@sema-agent/server 1.311.0 → 1.312.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth-keys.d.ts +14 -0
- package/dist/auth-keys.js +31 -0
- package/dist/brain.d.ts +1 -1
- package/dist/capabilities/select-environment-tool.d.ts +1 -1
- package/dist/config-types.d.ts +306 -0
- package/dist/config-types.js +2 -0
- package/dist/config.d.ts +4 -305
- package/dist/config.js +1 -1
- package/dist/env-facts.d.ts +1 -1
- package/dist/hooks/hook-llm.d.ts +1 -1
- package/dist/http/server.d.ts +5 -85
- package/dist/http/wire-types.d.ts +84 -0
- package/dist/http/wire-types.js +2 -0
- package/dist/images/manifest.d.ts +1 -1
- package/dist/index.d.ts +2 -1
- package/dist/index.js +1 -1
- package/dist/per-task-image.d.ts +2 -2
- package/dist/plugins/file-run-store.d.ts +1 -1
- package/dist/plugins/local-session-store.d.ts +2 -2
- package/dist/plugins/local-session-store.js +1 -1
- package/dist/plugins/memory-run-store.d.ts +1 -1
- package/dist/plugins/pg-image-bake.d.ts +2 -2
- package/dist/plugins/pg-image-bake.js +1 -1
- package/dist/plugins/pg-image-index.d.ts +2 -2
- package/dist/plugins/pg-image-index.js +1 -1
- package/dist/plugins/pg-pool.d.ts +1 -1
- package/dist/plugins/pg-run-store.d.ts +1 -1
- package/dist/plugins/pg-run-store.js +1 -1
- package/dist/plugins/pg-session-storage.d.ts +2 -2
- package/dist/plugins/pg-session-storage.js +2 -2
- package/dist/plugins/pg-tool-result-store.js +1 -1
- package/dist/plugins/session-store.d.ts +1 -1
- package/dist/plugins/sql-escape.d.ts +2 -0
- package/dist/plugins/sql-escape.js +4 -0
- package/dist/plugins/store-backend.d.ts +1 -1
- package/dist/plugins/store-contracts.d.ts +205 -0
- package/dist/plugins/store-contracts.js +61 -0
- package/dist/plugins/tidb-image-bake.d.ts +3 -95
- package/dist/plugins/tidb-image-bake.js +3 -35
- package/dist/plugins/tidb-image-index.d.ts +3 -76
- package/dist/plugins/tidb-image-index.js +2 -26
- package/dist/plugins/tidb-pool.d.ts +1 -1
- package/dist/plugins/tidb-run-store.d.ts +2 -32
- package/dist/plugins/tidb-run-store.js +1 -1
- package/dist/plugins/tidb-session-store.d.ts +2 -2
- package/dist/plugins/tidb-session-store.js +2 -2
- package/dist/plugins/tidb-tool-result-store.d.ts +1 -1
- package/dist/plugins/tidb-tool-result-store.js +2 -3
- package/dist/security.d.ts +6 -16
- package/dist/security.js +1 -30
- package/dist/sema-registry.d.ts +1 -1
- package/dist/session-sync-kernel.d.ts +47 -0
- package/dist/session-sync-kernel.js +47 -0
- package/dist/session-sync.d.ts +3 -45
- package/dist/session-sync.js +2 -46
- package/dist/trace/artifacts.d.ts +1 -1
- package/dist/trace/project.d.ts +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
|
|
2
|
+
export function mapBakeRow(r) {
|
|
3
|
+
return {
|
|
4
|
+
bakeId: r.bake_id,
|
|
5
|
+
profile: r.profile,
|
|
6
|
+
bands: r.bands == null ? null : parseJsonOr(r.bands, []),
|
|
7
|
+
baseRef: r.base_ref,
|
|
8
|
+
push: !!r.push,
|
|
9
|
+
dryRun: !!r.dry_run,
|
|
10
|
+
logs: !!r.logs,
|
|
11
|
+
argv: parseJsonOr(r.argv, []),
|
|
12
|
+
status: r.status,
|
|
13
|
+
state: r.state ?? null,
|
|
14
|
+
digest: r.digest,
|
|
15
|
+
repo: r.repo,
|
|
16
|
+
ref: r.ref,
|
|
17
|
+
indexId: r.index_id,
|
|
18
|
+
exitCode: r.exit_code === null ? null : Number(r.exit_code),
|
|
19
|
+
error: r.error,
|
|
20
|
+
errorCode: r.error_code ?? null,
|
|
21
|
+
manifestSha: r.manifest_sha,
|
|
22
|
+
tag: r.tag,
|
|
23
|
+
idemKey: r.idem_key,
|
|
24
|
+
ingestSecret: r.ingest_secret,
|
|
25
|
+
runnerId: r.runner_id,
|
|
26
|
+
leaseUntil: isoOrNull(r.lease_until),
|
|
27
|
+
cancelRequested: !!r.cancel_requested,
|
|
28
