@sema-agent/server 1.310.0 → 1.312.0

package/dist/plugins/tidb-image-index.js

@@ -1,49 +1,8 @@
 import { createHash } from "node:crypto";
+import { mapImageRow as mapRow, } from "./store-contracts.js";
+export { mapImageRow as mapRow } from "./store-contracts.js";
 const MAX_LIMIT = 200;
 const DEFAULT_LIMIT = 50;
-function asJson(v, fallback) {
-    if (v === null || v === undefined)
-        return fallback;
-    if (typeof v === "string") {
-        try {
-            return JSON.parse(v);
-        }
-        catch {
-            return fallback;
-        }
-    }
-    return v;
-}
-function iso(v) {
-    if (v === null || v === undefined)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function mapRow(r) {
-    return {
-        id: r.id,
-        profile: r.profile,
-        bands: asJson(r.bands, []),
-        repo: r.repo,
-        tag: r.tag,
-        digest: r.digest,
-        toolchainVersions: asJson(r.toolchain_versions, {}),
-        capabilities: asJson(r.capabilities, {}),
-        podContract: asJson(r.pod_contract, {}),
-        sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
-        status: r.status,
-        visibility: r.visibility,
-        tenantId: r.tenant_id,
-        manifestSha: r.manifest_sha,
-        recipeGitSha: r.recipe_git_sha,
-        generatorVersion: r.generator_version,
-        buildDate: iso(r.build_date),
-        supersedes: r.supersedes,
-        signed: !!r.signed,
-        createdAt: iso(r.created_at) ?? new Date(0).toISOString(),
-        updatedAt: iso(r.updated_at) ?? new Date(0).toISOString(),
-    };
-}
 function visibilityClause(viewer) {
     if (viewer.operator)
         return { sql: "1=1", params: [] };

package/dist/plugins/tidb-pool.d.ts

@@ -1,6 +1,6 @@
 import mysql from "mysql2/promise";
 import type { Pool, PoolConnection } from "mysql2/promise";
-import type { ServiceConfig } from "../config.js";
+import type { ServiceConfig } from "../config-types.js";
 export declare function tidbPoolOptions(tidb: NonNullable<ServiceConfig["tidb"]>): mysql.PoolOptions;
 export declare function createTidbPool(config: ServiceConfig): Pool;
 export declare const SCHEMA_STATEMENTS: readonly string[];

package/dist/plugins/tidb-run-store.d.ts

@@ -1,38 +1,8 @@
 import type { TaskResult, TaskStatus } from "@sema-agent/core";
 import { type UsageRow } from "../usage-analytics.js";
 import type { Pool } from "mysql2/promise";
-export interface RunRecord {
-    taskId: string;
-    sessionId: string;
-    owner: string | null;
-    status: "running" | TaskStatus;
-    result: TaskResult | null;
-    error: string | null;
-    errorCode: string | null;
-    jobId: string | null;
-    source: string | null;
-    instanceId: string | null;
-    objectivePreview: string | null;
-    createdAt: string;
-    updatedAt: string;
-}
-export interface SessionSummary {
-    sessionId: string;
-    owner: string | null;
-    lastActivityAt: string;
-    firstActivityAt: string;
-    runCount: number;
-    objectivePreview: string | null;
-    lastStatus: string;
-    lastRunId: string | null;
-    title: string | null;
-}
-export interface RunEvent {
-    seq: number;
-    type: string;
-    data: unknown;
-    ts: string;
-}
+import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
+export type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
 export declare class TiDBRunStore {
     private readonly pool;
     constructor(pool: Pool);

package/dist/plugins/tidb-run-store.js

@@ -1,23 +1,9 @@
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
-import { escapeLike } from "./tidb-tool-result-store.js";
-function parseJson(v) {
-    if (v == null)
-        return null;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return null;
-    }
-}
+import { escapeLike } from "./sql-escape.js";
+import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "ER_DUP_ENTRY";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
 export class TiDBRunStore {
     pool;
     constructor(pool) {

package/dist/plugins/tidb-session-storage.js

@@ -1,13 +1,9 @@
 import { emitLeafAdvance } from "../session-leaf-bus.js";
 import { BaseSessionStorage, SessionError, leafIdAfterEntry, normalizePromptEpoch, } from "@sema-agent/core";
+import { toIso } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "ER_DUP_ENTRY";
 }
-function toIso(v) {
-    if (v instanceof Date)
-        return v.toISOString();
-    return String(v);
-}
 export class TiDBSessionStorage extends BaseSessionStorage {
     pool;
     sessionId;

