@sema-agent/server 4.3.0 → 5.0.0

package/dist/http/server.d.ts

@@ -5,7 +5,7 @@ import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type RestartSignal, type SessionMirrorRuling } from "../config-center/facade.js";
 import { type OwnerAwareSessionStore } from "../security.js";
-import type { RunStore, ApprovalStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
+import type { RunStore, ImageIndex, ImageBake, CheckpointStoreFull, ResumeAnchorStore, ApprovalExemptionStore, ServiceSessionPolicyStore, ServiceFileSnapshotStore, StoreBackend } from "../plugins/store-backend.js";
 import { type MemorySyncRequest, type MemorySyncResponse } from "../memory-sync.js";
 import type { TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { LeaderEndpoint } from "../leader/endpoint.js";
@@ -25,8 +25,6 @@ import type { QuotaTracker } from "../observability/cost-quota.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import { scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
-import { clampVerifyRounds } from "./verify-rounds.js";
-export { clampVerifyRounds };
 import { streamApprovals, isQuestionAnswer } from "./routes/approvals-assistant.js";
 export { streamApprovals, isQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
@@ -88,8 +86,6 @@ export interface ServiceStoreDeps {
     /** E18 resume-at: the eventId→entryId anchor map (tidb/pg/local). Present whenever a backend is — resolveSpec
      *  resolves body.resumeAt(eventId)→entryId, the run lifecycle captures per-turn anchors, E21 purges them. */
     resumeAnchorStore?: ResumeAnchorStore;
-    /** Human-in-the-loop approval store (F4 poll gate). Enables /v1/approvals when present. */
-    approvalStore?: ApprovalStore;
     /** Per-session approval exemption store — enables decide body `remember:"session"` + the
      *  exemptions list/revoke surfaces on /v1/approvals. The ask-gate probe is wired separately (main.ts). */
     approvalExemptionStore?: ApprovalExemptionStore;
@@ -439,7 +435,6 @@ export type FlatServiceDeps = ServiceCoreDeps & Partial<ServiceStoreDeps & Servi
 export type ServiceDeps = FlatServiceDeps & ServiceDepGroups;
 /** 分组入参 → 平铺视图(createHttpServer 的第一件事)。一组都没给 ⇒ 原样返回(存量调用零开销、零形变)。 */
 export declare function flattenServiceDeps(deps: ServiceDeps): FlatServiceDeps;
-export type { TaskRequestBody } from "./wire-types.js";
 /** Personalization caps: server-pinned hard limits — a UI may be stricter, never looser. */
 export declare const MAX_USER_SKILLS = 10;
 /** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在

package/dist/http/server.js

@@ -1,31 +1,31 @@
 import http from "node:http";
 import { once } from "node:events";
 import { createHash } from "node:crypto";
-import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, canonicalToolName, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow } from "@sema-agent/core"; // canonicalToolName = core single-source (1.162; replaced the transitional service mirror)
+import { uuidv7, isThinkingLevel, expandTiers, resumeWithVerification, CheckpointError, HAND_TOOL_EFFECTS, defaultTaskRegistry, validatePendingSteer, subscribeWorkflow } from "@sema-agent/core"; // canonicalToolName = core single-source (1.162; replaced the transitional service mirror)
 import { decideParkedAgent, findParkedAgentForCheckpoint } from "../parked-decide.js";
 import { matchCatalogModel } from "../model-select.js";
 import {} from "../config-center/facade.js";
-import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, verifyDirectDoorProof, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { HttpError, principalFrom, verifiedPrincipal, setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isUuidV7, isDestructiveSessionWrite, decodeCheckpointScope, CHECKPOINT_PUBLIC_SCOPE } from "../security.js";
+import { verifyDirectDoorProof } from "../principal-jwt.js";
 import {} from "../memory-sync.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_PERMISSION_RULES, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../task-settings.js";
 import { parseHooksConfig } from "../hooks/hook-runner.js";
 import { validateTaskAgents } from "../spec-fields.js";
 import { isValidCwd, MAX_ADDITIONAL_DIRS } from "../task-cwd.js";
 import { runInBackground, evictIfConflict, stripCheckpointToken, TurnAnchorCapture, HEARTBEAT_MS, markChildrenStoppedByUserOnAbort } from "../runs.js";
-import { looksLikeJwt } from "../auth-bridge.js";
+import { looksLikeJwt } from "@sema-agent/registry-core/api/auth-bridge";
 import {} from "../orchestration/workflow-agent-steer.js";
 import { emitPendingWorkflowCompletions, taskNotificationInboxEntry, taskNotificationStreamKey, NotifiedKeys } from "../orchestration/workflow-completion-inbox.js";
 import { fleetRunPublisher, fleetRunLabels, fleetRunResiduals } from "../fleet/fleet-bus.js";
 import { defaultSubagentTailBus, projectTailFrame } from "../fleet/subagent-tail-bus.js";
 import {} from "../observability/rate-limit.js";
 import { withPrincipal } from "../observability/principal-context.js";
-import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, workspaceChangedEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
+import { turnEndEventData, contextUsageEventData, toolStartEventData, toolEndEventData, taskProgressEventData, taskNotificationEventData, compactedEventData, diagnosticsEventData, brainStatusEventData, steeringInjectedEventData, compactionOutcomeEventData, workspaceChangedEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "../trace/project.js";
 import { redactSecrets } from "../trace/redact.js";
 import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
 export { scopedIdempotencyKey };
 import { streamSseLog } from "./sse-log.js";
 import { clampVerifyRounds, verifyRoundsFromBody } from "./verify-rounds.js"; // design/97 R9: the shape's neutral leaf (route-ctx.ts type-imports VerifyRoundsSpec from here, not from this file)
-export { clampVerifyRounds }; // deep-path test imports of http/server.js's clampVerifyRounds keep working unchanged
 import { handleCapabilities } from "./routes/capabilities.js";
 import { handleObservability } from "./routes/observability.js";
 import { handleMemoryPolicy } from "./routes/memory-policy.js";
@@ -59,6 +59,8 @@ export function flattenServiceDeps(deps) {
         return deps;
     return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
 }
+// design/158 A4: TaskRequestBody lives in ./wire-types.ts (a type-only leaf) — import it from there
+// ([2354] 兼容面全清:此处的兼容 re-export 已删;index.ts 公共面直接从 wire-types 转出)。
 /** Personalization caps: server-pinned hard limits — a UI may be stricter, never looser. */
 export const MAX_USER_SKILLS = 10;
 /** = core `SKILL_CONTENT_MAX_CHARS`(1MB 加载门,core 1.293 起 invoke 全文零截断、超 1MB 整拒;常量在
@@ -1273,11 +1275,11 @@ export function createHttpServer(rawDeps) {
         // (core `HAND_TOOL_EFFECTS`, not re-exported from the package root → mirrored here). When this deployment
         // has remote exec configured the rebuilt task WILL expose them, so union them in; else gating a hand tool
         // (the common code-agent case) would always 422 on resume. Keep in sync with core's HAND_TOOL_EFFECTS.
-        // Q6 (core 1.161): canonicalize a PRE-Q6 persisted name (`bash`/`write_file`/…) to its CC-aligned new name
-        // BEFORE matching the rebuilt (post-Q6) tool set — else an in-flight checkpoint suspended before the upgrade
-        // would 422 here before core's own resume shim runs. New names map to themselves (idempotent).
+        // [2380] RB-476(5.0.0):Q6 折叠预检退役——满足性匹配按 RAW 名。pre-floor 旧名 checkpoint
+        // (`bash`/`run_workflow` 等)在此 422 诚实拒,与 core 自己的 resume.tool_unavailable 同方向
+        // ([2364] 令:耐久面响亮牺牲 + P-7 重开,不静默兜)。现役名恒自映射。
         const pendingTool = cp.pendingAction.toolName;
-        const pendingToolCanon = pendingTool ? canonicalToolName(pendingTool) : undefined;
+        const pendingToolCanon = pendingTool;
         const availableTools = new Set((spec.tools ?? []).map((t) => t.name));
         if (deps.config.remoteExec)
             for (const name of HAND_TOOL_NAMES)
@@ -1763,6 +1765,10 @@ export function createHttpServer(rawDeps) {
                                 await flush();
                                 await append("steering_injected", steeringInjectedEventData(ev));
                                 break; // [1550]/[1552]: shared whitelist builder, §E1 redact — resume twin of the sync + ledger-sink legs
+                            case "compaction_outcome":
+                                await flush();
+                                await append("compaction_outcome", compactionOutcomeEventData(ev));
+                                break; // [2373]A-2/C-2: durable 双腿补齐(此前回放即消失);共享 builder,差集门看守
                             case "workspace_changed":
                                 await flush();
                                 await append("workspace_changed", workspaceChangedEventData(ev));
@@ -2470,7 +2476,6 @@ const ROUTE_LABEL_PATTERNS = [
     [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
     [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
     [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
-    [/^\/v1\/approvals\/[^/]+$/, "/v1/approvals/:id"],
     [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|policy|settings)$/, "/v1/sessions/:id/$verb"],
     [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
     [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],