|
+
requestedBy: r.requested_by,
|
|
29
|
+
createdAt: iso(r.created_at),
|
|
30
|
+
updatedAt: iso(r.updated_at),
|
|
31
|
+
};
|
|
32
|
+
}
|
|
33
|
+
export const BAKE_SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
|
|
34
|
+
"exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
|
|
35
|
+
"cancel_requested, requested_by, created_at, updated_at";
|
|
36
|
+
export function mapImageRow(r) {
|
|
37
|
+
return {
|
|
38
|
+
id: r.id,
|
|
39
|
+
profile: r.profile,
|
|
40
|
+
bands: parseJsonOr(r.bands, []),
|
|
41
|
+
repo: r.repo,
|
|
42
|
+
tag: r.tag,
|
|
43
|
+
digest: r.digest,
|
|
44
|
+
toolchainVersions: parseJsonOr(r.toolchain_versions, {}),
|
|
45
|
+
capabilities: parseJsonOr(r.capabilities, {}),
|
|
46
|
+
podContract: parseJsonOr(r.pod_contract, {}),
|
|
47
|
+
sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
|
|
48
|
+
status: r.status,
|
|
49
|
+
visibility: r.visibility,
|
|
50
|
+
tenantId: r.tenant_id,
|
|
51
|
+
manifestSha: r.manifest_sha,
|
|
52
|
+
recipeGitSha: r.recipe_git_sha,
|
|
53
|
+
generatorVersion: r.generator_version,
|
|
54
|
+
buildDate: isoOrNull(r.build_date),
|
|
55
|
+
supersedes: r.supersedes,
|
|
56
|
+
signed: !!r.signed,
|
|
57
|
+
createdAt: isoOrNull(r.created_at) ?? new Date(0).toISOString(),
|
|
58
|
+
updatedAt: isoOrNull(r.updated_at) ?? new Date(0).toISOString(),
|
|
59
|
+
};
|
|
60
|
+
}
|
|
61
|
+
//# sourceMappingURL=store-contracts.js.map
|
|
@@ -1,99 +1,7 @@
|
|
|
1
1
|
import type { Pool } from "mysql2/promise";
|
|
2
|
-
|
|
3
|
-
export type
|
|
4
|
-
export
|
|
5
|
-
export interface BakeRecord {
|
|
6
|
-
bakeId: string;
|
|
7
|
-
profile: string;
|
|
8
|
-
bands: string[] | null;
|
|
9
|
-
baseRef: string | null;
|
|
10
|
-
push: boolean;
|
|
11
|
-
dryRun: boolean;
|
|
12
|
-
logs: boolean;
|
|
13
|
-
argv: string[];
|
|
14
|
-
status: BakeStatus;
|
|
15
|
-
state: BakeState | null;
|
|
16
|
-
digest: string | null;
|
|
17
|
-
repo: string | null;
|
|
18
|
-
ref: string | null;
|
|
19
|
-
indexId: string | null;
|
|
20
|
-
exitCode: number | null;
|
|
21
|
-
error: string | null;
|
|
22
|
-
errorCode: BakeErrorCode;
|
|
23
|
-
manifestSha: string | null;
|
|
24
|
-
tag: string | null;
|
|
25
|
-
idemKey: string | null;
|
|
26
|
-
ingestSecret: string | null;
|
|
27
|
-
runnerId: string | null;
|
|
28
|
-
leaseUntil: string | null;
|
|
29
|
-
cancelRequested: boolean;
|
|
30
|
-
requestedBy: string | null;
|
|
31
|
-
createdAt: string;
|
|
32
|
-
updatedAt: string;
|
|
33
|
-
}
|
|
34
|
-
export interface BakeEvent {
|
|
35
|
-
seq: number;
|
|
36
|
-
lineOrd: number | null;
|
|
37
|
-
kind: string;
|
|
38
|
-
level: string | null;
|
|
39
|
-
data: unknown;
|
|
40
|
-
ts: string;
|
|
41
|
-
}
|
|
42
|
-
export interface CreateBakeInput {
|
|
43
|
-
profile: string;
|
|
44
|
-
bands: string[] | null;
|
|
45
|
-
baseRef: string | null;
|
|
46
|
-
push: boolean;
|
|
47
|
-
dryRun: boolean;
|
|
48
|
-
logs: boolean;
|
|
49
|
-
argv: string[];
|
|
50
|
-
idemKey: string | null;
|
|
51
|
-
requestedBy: string | null;
|
|
52
|
-
}
|
|
53
|
-
export interface BakeTerminal {
|
|
54
|
-
status: "done" | "failed";
|
|
55
|
-
state: BakeState;
|
|
56
|
-
digest?: string | null;
|
|
57
|
-
repo?: string | null;
|
|
58
|
-
ref?: string | null;
|
|
59
|
-
indexId?: string | null;
|
|
60
|
-
exitCode?: number | null;
|
|
61
|
-
error?: string | null;
|
|
62
|
-
errorCode?: BakeErrorCode;
|
|
63
|
-
manifestSha?: string | null;
|
|
64
|
-
tag?: string | null;
|
|
65
|
-
}
|
|
66
|
-
export interface BakeRow {
|
|
67
|
-
bake_id: string;
|
|
68
|
-
profile: string;
|
|
69
|
-