package/dist/plugins/tidb-session-store.d.ts

@@ -1,7 +1,7 @@
 import { type AcquiredSession, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
-import type { SessionSummary } from "./tidb-run-store.js";
-import { type StagingHandle } from "../session-sync.js";
+import type { SessionSummary } from "./store-contracts.js";
+import { type StagingHandle } from "../session-sync-kernel.js";
 export declare class TiDBSessionStore implements SessionStore {
     private readonly pool;
     private readonly pending;

package/dist/plugins/tidb-session-store.js

@@ -1,7 +1,7 @@
 import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
 import { TiDBSessionStorage } from "./tidb-session-storage.js";
-import { escapeLike } from "./tidb-tool-result-store.js";
-import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync.js";
+import { escapeLike } from "./sql-escape.js";
+import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
 const STAGING_GC_GRACE_MS = 3_600_000;
 export class TiDBSessionStore {
     pool;

package/dist/plugins/tidb-tool-result-store.d.ts

@@ -1,5 +1,6 @@
 import type { ToolResultStore, ToolResultSlice } from "@sema-agent/core";
 import type { Pool } from "mysql2/promise";
+export { escapeLike } from "./sql-escape.js";
 export declare class TiDBToolResultStore implements ToolResultStore {
     private readonly pool;
     constructor(pool: Pool);
@@ -11,5 +12,4 @@ export declare class TiDBToolResultStore implements ToolResultStore {
     reapOlderThan(cutoffMs: number): Promise<number>;
     deleteBySession(sessionId: string): Promise<number>;
 }
-export declare function escapeLike(s: string): string;
 //# sourceMappingURL=tidb-tool-result-store.d.ts.map

package/dist/plugins/tidb-tool-result-store.js

@@ -1,3 +1,5 @@
+import { escapeLike } from "./sql-escape.js";
+export { escapeLike } from "./sql-escape.js";
 export class TiDBToolResultStore {
     pool;
     constructor(pool) {
@@ -35,7 +37,4 @@ export class TiDBToolResultStore {
         return res.affectedRows;
     }
 }
-export function escapeLike(s) {
-    return s.replace(/[\\%_]/g, (ch) => `\\${ch}`);
-}
 //# sourceMappingURL=tidb-tool-result-store.js.map

package/dist/prompts-domain-validate.d.ts

@@ -0,0 +1,29 @@
+import { type PromptTextDeclaration, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
+export interface EffectiveCenterPrompts {
+    packId: string;
+    contentDigest: string;
+    sections: PromptTextDeclaration[];
+    scenarioOverrides?: Record<string, PromptTextDeclaration[]>;
+}
+export declare function validateCenterPrompts(raw: unknown): {
+    ok: true;
+    value: EffectiveCenterPrompts;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const CORE_ENGINE_VERSION: string;
+export interface PromptsDomainFaces {
+    declarations?: EffectiveCenterPrompts;
+    catalog?: PublishedPromptArtifactEnvelope;
+    identity: string;
+    axes: Array<"declarations" | "catalog">;
+}
+export declare function validatePromptsDomain(raw: unknown): {
+    ok: true;
+    value: PromptsDomainFaces;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=prompts-domain-validate.d.ts.map

