@sema-agent/server 7.150.0 → 7.152.0

package/dist/plugins/approval-ask-store-sql.js

@@ -9,6 +9,7 @@ import { decodeJsonColumn, foldJsonColumn, jsonColumnText, readJsonObjectColumn,
 import { ensureIndexes } from "./ensure-index.js";
 import { isExecutionLane } from "../execution-lane-caps.js";
 import { retiredExecutionLaneHintM40 } from "./execution-lane-rename-m40.js";
+import { sealStoreClass } from "./store-boundary.js";
 export function assertIntegralEpochMs(field, value) {
     if (!Number.isSafeInteger(value)) {
         throw new TypeError(`approval-ask store: ${field} must be an integer epoch-ms (BIGINT column), got ${String(value)}`);
@@ -120,6 +121,13 @@ export function projectAskTerminalClaimTruth(row) {
 export function askRowOnCall(row, call) {
     return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceSessionId === call.sourceSessionId;
 }
+export function askAtGate(r, sourceSessionId, binding) {
+    if (r.sourceSessionId !== sourceSessionId)
+        return false;
+    if (r.state === "PARKED")
+        return r.gateBoundCallId === binding.boundCallId && r.gateBoundInputHash === binding.boundInputHash;
+    return r.state === "PARKING" && r.toolCallId === binding.boundCallId && r.boundInputHash === binding.boundInputHash;
+}
 export function askRowCarriesOwner(row, owner) {
     return row !== null && row.owner === owner;
 }
@@ -565,11 +573,7 @@ export class SqlApprovalAskStore {
             let askRes;
             try {
                 askRes = await conn.query(`UPDATE ${APPROVAL_ASK_TABLE} SET state='DECIDED', decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, decided_via=${ph(dialect, 5)}, updated_input=${ph(dialect, 6)}, decided_at_ms=${ph(dialect, 7)}, idempotency_key=${ph(dialect, 8)}, rev=rev+1, updated_at_ms=${ph(dialect, 9)} WHERE ${pendingClaimWhere(dialect, 10)} AND ${ownerWhere.sql}`, [
-                    decision.decision,
-                    decision.decisionActor == null ? null : this.json(decision.decisionActor),
-                    decision.decisionNote ?? null,
-                    decision.settledBy ?? null,
-                    decision.decidedVia ?? null,
+                    ...this.decisionRecordValues(decision),
                     decision.updatedInput === undefined ? null : this.json(decision.updatedInput),
                     now,
                     decision.idempotencyKey ?? null,
@@ -608,6 +612,32 @@ export class SqlApprovalAskStore {
             throw new Error(`decideAsk: row vanished after commit (askId=${askId})`);
         return { ok: true, row };
     }
+    decisionRecordValues(record) {
+        return [record.decision, record.decisionActor == null ? null : this.json(record.decisionActor), record.decisionNote ?? null, record.settledBy ?? null, record.decidedVia ?? null];
+    }
+    async recordParkedDecision(askId, owner, record) {
+        if (record.idempotencyKey != null)
+            assertIdempotencyKeyShape(record.idempotencyKey);
+        assertDecideSource(record);
+        const now = Date.now();
+        const dialect = this.db.dialect;
+        const ownerWhere = decideOwnerWhere(dialect, owner, 10);
+        let res;
+        try {
+            res = await this.db.query(`UPDATE ${APPROVAL_ASK_TABLE} SET decision=${ph(dialect, 1)}, decision_actor=${ph(dialect, 2)}, decision_note=${ph(dialect, 3)}, settled_by=${ph(dialect, 4)}, decided_via=${ph(dialect, 5)}, decided_at_ms=${ph(dialect, 6)}, idempotency_key=${ph(dialect, 7)}, rev=rev+1, updated_at_ms=${ph(dialect, 8)} WHERE ask_id = ${ph(dialect, 9)} AND state = 'PARKED' AND ${ownerWhere.sql}`, [...this.decisionRecordValues(record), now, record.idempotencyKey ?? null, now, askId, ...ownerWhere.params]);
+        }
+        catch (err) {
+            if (this.isDupKey(err))
+                return { ok: false, reason: "idempotency_conflict", row: projectDecideReading(await this.getAsk(askId), owner) };
+            throw err;
+        }
+        const row = projectDecideReading(await this.getAsk(askId), owner);
+        if (res.affected !== 1)
+            return { ok: false, reason: "ask_not_parked", row };
+        if (row === null)
+            throw new Error(`recordParkedDecision: row vanished after write (askId=${askId})`);
+        return { ok: true, row };
+    }
     async claimTerminal(askId, batchId, intent, opts) {
         const to = claimTargetState(intent);
         if (!canAskTransition("STREAM_PENDING", to)) {
@@ -794,6 +824,10 @@ export class SqlApprovalAskStore {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sourceSessionId]);
         return rows.map(mapAskRow).filter((r) => r.sourceSessionId === sourceSessionId);
     }
+    async listAsksAtGate(sourceSessionId, binding) {
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = ? AND ((state = 'PARKED' AND gate_bound_call_id = ? AND gate_bound_input_hash = ?) OR (state = 'PARKING' AND tool_call_id = ? AND bound_input_hash = ?)) ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = $1 AND ((state = 'PARKED' AND gate_bound_call_id = $2 AND gate_bound_input_hash = $3) OR (state = 'PARKING' AND tool_call_id = $2 AND bound_input_hash = $3)) ORDER BY created_at_ms ASC, ask_id ASC`), [sourceSessionId, binding.boundCallId, binding.boundInputHash, binding.boundCallId, binding.boundInputHash]);
+        return rows.map(mapAskRow).filter((r) => askAtGate(r, sourceSessionId, binding));
+    }
     async getAsk(askId) {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
             askId,
@@ -877,6 +911,12 @@ export class SqlApprovalAskStore {
         return rows[0] ? mapBatchRow(rows[0]) : null;
     }
 }
+sealStoreClass(SqlApprovalAskStore, "sql-approval-ask-store", {
+    ensureAsk: "exit", transitionAsk: "exit", decideAsk: "exit", claimTerminal: "exit", expireAsk: "exit", bindBatch: "exit", abortBatch: "exit",
+    listByState: "exit", listPendingByTask: "exit", listPendingBySession: "exit", listByCall: "exit", listParkingBySourceSession: "exit", getAsk: "exit",
+    getByIdempotencyKey: "exit", deferReconcile: "exit", resolveProvisional: "exit", deleteBySession: "exit", reapSettledAsks: "exit", reapEmptyBatches: "exit",
+    getBatch: "exit", recordParkedDecision: "exit", listAsksAtGate: "exit",
+});
 export class TiDBApprovalAskStore extends SqlApprovalAskStore {
     constructor(pool) {
         super(mysqlDriver(pool));

