@sema-agent/server 1.311.0 → 1.312.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/dist/auth-keys.d.ts +14 -0
  2. package/dist/auth-keys.js +31 -0
  3. package/dist/brain.d.ts +1 -1
  4. package/dist/capabilities/select-environment-tool.d.ts +1 -1
  5. package/dist/config-types.d.ts +306 -0
  6. package/dist/config-types.js +2 -0
  7. package/dist/config.d.ts +4 -305
  8. package/dist/config.js +1 -1
  9. package/dist/env-facts.d.ts +1 -1
  10. package/dist/hooks/hook-llm.d.ts +1 -1
  11. package/dist/http/server.d.ts +5 -85
  12. package/dist/http/wire-types.d.ts +84 -0
  13. package/dist/http/wire-types.js +2 -0
  14. package/dist/images/manifest.d.ts +1 -1
  15. package/dist/index.d.ts +2 -1
  16. package/dist/index.js +1 -1
  17. package/dist/per-task-image.d.ts +2 -2
  18. package/dist/plugins/file-run-store.d.ts +1 -1
  19. package/dist/plugins/local-session-store.d.ts +2 -2
  20. package/dist/plugins/local-session-store.js +1 -1
  21. package/dist/plugins/memory-run-store.d.ts +1 -1
  22. package/dist/plugins/pg-image-bake.d.ts +2 -2
  23. package/dist/plugins/pg-image-bake.js +1 -1
  24. package/dist/plugins/pg-image-index.d.ts +2 -2
  25. package/dist/plugins/pg-image-index.js +1 -1
  26. package/dist/plugins/pg-pool.d.ts +1 -1
  27. package/dist/plugins/pg-run-store.d.ts +1 -1
  28. package/dist/plugins/pg-run-store.js +1 -1
  29. package/dist/plugins/pg-session-storage.d.ts +2 -2
  30. package/dist/plugins/pg-session-storage.js +2 -2
  31. package/dist/plugins/pg-tool-result-store.js +1 -1
  32. package/dist/plugins/session-store.d.ts +1 -1
  33. package/dist/plugins/sql-escape.d.ts +2 -0
  34. package/dist/plugins/sql-escape.js +4 -0
  35. package/dist/plugins/store-backend.d.ts +1 -1
  36. package/dist/plugins/store-contracts.d.ts +205 -0
  37. package/dist/plugins/store-contracts.js +61 -0
  38. package/dist/plugins/tidb-image-bake.d.ts +3 -95
  39. package/dist/plugins/tidb-image-bake.js +3 -35
  40. package/dist/plugins/tidb-image-index.d.ts +3 -76
  41. package/dist/plugins/tidb-image-index.js +2 -26
  42. package/dist/plugins/tidb-pool.d.ts +1 -1
  43. package/dist/plugins/tidb-run-store.d.ts +2 -32
  44. package/dist/plugins/tidb-run-store.js +1 -1
  45. package/dist/plugins/tidb-session-store.d.ts +2 -2
  46. package/dist/plugins/tidb-session-store.js +2 -2
  47. package/dist/plugins/tidb-tool-result-store.d.ts +1 -1
  48. package/dist/plugins/tidb-tool-result-store.js +2 -3
  49. package/dist/security.d.ts +6 -16
  50. package/dist/security.js +1 -30
  51. package/dist/sema-registry.d.ts +1 -1
  52. package/dist/session-sync-kernel.d.ts +47 -0
  53. package/dist/session-sync-kernel.js +47 -0
  54. package/dist/session-sync.d.ts +3 -45
  55. package/dist/session-sync.js +2 -46
  56. package/dist/trace/artifacts.d.ts +1 -1
  57. package/dist/trace/project.d.ts +1 -1
  58. package/package.json +1 -1
@@ -0,0 +1,61 @@
1
+ import { parseJsonOr, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
2
+ export function mapBakeRow(r) {
3
+ return {
4
+ bakeId: r.bake_id,
5
+ profile: r.profile,
6
+ bands: r.bands == null ? null : parseJsonOr(r.bands, []),
7
+ baseRef: r.base_ref,
8
+ push: !!r.push,
9
+ dryRun: !!r.dry_run,
10
+ logs: !!r.logs,
11
+ argv: parseJsonOr(r.argv, []),
12
+ status: r.status,
13
+ state: r.state ?? null,
14
+ digest: r.digest,
15
+ repo: r.repo,
16
+ ref: r.ref,
17
+ indexId: r.index_id,
18
+ exitCode: r.exit_code === null ? null : Number(r.exit_code),
19
+ error: r.error,
20
+ errorCode: r.error_code ?? null,
21
+ manifestSha: r.manifest_sha,
22
+ tag: r.tag,
23
+ idemKey: r.idem_key,
24
+ ingestSecret: r.ingest_secret,
25
+ runnerId: r.runner_id,
26
+ leaseUntil: isoOrNull(r.lease_until),
27
+ cancelRequested: !!r.cancel_requested,
