@sema-agent/server 7.151.0 → 7.152.0

package/dist/plugins/approval-ask-store-sql.d.ts

@@ -28,7 +28,7 @@
  *     先 `SELECT` 后 `UPDATE`(设计定稿 §4 原话)。
  *   - JSON 列(`card_json`/`decision_actor`)走 `dialectJsonEncoder`(TiDB verbatim `JSON.stringify`;
  *     PG 走 `pgSafeJsonStringify` 深度 sanitize——这两列是「已帽已洗后的投影」内容面 blob,不是像
- *     checkpoint 的 `tool_input` 那样跨信任边界做 hash 绑定的执行面字节,故用有损而非无损信封)。
+ *     checkpoint 列里待决动作的 `args` 那样跨信任边界做 hash 绑定的执行面字节,故用有损而非无损信封)。
  *
  * ── 施工偏离记录(设计定稿字面矛盾,未擅自改设计,如实记在这里 + 车1 最终汇报)──────────────────────
  *   - deriveAskId/deriveBatchId 的分隔符:设计定稿 §5 代码片段字面写 `.join(' ')`(单空格),但同一段
@@ -497,11 +497,16 @@ export declare function askRowOnCall(row: AskRow, call: AskCallCoordinate): bool
  * 🔴 [ref] —— **决议作用域的属主维**:这一行此刻带着的属主,是不是这次决议的门判过的那一位(逐字相等;`null` 只等于 `null`)。
  *
  * 律(一条):一次决议请求的作用域 = (ask, 批, **门判过的那位属主**)。属主的唯一来源是行上的 `owner` 列(铸行写定,只有 `/v1/adoption` 改写它);
- * 门(面表 `owner-faces.ts` 的 ask 两行:耐久回决口 `ask.decide` 属主 ∨ 无主 ∨ 运维、live 应答口 `ask.answer` 属主 ∨ 无主)照旧在门里判授权,本谓词**不复判授权**,只绑「门判的那一份属主事实」——
+ * 门(面表 `owner-faces.ts` 的 ask 两行:决断口 `ask.decide` 属主 ∨ 无主 ∨ 运维、按问读口 `ask.answer` 属主 ∨ 无主)照旧在门里判授权,本谓词**不复判授权**,只绑「门判的那一份属主事实」——
  * 门读行与 CAS 之间属主被改写,门的判断就不再是关于这一行的判断。于是这次请求拿到的**每一份**行读数(CAS 本身、CAS 输者的读数、
  * 提交歧义的确认读、幂等回放的命中)都过这一只:出域 = 缺席,门按缺席答(与行不在同体同码)。
  * InMemory twin 的判定、SQL twin 输者读数的投影、两扇门的确认读读同一只;SQL twin 的 UPDATE 谓词是它的方言镜像({@link decideOwnerWhere})。
  */
+/** {@link ApprovalAskStore.listAsksAtGate} 的行判据(三 twin 的出口对齐与 InMemory 内核同调这一只)。 */
+export declare function askAtGate(r: AskRow, sourceSessionId: string, binding: {
+    readonly boundCallId: string;
+    readonly boundInputHash: string;
+}): boolean;
 export declare function askRowCarriesOwner(row: AskRow | null, owner: string | null): row is AskRow;
 /** [ref]:决议输者读数的投影(三 twin 共用一份):行出了这次决议的属主域 ⇒ 读作缺席,不交出别人的行。 */
 export declare function projectDecideReading(row: AskRow | null, owner: string | null): AskRow | null;
@@ -617,6 +622,21 @@ export interface ApprovalAskStore {
      * 行数随在途停驻,不随账本总量)。三 twin 同答:SQL twin 读后按发起会话逐字再滤一遍(MySQL 协议 VARCHAR 等值的 PAD SPACE,与 `listByCall` 同一条出口对齐)。
      */
     listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
+    /**
+     * 「这道停驻门属于哪只问」:发起会话(列 `source_task_id`)= 给定会话,且 ① `state = 'PARKED'` ∧ 门上的绑定对(`gate_bound_call_id` / `gate_bound_input_hash`,收敛器
+     * 按停驻行的「同调用 ∧ 同展示入参摘要」绑上的那一对)逐字等于给定的一对,或 ② `state = 'PARKING'`(收敛器还没绑上)∧ 这只问自己的调用 id 与展示入参摘要
+     * (`tool_call_id` / `bound_input_hash`,收敛器绑定判的就是这两格)逐字等于给定的一对 —— 同一只问在绑定前后都是同一行、同一份 `card_json`,两个读者跨过绑定那一拍同答。按绑定对而不是令牌:运维队列行与续跑腿两个读者手里都有这一对
+     * (队列行不带令牌),同一个问题一个键、一只读口。
+     * 停驻行陈述的会话 = 铸它的那条腿的会话 = 同一次调用的问的发起会话(委派 / 后台子代 = 子代自己的会话;行上的 `sessionId` 记的是投递上下文,不是这一格)。
+     * 两个消费者(同一只协调器读口):续跑腿的规则记录读者(`http/resume-legs.ts`)与运维队列行的候选投影(`routes/approvals-assistant.ts`)—— 有问行的停驻卡读问行、
+     * 没有读停驻行;恰好一行才是这张卡的记录,零行 = 直停驻卡,多行 = 读不出记录(两个读者同答 fail-closed)。
+     * 不带租户门(内部读口,不上 wire;调用方已复核过停驻行的属主,记录读者再比一次行属主)。索引走既有 `idx_ask_source_session (source_task_id)`;零 DDL。
+     * 三 twin 同答:SQL twin 读后按发起会话与令牌逐字再滤一遍(MySQL 协议 VARCHAR 等值的 PAD SPACE,与 `listByCall` 同一条出口对齐)。
+     */
+    listAsksAtGate(sourceSessionId: string, binding: {
+        readonly boundCallId: string;
+        readonly boundInputHash: string;
+    }): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     /** 回决幂等回放的读口。🔴 `taskId` **必填**且是键的第一维——UNIQUE 已改 `(task_id, idempotency_key)`
      *  (车4 §12-E),裸按 key 全局查在多租户库上既可能回**别人 task** 的行(存在性外泄),也可能在同 key
@@ -832,6 +852,10 @@ export declare class SqlApprovalAskStore implements ApprovalAskStore {
     listPendingBySession(sessionId: string, owner: string | null, signal?: AbortSignal): Promise<AskRow[]>;
     listByCall(call: AskCallCoordinate): Promise<AskRow[]>;
     listParkingBySourceSession(sourceSessionId: string): Promise<AskRow[]>;
+    listAsksAtGate(sourceSessionId: string, binding: {
+        readonly boundCallId: string;
+        readonly boundInputHash: string;
+    }): Promise<AskRow[]>;
     getAsk(askId: string): Promise<AskRow | null>;
     getByIdempotencyKey(taskId: string, key: string): Promise<AskRow | null>;
     deferReconcile(askId: string, expectedState: AskState, expectedRev: number, nowMs: number): Promise<boolean>;