package/dist/http/verify-rounds.d.ts

@@ -5,8 +5,8 @@
  * http/server.ts that each re-derived the same "verify:true → clamp rounds + fold cost ceiling" expression from a
  * request body. A leaf (not server.ts itself) so route-ctx.ts — which must never value-import server.ts (that
  * closes the runtime module-load cycle test/module-cycle-gate.test.ts guards) — can `import type` the shape from
- * one place. server.ts imports {@link clampVerifyRounds} from here and RE-EXPORTS it (deep-path test imports of
- * `http/server.js`'s `clampVerifyRounds` keep working unchanged).
+ * one place. server.ts imports {@link clampVerifyRounds} from here; tests import it from HERE too
+ * ([2354] 兼容面全清:server.ts 的保深路径 re-export 已删).
  */
 import type { TaskRequestBody } from "./wire-types.js";
 /** Verification-rounds config threaded onto a task's `verify`/resume paths (see {@link verifyRoundsFromBody}). */

package/dist/http/wire-types.d.ts

@@ -258,7 +258,7 @@ export interface TaskRequestBody {
     enableFork?: boolean;
     [k: string]: unknown;
 }
-/** design/80 D-1: the operator-echoed decision-action binding carried on POST /v1/approvals/:id[/decide].
+/** design/80 D-1: the operator-echoed decision-action binding carried on POST /v1/approvals/:sessionId/decide([2373]C-4:裸 :id 臂已删).
  *  All optional for back-compat — a legacy BFF caller omitting them resumes on the current-pending values
  *  exactly as before (the pre-D-1 path), tracked by a deprecation counter.
  *  design/158 A9: hoisted VERBATIM out of `createHttpServer`'s closure so the approvals/assistant route domain

package/dist/images/bake-validate.d.ts

@@ -1,21 +1,3 @@
-/**
- * Bake input WHITELIST + vetted-argv builder (IMAGE-API-DESIGN.md §P2.4 — the anti-RCE core).
- *
- * bands/profile/baseRef/bump compose a Dockerfile + a `FROM` + a `docker build` = arbitrary code on the build
- * host. So EVERY field is validated SERVER-SIDE against a CLOSED SET *before* an argv is built; off-list → an
- * error, never coerced. The runner only ever sees the VETTED argv this module emits (never operator free-text)
- * and only runs `build.sh`, which composes Dockerfiles from the in-repo `bands/` via `gen-dockerfile.sh` — there
- * is no path here to inject a raw Dockerfile or a shell command.
- *
- * Set membership is the gate (NOT regex): `^[a-z0-9-]+$` is belt-only — `python; rm -rf /` ∉ the frozen set →
- * rejected, and the argv is a RAW vetted VECTOR the runner array-spawns (each element in its own argv slot, no
- * shell), never concatenated into a command string.
- *
- * The frozen catalogs below MIRROR the recipe source of truth (`gen-dockerfile.sh` `profile_bands()` + the
- * `bands/` dir). A DRIFT test (test/image-bake-validate.test.ts) asserts they still match — a silently-drifted
- * list would either reject a valid profile or admit a removed band. Keep them in lockstep with the recipes.
- */
-import { SHA256_DIGEST_RE as DIGEST_RE } from "../digest-form.js";
 /**
  * FROZEN profile catalog — mirrored from `e2b-template/dev-sandbox/gen-dockerfile.sh` `profile_bands()`.
  * (db / browser-nodriver are opt-in overlays, NOT in `code-full` — `code-full-db` adds db; per design §4.)
@@ -33,10 +15,6 @@ export declare const FROZEN_BUMP_TOOLS: readonly string[];
 export declare const VER_RE: RegExp;
 /** Belt-only band shape (set-membership is the real gate); a defense-in-depth reject of structurally weird ids. */
 export declare const BAND_SHAPE_RE: RegExp;
-/** A digest must be an immutable sha256 ref (the allow-list check against the index is the real gate, P2.4c).
- *  design/158 R12: the shape itself is collected in `digest-form.ts`'s `SHA256_DIGEST_RE`; `DIGEST_RE` stays a
- *  re-exported alias (compat — export surface unchanged). */
-export { DIGEST_RE };
 /** The raw, untrusted submit body fields this module validates (operator free-text). */
 export interface BakeSubmit {
     profile?: unknown;