28
+ requestedBy: r.requested_by,
29
+ createdAt: iso(r.created_at),
30
+ updatedAt: iso(r.updated_at),
31
+ };
32
+ }
33
+ export const BAKE_SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
34
+ "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
35
+ "cancel_requested, requested_by, created_at, updated_at";
36
+ export function mapImageRow(r) {
37
+ return {
38
+ id: r.id,
39
+ profile: r.profile,
40
+ bands: parseJsonOr(r.bands, []),
41
+ repo: r.repo,
42
+ tag: r.tag,
43
+ digest: r.digest,
44
+ toolchainVersions: parseJsonOr(r.toolchain_versions, {}),
45
+ capabilities: parseJsonOr(r.capabilities, {}),
46
+ podContract: parseJsonOr(r.pod_contract, {}),
47
+ sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
48
+ status: r.status,
49
+ visibility: r.visibility,
50
+ tenantId: r.tenant_id,
51
+ manifestSha: r.manifest_sha,
52
+ recipeGitSha: r.recipe_git_sha,
53
+ generatorVersion: r.generator_version,
54
+ buildDate: isoOrNull(r.build_date),
55
+ supersedes: r.supersedes,
56
+ signed: !!r.signed,
57
+ createdAt: isoOrNull(r.created_at) ?? new Date(0).toISOString(),
58
+ updatedAt: isoOrNull(r.updated_at) ?? new Date(0).toISOString(),
59
+ };
60
+ }
61
+ //# sourceMappingURL=store-contracts.js.map
@@ -1,99 +1,7 @@
1
1
  import type { Pool } from "mysql2/promise";
2
- export type BakeStatus = "queued" | "running" | "done" | "failed";
3
- export type BakeState = "PENDING" | "BUILDING" | "PUSHING" | "VERIFYING" | "REGISTERING" | "COMPLETE" | "FAILED" | "CANCELLED";
4
- export type BakeErrorCode = "band-conflict" | "duplicate" | "disk" | "timeout" | "cancelled" | null;
5
- export interface BakeRecord {
6
- bakeId: string;
7
- profile: string;
8
- bands: string[] | null;
9
- baseRef: string | null;
10
- push: boolean;
11
- dryRun: boolean;
12
- logs: boolean;
13
- argv: string[];
14
- status: BakeStatus;
15
- state: BakeState | null;
16
- digest: string | null;
17
- repo: string | null;
18
- ref: string | null;
19
- indexId: string | null;
20
- exitCode: number | null;
21
- error: string | null;
22
- errorCode: BakeErrorCode;
23
- manifestSha: string | null;
24
- tag: string | null;
25
- idemKey: string | null;
26
- ingestSecret: string | null;
27
- runnerId: string | null;
28
- leaseUntil: string | null;
29
- cancelRequested: boolean;
30
- requestedBy: string | null;
31
- createdAt: string;
32
- updatedAt: string;
33
- }
34
- export interface BakeEvent {
35
- seq: number;
36
- lineOrd: number | null;
37
- kind: string;
38
- level: string | null;
39
- data: unknown;
40
- ts: string;
41
- }
42
- export interface CreateBakeInput {
43
- profile: string;
44
- bands: string[] | null;
45
- baseRef: string | null;
46
- push: boolean;
47
- dryRun: boolean;
48
- logs: boolean;
49
- argv: string[];
50
- idemKey: string | null;
51
- requestedBy: string | null;
52
- }
53
- export interface BakeTerminal {
54
- status: "done" | "failed";
55
- state: BakeState;
56
- digest?: string | null;
57
- repo?: string | null;
58
- ref?: string | null;
59
- indexId?: string | null;
60
- exitCode?: number | null;
61
- error?: string | null;
62
- errorCode?: BakeErrorCode;
63
- manifestSha?: string | null;
64
- tag?: string | null;
65
- }
66
- export interface BakeRow {
67
- bake_id: string;
68
- profile: string;
69
- bands: unknown;
70
- base_ref: string | null;
71
- push: number;
72
- dry_run: number;
73
- logs: number;
74
- argv: unknown;
75
- status: string;
76
- state: string | null;
77
- digest: string | null;
78
- repo: string | null;
79
- ref: string | null;
80
- index_id: string | null;
81
- exit_code: number | string | null;
82
- error: string | null;
83
- error_code: string | null;
84
- manifest_sha: string | null;
85
- tag: string | null;
86
- idem_key: string | null;