bands: unknown;
|
|
70
|
-
base_ref: string | null;
|
|
71
|
-
push: number;
|
|
72
|
-
dry_run: number;
|
|
73
|
-
logs: number;
|
|
74
|
-
argv: unknown;
|
|
75
|
-
status: string;
|
|
76
|
-
state: string | null;
|
|
77
|
-
digest: string | null;
|
|
78
|
-
repo: string | null;
|
|
79
|
-
ref: string | null;
|
|
80
|
-
index_id: string | null;
|
|
81
|
-
exit_code: number | string | null;
|
|
82
|
-
error: string | null;
|
|
83
|
-
error_code: string | null;
|
|
84
|
-
manifest_sha: string | null;
|
|
85
|
-
tag: string | null;
|
|
86
|
-
idem_key: string | null;
|
|
87
|
-
ingest_secret: string | null;
|
|
88
|
-
runner_id: string | null;
|
|
89
|
-
lease_until: Date | string | null;
|
|
90
|
-
cancel_requested: number;
|
|
91
|
-
requested_by: string | null;
|
|
92
|
-
created_at: Date | string;
|
|
93
|
-
updated_at: Date | string;
|
|
94
|
-
}
|
|
95
|
-
export declare function mapRow(r: BakeRow): BakeRecord;
|
|
96
|
-
export declare const SELECT_COLS: string;
|
|
2
|
+
import { type BakeStatus, type BakeState, type BakeRecord, type BakeEvent, type CreateBakeInput, type BakeTerminal } from "./store-contracts.js";
|
|
3
|
+
export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, BakeRow, } from "./store-contracts.js";
|
|
4
|
+
export { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
|
|
97
5
|
export declare class TiDBImageBake {
|
|
98
6
|
private readonly pool;
|
|
99
7
|
private readonly poolName;
|
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
import { uuidv7 } from "@sema-agent/core";
|
|
2
2
|
import { randomBytes } from "node:crypto";
|
|
3
|
-
import { parseJsonOr as parseJson, toIso as iso
|
|
3
|
+
import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
|
|
4
|
+
import { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS, } from "./store-contracts.js";
|
|
5
|
+
export { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
|
|
4
6
|
function isDupKey(err) {
|
|
5
7
|
return Boolean(err) && err.code === "ER_DUP_ENTRY";
|
|
6
8
|
}
|
|
@@ -12,40 +14,6 @@ function dupKeyName(err) {
|
|
|
12
14
|
return "primary";
|
|
13
15
|
return "other";
|
|
14
16
|
}
|
|
15
|
-
export function mapRow(r) {
|
|
16
|
-
return {
|
|
17
|
-
bakeId: r.bake_id,
|
|
18
|
-
profile: r.profile,
|
|
19
|
-
bands: r.bands == null ? null : parseJson(r.bands, []),
|
|
20
|
-
baseRef: r.base_ref,
|
|
21
|
-
push: !!r.push,
|
|
22
|
-
dryRun: !!r.dry_run,
|
|
23
|
-
logs: !!r.logs,
|
|
24
|
-
argv: parseJson(r.argv, []),
|
|
25
|
-
status: r.status,
|
|
26
|
-
state: r.state ?? null,
|
|
27
|
-
digest: r.digest,
|
|
28
|
-
repo: r.repo,
|
|
29
|
-
ref: r.ref,
|
|
30
|
-
indexId: r.index_id,
|
|
31
|
-
exitCode: r.exit_code === null ? null : Number(r.exit_code),
|
|
32
|
-
error: r.error,
|
|
33
|
-
errorCode: r.error_code ?? null,
|
|
34
|
-
manifestSha: r.manifest_sha,
|
|
35
|
-
tag: r.tag,
|
|
36
|
-
idemKey: r.idem_key,
|
|
37
|
-
ingestSecret: r.ingest_secret,
|
|
38
|
-
runnerId: r.runner_id,
|
|
39
|
-
leaseUntil: isoOrNull(r.lease_until),
|
|
40
|
-
cancelRequested: !!r.cancel_requested,
|
|
41
|
-
requestedBy: r.requested_by,
|
|
42
|
-
createdAt: iso(r.created_at),
|
|
43
|
-
updatedAt: iso(r.updated_at),
|
|
44
|
-
};
|
|
45
|
-
}
|
|
46
|
-
export const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
|
|
47
|
-
"exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
|
|
48
|
-
"cancel_requested, requested_by, created_at, updated_at";
|
|
49
17
|
export class TiDBImageBake {
|
|
50
18
|
pool;
|
|
51
19
|
poolName;
|
|
@@ -1,80 +1,7 @@
|
|
|
1
1
|
import type { Pool } from "mysql2/promise";
|
|
2
|
-
|
|
3
|
-
export
|