package/dist/plugins/approval-exemption-store.js

@@ -2,6 +2,7 @@ import { join } from "node:path";
 import { existsSync, readdirSync, rmSync } from "node:fs";
 import { AppendLog, ensureDir, sanitizePathComponent } from "@sema-agent/core";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
+import { sealStoreClass } from "./store-boundary.js";
 export const APPROVAL_EXEMPTED_EVENT = "approval_exempted";
 export class TiDBApprovalExemptionStore {
     pool;
@@ -33,6 +34,7 @@ export class TiDBApprovalExemptionStore {
         return r.affectedRows;
     }
 }
+sealStoreClass(TiDBApprovalExemptionStore, "tidb-approval-exemption-store", { grant: "exit", has: "exit", list: "exit", revoke: "exit", deleteBySession: "exit" });
 export class PgApprovalExemptionStore {
     pool;
     constructor(pool) {
@@ -69,6 +71,7 @@ export class PgApprovalExemptionStore {
         return res.rowCount ?? 0;
     }
 }
+sealStoreClass(PgApprovalExemptionStore, "pg-approval-exemption-store", { grant: "exit", has: "exit", list: "exit", revoke: "exit", deleteBySession: "exit" });
 export class MemoryApprovalExemptionStore {
     bySession = new Map();
     async grant(sessionId, toolName, grantedBy) {

package/dist/plugins/approval-nonce-store.js

@@ -4,6 +4,7 @@ import { mysqlDriver, pgDriver, SQL_DB_NOW_MS } from "./sql-driver.js";
 import { isDupKeyError } from "./sql-errors.js";
 import { replayJsonlGuarded } from "../observability/corrupt-read-seat.js";
 import { createLogger } from "../observability/logger.js";
+import { sealStoreClass } from "./store-boundary.js";
 export const APPROVAL_NONCE_TABLE = "approval_nonce";
 export const MAX_APPROVAL_NONCE_CHARS = 190;
 export const APPROVAL_NONCE_FLOOR_TABLE = "approval_nonce_floor";
@@ -62,6 +63,7 @@ export class SqlApprovalNonceStore {
         return res.affected;
     }
 }
+sealStoreClass(SqlApprovalNonceStore, "sql-approval-nonce-store", { nowMs: "exit", consume: "exit", reapExpired: "exit" });
 export class TiDBApprovalNonceStore extends SqlApprovalNonceStore {
     constructor(pool, opts) {
         super(mysqlDriver(pool), opts);