87
- ingest_secret: string | null;
88
- runner_id: string | null;
89
- lease_until: Date | string | null;
90
- cancel_requested: number;
91
- requested_by: string | null;
92
- created_at: Date | string;
93
- updated_at: Date | string;
94
- }
95
- export declare function mapRow(r: BakeRow): BakeRecord;
96
- export declare const SELECT_COLS: string;
2
+ import { type BakeStatus, type BakeState, type BakeRecord, type BakeEvent, type CreateBakeInput, type BakeTerminal } from "./store-contracts.js";
3
+ export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, BakeRow, } from "./store-contracts.js";
4
+ export { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
97
5
  export declare class TiDBImageBake {
98
6
  private readonly pool;
99
7
  private readonly poolName;
@@ -1,6 +1,8 @@
1
1
  import { uuidv7 } from "@sema-agent/core";
2
2
  import { randomBytes } from "node:crypto";
3
- import { parseJsonOr as parseJson, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
3
+ import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
4
+ import { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS, } from "./store-contracts.js";
5
+ export { mapBakeRow as mapRow, BAKE_SELECT_COLS as SELECT_COLS } from "./store-contracts.js";
4
6
  function isDupKey(err) {
5
7
  return Boolean(err) && err.code === "ER_DUP_ENTRY";
6
8
  }
@@ -12,40 +14,6 @@ function dupKeyName(err) {
12
14
  return "primary";
13
15
  return "other";
14
16
  }
15
- export function mapRow(r) {
16
- return {
17
- bakeId: r.bake_id,
18
- profile: r.profile,
19
- bands: r.bands == null ? null : parseJson(r.bands, []),
20
- baseRef: r.base_ref,
21
- push: !!r.push,
22
- dryRun: !!r.dry_run,
23
- logs: !!r.logs,
24
- argv: parseJson(r.argv, []),
25
- status: r.status,
26
- state: r.state ?? null,
27
- digest: r.digest,
28
- repo: r.repo,
29
- ref: r.ref,
30
- indexId: r.index_id,
31
- exitCode: r.exit_code === null ? null : Number(r.exit_code),
32
- error: r.error,
33
- errorCode: r.error_code ?? null,
34
- manifestSha: r.manifest_sha,
35
- tag: r.tag,
36
- idemKey: r.idem_key,
37
- ingestSecret: r.ingest_secret,
38
- runnerId: r.runner_id,
39
- leaseUntil: isoOrNull(r.lease_until),
40
- cancelRequested: !!r.cancel_requested,
41
- requestedBy: r.requested_by,
42
- createdAt: iso(r.created_at),
43
- updatedAt: iso(r.updated_at),
44
- };
45
- }
46
- export const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
47
- "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
48
- "cancel_requested, requested_by, created_at, updated_at";
49
17
  export class TiDBImageBake {
50
18
  pool;
51
19
  poolName;
@@ -1,80 +1,7 @@
1
1
  import type { Pool } from "mysql2/promise";
2
- export type ImageNestedBuildMode = "none" | "docker-cli-only" | "rootless-buildkit" | "privileged-dind";
3
- export interface ImageCapabilities {
4
- browser?: boolean;
5
- db?: boolean;
6
- nestedBuild?: boolean;
7
- nestedBuildMode?: ImageNestedBuildMode;
8
- }
9
- export interface ImagePodContract {
10
- devShmMB?: number;
11
- minMemMB?: number;
12
- minCpu?: string;
13
- readyTimeoutSec?: number;
14
- securityContext?: Record<string, unknown>;
15
- }
16
- export type ImageStatus = "building" | "published" | "deprecated" | "failed";
17
- export type ImageVisibility = "public" | "tenant";
18
- export interface ImageIndexEntry {
19
- id: string;
20
- profile: string;
21
- bands: string[];
22
- repo: string;
23
- tag: string;
24
- digest: string;
25
- toolchainVersions: Record<string, string>;
26
- capabilities: ImageCapabilities;
27
- podContract: ImagePodContract;
28
- sizeBytes: number | null;
29
- status: ImageStatus;
30
- visibility: ImageVisibility;
31
- tenantId: string | null;
32
- manifestSha: string | null;
33