|
4
|
-
|
|
5
|
-
db?: boolean;
|
|
6
|
-
nestedBuild?: boolean;
|
|
7
|
-
nestedBuildMode?: ImageNestedBuildMode;
|
|
8
|
-
}
|
|
9
|
-
export interface ImagePodContract {
|
|
10
|
-
devShmMB?: number;
|
|
11
|
-
minMemMB?: number;
|
|
12
|
-
minCpu?: string;
|
|
13
|
-
readyTimeoutSec?: number;
|
|
14
|
-
securityContext?: Record<string, unknown>;
|
|
15
|
-
}
|
|
16
|
-
export type ImageStatus = "building" | "published" | "deprecated" | "failed";
|
|
17
|
-
export type ImageVisibility = "public" | "tenant";
|
|
18
|
-
export interface ImageIndexEntry {
|
|
19
|
-
id: string;
|
|
20
|
-
profile: string;
|
|
21
|
-
bands: string[];
|
|
22
|
-
repo: string;
|
|
23
|
-
tag: string;
|
|
24
|
-
digest: string;
|
|
25
|
-
toolchainVersions: Record<string, string>;
|
|
26
|
-
capabilities: ImageCapabilities;
|
|
27
|
-
podContract: ImagePodContract;
|
|
28
|
-
sizeBytes: number | null;
|
|
29
|
-
status: ImageStatus;
|
|
30
|
-
visibility: ImageVisibility;
|
|
31
|
-
tenantId: string | null;
|
|
32
|
-
manifestSha: string | null;
|
|
33
|
-
recipeGitSha: string | null;
|
|
34
|
-
generatorVersion: string | null;
|
|
35
|
-
buildDate: string | null;
|
|
36
|
-
supersedes: string | null;
|
|
37
|
-
signed: boolean;
|
|
38
|
-
createdAt: string;
|
|
39
|
-
updatedAt: string;
|
|
40
|
-
}
|
|
41
|
-
export type ImageIndexUpsert = Omit<ImageIndexEntry, "id" | "createdAt" | "updatedAt">;
|
|
42
|
-
export interface ImageViewer {
|
|
43
|
-
operator?: boolean;
|
|
44
|
-
tenantId?: string | null;
|
|
45
|
-
}
|
|
46
|
-
export interface ImageListFilter extends ImageViewer {
|
|
47
|
-
profile?: string;
|
|
48
|
-
status?: ImageStatus;
|
|
49
|
-
capability?: keyof ImageCapabilities;
|
|
50
|
-
latestOnly?: boolean;
|
|
51
|
-
limit?: number;
|
|
52
|
-
cursor?: string;
|
|
53
|
-
}
|
|
54
|
-
export interface ImageRow {
|
|
55
|
-
id: string;
|
|
56
|
-
profile: string;
|
|
57
|
-
bands: unknown;
|
|
58
|
-
repo: string;
|
|
59
|
-
tag: string;
|
|
60
|
-
digest: string;
|
|
61
|
-
toolchain_versions: unknown;
|
|
62
|
-
capabilities: unknown;
|
|
63
|
-
pod_contract: unknown;
|
|
64
|
-
size_bytes: number | string | null;
|
|
65
|
-
status: string;
|
|
66
|
-
visibility: string;
|
|
67
|
-
tenant_id: string | null;
|
|
68
|
-
manifest_sha: string | null;
|
|
69
|
-
recipe_git_sha: string | null;
|
|
70
|
-
generator_version: string | null;
|
|
71
|
-
build_date: Date | string | null;
|
|
72
|
-
supersedes: string | null;
|
|
73
|
-
signed: number;
|
|
74
|
-
created_at: Date | string;
|
|
75
|
-
updated_at: Date | string;
|
|
76
|
-
}
|
|
77
|
-
export declare function mapRow(r: ImageRow): ImageIndexEntry;
|
|
2
|
+
import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
|
|
3
|
+
export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, ImageRow, } from "./store-contracts.js";
|
|
4
|
+
export { mapImageRow as mapRow } from "./store-contracts.js";
|
|
78
5
|
export declare class TiDBImageIndex {
|
|
79
6
|
private readonly pool;
|
|
80
7
|
constructor(pool: Pool);
|
|
@@ -1,32 +1,8 @@
|
|
|
1
1
|
import { createHash } from "node:crypto";
|
|
2
|
-
import {
|
|
2
|
+
import { mapImageRow as mapRow, } from "./store-contracts.js";
|
|
3
|
+
export { mapImageRow as mapRow } from "./store-contracts.js";
|
|
3
4
|
const MAX_LIMIT = 200;
|
|
4
5
|
const DEFAULT_LIMIT = 50;
|
|
5
|
-
export function mapRow(r) {
|
|
6
|
-
return {
|
|
7
|
-
id: r.id,
|
|
8
|
-
profile: r.profile,
|
|
9
|
-
bands: asJson(r.bands, []),
|
|
10
|
-
repo: r.repo,
|
|
11
|
-
tag: r.tag,
|
|
12
|
-
digest: r.digest,
|
|
13
|
-
toolchainVersions: asJson(r.toolchain_versions, {}),