package/dist/images/bake-validate.js

@@ -90,10 +90,6 @@ const BUMP_TOOL_SET = new Set(FROZEN_BUMP_TOOLS);
 export const VER_RE = /^[A-Za-z0-9._-]{1,40}$/;
 /** Belt-only band shape (set-membership is the real gate); a defense-in-depth reject of structurally weird ids. */
 export const BAND_SHAPE_RE = /^[a-z0-9-]+$/;
-/** A digest must be an immutable sha256 ref (the allow-list check against the index is the real gate, P2.4c).
- *  design/158 R12: the shape itself is collected in `digest-form.ts`'s `SHA256_DIGEST_RE`; `DIGEST_RE` stays a
- *  re-exported alias (compat — export surface unchanged). */
-export { DIGEST_RE };
 function reject(status, error, conflictBands) {
     return conflictBands ? { ok: false, status, error, conflictBands } : { ok: false, status, error };
 }

package/dist/index.d.ts

@@ -6,8 +6,6 @@ export { CachingSessionStore, type CachingOptions } from "./plugins/caching-sess
 export type { RunRecord, RunEvent } from "./plugins/store-contracts.js";
 export { runInBackground } from "./runs.js";
 export type { VerifyRoundsSpec } from "./http/verify-rounds.js";
-export { type ApprovalRow, type ApprovalStatus } from "./plugins/approval-store-sql.js";
-export { createOaApprovalPolicy, type OaApprovalOptions } from "./approval.js";
 export { createHardenedVmRunner, runInHardenedVm, type HardenedVmLimits, type HardenedMembrane } from "./orchestration/hardened-vm-runner.js";
 export { createWorkerHardenedVmRunner } from "./orchestration/hardened-vm-worker-runner.js";
 export { buildSessionAudit, type SessionAudit } from "./audit.js";
@@ -19,6 +17,8 @@ export { nowTool } from "./capabilities/builtin-tools.js";
 export { createCouncilTool } from "./capabilities/code-review-council.js";
 export { loadSkills, skillsForScenario, type LoadedSkill } from "./capabilities/skills.js";
 export { buildScenarios, selectScenario, type Scenario, type ScenarioBundle, type ScenarioDeps, type ScenarioRequest, } from "./capabilities/scenarios.js";
-export { createAuthorizer, principalFrom, memoryScopeFor, memoryEngineBackendFor, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
-export { createHttpServer, type ServiceDeps, type TaskRequestBody, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
+export { createAuthorizer, principalFrom, HttpError, type AuthContext, type OwnerAwareSessionStore, } from "./security.js";
+export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
+export type { TaskRequestBody } from "./http/wire-types.js";
+export { createHttpServer, type ServiceDeps, type RequestAuth, type FlatServiceDeps, type ServiceDepGroups, type ServiceCoreDeps, type ServiceStoreDeps, type ServiceCoordinatorDeps, type ServiceSeamDeps, type ServiceObservabilityDeps, type ServiceGovernanceDeps, type ServiceDeploymentDeps, type ServiceKnobDeps, } from "./http/server.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -11,10 +11,6 @@ export { createStoreBackend } from "./plugins/store-backend.js";
 // docs/schema/baseline-{mysql,pg}.sql(生成基线,机器门逐字节)。类/函数本体仍是内部实现(深径 import)。
 export { CachingSessionStore } from "./plugins/caching-session-store.js";
 export { runInBackground } from "./runs.js";
-// B5-② 补漏:TiDBApprovalStore 是证据包漏数的第 7 个方言导出,同判据同车摘(全生态零消费);
-// 两个中立行类型改从 A12 后的真源(approval-store-sql.ts)导出。
-export {} from "./plugins/approval-store-sql.js";
-export { createOaApprovalPolicy } from "./approval.js";
 export { createHardenedVmRunner, runInHardenedVm } from "./orchestration/hardened-vm-runner.js";
 export { createWorkerHardenedVmRunner } from "./orchestration/hardened-vm-worker-runner.js";
 export { buildSessionAudit } from "./audit.js";
@@ -26,6 +22,7 @@ export { nowTool } from "./capabilities/builtin-tools.js";
 export { createCouncilTool } from "./capabilities/code-review-council.js";
 export { loadSkills, skillsForScenario } from "./capabilities/skills.js";
 export { buildScenarios, selectScenario, } from "./capabilities/scenarios.js";
-export { createAuthorizer, principalFrom, memoryScopeFor, memoryEngineBackendFor, HttpError, } from "./security.js";
+export { createAuthorizer, principalFrom, HttpError, } from "./security.js";
+export { memoryScopeFor, memoryEngineBackendFor } from "./memory-scope.js";
 export { createHttpServer, } from "./http/server.js";
 //# sourceMappingURL=index.js.map