package/dist/plugins/blob-backend.d.ts

@@ -1,3 +1,5 @@
+import { type ObjectStoreOp } from "../object-store-buckets.js";
+import type { SessionBlobNamespace } from "./session-blob-namespace.js";
 /**
  * The byte port. Keys are opaque to it (today every index owner keys a blob by its sha256 hash).
  *  - `put`: store `bytes` under `key`. Idempotent (a repeat for the same key overwrites with the identical bytes); a rejection is a
@@ -5,7 +7,10 @@
  *  - `get`: the bytes under `key`, or `undefined` when nothing is there. A TRANSIENT fault THROWS (so a restore / import fails LOUD,
  *    not as a silent "missing blob"). The index owner checks the bytes against the hash ({@link readAtAddress}).
  *  - `delete`: remove the bytes under each key. Idempotent — a key with nothing under it is a success; a key that could not be removed
- *    makes the call reject (after every key was tried).
+ *    makes the call reject (after every key was tried). A port whose deletes wait on a precondition (the session blob ports: the namespace's
+ *    ownership, `session-blob-namespace.ts`) checks it at the start of EVERY call, before any key — so `delete([])` is that precondition alone:
+ *    it rejects exactly as a real delete would be refused, and removes nothing. An index owner whose own writes come before its byte deletes
+ *    asks it that way first (`SqlBlobIndex.sweep`).
  */
 export interface BlobBackend {
     put(key: string, bytes: Uint8Array): Promise<void>;
@@ -19,20 +24,47 @@ export interface BlobBackend {
  * where both index owners judge it (the file-history blob index, the attachment store).
  */
 export declare function readAtAddress(port: Pick<BlobBackend, "get">, hash: string): Promise<Uint8Array | undefined>;
-export interface MinioBlobBackendConfig {
+/** A name a content-addressed domain could have written: a hex sha256, one key segment. A listed name of any other shape (a nested prefix's object, a
+ *  hand-placed file) is not the domain's — its sweep leaves it alone. */
+export declare function isContentAddress(name: string): boolean;
+/** The object-store action table rows one blob backend signs, by verb (`object-store-buckets.ts`). A verb with no row is a request this backend never
+ *  makes: calling it throws before anything is signed (the retired epoch's index only deletes; the boot check only lists). */
+export interface BlobBackendOps {
+    readonly put?: ObjectStoreOp;
+    readonly get?: ObjectStoreOp;
+    readonly head?: ObjectStoreOp;
+    readonly delete?: ObjectStoreOp;
+    readonly list?: ObjectStoreOp;
+}
+interface MinioBlobBackendBaseConfig {
     endpoint: string;
     bucket: string;
     accessKey: string;
     secretKey: string;
     region?: string;
-    /** Key prefix for blob objects, e.g. "blobs/". Object key = keyPrefix + key. Default "blobs/". */
-    keyPrefix?: string;
-    /** Presigned-URL TTL (seconds). Default 3600 (1h) — must comfortably exceed a ~64 MiB single-PUT/GET on a slow link
-     *  (a SigV4 X-Amz-Expires bounds the WHOLE transfer from X-Amz-Date; a too-short TTL fails mid-stream). */
+    /** Key prefix for blob objects. Object key = keyPrefix + key. The production domains get theirs from {@link createSessionBlobBackend}. */
+    keyPrefix: string;
+    /** Presigned-URL TTL (seconds; `SESSION_SNAPSHOT_TTL_SEC`). Unset ⇒ the row's default in the object-store action table (3600 s — it must
+     *  comfortably exceed a ~64 MiB single-PUT/GET on a slow link: a SigV4 X-Amz-Expires bounds the WHOLE transfer from X-Amz-Date; a too-short TTL
+     *  fails mid-stream). A row whose TTL is fixed (the boot probe's) refuses a configured one. */
     presignTtlSec?: number;
     /** 测试注入口(listObjects 分页钉用);生产缺省 global fetch。 */
     fetchImpl?: typeof fetch;
 }
+/** A backend's rows and, for one that signs DELETE, the namespace's ownership every DELETE waits for — required by construction: every delete of a
+ *  content-addressed domain is judged by one database's references, so a port that can delete is built from that database's proven namespace
+ *  (`session-blob-namespace.ts`; `createSessionBlobBackend` passes it). A port with no DELETE row (the boot probe) has no owner. */
+export type MinioBlobBackendConfig = MinioBlobBackendBaseConfig & ({
+    readonly ops: BlobBackendOps & {
+        readonly delete?: undefined;
+    };
+    readonly owner?: undefined;
+} | {
+    readonly ops: BlobBackendOps & {
+        readonly delete: ObjectStoreOp;
+    };
+    readonly owner: Pick<SessionBlobNamespace, "assertOwned">;
+});
 /** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
  *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 卡住 restore/session-import