- recipeGitSha: string | null;
34
- generatorVersion: string | null;
35
- buildDate: string | null;
36
- supersedes: string | null;
37
- signed: boolean;
38
- createdAt: string;
39
- updatedAt: string;
40
- }
41
- export type ImageIndexUpsert = Omit<ImageIndexEntry, "id" | "createdAt" | "updatedAt">;
42
- export interface ImageViewer {
43
- operator?: boolean;
44
- tenantId?: string | null;
45
- }
46
- export interface ImageListFilter extends ImageViewer {
47
- profile?: string;
48
- status?: ImageStatus;
49
- capability?: keyof ImageCapabilities;
50
- latestOnly?: boolean;
51
- limit?: number;
52
- cursor?: string;
53
- }
54
- export interface ImageRow {
55
- id: string;
56
- profile: string;
57
- bands: unknown;
58
- repo: string;
59
- tag: string;
60
- digest: string;
61
- toolchain_versions: unknown;
62
- capabilities: unknown;
63
- pod_contract: unknown;
64
- size_bytes: number | string | null;
65
- status: string;
66
- visibility: string;
67
- tenant_id: string | null;
68
- manifest_sha: string | null;
69
- recipe_git_sha: string | null;
70
- generator_version: string | null;
71
- build_date: Date | string | null;
72
- supersedes: string | null;
73
- signed: number;
74
- created_at: Date | string;
75
- updated_at: Date | string;
76
- }
77
- export declare function mapRow(r: ImageRow): ImageIndexEntry;
2
+ import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
3
+ export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, ImageRow, } from "./store-contracts.js";
4
+ export { mapImageRow as mapRow } from "./store-contracts.js";
78
5
  export declare class TiDBImageIndex {
79
6
  private readonly pool;
80
7
  constructor(pool: Pool);
@@ -1,32 +1,8 @@
1
1
  import { createHash } from "node:crypto";
2
- import { parseJsonOr as asJson, normalizeIsoOrNull as iso } from "./sql-row-helpers.js";
2
+ import { mapImageRow as mapRow, } from "./store-contracts.js";
3
+ export { mapImageRow as mapRow } from "./store-contracts.js";
3
4
  const MAX_LIMIT = 200;
4
5
  const DEFAULT_LIMIT = 50;
5
- export function mapRow(r) {
6
- return {
7
- id: r.id,
8
- profile: r.profile,
9
- bands: asJson(r.bands, []),
10
- repo: r.repo,
11
- tag: r.tag,
12
- digest: r.digest,
13
- toolchainVersions: asJson(r.toolchain_versions, {}),
14
- capabilities: asJson(r.capabilities, {}),
15
- podContract: asJson(r.pod_contract, {}),
16
- sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
17
- status: r.status,
18
- visibility: r.visibility,
19
- tenantId: r.tenant_id,
20
- manifestSha: r.manifest_sha,
21
- recipeGitSha: r.recipe_git_sha,
22
- generatorVersion: r.generator_version,
23
- buildDate: iso(r.build_date),
24
- supersedes: r.supersedes,
25
- signed: !!r.signed,
26
- createdAt: iso(r.created_at) ?? new Date(0).toISOString(),
27
- updatedAt: iso(r.updated_at) ?? new Date(0).toISOString(),
28
- };
29
- }
30
6
  function visibilityClause(viewer) {
31
7
  if (viewer.operator)
32
8
  return { sql: "1=1", params: [] };
@@ -1,6 +1,6 @@
1
1
  import mysql from "mysql2/promise";
2
2
  import type { Pool, PoolConnection } from "mysql2/promise";
3
- import type { ServiceConfig } from "../config.js";
3
+ import type { ServiceConfig } from "../config-types.js";
4
4
  export declare function tidbPoolOptions(tidb: NonNullable<ServiceConfig["tidb"]>): mysql.PoolOptions;
5
5
  export declare function createTidbPool(config: ServiceConfig): Pool;
6
6
  export declare const SCHEMA_STATEMENTS: readonly string[];
@@ -1,38 +1,8 @@
1
1
  import type { TaskResult, TaskStatus } from "@sema-agent/core";
2
2
  import { type UsageRow } from "../usage-analytics.js";
3
3
  import type { Pool } from "mysql2/promise";
4
- export interface RunRecord {
5
- taskId: string;
6
- sessionId: string;
7
- owner: string | null;
8