package/dist/prompts-domain-validate.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { verifyPromptArtifact } from "@sema-agent/core";
+const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
+const SLOTS = new Set(["identity", "scenario", "behavior"]);
+const HASH_RE = /^sha256:[0-9a-f]{64}$/;
+function declarationIssue(d, where) {
+    if (d === null || typeof d !== "object")
+        return `${where}: declaration is not an object`;
+    const o = d;
+    if (typeof o.id !== "string" || o.id.length === 0 || o.id.length > 128 || !ID_RE.test(o.id))
+        return `${where}: bad id`;
+    if (o.id.startsWith("core/"))
+        return `${where}: id in the reserved core/ namespace`;
+    if (typeof o.slot !== "string" || !SLOTS.has(o.slot))
+        return `${where}: bad slot`;
+    if (typeof o.text !== "string" || o.text.length === 0)
+        return `${where}: text must be a non-empty string`;
+    if (typeof o.contentHash !== "string" || !HASH_RE.test(o.contentHash))
+        return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
+    const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
+    if (o.contentHash !== expected)
+        return `${where}: contentHash does not match sha256(text) — stale or tampered declaration`;
+    return undefined;
+}
+export function validateCenterPrompts(raw) {
+    if (raw === null || typeof raw !== "object")
+        return { ok: false, error: "prompts is not an object" };
+    const p = raw;
+    if (typeof p.packId !== "string" || !/^center:[0-9a-f]{12}$/.test(p.packId))
+        return { ok: false, error: "bad packId form (center:<digest12>)" };
+    if (typeof p.contentDigest !== "string" || !HASH_RE.test(p.contentDigest))
+        return { ok: false, error: "bad contentDigest form" };
+    const arrayIssue = (decls, where) => {
+        if (!Array.isArray(decls))
+            return `${where} is not an array`;
+        if (decls.length === 0)
+            return `${where} is empty (an empty replacement set is not a v1 semantic — omit the key instead)`;
+        const seen = new Set();
+        for (let i = 0; i < decls.length; i++) {
+            const issue = declarationIssue(decls[i], `${where}[${i}]`);
+            if (issue)
+                return issue;
+            const id = decls[i].id;
+            if (seen.has(id))
+                return `${where}[${i}]: duplicate id "${id}" (core composer throws on duplicates)`;
+            seen.add(id);
+        }
+        return undefined;
+    };
+    const sectionsIssue = arrayIssue(p.sections, "sections");
+    if (sectionsIssue)
+        return { ok: false, error: sectionsIssue };
+    if (p.scenarioOverrides !== undefined) {
+        if (p.scenarioOverrides === null || typeof p.scenarioOverrides !== "object" || Array.isArray(p.scenarioOverrides)) {
+            return { ok: false, error: "scenarioOverrides is not an object" };
+        }
+        for (const [name, decls] of Object.entries(p.scenarioOverrides)) {
+            const issue = arrayIssue(decls, `scenarioOverrides[${name}]`);
+            if (issue)
+                return { ok: false, error: issue };
+        }
+    }
+    return { ok: true, value: raw };
+}
+export const CORE_ENGINE_VERSION = (() => {
+    try {
+        const entry = createRequire(import.meta.url).resolve("@sema-agent/core");
+        return JSON.parse(readFileSync(join(dirname(entry), "..", "package.json"), "utf8")).version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
+export function validatePromptsDomain(raw) {
+    if (raw === null || typeof raw !== "object")
+        return { ok: false, error: "prompts is not an object" };
+    const w = raw;
+    if (w.schemaVersion === undefined) {
+        const legacy = validateCenterPrompts(raw);
+        if (!legacy.ok)
+            return legacy;
+        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
+    }
+    if (w.schemaVersion !== 1)
+        return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };
+    if (w.declarations === undefined && w.catalog === undefined)
+        return { ok: false, error: "dual-axis prompts carries neither axis (at least one of declarations|catalog required)" };
+    const value = { identity: "", axes: [] };
+    if (w.declarations !== undefined) {
+        const d = validateCenterPrompts(w.declarations);
+        if (!d.ok)
+            return { ok: false, error: `declarations axis: ${d.error}` };
+        value.declarations = d.value;
+        value.axes.push("declarations");
+    }
+    if (w.catalog !== undefined) {
+        const c = verifyPromptArtifact(w.catalog, { engineVersion: CORE_ENGINE_VERSION });
+        if (!c.ok)
+            return { ok: false, error: `catalog axis: ${c.code}: ${c.reason}` };
+        value.catalog = w.catalog;
+        value.axes.push("catalog");
+    }
+    value.identity = `${value.declarations?.contentDigest ?? "-"}+${value.catalog?.artifact.artifactDigest ?? "-"}`;
+    return { ok: true, value };
+}
+//# sourceMappingURL=prompts-domain-validate.js.map

package/dist/security.d.ts

@@ -1,8 +1,11 @@
 import type { IncomingMessage } from "node:http";
 import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
-import type { ServiceConfig } from "./config.js";
-import type { TaskRequestBody } from "./http/server.js";
-import type { StagingHandle } from "./session-sync.js";
+import type { ServiceConfig } from "./config-types.js";
+import type { TaskRequestBody } from "./http/wire-types.js";
+import type { StagingHandle } from "./session-sync-kernel.js";
+import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 export interface SessionListItem {
     sessionId: string;
     owner: string | null;
@@ -92,12 +95,6 @@ export declare function memorySpecForRequest(scope: string | undefined, memoryWr
     writeScope?: string | null;
     scopeContract?: "v2";
 } | undefined;
-export interface ApprovalHmacKey {
-    kid: string;
-    key: string;
-    status?: "active" | "retiring";
-}
-export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
 export declare function approvalHmacMessage(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -113,13 +110,6 @@ export declare function verifyApprovalHmac(env: {
     decision: string;
     reason?: string | null;
 }, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
-export interface PrincipalJwtKey {
-    kid: string;
-    alg: "EdDSA" | "RS256" | "ES256";
-    key: string;
-    status?: "active" | "retiring";
-}
-export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
 export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
     iss: string;
     aud: string;