  *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
@@ -56,11 +88,14 @@ export type BucketProbe = {
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;
+    /** The configured TTL, or nothing (the seat then takes the row's own). */
     private readonly ttl;
     /** 六个站点(put / get / delete / listObjects / headObject / probeBucket)的唯一出口:端点回重定向 ⇒ 拒,预签名 URL 与对象体不被带去 `Location`。 */
     private readonly egressFetch;
     constructor(cfg: MinioBlobBackendConfig);
     private objectKey;
+    /** The table row this backend signs `verb` under; none ⇒ throw (a request this backend's domain never makes). */
+    private opFor;
     private presign;
     /** PUT the bytes under the key. A non-2xx PUT throws (an upload failure must surface — a silent drop would later read_failed on
      *  restore). NOTE no post-PUT read-back verify on the live path (perf): a corrupted PUT is caught at the next read's content-address
@@ -75,7 +110,8 @@ export declare class MinioBlobBackend implements BlobBackend {
     /** DELETE every key's object, at most {@link MINIO_OP_CONCURRENCY} in flight (no FD / throttle storm). Each key is independent: a
      *  2xx or a 404 (already gone) is a success; any other answer or a network failure is a failure. Every key is tried; then, if any
      *  failed, the call REJECTS naming how many (🔴 复审 F4 的同一判据:对象存储完全不可写时绝不报「清理成功」—— 失败只在这里说出来,
-     *  调用方据此记账,不吞)。 */
+     *  调用方据此记账,不吞)。The namespace's ownership is read first on every call, an empty `keys` included (that call is the precondition
+     *  alone: the port contract, {@link BlobBackend}). */
     delete(keys: readonly string[]): Promise<void>;
     /** D-1 孤儿对象 GC(clay 拍 2026-07-28):列举本后端 keyPrefix 下的全部对象(ListObjectsV2 分页,
      *  零依赖 XML 取 <Key>/<LastModified>/<NextContinuationToken>)。**server 端 sweep 专用**——presign 的
@@ -95,4 +131,44 @@ export declare class MinioBlobBackend implements BlobBackend {
      *  都**证明不了**缺桶 ⇒ `unknown`,调用方不拒启、只报一次。总函数:不抛。`timeoutMs`:boot 期调用方给的单次上界(黑洞端点不许把起服拖到 120s)。 */
     probeBucket(timeoutMs?: number): Promise<BucketProbe>;
 }
+/** The blob domains of the session snapshot bucket (closed set) → the table rows each signs. File history reads, writes and sweeps; attachments also list
+ *  and HEAD (their orphan sweep); the retired snapshot epoch only deletes (its sweep). */
+export declare const SESSION_BLOB_DOMAIN_OPS: {
+    readonly "file-history": {
+        readonly put: "file-history/blob:PUT";
+        readonly get: "file-history/blob:GET";
+        readonly delete: "file-history/blob:DELETE";
+    };
+    readonly attachments: {
+        readonly put: "attachments/blob:PUT";
+        readonly get: "attachments/blob:GET";
+        readonly head: "attachments/blob:HEAD";
+        readonly delete: "attachments/blob:DELETE";
+        readonly list: "attachments/prefix:LIST";
+    };
+    readonly "legacy-blobs": {
+        readonly delete: "legacy-blobs/blob:DELETE";
+    };
+};
+export type SessionBlobDomain = keyof typeof SESSION_BLOB_DOMAIN_OPS;
+/** The session snapshot bucket's store config (`config.snapshotBlobStore`: `SESSION_SNAPSHOT_BUCKET`, `SESSION_SNAPSHOT_PREFIX`, `SESSION_SNAPSHOT_TTL_SEC`). */
+export interface SessionBlobStoreConfig {
+    endpoint: string;
+    bucket: string;
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+    keyPrefix?: string;
+    presignTtlSec?: number;
+}
+/** The key prefix of a session blob domain, or the key of the namespace's claim — the ONE place each composes `SESSION_SNAPSHOT_PREFIX` with its
+ *  segment (the table's key forms `{sessionPrefix}file-history/…`, `{sessionPrefix}attachments/…`, `{legacyBlobRoot}…`, `{sessionPrefix}blob-namespace-claim`).
+ *  An empty prefix reads as unset (the env loader's reading of the knob, kept for a hand-built config too): file history, attachments and the claim then
+ *  sit at the bucket root, the retired epoch at its own root `blobs/` (where its objects were written). */
+export declare function sessionBlobKeyPrefixOf(store: Pick<SessionBlobStoreConfig, "keyPrefix">, part: SessionBlobDomain | "claim"): string;
+/** The byte port of one session blob domain over the session snapshot bucket: its key prefix ({@link sessionBlobKeyPrefixOf}), its table rows
+ *  ({@link SESSION_BLOB_DOMAIN_OPS}) and the namespace's ownership its deletes wait for — the one construction every production domain uses, and it
+ *  takes the namespace (one database's), not a bare bucket config. */
+export declare function createSessionBlobBackend(namespace: SessionBlobNamespace, domain: SessionBlobDomain): MinioBlobBackend;
+export {};
 //# sourceMappingURL=blob-backend.d.ts.map