- status: "running" | TaskStatus;
9
- result: TaskResult | null;
10
- error: string | null;
11
- errorCode: string | null;
12
- jobId: string | null;
13
- source: string | null;
14
- instanceId: string | null;
15
- objectivePreview: string | null;
16
- createdAt: string;
17
- updatedAt: string;
18
- }
19
- export interface SessionSummary {
20
- sessionId: string;
21
- owner: string | null;
22
- lastActivityAt: string;
23
- firstActivityAt: string;
24
- runCount: number;
25
- objectivePreview: string | null;
26
- lastStatus: string;
27
- lastRunId: string | null;
28
- title: string | null;
29
- }
30
- export interface RunEvent {
31
- seq: number;
32
- type: string;
33
- data: unknown;
34
- ts: string;
35
- }
4
+ import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
5
+ export type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
36
6
  export declare class TiDBRunStore {
37
7
  private readonly pool;
38
8
  constructor(pool: Pool);
@@ -1,5 +1,5 @@
1
1
  import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
2
- import { escapeLike } from "./tidb-tool-result-store.js";
2
+ import { escapeLike } from "./sql-escape.js";
3
3
  import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
4
4
  function isDupKey(err) {
5
5
  return Boolean(err) && err.code === "ER_DUP_ENTRY";
@@ -1,7 +1,7 @@
1
1
  import { type AcquiredSession, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
2
2
  import type { Pool } from "mysql2/promise";
3
- import type { SessionSummary } from "./tidb-run-store.js";
4
- import { type StagingHandle } from "../session-sync.js";
3
+ import type { SessionSummary } from "./store-contracts.js";
4
+ import { type StagingHandle } from "../session-sync-kernel.js";
5
5
  export declare class TiDBSessionStore implements SessionStore {
6
6
  private readonly pool;
7
7
  private readonly pending;
@@ -1,7 +1,7 @@
1
1
  import { StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry } from "@sema-agent/core";
2
2
  import { TiDBSessionStorage } from "./tidb-session-storage.js";
3
- import { escapeLike } from "./tidb-tool-result-store.js";
4
- import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync.js";
3
+ import { escapeLike } from "./sql-escape.js";
4
+ import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync-kernel.js";
5
5
  const STAGING_GC_GRACE_MS = 3_600_000;
6
6
  export class TiDBSessionStore {
7
7
  pool;
@@ -1,5 +1,6 @@
1
1
  import type { ToolResultStore, ToolResultSlice } from "@sema-agent/core";
2
2
  import type { Pool } from "mysql2/promise";
3
+ export { escapeLike } from "./sql-escape.js";
3
4
  export declare class TiDBToolResultStore implements ToolResultStore {
4
5
  private readonly pool;
5
6
  constructor(pool: Pool);
@@ -11,5 +12,4 @@ export declare class TiDBToolResultStore implements ToolResultStore {
11
12
  reapOlderThan(cutoffMs: number): Promise<number>;
12
13
  deleteBySession(sessionId: string): Promise<number>;
13
14
  }
14
- export declare function escapeLike(s: string): string;
15
15
  //# sourceMappingURL=tidb-tool-result-store.d.ts.map
@@ -1,3 +1,5 @@
1
+ import { escapeLike } from "./sql-escape.js";
2
+ export { escapeLike } from "./sql-escape.js";
1
3
  export class TiDBToolResultStore {
2
4
  pool;
3
5
  constructor(pool) {
@@ -35,7 +37,4 @@ export class TiDBToolResultStore {
35
37
  return res.affectedRows;
36
38
  }
37
39
  }
38
- export function escapeLike(s) {
39
- return s.replace(/[\\%_]/g, (ch) => `\\${ch}`);
40
- }
41
40
  //# sourceMappingURL=tidb-tool-result-store.js.map
@@ -1,8 +1,11 @@
1
1
  import type { IncomingMessage } from "node:http";
2
2
  import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
3
- import type { ServiceConfig } from "./config.js";
4
- import type { TaskRequestBody } from "./http/server.js";