package/dist/main.js

@@ -390,12 +390,10 @@ async function main() {
         maxOutputTokens: capEnv("TASK_MAX_OUTPUT_TOKENS_MAX"),
         maxTurns: capEnv("TASK_MAX_TURNS_MAX"),
     };
-    // F4: human-in-the-loop approval gate (pending state durable so any instance can decide).
-    const approvalStore = backend?.approval ? backend.approval() : undefined; // local omits approval() → legacy poll-gate off (durable HITL needs checkpoint anyway)
-    const approvalEnabled = approvalStore && config.approvalRequire.length > 0;
+    // [2354]/[2356] A-5(5.0.0):F4 轮询门(approvalStore pending 行)整体退役——durable checkpoint 是唯一门形。
     // Finding #2 (edge case): the single-user auto-accept tool-policy BASELINE applies ONLY when the operator
     // expressed NO gate intent. If they SET approval flags (APPROVAL_REQUIRE/APPROVAL_DENY/DURABLE_APPROVAL) but no
-    // backing store is wired (e.g. DB_BACKEND=local → no approvalStore/checkpointStore ⇒ approvalEnabled/durableEnabled
+    // backing store is wired (e.g. DB_BACKEND=local → no checkpointStore ⇒ durableEnabled
     // false), that is a MISCONFIG — do NOT mask it with allow-all; leave toolPolicy undefined so core's UNGATED warning
     // still surfaces it. So the baseline needs single-user turnkey ∧ zero expressed gate intent.
     // 单源在 approval.ts(与 inv#2 同文件)—— 这里原是内联的三格枚举,漏了 approvalNeverAuto,详见该函数顶注。
@@ -585,7 +583,6 @@ async function main() {
         // 构造区上方 const)同实例;ensureChildSessionDurable 见上方构造闭包注释。
         checkpointStore: checkpointStore ? checkpointStore : undefined,
         ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
-        oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         brandIdentity: config.configProvider === "local",
         // core 1.287 extraTools seam ([802]③ server half): SendUserFile reaches the delegated-child roster. SAME
         // existence gate as the top-level mount (the one sendUserFileToolSpec built above — lane/tenancy/config
@@ -646,7 +643,7 @@ async function main() {
     let runDenySweep;
     // design/158 A10:reaper 段搬到 src/boot/reapers.ts(逐字;deny-sweep 晚绑改取值,见该文件头注)。
     const reaper = startReapers({
-        config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, approvalStore,
+        config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
         rateLimiter, costQuota, toolResultStore, fileSnapshotStore, taskAttachmentStore, imageBakes, worktreeReap,
         workflowNotifyGate, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
         backgroundAgentStore, mailboxStore,
@@ -704,7 +701,6 @@ async function main() {
     const stores = {
         runStore,
         resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined, // E18 resume-at eventId→entryId map (tidb/pg/local)
-        approvalStore,
         approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined, // decide remember="session" + list/revoke
         checkpointStore,
         sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined, // E6 operator session-rule store (PUT/GET /v1/sessions/:id/policy)
@@ -856,8 +852,8 @@ async function main() {
         getKeyResolver: () => configCenter.getKeyResolver(),
         taskAttachmentStore, perSessionCwd, setSessionCwd, setSessionShellEnv,
         hookLlm, hookAgent, fleetBus, hookWakeBus, resumeAnchorStore, ownerAware, taskLimitCaps, taskTimeoutSec,
-        selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore, approvalEnabled,
-        approvalStore, singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
+        selectEnvTool, sendUserFileToolSpec, memoryEngine, durableEnabled, approvalExemptionStore,
+        singleUserAutoAcceptBaseline, checkpointStore, deploymentHooks, imageIndex, perTaskImage,
         sessionEnvSelection,
     });
     const server = createHttpServer({ runner, config, resolveSpec, stores, coordinators, seams, observability, governance, deployment, knobs });

package/dist/memory-scope.js

@@ -1,7 +1,7 @@
 // design/158 N17: the memory-plane resolvers moved VERBATIM out of security.ts (lens4 §4.1 — "budget.ts"'s
 // sibling finding: security.ts's name says auth, but ~110 of its 765 lines were memory-scope config
-// resolution with nothing to do with authentication). security.ts re-exports all four for compat (its own
-// createAuthorizer still calls memoryScopeFor); index.ts's npm-facing re-export is unaffected (package.json
+// resolution with nothing to do with authentication). security.ts imports memoryScopeFor for its own
+// createAuthorizer; consumers import all four from HERE ([2354] 兼容面全清 — the security.ts compat re-export is gone); index.ts's npm-facing re-export is unaffected (package.json
 // "exports" only ever exposed "." and "./main" — dist/security.js was never a reachable deep-import path).
 import { join } from "node:path";
 import { FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";

package/dist/orchestration/workflow-completion-inbox.d.ts

@@ -77,7 +77,7 @@ export declare const SERVED_FENCE_MS: number;
  *
  *  编码=防碰撞元组:域/taskId/status 走 JSON 数组(调用方自由串伪造不了分隔符);`#seq` 尾折在 JSON 之外
  *  ——JSON 段恒以 `"]` 结尾,`#digits` 尾无歧义,于是 {@link foldKeyFamily} 的剥尾语义 AND SQL 双生子
- *  (tidb/pg-workflow-run-store 的 `regexp_replace(run_id, '#[0-9]+$', '')` 家族比对)原样成立——把 seq 折进
+ *  (workflow-run-store-sql 的 `regexp_replace(run_id, '#[0-9]+$', '')` 家族比对)原样成立——把 seq 折进
  *  JSON 元组会让 SQL 侧家族 ack/fence 永 miss(那是另一批的真库改动面,本修有意不碰)。
  *  seq 折入=逐停机周期各自成键(1.283 起 background_agent 四腿 notify 铸 cycleSeq);无 seq=单周期旧键
  *  (bash/monitor terminal/retain 降级,诚实语义)。serve-fence 侧必须用同一函数(或其家族前缀)构造,
@@ -97,9 +97,11 @@ export declare function taskNotificationFoldKey(n: {
  *  task 的 Monitor event 批与 failed 终态在一条腿上互吞;wire 去重要的是逐帧身份,不是 inbox 的双终态列。
  *  `seq` 折入 = 停→唤→停的第二周期同 status 帧各自成键(core 1.283 起 background_agent 四腿 notify 铸
  *  cycleSeq;缺 seq 时旧键曾把二周期 completed 帧在 observer 臂反向吞掉——core [784]④a);无 seq 的帧
- *  (bash/monitor terminal/retain 降级)保持单周期旧键=同键第二帧吞,诚实语义。task_type 缺席(旧 core
- *  内部帧)归 "task" 域——external 帧的 task_type 三来源齐备(notify 端点 core 铸 / inbox entry extras 存
- *  / drain 帧 spread 复原),不会漏域。observer 臂 / stream 臂 / turn-open drain 登记三处必须用本函数
+ *  (bash/monitor terminal/retain 降级)保持单周期旧键=同键第二帧吞,诚实语义。[2373]B-10:core 4.0.0 起
+ *  task_type 是必填闭合枚举——`task_type?` 可选性**不再对应旧 core 帧**,它活着只为家族前缀构造
+ *  (server.ts fleet 腿 `taskNotificationFoldKey({task_id,status})` 同款用法);缺席归 "task" 域的语义
+ *  只在前缀用途下生效。external 帧三来源齐备(notify 端点 core 铸 / inbox entry extras 存 / drain 帧
+ *  spread 复原),不会漏域。observer 臂 / stream 臂 / turn-open drain 登记三处必须用本函数
  *  构键且都传 task_type,键形漂移=去重永 miss。 */
 export declare function taskNotificationStreamKey(n: {
     task_type?: string;