|
|
14
|
-
capabilities: asJson(r.capabilities, {}),
|
|
15
|
-
podContract: asJson(r.pod_contract, {}),
|
|
16
|
-
sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
|
|
17
|
-
status: r.status,
|
|
18
|
-
visibility: r.visibility,
|
|
19
|
-
tenantId: r.tenant_id,
|
|
20
|
-
manifestSha: r.manifest_sha,
|
|
21
|
-
recipeGitSha: r.recipe_git_sha,
|
|
22
|
-
generatorVersion: r.generator_version,
|
|
23
|
-
buildDate: iso(r.build_date),
|
|
24
|
-
supersedes: r.supersedes,
|
|
25
|
-
signed: !!r.signed,
|
|
26
|
-
createdAt: iso(r.created_at) ?? new Date(0).toISOString(),
|
|
27
|
-
updatedAt: iso(r.updated_at) ?? new Date(0).toISOString(),
|
|
28
|
-
};
|
|
29
|
-
}
|
|
30
6
|
function visibilityClause(viewer) {
|
|
31
7
|
if (viewer.operator)
|
|
32
8
|
return { sql: "1=1", params: [] };
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import mysql from "mysql2/promise";
|
|
2
2
|
import type { Pool, PoolConnection } from "mysql2/promise";
|
|
3
|
-
import type { ServiceConfig } from "../config.js";
|
|
3
|
+
import type { ServiceConfig } from "../config-types.js";
|
|
4
4
|
export declare function tidbPoolOptions(tidb: NonNullable<ServiceConfig["tidb"]>): mysql.PoolOptions;
|
|
5
5
|
export declare function createTidbPool(config: ServiceConfig): Pool;
|
|
6
6
|
export declare const SCHEMA_STATEMENTS: readonly string[];
|
|
@@ -1,38 +1,8 @@
|
|
|
1
1
|
import type { TaskResult, TaskStatus } from "@sema-agent/core";
|
|
2
2
|
import { type UsageRow } from "../usage-analytics.js";
|
|
3
3
|
import type { Pool } from "mysql2/promise";
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
sessionId: string;
|
|
7
|
-
owner: string | null;
|
|
8
|
-
status: "running" | TaskStatus;
|
|
9
|
-
result: TaskResult | null;
|
|
10
|
-
error: string | null;
|
|
11
|
-
errorCode: string | null;
|
|
12
|
-
jobId: string | null;
|
|
13
|
-
source: string | null;
|
|
14
|
-
instanceId: string | null;
|
|
15
|
-
objectivePreview: string | null;
|
|
16
|
-
createdAt: string;
|
|
17
|
-
updatedAt: string;
|
|
18
|
-
}
|
|
19
|
-
export interface SessionSummary {
|
|
20
|
-
sessionId: string;
|
|
21
|
-
owner: string | null;
|
|
22
|
-
lastActivityAt: string;
|
|
23
|
-
firstActivityAt: string;
|
|
24
|
-
runCount: number;
|
|
25
|
-
objectivePreview: string | null;
|
|
26
|
-
lastStatus: string;
|
|
27
|
-
lastRunId: string | null;
|
|
28
|
-
title: string | null;
|
|
29
|
-
}
|
|
30
|
-
export interface RunEvent {
|
|
31
|
-
seq: number;
|
|
32
|
-
type: string;
|
|
33
|
-
data: unknown;
|
|
34
|
-
ts: string;
|
|
35
|
-
}
|
|
4
|
+
import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
|
|
5
|
+
export type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
|
|
36
6
|
export declare class TiDBRunStore {
|
|
37
7
|
private readonly pool;
|
|
38
8
|
constructor(pool: Pool);
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
|
|
2
|
-
import { escapeLike } from "./
|
|
2
|
+
import { escapeLike } from "./sql-escape.js";
|
|
3
3
|
import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
|
|
4
4
|
function isDupKey(err) {
|
|
5
5
|
return Boolean(err) && err.code === "ER_DUP_ENTRY";
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { type AcquiredSession, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
|
|
2
2
|
import type { Pool } from "mysql2/promise";
|
|
3
|
-
import type { SessionSummary } from "./
|
|
4
|
-
import { type StagingHandle } from "../session-sync.js";
|
|
3
|
+
import type { SessionSummary } from "./store-contracts.js";
|
|
4
|
+
import { type StagingHandle } from "../session-sync-kernel.js";
|
|
5
5
|