package/dist/security.js

@@ -2,6 +2,7 @@ import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cry
 import { join } from "node:path";
 import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
 import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
+export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 export function isUuidV7(s) {
     return UUIDV7_RE.test(s);
@@ -162,19 +163,6 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
     const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
     return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
 }
-export function parseApprovalHmacKeys(raw) {
-    if (!raw)
-        return [];
-    try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
-    }
-    catch {
-        return [];
-    }
-}
 export function approvalHmacMessage(env) {
     return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
 }
@@ -200,23 +188,6 @@ export function verifyApprovalHmac(env, mac, kid, keys) {
     }
     return false;
 }
-export function parsePrincipalJwks(raw) {
-    if (!raw)
-        return [];
-    const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
-    try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => {
-            const e = k;
-            return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
-        });
-    }
-    catch {
-        return [];
-    }
-}
 function b64urlToBuf(s) {
     return Buffer.from(s, "base64url");
 }

package/dist/sema-registry.d.ts

@@ -1,6 +1,6 @@
 import type { McpServerSpec } from "@sema-agent/core";
 import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
-import type { ScopedMcpServer, ServiceConfig } from "./config.js";
+import type { ScopedMcpServer, ServiceConfig } from "./config-types.js";
 import { type SealedKeyOpener } from "./sealed-key.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { Logger } from "./observability/logger.js";

package/dist/session-sync-kernel.d.ts

@@ -0,0 +1,47 @@
+import type { SessionTreeEntry } from "@sema-agent/core";
+export interface StagingHandle {
+    readonly stagingId: string;
+    readonly realSessionId: string;
+    appendBatch(entries: SessionTreeEntry[]): Promise<void>;
+    commit(owner: string | null, opts?: {
+        resolution?: "overwrite-dst";
+    }): Promise<{
+        relation: SyncRelation["relation"];
+    }>;
+    abort(): Promise<void>;
+}
+export type ImportStagingStore = {
+    beginImportStaging(realSessionId: string, token: string): StagingHandle;
+    sweepStagingSessions?(): Promise<number>;
+};
+export declare function stagingIdFor(realSessionId: string, token: string): string;
+export declare const STAGING_ID_MARKER = "#stg-";
+export declare function realIdOfStaging(stagingId: string): string | null;
+export type SyncRelation = {
+    relation: "fresh";
+} | {
+    relation: "identical";
+} | {
+    relation: "fast_forward";
+    newEntryIds: string[];
+} | {
+    relation: "stale";
+    dstAheadBy: string[];
+} | {
+    relation: "fork";
+    commonAncestor: string | null;
+    srcExclusive: string[];
+    dstExclusive: string[];
+};
+export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
+export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
+export declare class SyncConflictError extends Error {
+    readonly sessionId: string;
+    readonly relation: Extract<SyncRelation, {
+        relation: "fork" | "stale";
+    }>;
+    constructor(sessionId: string, relation: Extract<SyncRelation, {
+        relation: "fork" | "stale";
+    }>);
+}
+//# sourceMappingURL=session-sync-kernel.d.ts.map

package/dist/session-sync-kernel.js

@@ -0,0 +1,47 @@
+export function stagingIdFor(realSessionId, token) {
+    return `${realSessionId}#stg-${token}`;
+}
+export const STAGING_ID_MARKER = "#stg-";
+export function realIdOfStaging(stagingId) {
+    const i = stagingId.indexOf(STAGING_ID_MARKER);
+    return i < 0 ? null : stagingId.slice(0, i);
+}
+export function classifySyncRelationship(srcEntries, dstEntries) {
+    return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
+}
+export function classifySyncRelationshipByIds(srcIds, dstIds) {
+    if (dstIds === null || dstIds.length === 0)
+        return { relation: "fresh" };
+    const srcSet = new Set(srcIds);
+    const dstSet = new Set(dstIds);
+    if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
+        return { relation: "identical" };
+    const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
+    const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
+    if (allDstInSrc && !allSrcInDst) {
+        const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
+        return { relation: "fast_forward", newEntryIds };
+    }
+    if (allSrcInDst && !allDstInSrc) {
+        const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
+        return { relation: "stale", dstAheadBy };
+    }
+    const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
+    const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
+    let commonAncestor = null;
+    for (const id of srcIds)
+        if (dstSet.has(id))
+            commonAncestor = id;
+    return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
+}
+export class SyncConflictError extends Error {
+    sessionId;
+    relation;
+    constructor(sessionId, relation) {
+        super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
+        this.sessionId = sessionId;
+        this.relation = relation;
+        this.name = "SyncConflictError";
+    }
+}
+//# sourceMappingURL=session-sync-kernel.js.map

