repo,
-        tag: r.tag,
-        digest: r.digest,
-        toolchainVersions: asJson(r.toolchain_versions, {}),
-        capabilities: asJson(r.capabilities, {}),
-        podContract: asJson(r.pod_contract, {}),
-        sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
-        status: r.status,
-        visibility: r.visibility,
-        tenantId: r.tenant_id,
-        manifestSha: r.manifest_sha,
-        recipeGitSha: r.recipe_git_sha,
-        generatorVersion: r.generator_version,
-        buildDate: iso(r.build_date),
-        supersedes: r.supersedes,
-        signed: !!r.signed,
-        createdAt: iso(r.created_at) ?? new Date(0).toISOString(),
-        updatedAt: iso(r.updated_at) ?? new Date(0).toISOString(),
-    };
-}
 function visibilityClause(viewer, startIdx) {
     if (viewer.operator)
         return { sql: "1=1", params: [], nextIdx: startIdx };

package/dist/plugins/pg-pool.d.ts

@@ -1,5 +1,5 @@
 import pg from "pg";
-import type { ServiceConfig } from "../config.js";
+import type { ServiceConfig } from "../config-types.js";
 export declare const PG_SCHEMA_STATEMENTS: readonly string[];
 export declare function pgPoolOptions(pgCfg: NonNullable<ServiceConfig["pg"]>, dbQueryTimeoutMs?: number): pg.PoolConfig;
 export declare function createPgPool(opts: string | pg.PoolConfig): pg.Pool;

package/dist/plugins/pg-run-store.d.ts

@@ -1,7 +1,7 @@
 import type { TaskResult, TaskStatus } from "@sema-agent/core";
 import { type UsageRow } from "../usage-analytics.js";
 import type { Pool } from "pg";
-import type { RunRecord, RunEvent, SessionSummary } from "./tidb-run-store.js";
+import type { RunRecord, RunEvent, SessionSummary } from "./store-contracts.js";
 export declare class PgRunStore {
     private readonly pool;
     constructor(pool: Pool);