package/dist/orchestration/workflow-completion-inbox.js

@@ -69,7 +69,7 @@ export const SERVED_FENCE_MS = 30 * 60 * 1000;
  *
  *  编码=防碰撞元组:域/taskId/status 走 JSON 数组(调用方自由串伪造不了分隔符);`#seq` 尾折在 JSON 之外
  *  ——JSON 段恒以 `"]` 结尾,`#digits` 尾无歧义,于是 {@link foldKeyFamily} 的剥尾语义 AND SQL 双生子
- *  (tidb/pg-workflow-run-store 的 `regexp_replace(run_id, '#[0-9]+$', '')` 家族比对)原样成立——把 seq 折进
+ *  (workflow-run-store-sql 的 `regexp_replace(run_id, '#[0-9]+$', '')` 家族比对)原样成立——把 seq 折进
  *  JSON 元组会让 SQL 侧家族 ack/fence 永 miss(那是另一批的真库改动面,本修有意不碰)。
  *  seq 折入=逐停机周期各自成键(1.283 起 background_agent 四腿 notify 铸 cycleSeq);无 seq=单周期旧键
  *  (bash/monitor terminal/retain 降级,诚实语义)。serve-fence 侧必须用同一函数(或其家族前缀)构造,
@@ -87,9 +87,11 @@ export function taskNotificationFoldKey(n) {
  *  task 的 Monitor event 批与 failed 终态在一条腿上互吞;wire 去重要的是逐帧身份,不是 inbox 的双终态列。
  *  `seq` 折入 = 停→唤→停的第二周期同 status 帧各自成键(core 1.283 起 background_agent 四腿 notify 铸
  *  cycleSeq;缺 seq 时旧键曾把二周期 completed 帧在 observer 臂反向吞掉——core [784]④a);无 seq 的帧
- *  (bash/monitor terminal/retain 降级)保持单周期旧键=同键第二帧吞,诚实语义。task_type 缺席(旧 core
- *  内部帧)归 "task" 域——external 帧的 task_type 三来源齐备(notify 端点 core 铸 / inbox entry extras 存
- *  / drain 帧 spread 复原),不会漏域。observer 臂 / stream 臂 / turn-open drain 登记三处必须用本函数
+ *  (bash/monitor terminal/retain 降级)保持单周期旧键=同键第二帧吞,诚实语义。[2373]B-10:core 4.0.0 起
+ *  task_type 是必填闭合枚举——`task_type?` 可选性**不再对应旧 core 帧**,它活着只为家族前缀构造
+ *  (server.ts fleet 腿 `taskNotificationFoldKey({task_id,status})` 同款用法);缺席归 "task" 域的语义
+ *  只在前缀用途下生效。external 帧三来源齐备(notify 端点 core 铸 / inbox entry extras 存 / drain 帧
+ *  spread 复原),不会漏域。observer 臂 / stream 臂 / turn-open drain 登记三处必须用本函数
  *  构键且都传 task_type,键形漂移=去重永 miss。 */
 export function taskNotificationStreamKey(n) {
     const domain = n.task_type === "external" ? "external" : "task";

package/dist/plugins/breaker-state-sql.d.ts

@@ -1,8 +1,7 @@
 /**
  * Cross-replica circuit-breaker state (core 1.38 `BreakerState`) — SINGLE-FILE DUAL-DIALECT
  * (design/158 A12 定型半场). ONE implementation, TWO dialects; the historical `TiDBBreakerState` /
- * `PgBreakerState` class names survive as thin ctor subclasses (src/plugins/tidb-breaker-state.ts +
- * src/plugins/pg-breaker-state.ts are now re-export shims) so every consumer (store-backend.ts, the
+ * `PgBreakerState` class names survive as thin ctor subclasses in THIS file ([2354]: the old per-dialect shim files are deleted) so every consumer (store-backend.ts, the
  * fake-pool unit suites, the real dual-DB integration suite) is untouched.
  *
  * core's `createCircuitBreakerBrain` defaults to a per-PROCESS Map → on a multi-replica deployment
@@ -26,7 +25,7 @@
  *   - upsert form: `ON DUPLICATE KEY UPDATE … VALUES(col)` vs `ON CONFLICT (breaker_key) DO UPDATE SET
  *     … EXCLUDED.col`
  *   - schema ownership: TiDB DDL lives centrally in tidb-pool.ts; PG DDL is self-contained here
- *     (`PG_BREAKER_STATE_SCHEMA` / `ensureSchema`, re-exported off pg-breaker-state.ts) — disjoint table,
+ *     (`PG_BREAKER_STATE_SCHEMA` / `ensureSchema`, exported from THIS file) — disjoint table,
  *     so a standalone idempotent apply is safe (no central-schema shadowing), mirroring every other PG store.
  * Everything else (write-through logic, the pending-guard race fix, refresh/prune, row→snapshot mapping,
  * opened_at Date handling) is IDENTICAL — the SqlDriver seam (result unwrapping) is what let the row