export declare class TiDBSessionStore implements SessionStore {
|
|
6
6
|
private readonly pool;
|
|
7
7
|
private readonly pending;
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
|
|
2
2
|
import { TiDBSessionStorage } from "./tidb-session-storage.js";
|
|
3
|
-
import { escapeLike } from "./
|
|
4
|
-
import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync.js";
|
|
3
|
+
import { escapeLike } from "./sql-escape.js";
|
|
4
|
+
import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
|
|
5
5
|
const STAGING_GC_GRACE_MS = 3_600_000;
|
|
6
6
|
export class TiDBSessionStore {
|
|
7
7
|
pool;
|
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import type { ToolResultStore, ToolResultSlice } from "@sema-agent/core";
|
|
2
2
|
import type { Pool } from "mysql2/promise";
|
|
3
|
+
export { escapeLike } from "./sql-escape.js";
|
|
3
4
|
export declare class TiDBToolResultStore implements ToolResultStore {
|
|
4
5
|
private readonly pool;
|
|
5
6
|
constructor(pool: Pool);
|
|
@@ -11,5 +12,4 @@ export declare class TiDBToolResultStore implements ToolResultStore {
|
|
|
11
12
|
reapOlderThan(cutoffMs: number): Promise<number>;
|
|
12
13
|
deleteBySession(sessionId: string): Promise<number>;
|
|
13
14
|
}
|
|
14
|
-
export declare function escapeLike(s: string): string;
|
|
15
15
|
//# sourceMappingURL=tidb-tool-result-store.d.ts.map
|
|
@@ -1,3 +1,5 @@
|
|
|
1
|
+
import { escapeLike } from "./sql-escape.js";
|
|
2
|
+
export { escapeLike } from "./sql-escape.js";
|
|
1
3
|
export class TiDBToolResultStore {
|
|
2
4
|
pool;
|
|
3
5
|
constructor(pool) {
|
|
@@ -35,7 +37,4 @@ export class TiDBToolResultStore {
|
|
|
35
37
|
return res.affectedRows;
|
|
36
38
|
}
|
|
37
39
|
}
|
|
38
|
-
export function escapeLike(s) {
|
|
39
|
-
return s.replace(/[\\%_]/g, (ch) => `\\${ch}`);
|
|
40
|
-
}
|
|
41
40
|
//# sourceMappingURL=tidb-tool-result-store.js.map
|
package/dist/security.d.ts
CHANGED
|
@@ -1,8 +1,11 @@
|
|
|
1
1
|
import type { IncomingMessage } from "node:http";
|
|
2
2
|
import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
|
|
3
|
-
import type { ServiceConfig } from "./config.js";
|
|
4
|
-
import type { TaskRequestBody } from "./http/
|
|
5
|
-
import type { StagingHandle } from "./session-sync.js";
|
|
3
|
+
import type { ServiceConfig } from "./config-types.js";
|
|
4
|
+
import type { TaskRequestBody } from "./http/wire-types.js";
|
|
5
|
+
import type { StagingHandle } from "./session-sync-kernel.js";
|
|
6
|
+
import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
|
|
7
|
+
export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
|
|
8
|
+
export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
|
|
6
9
|
export interface SessionListItem {
|
|
7
10
|
sessionId: string;
|
|
8
11
|
owner: string | null;
|
|
@@ -92,12 +95,6 @@ export declare function memorySpecForRequest(scope: string | undefined, memoryWr
|
|
|
92
95
|
writeScope?: string | null;
|
|
93
96
|
scopeContract?: "v2";
|
|
94
97
|
} | undefined;
|
|
95
|
-
export interface ApprovalHmacKey {
|
|
96
|
-
kid: string;
|
|
97
|
-
key: string;
|
|
98
|
-
status?: "active" | "retiring";
|
|
99
|
-
}
|
|
100
|
-
export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
|
|
101
98
|
export declare function approvalHmacMessage(env: {
|
|
102
99
|
sessionId: string;
|
|
103
100
|
boundCallId?: string | null;
|
|
@@ -113,13 +110,6 @@ export declare function verifyApprovalHmac(env: {
|
|
|
113
110
|
decision: string;
|
|
114
111
|
reason?: string | null;
|
|
115
112
|
}, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
|
|
116
|
-
export interface PrincipalJwtKey {