5
- import type { StagingHandle } from "./session-sync.js";
3
+ import type { ServiceConfig } from "./config-types.js";
4
+ import type { TaskRequestBody } from "./http/wire-types.js";
5
+ import type { StagingHandle } from "./session-sync-kernel.js";
6
+ import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
7
+ export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
8
+ export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
6
9
  export interface SessionListItem {
7
10
  sessionId: string;
8
11
  owner: string | null;
@@ -92,12 +95,6 @@ export declare function memorySpecForRequest(scope: string | undefined, memoryWr
92
95
  writeScope?: string | null;
93
96
  scopeContract?: "v2";
94
97
  } | undefined;
95
- export interface ApprovalHmacKey {
96
- kid: string;
97
- key: string;
98
- status?: "active" | "retiring";
99
- }
100
- export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
101
98
  export declare function approvalHmacMessage(env: {
102
99
  sessionId: string;
103
100
  boundCallId?: string | null;
@@ -113,13 +110,6 @@ export declare function verifyApprovalHmac(env: {
113
110
  decision: string;
114
111
  reason?: string | null;
115
112
  }, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
116
- export interface PrincipalJwtKey {
117
- kid: string;
118
- alg: "EdDSA" | "RS256" | "ES256";
119
- key: string;
120
- status?: "active" | "retiring";
121
- }
122
- export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
123
113
  export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
124
114
  iss: string;
125
115
  aud: string;
package/dist/security.js CHANGED
@@ -2,6 +2,7 @@ import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cry
2
2
  import { join } from "node:path";
3
3
  import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
4
4
  import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
5
+ export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
5
6
  const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
6
7
  export function isUuidV7(s) {
7
8
  return UUIDV7_RE.test(s);
@@ -162,19 +163,6 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
162
163
  const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
163
164
  return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
164
165
  }
165
- export function parseApprovalHmacKeys(raw) {
166
- if (!raw)
167
- return [];
168
- try {
169
- const v = JSON.parse(raw);
170
- if (!Array.isArray(v))
171
- return [];
172
- return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
173
- }
174
- catch {
175
- return [];
176
- }
177
- }
178
166
  export function approvalHmacMessage(env) {
179
167
  return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
180
168
  }
@@ -200,23 +188,6 @@ export function verifyApprovalHmac(env, mac, kid, keys) {
200
188
  }
201
189
  return false;
202
190
  }
203
- export function parsePrincipalJwks(raw) {
204
- if (!raw)
205
- return [];
206
- const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
207
- try {
208
- const v = JSON.parse(raw);
209
- if (!Array.isArray(v))
210
- return [];
211
- return v.filter((k) => {
212
- const e = k;
213
- return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
214
- });
215
- }
216
- catch {
217
- return [];
218
- }
219
- }
220
191
  function b64urlToBuf(s) {
221
192
  return Buffer.from(s, "base64url");
222
193
  }
@@ -1,6 +1,6 @@
1
1
  import type { McpServerSpec } from "@sema-agent/core";
2
2
  import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
3
- import type { ScopedMcpServer, ServiceConfig } from "./config.js";
3
+ import type { ScopedMcpServer, ServiceConfig } from "./config-types.js";
4
4
  import { type SealedKeyOpener } from "./sealed-key.js";