package/dist/plugins/blob-backend.js

@@ -2,12 +2,16 @@ import { createHash } from "node:crypto";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { isNoSuchBucketAnswer } from "./s3-answer.js";
 import { createEgressFetch } from "../egress-redirect.js";
+import { ATTACHMENT_BLOB_SEGMENT, FILE_HISTORY_BLOB_SEGMENT, LEGACY_BLOB_ROOT_DEFAULT, SESSION_BLOB_CLAIM_KEY } from "../object-store-buckets.js";
 export async function readAtAddress(port, hash) {
     const bytes = await port.get(hash);
     if (bytes === undefined)
         return undefined;
     return createHash("sha256").update(bytes).digest("hex") === hash ? bytes : undefined;
 }
+export function isContentAddress(name) {
+    return /^[0-9a-f]{64}$/.test(name);
+}
 const MINIO_OP_CONCURRENCY = 16;
 async function mapBounded(items, limit, fn) {
     let i = 0;
@@ -27,23 +31,30 @@ export class MinioBlobBackend {
     egressFetch;
     constructor(cfg) {
         this.cfg = cfg;
-        this.keyPrefix = cfg.keyPrefix ?? "blobs/";
-        this.ttl = cfg.presignTtlSec ?? 3600;
+        this.keyPrefix = cfg.keyPrefix;
+        this.ttl = cfg.presignTtlSec !== undefined ? { expiresSec: cfg.presignTtlSec } : {};
         this.egressFetch = createEgressFetch("declare the final object-store address as MINIO_ENDPOINT / S3_ENDPOINT", cfg.fetchImpl);
     }
     objectKey(key) {
         return `${this.keyPrefix}${key}`;
     }
+    opFor(verb) {
+        const op = this.cfg.ops[verb];
+        if (op === undefined)
+            throw new Error(`MinioBlobBackend: this blob domain (prefix ${JSON.stringify(this.keyPrefix)}) signs no ${verb.toUpperCase()} — no object-store action row for it`);
+        return op;
+    }
     presign(key, method) {
         return presignS3Url({
+            op: this.opFor(method === "GET" ? "get" : method === "PUT" ? "put" : method === "HEAD" ? "head" : "delete"),
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,
             key: this.objectKey(key),
-            method: method,
+            method,
             accessKey: this.cfg.accessKey,
             secretKey: this.cfg.secretKey,
             ...(this.cfg.region ? { region: this.cfg.region } : {}),
-            expiresSec: this.ttl,
+            ...this.ttl,
         });
     }
     async put(key, bytes) {
@@ -72,7 +83,13 @@ export class MinioBlobBackend {
         return new Uint8Array(await res.arrayBuffer());
     }
     async delete(keys) {
+        const owner = this.cfg.owner;
+        if (owner === undefined)
+            throw new Error(`MinioBlobBackend: this blob domain (prefix ${JSON.stringify(this.keyPrefix)}) has no namespace ownership to delete under — a port that signs DELETE is built from a proven namespace`);
+        await owner.assertOwned();
         const distinct = [...new Set(keys)];
+        if (distinct.length === 0)
+            return;
         let failed = 0;
         let firstFailure;
         await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (key) => {
@@ -100,6 +117,7 @@ export class MinioBlobBackend {
             if (++pages > MAX_PAGES)
                 throw new Error(`listObjects: exceeded ${MAX_PAGES} pages (max-keys 1000/page) — the backend is looping its continuation-token or the prefix is unexpectedly large; refusing to report a partial orphan set`);
             const url = presignS3ListUrl({
+                op: this.opFor("list"),
                 endpoint: this.cfg.endpoint,
                 bucket: this.cfg.bucket,
                 prefix: this.keyPrefix,
@@ -108,7 +126,7 @@ export class MinioBlobBackend {
                 accessKey: this.cfg.accessKey,
                 secretKey: this.cfg.secretKey,
                 ...(this.cfg.region ? { region: this.cfg.region } : {}),
-                expiresSec: this.ttl,
+                ...this.ttl,
             });
             const res = await f(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
             if (!res.ok)
@@ -141,6 +159,7 @@ export class MinioBlobBackend {
     async probeBucket(timeoutMs = OBJECT_STORE_IO_TIMEOUT_MS) {
         const f = this.egressFetch;
         const url = presignS3ListUrl({
+            op: this.opFor("list"),
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,
             prefix: this.keyPrefix,
@@ -148,7 +167,7 @@ export class MinioBlobBackend {
             accessKey: this.cfg.accessKey,
             secretKey: this.cfg.secretKey,
             ...(this.cfg.region ? { region: this.cfg.region } : {}),
-            expiresSec: this.ttl,
+            ...this.ttl,
         });
         let res;
         try {
@@ -165,4 +184,36 @@ export class MinioBlobBackend {
         return { state: "unknown", detail: `HTTP ${res.status}` };
     }
 }
+export const SESSION_BLOB_DOMAIN_OPS = {
+    "file-history": { put: "file-history/blob:PUT", get: "file-history/blob:GET", delete: "file-history/blob:DELETE" },
+    attachments: { put: "attachments/blob:PUT", get: "attachments/blob:GET", head: "attachments/blob:HEAD", delete: "attachments/blob:DELETE", list: "attachments/prefix:LIST" },
+    "legacy-blobs": { delete: "legacy-blobs/blob:DELETE" },
+};
+export function sessionBlobKeyPrefixOf(store, part) {
+    const prefix = store.keyPrefix === "" ? undefined : store.keyPrefix;
+    switch (part) {
+        case "file-history":
+            return `${prefix ?? ""}${FILE_HISTORY_BLOB_SEGMENT}`;
+        case "attachments":
+            return `${prefix ?? ""}${ATTACHMENT_BLOB_SEGMENT}`;
+        case "claim":
+            return `${prefix ?? ""}${SESSION_BLOB_CLAIM_KEY}`;
+        case "legacy-blobs":
+            return prefix ?? LEGACY_BLOB_ROOT_DEFAULT;
+    }
+}
+export function createSessionBlobBackend(namespace, domain) {
+    const store = namespace.store;
+    return new MinioBlobBackend({
+        endpoint: store.endpoint,
+        bucket: store.bucket,
+        accessKey: store.accessKey,
+        secretKey: store.secretKey,
+        ...(store.region ? { region: store.region } : {}),
+        keyPrefix: sessionBlobKeyPrefixOf(store, domain),
+        ops: SESSION_BLOB_DOMAIN_OPS[domain],
+        owner: namespace,
+        ...(store.presignTtlSec ? { presignTtlSec: store.presignTtlSec } : {}),
+    });
+}
 //# sourceMappingURL=blob-backend.js.map