|
|
117
|
-
kid: string;
|
|
118
|
-
alg: "EdDSA" | "RS256" | "ES256";
|
|
119
|
-
key: string;
|
|
120
|
-
status?: "active" | "retiring";
|
|
121
|
-
}
|
|
122
|
-
export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
|
|
123
113
|
export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
|
|
124
114
|
iss: string;
|
|
125
115
|
aud: string;
|
package/dist/security.js
CHANGED
|
@@ -2,6 +2,7 @@ import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cry
|
|
|
2
2
|
import { join } from "node:path";
|
|
3
3
|
import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
|
|
4
4
|
import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
|
|
5
|
+
export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
|
|
5
6
|
const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
|
|
6
7
|
export function isUuidV7(s) {
|
|
7
8
|
return UUIDV7_RE.test(s);
|
|
@@ -162,19 +163,6 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
|
|
|
162
163
|
const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
|
|
163
164
|
return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
|
|
164
165
|
}
|
|
165
|
-
export function parseApprovalHmacKeys(raw) {
|
|
166
|
-
if (!raw)
|
|
167
|
-
return [];
|
|
168
|
-
try {
|
|
169
|
-
const v = JSON.parse(raw);
|
|
170
|
-
if (!Array.isArray(v))
|
|
171
|
-
return [];
|
|
172
|
-
return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
|
|
173
|
-
}
|
|
174
|
-
catch {
|
|
175
|
-
return [];
|
|
176
|
-
}
|
|
177
|
-
}
|
|
178
166
|
export function approvalHmacMessage(env) {
|
|
179
167
|
return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
|
|
180
168
|
}
|
|
@@ -200,23 +188,6 @@ export function verifyApprovalHmac(env, mac, kid, keys) {
|
|
|
200
188
|
}
|
|
201
189
|
return false;
|
|
202
190
|
}
|
|
203
|
-
export function parsePrincipalJwks(raw) {
|
|
204
|
-
if (!raw)
|
|
205
|
-
return [];
|
|
206
|
-
const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
|
|
207
|
-
try {
|
|
208
|
-
const v = JSON.parse(raw);
|
|
209
|
-
if (!Array.isArray(v))
|
|
210
|
-
return [];
|
|
211
|
-
return v.filter((k) => {
|
|
212
|
-
const e = k;
|
|
213
|
-
return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
|
|
214
|
-
});
|
|
215
|
-
}
|
|
216
|
-
catch {
|
|
217
|
-
return [];
|
|
218
|
-
}
|
|
219
|
-
}
|
|
220
191
|
function b64urlToBuf(s) {
|
|
221
192
|
return Buffer.from(s, "base64url");
|
|
222
193
|
}
|
package/dist/sema-registry.d.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import type { McpServerSpec } from "@sema-agent/core";
|
|
2
2
|
import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
|
|
3
|
-
import type { ScopedMcpServer, ServiceConfig } from "./config.js";
|
|
3
|
+
import type { ScopedMcpServer, ServiceConfig } from "./config-types.js";
|
|
4
4
|
import { type SealedKeyOpener } from "./sealed-key.js";
|
|
5
5
|
import type { Autonomy, CommandRule } from "./runtime-governance.js";
|
|
6
6
|
import type { Logger } from "./observability/logger.js";
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
import type { SessionTreeEntry } from "@sema-agent/core";
|
|
2
|
+
export interface StagingHandle {
|
|
3
|
+
readonly stagingId: string;
|
|
4
|
+
readonly realSessionId: string;
|
|
5
|
+
appendBatch(entries: SessionTreeEntry[]): Promise<void>;
|
|
6
|
+
commit(owner: string | null, opts?: {
|
|
7
|
+
resolution?: "overwrite-dst";
|
|
8
|
+
}): Promise<{
|
|
9
|
+
relation: SyncRelation["relation"];
|
|
10
|
+
}>;
|
|
11
|
+
abort(): Promise<void>;
|
|
12
|
+
}
|
|
13
|
+
export type ImportStagingStore = {
|
|
14
|
+