package/dist/plugins/image-index-sql.d.ts

@@ -3,7 +3,6 @@ import type { Pool as PgPool, PoolClient } from "pg";
 import { type ImageStatus, type ImageIndexEntry, type ImageIndexUpsert, type ImageViewer, type ImageListFilter } from "./store-contracts.js";
 import { type SqlDriver } from "./sql-driver.js";
 export type { ImageNestedBuildMode, ImageCapabilities, ImagePodContract, ImageStatus, ImageVisibility, ImageIndexEntry, ImageIndexUpsert, ImageViewer, ImageListFilter, ImageRow, } from "./store-contracts.js";
-export { mapImageRow as mapRow } from "./store-contracts.js";
 /** PG translation of the `sandbox_image_index` DDL in tidb-pool.ts (JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3),
  *  TINYINT(1)→SMALLINT(布尔列 PG 映射归一,clay 批 2026-07-26 —— 两方言读回同为 number,写入 0/1,
  *  读侧 `!!` 保持,出口 JS 类型不变), inline UNIQUE KEY/KEY → separate CREATE UNIQUE INDEX / CREATE INDEX). */

package/dist/plugins/image-index-sql.js

@@ -47,7 +47,6 @@ import {
 // backend-neutral store-contracts.ts (design/158 A3 沉底; no adapter imports its twin).
 mapImageRow as mapRow, } from "./store-contracts.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
-export { mapImageRow as mapRow } from "./store-contracts.js";
 /** PG translation of the `sandbox_image_index` DDL in tidb-pool.ts (JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3),
  *  TINYINT(1)→SMALLINT(布尔列 PG 映射归一,clay 批 2026-07-26 —— 两方言读回同为 number,写入 0/1,
  *  读侧 `!!` 保持,出口 JS 类型不变), inline UNIQUE KEY/KEY → separate CREATE UNIQUE INDEX / CREATE INDEX). */

package/dist/plugins/local-checkpoint-store.d.ts

@@ -1,5 +1,5 @@
 import { type Checkpoint, type CheckpointSummary, type CheckpointToken, type ReopenReason, type ResolveExpectation, type ResumeOutcome } from "@sema-agent/core";
-import { type PendingCheckpoint } from "./tidb-checkpoint-store.js";
+import { type PendingCheckpoint } from "./checkpoint-store-sql.js";
 export interface LocalCheckpointStoreOptions {
     /** taskId join for the pending card (the local FileRunStore's `getActiveTaskId`). Absent ⇒ `taskId: null`. */
     getActiveTaskId?: (sessionId: string) => Promise<string | undefined>;

package/dist/plugins/local-checkpoint-store.js

@@ -24,7 +24,7 @@ import { createHash } from "node:crypto";
 import { existsSync, readFileSync, readdirSync, renameSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { FileCheckpointStore, atomicWriteFile, sanitizePathComponent, } from "@sema-agent/core";
-import { boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./tidb-checkpoint-store.js";
+import { boundedToolInput, TERMINAL_BACKSTOP_MS, TERMINAL_GRACE_MS } from "./checkpoint-store-sql.js";
 /** design/80 D-D read-time twin of the TiDB put-time `terminal_at` column (same formula — anti-drift). */
 function terminalAtOf(cp) {
     return Math.max(cp.createdAt + TERMINAL_BACKSTOP_MS, (cp.deadline ?? 0) + TERMINAL_GRACE_MS);

package/dist/plugins/memory-engine-pg.js

@@ -19,7 +19,8 @@
 // Vector rungs (design/81, re-mounted here per §4): lexical (jaccard, byte-equal to FileBackend) →
 // portable (jsonb vectors, in-process cosine) → native (pgvector `<=>` SQL). All three share the
 // cosine-distance contract score ∈ [0,2] — upgrading recall is a config change, not a recalibration.
-import { cosineDistance, jaccardDistance, termSet, isUniqueViolation } from "./memory-engine-vector-util.js";
+import { cosineDistance, jaccardDistance, termSet } from "@sema-agent/core";
+import { isUniqueViolation } from "./memory-engine-vector-util.js";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
 import { pgSafeJsonStringify, pgHasUnstorable } from "./pg-safe-json.js";
 /** Table names (single source). Deliberately DISJOINT from the legacy `agent_memory*` tables —

package/dist/plugins/memory-engine-tidb.js

@@ -21,7 +21,7 @@
 //   - v1 lexical only:embedder/vector 面无 TiDB 对应(Pg 的 pgvector rung 是 Pg 专属);构造签名保留
 //     opts 但传入 embedder=fail-loud 拒绝,search 恒走 jaccard 词面,haystack 与 Pg/File 逐字节同构
 //     (`${name ?? slug} ${description} ${body}`——memoryBackendContract 的 search 等价断言依赖)。
-import { jaccardDistance, termSet } from "./memory-engine-vector-util.js";
+import { jaccardDistance, termSet } from "@sema-agent/core";
 import { computeEntryRev, serializeEntryFile } from "@sema-agent/core";
 import { pgHasUnstorable } from "./pg-safe-json.js";
 /** Table names (single source) — SAME names as PG_MEMORY_ENGINE_TABLES (the two dialects never share

package/dist/plugins/memory-engine-vector-util.d.ts

@@ -1,8 +1,7 @@
-/** memory-engine 方言实现共用的纯工具函数。三个距离/词集函数 re-export 自 core(1.268.0 起公开导出,
- *  单一语义源;memoryBackendContract 的 search 等价断言依赖同源 haystack 距离)。
+/** memory-engine 方言实现共用的纯工具函数。三个距离/词集函数(termSet/jaccardDistance/cosineDistance)
+ *  在 core(1.268.0 起公开导出,单一语义源)——消费者直引 core([2354] 兼容面全清:此处转口已删)。
  *  `isUniqueViolation` 重新内联:它当年随 core 的 pg **示例适配器**导出面走,core 1.424 按 clay 包卫生令
  *  把整个 examples 面退出 npm 包([1803] BREAKING)⇒ re-export 断源。逐字抄自 core 1.423
  *  `examples/adapters/pg-adapter.js`(纯谓词,无 byte-equal 契约约束)。 */
-export { termSet, jaccardDistance, cosineDistance } from "@sema-agent/core";
 export declare function isUniqueViolation(err: unknown): boolean;
 //# sourceMappingURL=memory-engine-vector-util.d.ts.map

