@sema-agent/server 1.311.0 → 1.313.0

package/dist/security.d.ts

@@ -1,8 +1,11 @@
 import type { IncomingMessage } from "node:http";
 import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
-import type { ServiceConfig } from "./config.js";
-import type { TaskRequestBody } from "./http/server.js";
-import type { StagingHandle } from "./session-sync.js";
+import type { ServiceConfig } from "./config-types.js";
+import type { TaskRequestBody } from "./http/wire-types.js";
+import type { StagingHandle } from "./session-sync-kernel.js";
+import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
+export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 export interface SessionListItem {
     sessionId: string;
     owner: string | null;
@@ -92,12 +95,6 @@ export declare function memorySpecForRequest(scope: string | undefined, memoryWr
     writeScope?: string | null;
     scopeContract?: "v2";
 } | undefined;
-export interface ApprovalHmacKey {
-    kid: string;
-    key: string;
-    status?: "active" | "retiring";
-}
-export declare function parseApprovalHmacKeys(raw: string | undefined): ApprovalHmacKey[];
 export declare function approvalHmacMessage(env: {
     sessionId: string;
     boundCallId?: string | null;
@@ -113,13 +110,6 @@ export declare function verifyApprovalHmac(env: {
     decision: string;
     reason?: string | null;
 }, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
-export interface PrincipalJwtKey {
-    kid: string;
-    alg: "EdDSA" | "RS256" | "ES256";
-    key: string;
-    status?: "active" | "retiring";
-}
-export declare function parsePrincipalJwks(raw: string | undefined): PrincipalJwtKey[];
 export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
     iss: string;
     aud: string;

package/dist/security.js

@@ -2,6 +2,7 @@ import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cry
 import { join } from "node:path";
 import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
 import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
+export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 export function isUuidV7(s) {
     return UUIDV7_RE.test(s);
@@ -162,19 +163,6 @@ export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
     const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
     return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
 }
-export function parseApprovalHmacKeys(raw) {
-    if (!raw)
-        return [];
-    try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
-    }
-    catch {
-        return [];
-    }
-}
 export function approvalHmacMessage(env) {
     return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
 }
@@ -200,23 +188,6 @@ export function verifyApprovalHmac(env, mac, kid, keys) {
     }
     return false;
 }
-export function parsePrincipalJwks(raw) {
-    if (!raw)
-        return [];
-    const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
-    try {
-        const v = JSON.parse(raw);
-        if (!Array.isArray(v))
-            return [];
-        return v.filter((k) => {
-            const e = k;
-            return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
-        });
-    }
-    catch {
-        return [];
-    }
-}
 function b64urlToBuf(s) {
     return Buffer.from(s, "base64url");
 }

package/dist/sema-registry.d.ts

@@ -1,6 +1,6 @@
 import type { McpServerSpec } from "@sema-agent/core";
 import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
-import type { ScopedMcpServer, ServiceConfig } from "./config.js";
+import type { ScopedMcpServer, ServiceConfig } from "./config-types.js";
 import { type SealedKeyOpener } from "./sealed-key.js";
 import type { Autonomy, CommandRule } from "./runtime-governance.js";
 import type { Logger } from "./observability/logger.js";

package/dist/session-sync-kernel.d.ts

@@ -0,0 +1,47 @@
+import type { SessionTreeEntry } from "@sema-agent/core";
+export interface StagingHandle {
+    readonly stagingId: string;
+    readonly realSessionId: string;
+    appendBatch(entries: SessionTreeEntry[]): Promise<void>;
+    commit(owner: string | null, opts?: {
+        resolution?: "overwrite-dst";
+    }): Promise<{
+        relation: SyncRelation["relation"];
+    }>;
+    abort(): Promise<void>;
+}
+export type ImportStagingStore = {
+    beginImportStaging(realSessionId: string, token: string): StagingHandle;
+    sweepStagingSessions?(): Promise<number>;
+};
+export declare function stagingIdFor(realSessionId: string, token: string): string;
+export declare const STAGING_ID_MARKER = "#stg-";
+export declare function realIdOfStaging(stagingId: string): string | null;
+export type SyncRelation = {
+    relation: "fresh";
+} | {
+    relation: "identical";
+} | {
+    relation: "fast_forward";
+    newEntryIds: string[];
+} | {
+    relation: "stale";
+    dstAheadBy: string[];
+} | {
+    relation: "fork";
+    commonAncestor: string | null;
+    srcExclusive: string[];
+    dstExclusive: string[];
+};
+export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
+export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
+export declare class SyncConflictError extends Error {
+    readonly sessionId: string;
+    readonly relation: Extract<SyncRelation, {
+        relation: "fork" | "stale";
+    }>;
+    constructor(sessionId: string, relation: Extract<SyncRelation, {
+        relation: "fork" | "stale";
+    }>);
+}
+//# sourceMappingURL=session-sync-kernel.d.ts.map