beginImportStaging(realSessionId: string, token: string): StagingHandle;
|
|
15
|
+
sweepStagingSessions?(): Promise<number>;
|
|
16
|
+
};
|
|
17
|
+
export declare function stagingIdFor(realSessionId: string, token: string): string;
|
|
18
|
+
export declare const STAGING_ID_MARKER = "#stg-";
|
|
19
|
+
export declare function realIdOfStaging(stagingId: string): string | null;
|
|
20
|
+
export type SyncRelation = {
|
|
21
|
+
relation: "fresh";
|
|
22
|
+
} | {
|
|
23
|
+
relation: "identical";
|
|
24
|
+
} | {
|
|
25
|
+
relation: "fast_forward";
|
|
26
|
+
newEntryIds: string[];
|
|
27
|
+
} | {
|
|
28
|
+
relation: "stale";
|
|
29
|
+
dstAheadBy: string[];
|
|
30
|
+
} | {
|
|
31
|
+
relation: "fork";
|
|
32
|
+
commonAncestor: string | null;
|
|
33
|
+
srcExclusive: string[];
|
|
34
|
+
dstExclusive: string[];
|
|
35
|
+
};
|
|
36
|
+
export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
|
|
37
|
+
export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
|
|
38
|
+
export declare class SyncConflictError extends Error {
|
|
39
|
+
readonly sessionId: string;
|
|
40
|
+
readonly relation: Extract<SyncRelation, {
|
|
41
|
+
relation: "fork" | "stale";
|
|
42
|
+
}>;
|
|
43
|
+
constructor(sessionId: string, relation: Extract<SyncRelation, {
|
|
44
|
+
relation: "fork" | "stale";
|
|
45
|
+
}>);
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=session-sync-kernel.d.ts.map
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
export function stagingIdFor(realSessionId, token) {
|
|
2
|
+
return `${realSessionId}#stg-${token}`;
|
|
3
|
+
}
|
|
4
|
+
export const STAGING_ID_MARKER = "#stg-";
|
|
5
|
+
export function realIdOfStaging(stagingId) {
|
|
6
|
+
const i = stagingId.indexOf(STAGING_ID_MARKER);
|
|
7
|
+
return i < 0 ? null : stagingId.slice(0, i);
|
|
8
|
+
}
|
|
9
|
+
export function classifySyncRelationship(srcEntries, dstEntries) {
|
|
10
|
+
return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
|
|
11
|
+
}
|
|
12
|
+
export function classifySyncRelationshipByIds(srcIds, dstIds) {
|
|
13
|
+
if (dstIds === null || dstIds.length === 0)
|
|
14
|
+
return { relation: "fresh" };
|
|
15
|
+
const srcSet = new Set(srcIds);
|
|
16
|
+
const dstSet = new Set(dstIds);
|
|
17
|
+
if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
|
|
18
|
+
return { relation: "identical" };
|
|
19
|
+
const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
|
|
20
|
+
const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
|
|
21
|
+
if (allDstInSrc && !allSrcInDst) {
|
|
22
|
+
const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
|
|
23
|
+
return { relation: "fast_forward", newEntryIds };
|
|
24
|
+
}
|
|
25
|
+
if (allSrcInDst && !allDstInSrc) {
|
|
26
|
+
const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
|
|
27
|
+
return { relation: "stale", dstAheadBy };
|
|
28
|
+
}
|
|
29
|
+
const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
|
|
30
|
+
const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
|
|
31
|
+
let commonAncestor = null;
|
|
32
|
+
for (const id of srcIds)
|
|
33
|
+
if (dstSet.has(id))
|
|
34
|
+
commonAncestor = id;
|
|
35
|
+
return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
|
|
36
|
+
}
|
|
37
|
+
export class SyncConflictError extends Error {
|
|
38
|
+
sessionId;
|
|
39
|
+
relation;
|
|
40
|
+
constructor(sessionId, relation) {
|
|
41
|
+
super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
|
|
42
|
+
this.sessionId = sessionId;
|
|
43
|
+
this.relation = relation;
|
|
44
|
+
this.name = "SyncConflictError";
|
|
45
|
+
}
|
|
46
|
+
}
|
|
47
|
+
//# sourceMappingURL=session-sync-kernel.js.map
|