package/dist/plugins/memory-engine-vector-util.js

@@ -1,9 +1,8 @@
-/** memory-engine 方言实现共用的纯工具函数。三个距离/词集函数 re-export 自 core(1.268.0 起公开导出,
- *  单一语义源;memoryBackendContract 的 search 等价断言依赖同源 haystack 距离)。
+/** memory-engine 方言实现共用的纯工具函数。三个距离/词集函数(termSet/jaccardDistance/cosineDistance)
+ *  在 core(1.268.0 起公开导出,单一语义源)——消费者直引 core([2354] 兼容面全清:此处转口已删)。
  *  `isUniqueViolation` 重新内联:它当年随 core 的 pg **示例适配器**导出面走,core 1.424 按 clay 包卫生令
  *  把整个 examples 面退出 npm 包([1803] BREAKING)⇒ re-export 断源。逐字抄自 core 1.423
  *  `examples/adapters/pg-adapter.js`(纯谓词,无 byte-equal 契约约束)。 */
-export { termSet, jaccardDistance, cosineDistance } from "@sema-agent/core";
 export function isUniqueViolation(err) {
     if (typeof err !== "object" || err === null)
         return false;

package/dist/plugins/memory-run-store.d.ts

@@ -22,7 +22,7 @@ import type { RunRecord, SessionSummary, RunEvent } from "./store-contracts.js";
  * injects this probe so the reapers get the SAME two predicates the SQL twins express as EXISTS subqueries:
  *  - hasPending  = EXISTS (checkpoint c WHERE c.session_id = ? AND c.status = 'pending')  — the design/80 D-D
  *    NOT-EXISTS-pending guard: a row whose checkpoint is STILL pending is owned by the checkpoint-state-driven
- *    sweeps and must NEVER be time-reaped (else two-runs-one-session, see tidb-run-store.ts reapSuspended doc).
+ *    sweeps and must NEVER be time-reaped (else two-runs-one-session, see run-store-sql.ts reapSuspended doc).
  *  - hasExpired  = EXISTS (checkpoint ce WHERE ce.session_id = ? AND ce.status = 'expired') — the
  *    failSuspendedWithExpiredCheckpoint driver (checkpoint-STATE-driven, not time-driven).
  * Probe ABSENT (old assembly / no checkpoint store wired) ⇒ the reapers stay honest NO-OPs — without the

package/dist/plugins/memory-session-policy-store.d.ts

@@ -4,7 +4,7 @@
  * WHY THIS EXISTS (and not core's `InMemorySessionPolicyStore`): core's in-memory/file policy stores implement only
  * the core interface (getRules/putRules/listBySession) — they have NO deletion seam, so neither the E21 session purge
  * nor the 2c `overwrite-dst` subsystem wipe can remove policy rows on a backend that uses them (the SQL twins carry
- * `deleteBySession` as a service extension; see tidb/pg-session-policy-store.ts). This store is the delete-capable
+ * `deleteBySession` as a service extension; see session-policy-store-sql.ts). This store is the delete-capable
  * in-memory twin. The seam itself is also requested upstream (core: optional `deleteBySession?` on the interface +
  * the File/InMemory impls) — if core lands it, this class can retire in favor of core's.
  *

package/dist/plugins/memory-session-policy-store.js

@@ -4,7 +4,7 @@
  * WHY THIS EXISTS (and not core's `InMemorySessionPolicyStore`): core's in-memory/file policy stores implement only
  * the core interface (getRules/putRules/listBySession) — they have NO deletion seam, so neither the E21 session purge
  * nor the 2c `overwrite-dst` subsystem wipe can remove policy rows on a backend that uses them (the SQL twins carry
- * `deleteBySession` as a service extension; see tidb/pg-session-policy-store.ts). This store is the delete-capable
+ * `deleteBySession` as a service extension; see session-policy-store-sql.ts). This store is the delete-capable
  * in-memory twin. The seam itself is also requested upstream (core: optional `deleteBySession?` on the interface +
  * the File/InMemory impls) — if core lands it, this class can retire in favor of core's.
  *

package/dist/plugins/memory-sync-store-pg.js

@@ -27,7 +27,7 @@ export async function ensurePgMemorySyncSchema(query) {
     await query(`CREATE INDEX IF NOT EXISTS ${PG_MEMORY_SYNC_TABLES.pushQueue}_next_attempt_idx ON ${PG_MEMORY_SYNC_TABLES.pushQueue} (next_attempt_at)`);
 }
 /** jsonb defense: node-pg hands back parsed objects, but a text-typed round-trip (or a foreign
- *  writer) may yield a string — same posture as parseJson in pg-run-store.ts. */
+ *  writer) may yield a string — same posture as parseJson in run-store-sql.ts. */
 function fromJsonb(v) {
     if (typeof v === "string")
         return JSON.parse(v);