package/dist/plugins/approval-ask-store-sql.js

@@ -121,6 +121,13 @@ export function projectAskTerminalClaimTruth(row) {
 export function askRowOnCall(row, call) {
     return row.taskId === call.taskId && row.legKey === call.legKey && row.toolCallId === call.toolCallId && row.sourceSessionId === call.sourceSessionId;
 }
+export function askAtGate(r, sourceSessionId, binding) {
+    if (r.sourceSessionId !== sourceSessionId)
+        return false;
+    if (r.state === "PARKED")
+        return r.gateBoundCallId === binding.boundCallId && r.gateBoundInputHash === binding.boundInputHash;
+    return r.state === "PARKING" && r.toolCallId === binding.boundCallId && r.boundInputHash === binding.boundInputHash;
+}
 export function askRowCarriesOwner(row, owner) {
     return row !== null && row.owner === owner;
 }
@@ -817,6 +824,10 @@ export class SqlApprovalAskStore {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = ? AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = $1 AND state = 'PARKING' ORDER BY created_at_ms ASC, ask_id ASC`), [sourceSessionId]);
         return rows.map(mapAskRow).filter((r) => r.sourceSessionId === sourceSessionId);
     }
+    async listAsksAtGate(sourceSessionId, binding) {
+        const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = ? AND ((state = 'PARKED' AND gate_bound_call_id = ? AND gate_bound_input_hash = ?) OR (state = 'PARKING' AND tool_call_id = ? AND bound_input_hash = ?)) ORDER BY created_at_ms ASC, ask_id ASC`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE source_task_id = $1 AND ((state = 'PARKED' AND gate_bound_call_id = $2 AND gate_bound_input_hash = $3) OR (state = 'PARKING' AND tool_call_id = $2 AND bound_input_hash = $3)) ORDER BY created_at_ms ASC, ask_id ASC`), [sourceSessionId, binding.boundCallId, binding.boundInputHash, binding.boundCallId, binding.boundInputHash]);
+        return rows.map(mapAskRow).filter((r) => askAtGate(r, sourceSessionId, binding));
+    }
     async getAsk(askId) {
         const { rows } = await this.db.query(this.q(`SELECT ${askCols("mysql")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = ?`, `SELECT ${askCols("pg")} FROM ${APPROVAL_ASK_TABLE} WHERE ask_id = $1`), [
             askId,
@@ -904,7 +915,7 @@ sealStoreClass(SqlApprovalAskStore, "sql-approval-ask-store", {
     ensureAsk: "exit", transitionAsk: "exit", decideAsk: "exit", claimTerminal: "exit", expireAsk: "exit", bindBatch: "exit", abortBatch: "exit",
     listByState: "exit", listPendingByTask: "exit", listPendingBySession: "exit", listByCall: "exit", listParkingBySourceSession: "exit", getAsk: "exit",
     getByIdempotencyKey: "exit", deferReconcile: "exit", resolveProvisional: "exit", deleteBySession: "exit", reapSettledAsks: "exit", reapEmptyBatches: "exit",
-    getBatch: "exit", recordParkedDecision: "exit",
+    getBatch: "exit", recordParkedDecision: "exit", listAsksAtGate: "exit",
 });
 export class TiDBApprovalAskStore extends SqlApprovalAskStore {
     constructor(pool) {