package/dist/session-sync-kernel.js

@@ -0,0 +1,47 @@
+export function stagingIdFor(realSessionId, token) {
+    return `${realSessionId}#stg-${token}`;
+}
+export const STAGING_ID_MARKER = "#stg-";
+export function realIdOfStaging(stagingId) {
+    const i = stagingId.indexOf(STAGING_ID_MARKER);
+    return i < 0 ? null : stagingId.slice(0, i);
+}
+export function classifySyncRelationship(srcEntries, dstEntries) {
+    return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
+}
+export function classifySyncRelationshipByIds(srcIds, dstIds) {
+    if (dstIds === null || dstIds.length === 0)
+        return { relation: "fresh" };
+    const srcSet = new Set(srcIds);
+    const dstSet = new Set(dstIds);
+    if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
+        return { relation: "identical" };
+    const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
+    const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
+    if (allDstInSrc && !allSrcInDst) {
+        const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
+        return { relation: "fast_forward", newEntryIds };
+    }
+    if (allSrcInDst && !allDstInSrc) {
+        const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
+        return { relation: "stale", dstAheadBy };
+    }
+    const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
+    const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
+    let commonAncestor = null;
+    for (const id of srcIds)
+        if (dstSet.has(id))
+            commonAncestor = id;
+    return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
+}
+export class SyncConflictError extends Error {
+    sessionId;
+    relation;
+    constructor(sessionId, relation) {
+        super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
+        this.sessionId = sessionId;
+        this.relation = relation;
+        this.name = "SyncConflictError";
+    }
+}
+//# sourceMappingURL=session-sync-kernel.js.map

package/dist/session-sync.d.ts

@@ -1,51 +1,9 @@
 import type { StoreBackend } from "./plugins/store-backend.js";
+import { type SyncRelation } from "./session-sync-kernel.js";
 import type { SessionTreeEntry, SessionRulesRecord } from "@sema-agent/core";
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
-export interface StagingHandle {
-    readonly stagingId: string;
-    readonly realSessionId: string;
-    appendBatch(entries: SessionTreeEntry[]): Promise<void>;
-    commit(owner: string | null, opts?: {
-        resolution?: "overwrite-dst";
-    }): Promise<{
-        relation: SyncRelation["relation"];
-    }>;
-    abort(): Promise<void>;
-}
-export type ImportStagingStore = {
-    beginImportStaging(realSessionId: string, token: string): StagingHandle;
-    sweepStagingSessions?(): Promise<number>;
-};
-export declare function stagingIdFor(realSessionId: string, token: string): string;
-export declare const STAGING_ID_MARKER = "#stg-";
-export declare function realIdOfStaging(stagingId: string): string | null;
-export type SyncRelation = {
-    relation: "fresh";
-} | {
-    relation: "identical";
-} | {
-    relation: "fast_forward";
-    newEntryIds: string[];
-} | {
-    relation: "stale";
-    dstAheadBy: string[];
-} | {
-    relation: "fork";
-    commonAncestor: string | null;
-    srcExclusive: string[];
-    dstExclusive: string[];
-};
-export declare function classifySyncRelationship(srcEntries: SessionTreeEntry[], dstEntries: SessionTreeEntry[] | null): SyncRelation;
-export declare function classifySyncRelationshipByIds(srcIds: string[], dstIds: string[] | null): SyncRelation;
-export declare class SyncConflictError extends Error {
-    readonly sessionId: string;
-    readonly relation: Extract<SyncRelation, {
-        relation: "fork" | "stale";
-    }>;
-    constructor(sessionId: string, relation: Extract<SyncRelation, {
-        relation: "fork" | "stale";
-    }>);
-}
+export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
+export type { StagingHandle, ImportStagingStore, SyncRelation } from "./session-sync-kernel.js";
 export interface SessionBundle {
     sessionId: string;
     entries: SessionTreeEntry[];