5
5
  import type { Autonomy, CommandRule } from "./runtime-governance.js";
6
6
  import type { Logger } from "./observability/logger.js";
@@ -0,0 +1,47 @@
1
+ import type { SessionTreeEntry } from "@sema-agent/core";
2
+ export interface StagingHandle {
3
+ readonly stagingId: string;
4
+ readonly realSessionId: string;
5
+ appendBatch(entries: SessionTreeEntry[]): Promise<void>;
6
+ commit(owner: string | null, opts?: {
7
+ resolution?: "overwrite-dst";
8
+ }): Promise<{
9
+ relation: SyncRelation["relation"];
10
+ }>;
11
+ abort(): Promise<void>;
12
+ }
13
+ export type ImportStagingStore = {
14
+ beginImportStaging(realSessionId: string, token: string): StagingHandle;
15
+ sweepStagingSessions?(): Promise<number>;
16
+ };
17
+ export declare function stagingIdFor(realSessionId: string, token: string): string;
18
+ export declare const STAGING_ID_MARKER = "#stg-";
19
+ export declare function realIdOfStaging(stagingId: string): string | null;
20
+ export type SyncRelation = {
21
+ relation: "fresh";
22
+ } | {
23
+ relation: "identical";
24
+ } | {
25
+ relation: "fast_forward";
26
+ newEntryIds: string[];
27
+ } | {
28
+ relation: "stale";
29
+ dstAheadBy: string[];
30
+ } | {
31
+ relation: "fork";
32
+ commonAncestor: string | null;
33
+ srcExclusive: string[];
34
+ dstExclusive: string[];
35
+ };
36
+ export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
37
+ export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
38
+ export declare class SyncConflictError extends Error {
39
+ readonly sessionId: string;
40
+ readonly relation: Extract<SyncRelation, {
41
+ relation: "fork" | "stale";
42
+ }>;
43
+ constructor(sessionId: string, relation: Extract<SyncRelation, {
44
+ relation: "fork" | "stale";
45
+ }>);
46
+ }
47
+ //# sourceMappingURL=session-sync-kernel.d.ts.map
@@ -0,0 +1,47 @@
1
+ export function stagingIdFor(realSessionId, token) {
2
+ return `${realSessionId}#stg-${token}`;
3
+ }
4
+ export const STAGING_ID_MARKER = "#stg-";
5
+ export function realIdOfStaging(stagingId) {
6
+ const i = stagingId.indexOf(STAGING_ID_MARKER);
7
+ return i < 0 ? null : stagingId.slice(0, i);
8
+ }
9
+ export function classifySyncRelationship(srcEntries, dstEntries) {
10
+ return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
11
+ }
12
+ export function classifySyncRelationshipByIds(srcIds, dstIds) {
13
+ if (dstIds === null || dstIds.length === 0)
14
+ return { relation: "fresh" };
15
+ const srcSet = new Set(srcIds);
16
+ const dstSet = new Set(dstIds);
17
+ if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
18
+ return { relation: "identical" };
19
+ const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
20
+ const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
21
+ if (allDstInSrc && !allSrcInDst) {
22
+ const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
23
+ return { relation: "fast_forward", newEntryIds };
24
+ }
25
+ if (allSrcInDst && !allDstInSrc) {
26
+ const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
27
+ return { relation: "stale", dstAheadBy };
28
+ }
29
+ const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
30
+ const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
31
+ let commonAncestor = null;
32
+ for (const id of srcIds)
33
+ if (dstSet.has(id))
34
+ commonAncestor = id;
35
+ return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
36
+ }
37
+ export class SyncConflictError extends Error {
38
+ sessionId;
39
+ relation;
40
+ constructor(sessionId, relation) {
41
+ super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
42
+ this.sessionId = sessionId;
43
+ this.relation = relation;
44
+ this.name = "SyncConflictError";
45
+ }
46
+ }
47
+ //# sourceMappingURL=session-sync-kernel.js.map