package/dist/plugins/breaker-state-sql.js

@@ -1,4 +1,5 @@
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { sealStoreClass } from "./store-boundary.js";
 export const PG_BREAKER_STATE_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS breaker_state (
      breaker_key VARCHAR(190) COLLATE "C"   NOT NULL,
@@ -91,6 +92,7 @@ export class SqlBreakerState {
         this.timer = undefined;
     }
 }
+sealStoreClass(SqlBreakerState, "sql-breaker-state", { get: "exit", set: "exit", refresh: "exit", startRefresh: "exit", stop: "exit" });
 export class TiDBBreakerState extends SqlBreakerState {
     constructor(pool, onWriteFail) {
         super(mysqlDriver(pool), onWriteFail);

package/dist/plugins/caching-session-store.d.ts

@@ -1,4 +1,5 @@
 import { type AcquiredSession, type PlacedSessionRow, type RetentionDeclaration, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import type { EntriesStreamOptions } from "../session-sync-kernel.js";
 import type { LocalSessionDeletionSection } from "../session-erase.js";
 import type { OwnerAwareSessionStore, SessionListItem } from "../security.js";
 import type { StagingHandle } from "../session-sync-kernel.js";
@@ -7,6 +8,7 @@ import { type PlacementAcquireOpts } from "./session-placement.js";
 import type { InstructionSourceStore } from "../instruction-source-notice.js";
 import type { SessionWorkspaceStore } from "../session-workspace.js";
 import { type SessionBirthFace, type SessionWithdrawFace } from "./session-birth.js";
+import type { SessionFace } from "../session-incarnation.js";
 export interface CachingOptions {
     /** Idle seconds a woken session is kept warm. 0 disables caching (pure passthrough). */
     ttlSec: number;
@@ -72,18 +74,13 @@ export declare class CachingSessionStore implements SessionStore {
     readonly withdrawBirth?: SessionWithdrawFace["withdrawBirth"];
     /** Delegated SessionRepo seam (§0.5) — list/fork/delete operate on the DURABLE tables directly (they bypass the
      *  warm cache by design; a fork/delete must read/write durable state, not a possibly-stale cached view). */
-    readonly listSessions?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<SessionListItem[]>;
+    readonly listSessions?: OwnerAwareSessionStore["listSessions"];
     /** 带住客的同一只列表面(原样转发;理由同 listSessions)。 */
     readonly listSessionRows?: OwnerAwareSessionStore["listSessionRows"];
+    /** 按 id 的种类读(`session-kind.ts`;纯转发、不经暖缓存 —— 答的是行)。🔴 必须转发:授权口的种类判与能力位读的是本类。 */
+    readonly sessionKindOf?: OwnerAwareSessionStore["sessionKindOf"];
+    /** 老化候选面(纯转发;读的是持久行)。🔴 必须转发:能力位 `sessionKinds` 与老化腿读的是本类。 */
+    readonly listIdleOfKind?: OwnerAwareSessionStore["listIdleOfKind"];
     readonly fork?: OwnerAwareSessionStore["fork"];
     /** fork 续写的店契约(原样转发;与 fork 同理绕过暖缓存 —— 读写的是持久行,新 id 本来就不在缓存里)。 */
     readonly forkTo?: OwnerAwareSessionStore["forkTo"];
@@ -99,7 +96,7 @@ export declare class CachingSessionStore implements SessionStore {
     readonly sessionSummaryOf?: (sessionId: string) => Promise<SessionListItem | undefined>;
     readonly writeSessionRowCells?: OwnerAwareSessionStore["writeSessionRowCells"];
     /** The auto-titler's NULL-only title write (SQL twins + local sidecar carry it; pure pass-through). */
-    readonly setTitleIfNull?: (sessionId: string, title: string) => Promise<boolean>;
+    readonly setTitleIfNull?: (sessionId: string, title: string, landed: SessionFace) => Promise<boolean>;
     readonly probeTitle?: (sessionId: string) => Promise<"none" | "untitled" | "titled">;
     /** [ref] —— 换源通告的基线面(`session_ext.instruction_source` / local sidecar),纯转发、不经暖缓存。
      *  🔴 必须转发(与 retention / placements 同一条教训):默认 `SESSION_CACHE_TTL_SEC=300` 把真店包进本类,
@@ -117,10 +114,7 @@ export declare class CachingSessionStore implements SessionStore {
      *  (read straight from the durable log, bypassing the warm cache, like exportEntries). The stream's per-batch query
      *  discipline (one pooled query per page) lives in the inner store; this wrapper just forwards. */
     readonly listEntryIds?: (sessionId: string) => Promise<string[] | null>;
-    readonly exportEntriesStream?: (sessionId: string, opts?: {
-        afterSeq?: number;
-        batchSize?: number;
-    }) => Promise<AsyncIterable<SessionTreeEntry> | null>;
+    readonly exportEntriesStream?: (sessionId: string, opts: EntriesStreamOptions) => Promise<AsyncIterable<SessionTreeEntry> | null>;
     /** 轴A #1(1.254):core B-17 forget 面(evict 本地 + 转发 inner 可选面)。 */
     forget?: (sessionId: string) => void | Promise<void>;
     readonly importEntries?: (sessionId: string, owner: string | null, entries: SessionTreeEntry[]) => Promise<void>;