package/dist/session-sync.js

@@ -1,51 +1,7 @@
 import { identicalIdsAlsoIdenticalContent } from "./session-sync-content.js";
+import { classifySyncRelationship, SyncConflictError } from "./session-sync-kernel.js";
 import { validateEntriesForImport, normalizeRules, stripRev } from "@sema-agent/core";
-export function stagingIdFor(realSessionId, token) {
-    return `${realSessionId}#stg-${token}`;
-}
-export const STAGING_ID_MARKER = "#stg-";
-export function realIdOfStaging(stagingId) {
-    const i = stagingId.indexOf(STAGING_ID_MARKER);
-    return i < 0 ? null : stagingId.slice(0, i);
-}
-export function classifySyncRelationship(srcEntries, dstEntries) {
-    return classifySyncRelationshipByIds(srcEntries.map((e) => e.id), dstEntries === null ? null : dstEntries.map((e) => e.id));
-}
-export function classifySyncRelationshipByIds(srcIds, dstIds) {
-    if (dstIds === null || dstIds.length === 0)
-        return { relation: "fresh" };
-    const srcSet = new Set(srcIds);
-    const dstSet = new Set(dstIds);
-    if (srcSet.size === dstSet.size && [...srcSet].every((id) => dstSet.has(id)))
-        return { relation: "identical" };
-    const allDstInSrc = [...dstSet].every((id) => srcSet.has(id));
-    const allSrcInDst = [...srcSet].every((id) => dstSet.has(id));
-    if (allDstInSrc && !allSrcInDst) {
-        const newEntryIds = srcIds.filter((id) => !dstSet.has(id));
-        return { relation: "fast_forward", newEntryIds };
-    }
-    if (allSrcInDst && !allDstInSrc) {
-        const dstAheadBy = dstIds.filter((id) => !srcSet.has(id));
-        return { relation: "stale", dstAheadBy };
-    }
-    const srcExclusive = srcIds.filter((id) => !dstSet.has(id));
-    const dstExclusive = dstIds.filter((id) => !srcSet.has(id));
-    let commonAncestor = null;
-    for (const id of srcIds)
-        if (dstSet.has(id))
-            commonAncestor = id;
-    return { relation: "fork", commonAncestor, srcExclusive, dstExclusive };
-}
-export class SyncConflictError extends Error {
-    sessionId;
-    relation;
-    constructor(sessionId, relation) {
-        super(`session-sync: refusing to import session ${sessionId} — ${relation.relation} (would lose destination history; resolve explicitly)`);
-        this.sessionId = sessionId;
-        this.relation = relation;
-        this.name = "SyncConflictError";
-    }
-}
+export { stagingIdFor, STAGING_ID_MARKER, realIdOfStaging, classifySyncRelationship, classifySyncRelationshipByIds, SyncConflictError } from "./session-sync-kernel.js";
 function ownerAware(backend) {
     return backend.session();
 }

package/dist/trace/artifacts.d.ts

@@ -1,4 +1,4 @@
-import type { RunEvent } from "../plugins/tidb-run-store.js";
+import type { RunEvent } from "../plugins/store-contracts.js";
 export interface TraceArtifact {
     id: string;
     taskId: string;

package/dist/trace/core-keyset-guard.d.ts

@@ -1,8 +1,8 @@
 import type { TaskNotificationPayload, BackgroundChildEvent, RosterEntry, AskRequest, TaskEvent } from "@sema-agent/core";
 type AssertAllKeysHandled<T extends never> = T;
-type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable";
+type NotificationProjected = "task_id" | "task_type" | "toolUseId" | "status" | "summary" | "result" | "output_file" | "usage" | "sessionId" | "seq" | "lines" | "stoppedBy" | "source" | "exitCode" | "partial" | "diagnostics" | "recentSteps" | "editedFiles" | "resumable" | "completionId";
 type _GuardNotification = AssertAllKeysHandled<Exclude<keyof TaskNotificationPayload, NotificationProjected>>;
-type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId";
+type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "createdAt";

package/dist/trace/project.d.ts

@@ -1,5 +1,5 @@
 import type { TaskResult } from "@sema-agent/core";
-import type { RunEvent, RunRecord } from "../plugins/tidb-run-store.js";
+import type { RunEvent, RunRecord } from "../plugins/store-contracts.js";
 import type { ModelUsageDelta, ModelUsageTracker, PromptManifestRecord } from "../budget.js";
 type AppendFn = (type: string, data: unknown) => Promise<void>;
 type GetEventsFn = (taskId: string, afterSeq: number) => Promise<RunEvent[]>;
@@ -108,6 +108,7 @@ export declare function taskNotificationEventData(ev: {
             edits: number;
         }>;
         resumable?: boolean;
+        completionId?: string;
     };
     eventId?: string;
     parentToolCallId?: string;

package/dist/trace/project.js

@@ -92,6 +92,7 @@ export function taskNotificationEventData(ev) {
         ...(n.seq !== undefined ? { seq: n.seq } : {}),
         ...(n.lines !== undefined ? { lines: n.lines.map((l) => redactSecrets(l)) } : {}),
         ...(n.stoppedBy !== undefined ? { stoppedBy: n.stoppedBy } : {}),
+        ...(n.completionId !== undefined ? { completionId: n.completionId } : {}),
         ...(n.source !== undefined ? { source: redactSecrets(n.source) } : {}),
         ...(n.exitCode !== undefined ? { exitCode: n.exitCode } : {}),
         ...(n.partial !== undefined ? { partial: n.partial } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.311.0",
+  "version": "1.313.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -51,7 +51,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "^1.444.0",
+    "@sema-agent/core": "^1.452.0",
     "@sema-agent/registry-core": "^0.10.21",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",