package/dist/plugins/pg-pool.js

@@ -28,14 +28,13 @@ import pg from "pg";
 // Each PG store owns its own (disjoint) tables' DDL via a standalone idempotent ensureSchema; the central apply
 // composes them so production wires ONE ensurePgSchema (the PG twin of tidb-pool's single ensureSchema).
 import { ensureSchema as ensureSessionSchema } from "./pg-session-storage.js";
-import { ensureSchema as ensureToolResultSchema } from "./pg-tool-result-store.js";
+import { ensureSchema as ensureToolResultSchema } from "./tool-result-store-sql.js";
 import { ensureSchema as ensureCostQuotaSchema } from "./pg-cost-quota.js";
 import { ensureSchema as ensureRateLimitSchema } from "./pg-rate-limiter.js";
-import { ensureSchema as ensureBreakerStateSchema } from "./pg-breaker-state.js";
-import { ensureSchema as ensureApprovalSchema } from "./pg-approval-store.js";
-import { ensureSchema as ensureOutcomeLedgerSchema } from "./pg-outcome-ledger.js";
-import { ensureSchema as ensureImageIndexSchema } from "./pg-image-index.js";
-import { ensureSchema as ensureImageBakeSchema } from "./pg-image-bake.js";
+import { ensureSchema as ensureBreakerStateSchema } from "./breaker-state-sql.js";
+import { ensurePgOutcomeLedgerSchema as ensureOutcomeLedgerSchema } from "./outcome-ledger-sql.js";
+import { ensureSchema as ensureImageIndexSchema } from "./image-index-sql.js";
+import { ensurePgImageBakeSchema as ensureImageBakeSchema } from "./image-bake-store-sql.js";
 export const PG_SCHEMA_STATEMENTS = [
     `CREATE TABLE IF NOT EXISTS task_run (
      task_id     VARCHAR(64)  NOT NULL,
@@ -145,7 +144,7 @@ export const PG_SCHEMA_STATEMENTS = [
     `CREATE INDEX IF NOT EXISTS idx_sendfile_link_scope ON sendfile_link (scope, id)`,
     // E6 durable SessionPolicyStore (the PG twin of the TiDB session_policy table; policy_key = sha256(JSON.stringify(
     // [sessionId, principal ?? null])) = a fixed 64-char hash PK; rules JSONB; CAS-versioned tighten-only — see
-    // tidb-pool.ts / tidb-session-policy-store.ts).
+    // tidb-pool.ts / session-policy-store-sql.ts).
     `CREATE TABLE IF NOT EXISTS session_policy (
      policy_key CHAR(64)       NOT NULL,
      session_id VARCHAR(64)    NOT NULL,
@@ -186,7 +185,7 @@ export const PG_SCHEMA_STATEMENTS = [
     // SVC-2 (core CORE-7) durable WorkflowJournalStore — the PG twin of the TiDB workflow_journal table (cross-replica
     // resume journal; (run_id, ordinal) PK = idempotent OVERWRITE upsert; `result` = JSON.stringify(TaskResult)). `result`
     // is TEXT, NOT JSONB — the byte-match contract is "string in, string out" (the store JSON.parses on load); JSONB would
-    // make `pg` auto-parse the row back to an object and break the twin's String()→JSON.parse path. See pg-workflow-journal-store.ts.
+    // make `pg` auto-parse the row back to an object and break the twin's String()→JSON.parse path. See workflow-journal-store-sql.ts.
     `CREATE TABLE IF NOT EXISTS workflow_journal (
      run_id     VARCHAR(191) NOT NULL,
      ordinal    INT          NOT NULL,
@@ -210,7 +209,7 @@ export const PG_SCHEMA_STATEMENTS = [
      claimed_at    BIGINT       NOT NULL,
      PRIMARY KEY (source_run_id, scope)
    )`,
-    // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in tidb-workflow-run-store.ts).
+    // P1 (fleet failover): WorkflowRunStore + completion-inbox PG twins (design doc in workflow-run-store-sql.ts).
     // `run` is TEXT not jsonb (node-pg auto-parse would break the shared String()→JSON.parse path).
     `CREATE TABLE IF NOT EXISTS workflow_run (
      id         VARCHAR(191) NOT NULL,
@@ -332,7 +331,6 @@ export async function ensurePgSchema(pool) {
         await ensureCostQuotaSchema(client);
         await ensureRateLimitSchema(client);
         await ensureBreakerStateSchema(client);
-        await ensureApprovalSchema(client);
         await ensureOutcomeLedgerSchema(client);
         await ensureImageIndexSchema(client);
         await ensureImageBakeSchema(client);

package/dist/plugins/pg-rate-limiter.d.ts

@@ -8,8 +8,7 @@
  *
  * design/158 A12 C1b: the `PgWriteBehindCounter` this file used to define inline now lives in
  * write-behind-counter.ts as the PG binding of ONE dialect-parameterized counter (the mysql2 twin is
- * `WriteBehindCounter`); the SQL-dialect deltas are documented and branched there. It is re-exported here
- * so the historical import path keeps working.
+ * `WriteBehindCounter`); the SQL-dialect deltas are documented and branched there.
  *
  * Schema: this store's `rate_limit` table is DISJOINT from the other PG stores' tables, so a
  * self-contained {@link PG_RATE_LIMITER_SCHEMA} + {@link ensureSchema} is safe (no shadowing).
@@ -17,8 +16,6 @@
 import type { Pool, PoolClient } from "pg";
 import type { RateDecision, RateGate } from "../observability/rate-limit.js";
 import { type CounterDegradeHook } from "./write-behind-counter.js";
-export { PgWriteBehindCounter } from "./write-behind-counter.js";
-export type { CounterTable } from "./write-behind-counter.js";
 export declare class PgRateLimiter implements RateGate {
     private readonly limit;
     private readonly counter;

package/dist/plugins/pg-rate-limiter.js

@@ -1,5 +1,4 @@
 import { PgWriteBehindCounter } from "./write-behind-counter.js";
-export { PgWriteBehindCounter } from "./write-behind-counter.js";
 /** The counter's table binding for the per-key request rate limit (mirror of the TiDB twin's binding). */
 const RATE_LIMIT_TABLE = { table: "rate_limit", keyCol: "limit_key", valCol: "n" };
 export class PgRateLimiter {

package/dist/plugins/roster-store-sql.d.ts

@@ -21,11 +21,9 @@
  * 是「core 变语义必须先过迁移裁量」的告警钉)。
  */
 import type { Pool } from "mysql2/promise";
-import { normalizeAgentName, type RosterStore, type RosterEntry } from "@sema-agent/core";
+import { type RosterStore, type RosterEntry } from "@sema-agent/core";
 type RosterAccess = Parameters<RosterStore["resolve"]>[1];
 import type { PgQueryFn } from "./pg-query.js";
-/** 兼容名保留(测试/历史引用),现=core 导出直引(私拷已删)。 */
-export declare const normalizeAgentNameLocal: typeof normalizeAgentName;
 export declare const ROSTER_TABLE = "agent_roster";
 export declare function ensureTiDBRosterSchema(pool: Pool): Promise<void>;
 export declare function ensurePgRosterSchema(q: PgQueryFn): Promise<void>;