package/dist/plugins/caching-session-store.js

@@ -15,6 +15,8 @@ export class CachingSessionStore {
     withdrawBirth;
     listSessions;
     listSessionRows;
+    sessionKindOf;
+    listIdleOfKind;
     fork;
     forkTo;
     executionPlacement;
@@ -82,6 +84,10 @@ export class CachingSessionStore {
             this.listSessions = ownerAware.listSessions.bind(inner);
         if (ownerAware.listSessionRows)
             this.listSessionRows = ownerAware.listSessionRows.bind(inner);
+        if (ownerAware.sessionKindOf)
+            this.sessionKindOf = ownerAware.sessionKindOf.bind(inner);
+        if (ownerAware.listIdleOfKind)
+            this.listIdleOfKind = ownerAware.listIdleOfKind.bind(inner);
         if (ownerAware.sessionSummaryOf)
             this.sessionSummaryOf = ownerAware.sessionSummaryOf.bind(inner);
         if (ownerAware.writeSessionRowCells)

package/dist/plugins/checkpoint-index-columns.d.ts

@@ -4,11 +4,11 @@
  *
  * ## 写:一只派生 = core `checkpointIndexFacts(cp)`(core 7.55.0 [ref] P1 阶段二)
  * 行上「core 铸下、此后不动」的十三个事实(令牌、scope、会话、格式版本、门型、卡、待决工具的名 / 调用 id / 入参摘要、deadline、铸行时刻、风险描述符、
- * 双向控制字符在场位),每一个都由 core 那一只函数答;本模块只把它们落到列名下({@link buildCheckpointIndexCells})。修前写口自己从寄存行 / 门上逐格读,
- * 对任何寄存臂、任何门都不分臂 —— 与 core 读法在契约外的行上答两样(计划门上的卡、审阅寄存行上的工具位)。键表对 core 的事实键闭合
- * ({@link CHECKPOINT_INDEX_COLUMNS} `satisfies Record<keyof CheckpointIndexFacts, …>`):core 加 / 删一个事实 ⇒ 编译红,由人决定它落不落列。
- * 不在这里的:CAS 面推动的状态(`status` / `rev` / `reopen_reason` / 执行记录)、部署铸的值(`terminal_at_ms` 兜底)、部署截长脱敏的展示投影(`tool_input` /
- * `rule_suggestions`)—— 它们不是行的不变事实,core 也不答。
+ * 双向控制字符在场位),每一个都由 core 那一只函数答;本模块只把**有读者找行 / 判到期**的那几个落到列名下({@link buildCheckpointIndexCells})。
+ * 键表对 core 的事实键闭合({@link CHECKPOINT_INDEX_COLUMNS} `satisfies Record<keyof CheckpointIndexFacts, string | null>`):core 加 / 删一个事实 ⇒ 编译红,
+ * 由人决定它落不落列。**不落列**(`null`)的三个 —— 工具名、风险描述符、bidi 位 —— 只是运维队列的展示材料:队列行在读时从续跑执行的同一份字节、同一次整行解码投影
+ * (`checkpoint-store-face.ts` 的 `buildQueueActionFacts`,同调这同一只 core 派生),落一份列就是同一事实的第二份存储(7.151.x 及以前落过,一次性迁移 M54 删)。
+ * 不在这里的:CAS 面推动的状态(`status` / `rev` / `reopen_reason` / 执行记录)、部署铸的值(`terminal_at_ms` 兜底)—— 它们不是行的不变事实,core 也不答。
  *
  * ## 写之前:一只判官 = {@link judgeCheckpointIndexCells}
  * 一份文档能不能落进这些列,在写之前由**同一只**判官答 —— 写口 `put` 与 M29 的存量回填都问它,界不抄第二份。三个答案:`cells`(放得下,列格在手);`unreadable`(门或待决动作
@@ -29,9 +29,13 @@
  * (`boot/stores.ts`,先于任何路由与收割器装配),跑不完就拒启 —— 所以每只副本的收割器只在本次起服的 M29 完成之后才运行。混跑期间旧副本新写的行
  * 不带卡列(它们不认这一列),由下一次起服的 M29 补上;升级序见 MIGRATION 7.135.0 节(同一只库不混跑两版)。
  */
-import { PAUSE_REGISTRY, type Checkpoint, type CheckpointIndexFacts, type GateKind, type RiskDescriptor } from "@sema-agent/core";
+import { PAUSE_REGISTRY, type Checkpoint, type CheckpointIndexFacts, type GateKind } from "@sema-agent/core";
 import type { SqlDialect } from "./sql-driver.js";
-/** 每个索引事实落在哪一列(键表对 core 的事实键闭合:core 加 / 删一个事实 ⇒ 编译红)。 */
+/**
+ * 每个索引事实落在哪一列;`null` = 不落列(键表对 core 的事实键闭合:core 加 / 删一个事实 ⇒ 编译红,由人定落不落)。