package/dist/session-sync.d.ts

@@ -1,51 +1,9 @@
 import type { StoreBackend } from "./plugins/store-backend.js";
+import { type SyncRelation } from "./session-sync-kernel.js";
 import type { SessionTreeEntry, SessionRulesRecord } from "@sema-agent/core";
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
-export interface StagingHandle {
-    readonly stagingId: string;
-    readonly realSessionId: string;
-    appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    commit(owner: string | null, opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
-        relation: SyncRelation["relation"];
-    }>;
-    abort(): Promise<void>;
-}
-export type ImportStagingStore = {
-    beginImportStaging(realSessionId: string, token: string): StagingHandle;
-    sweepStagingSessions?(): Promise<number>;
-};
-export declare function stagingIdFor(realSessionId: string, token: string): string;
-export declare const STAGING_ID_MARKER = "#stg-";
-export declare function realIdOfStaging(stagingId: string): string | null;
-export type SyncRelation = {
-    relation: "fresh";
-} | {
-    relation: "identical";
-} | {
-    relation: "fast_forward";
-    newEntryIds: string[];
-} | {
-    relation: "stale";
-    dstAheadBy: string[];
-} | {
-    relation: "fork";
-    commonAncestor: string | null;
-    srcExclusive: string[];
-    dstExclusive: string[];
-};
-export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
-export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
-export declare class SyncConflictError extends Error {
-    readonly sessionId: string;
-    readonly relation: Extract<SyncRelation, {
-        relation: "fork" | "stale";
-    }>;
-    constructor(sessionId: string, relation: Extract<SyncRelation, {
-        relation: "fork" | "stale";
-    }>);
-}
+export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
+export type { StagingHandle, ImportStagingStore, SyncRelation } from "./session-sync-kernel.js";
 export interface SessionBundle {
     sessionId: string;
     entries: SessionTreeEntry[];

package/dist/session-sync.js

@@ -1,51 +1,7 @@
 import { identicalIdsAlsoIdenticalContent } from "./session-sync-content.js";
+import { classifySyncRelationship, SyncConflictError } from "./session-sync-kernel.js";
 import { validateEntriesForImport, normalizeRules, stripRev } from "@sema-agent/core";
-export function stagingIdFor(realSessionId, token) {
-    return `${realSessionId}#stg-${token}`;
-}
-export const STAGING_ID_MARKER = "#stg-";
-export function realIdOfStaging(stagingId) {
-    const i = stagingId.indexOf(STAGING_ID_MARKER);
-    return i < 0 ? null : stagingId.slice(0, i);
-}
-export function classifySyncRelationship(srcEntries, dstEntries) {
-    return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
-}
-export function classifySyncRelationshipByIds(srcIds, dstIds) {
-    if (dstIds === null || dstIds.length === 0)
-        return { relation: "fresh" };
-    const srcSet = new Set(srcIds);
-    const dstSet = new Set(dstIds);
-    if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
-        return { relation: "identical" };
-    const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
-    const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
-    if (allDstInSrc && !allSrcInDst) {
-        const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
-        return { relation: "fast_forward", newEntryIds };
-    }
-    if (allSrcInDst && !allDstInSrc) {
-        const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
-        return { relation: "stale", dstAheadBy };
-    }
-    const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
-    const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
-    let commonAncestor = null;
-    for (const id of srcIds)
-        if (dstSet.has(id))
-            commonAncestor = id;
-    return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
-}
-export class SyncConflictError extends Error {
-    sessionId;
-    relation;
-    constructor(sessionId, relation) {
-        super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
-        this.sessionId = sessionId;
-        this.relation = relation;
-        this.name = "SyncConflictError";
-    }
-}
+export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
 function ownerAware(backend) {
     return backend.session();
 }

package/dist/trace/artifacts.d.ts

@@ -1,4 +1,4 @@
-import type { RunEvent } from "../plugins/tidb-run-store.js";
+import type { RunEvent } from "../plugins/store-contracts.js";
 export interface TraceArtifact {
     id: string;
     taskId: string;

package/dist/trace/project.d.ts

@@ -1,5 +1,5 @@
 import type { TaskResult } from "@sema-agent/core";
-import type { RunEvent, RunRecord } from "../plugins/tidb-run-store.js";
+import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
 type AppendFn = (type: string, data: unknown) => Promise<void>;
 type GetEventsFn = (taskId: string, afterSeq: number) => Promise<RunEvent[]>;