+ * 落列的判据只有一条:**有读者按它找行或判到期**(决断口的门型绑定、对账与决断回放的调用 id / 绑定摘要、到期 facet 的卡与门型、会话 / scope / 时刻 / 截止)。
+ * 只给人看的事实不落列 —— 队列在读时从同一次整行解码投影,一个事实一份存储。
+ */
 export declare const CHECKPOINT_INDEX_COLUMNS: {
     readonly token: "token";
     readonly scope: "scope";
@@ -39,21 +43,21 @@ export declare const CHECKPOINT_INDEX_COLUMNS: {
     readonly version: "version";
     readonly gateKind: "gate_kind";
     readonly approvalCard: "approval_card";
-    readonly toolName: "tool_name";
+    readonly toolName: null;
     readonly toolCallId: "tool_call_id";
     readonly boundInputHash: "bound_input_hash";
     readonly deadline: "deadline";
     readonly createdAt: "created_at_ms";
-    readonly riskDescriptor: "risk_descriptor";
-    readonly hasBidiControls: "has_bidi_controls";
+    readonly riskDescriptor: null;
+    readonly hasBidiControls: null;
 };
-type IndexColumnOf<K extends keyof CheckpointIndexFacts> = (typeof CHECKPOINT_INDEX_COLUMNS)[K];
-/**
- * 一行的索引列格:core 的事实落在列名下。值逐字是事实本身,只有一处换形:双向控制字符在场位落 `1` 或 NULL(列是 TINYINT / SMALLINT,恒不写 0 —— core 的契约
- * 是「`true` 或缺席」,0 会把「没检出」谎成「已确认干净」)。描述符是行自己的对象,写口负责编码(两方言的 JSON 编码器不同)。
- */
+/** 落列的那几个事实(键表上列名不是 `null` 的)。 */
+type StoredIndexFact = {
+    [K in keyof CheckpointIndexFacts]: (typeof CHECKPOINT_INDEX_COLUMNS)[K] extends string ? K : never;
+}[keyof CheckpointIndexFacts];
+/** 一行的索引列格:落列的 core 事实落在列名下,值逐字是事实本身。 */
 export type CheckpointIndexCells = {
-    readonly [K in keyof CheckpointIndexFacts as IndexColumnOf<K>]: K extends "hasBidiControls" ? 1 | null : K extends "riskDescriptor" ? RiskDescriptor | null : CheckpointIndexFacts[K];
+    readonly [K in StoredIndexFact as (typeof CHECKPOINT_INDEX_COLUMNS)[K] & string]: CheckpointIndexFacts[K];
 };
 /** 一行的索引列格(纯数据;写口与 M29 回填同调这一只 —— 回填不另读门子树自算)。 */
 export declare function buildCheckpointIndexCells(cp: Checkpoint): CheckpointIndexCells;

package/dist/plugins/checkpoint-index-columns.js

@@ -7,13 +7,13 @@ export const CHECKPOINT_INDEX_COLUMNS = {
     version: "version",
     gateKind: "gate_kind",
     approvalCard: "approval_card",
-    toolName: "tool_name",
+    toolName: null,
     toolCallId: "tool_call_id",
     boundInputHash: "bound_input_hash",
     deadline: "deadline",
     createdAt: "created_at_ms",
-    riskDescriptor: "risk_descriptor",
-    hasBidiControls: "has_bidi_controls",
+    riskDescriptor: null,
+    hasBidiControls: null,
 };
 export function buildCheckpointIndexCells(cp) {
     const f = checkpointIndexFacts(cp);
@@ -24,13 +24,10 @@ export function buildCheckpointIndexCells(cp) {
         version: f.version,
         gate_kind: f.gateKind,
         approval_card: f.approvalCard,
-        tool_name: f.toolName,
         tool_call_id: f.toolCallId,
         bound_input_hash: f.boundInputHash,
         deadline: f.deadline,
         created_at_ms: f.createdAt,
-        risk_descriptor: f.riskDescriptor,
-        has_bidi_controls: f.hasBidiControls === true ? 1 : null,
     };
 }
 export const APPROVAL_CARD_COLUMN_MAX_BYTES = {