package/dist/plugins/blob-backend.d.ts

@@ -1,3 +1,5 @@
+import { type ObjectStoreOp } from "../object-store-buckets.js";
+import type { SessionBlobNamespace } from "./session-blob-namespace.js";
 /**
  * The byte port. Keys are opaque to it (today every index owner keys a blob by its sha256 hash).
  *  - `put`: store `bytes` under `key`. Idempotent (a repeat for the same key overwrites with the identical bytes); a rejection is a
@@ -5,7 +7,10 @@
  *  - `get`: the bytes under `key`, or `undefined` when nothing is there. A TRANSIENT fault THROWS (so a restore / import fails LOUD,
  *    not as a silent "missing blob"). The index owner checks the bytes against the hash ({@link readAtAddress}).
  *  - `delete`: remove the bytes under each key. Idempotent — a key with nothing under it is a success; a key that could not be removed
- *    makes the call reject (after every key was tried).
+ *    makes the call reject (after every key was tried). A port whose deletes wait on a precondition (the session blob ports: the namespace's
+ *    ownership, `session-blob-namespace.ts`) checks it at the start of EVERY call, before any key — so `delete([])` is that precondition alone:
+ *    it rejects exactly as a real delete would be refused, and removes nothing. An index owner whose own writes come before its byte deletes
+ *    asks it that way first (`SqlBlobIndex.sweep`).
  */
 export interface BlobBackend {
     put(key: string, bytes: Uint8Array): Promise<void>;
@@ -19,20 +24,47 @@ export interface BlobBackend {
  * where both index owners judge it (the file-history blob index, the attachment store).
  */
 export declare function readAtAddress(port: Pick<BlobBackend, "get">, hash: string): Promise<Uint8Array | undefined>;
-export interface MinioBlobBackendConfig {
+/** A name a content-addressed domain could have written: a hex sha256, one key segment. A listed name of any other shape (a nested prefix's object, a
+ *  hand-placed file) is not the domain's — its sweep leaves it alone. */
+export declare function isContentAddress(name: string): boolean;
+/** The object-store action table rows one blob backend signs, by verb (`object-store-buckets.ts`). A verb with no row is a request this backend never
+ *  makes: calling it throws before anything is signed (the retired epoch's index only deletes; the boot check only lists). */
+export interface BlobBackendOps {
+    readonly put?: ObjectStoreOp;
+    readonly get?: ObjectStoreOp;
+    readonly head?: ObjectStoreOp;
+    readonly delete?: ObjectStoreOp;
+    readonly list?: ObjectStoreOp;
+}
+interface MinioBlobBackendBaseConfig {
     endpoint: string;
     bucket: string;
     accessKey: string;
     secretKey: string;
     region?: string;
-    /** Key prefix for blob objects, e.g. "blobs/". Object key = keyPrefix + key. Default "blobs/". */
-    keyPrefix?: string;
-    /** Presigned-URL TTL (seconds). Default 3600 (1h) — must comfortably exceed a ~64 MiB single-PUT/GET on a slow link
-     *  (a SigV4 X-Amz-Expires bounds the WHOLE transfer from X-Amz-Date; a too-short TTL fails mid-stream). */
+    /** Key prefix for blob objects. Object key = keyPrefix + key. The production domains get theirs from {@link createSessionBlobBackend}. */
+    keyPrefix: string;
+    /** Presigned-URL TTL (seconds; `SESSION_SNAPSHOT_TTL_SEC`). Unset ⇒ the row's default in the object-store action table (3600 s — it must
+     *  comfortably exceed a ~64 MiB single-PUT/GET on a slow link: a SigV4 X-Amz-Expires bounds the WHOLE transfer from X-Amz-Date; a too-short TTL
+     *  fails mid-stream). A row whose TTL is fixed (the boot probe's) refuses a configured one. */
     presignTtlSec?: number;
     /** 测试注入口(listObjects 分页钉用);生产缺省 global fetch。 */
     fetchImpl?: typeof fetch;
 }
+/** A backend's rows and, for one that signs DELETE, the namespace's ownership every DELETE waits for — required by construction: every delete of a
+ *  content-addressed domain is judged by one database's references, so a port that can delete is built from that database's proven namespace
+ *  (`session-blob-namespace.ts`; `createSessionBlobBackend` passes it). A port with no DELETE row (the boot probe) has no owner. */
+export type MinioBlobBackendConfig = MinioBlobBackendBaseConfig & ({
+    readonly ops: BlobBackendOps & {
+        readonly delete?: undefined;
+    };
+    readonly owner?: undefined;
+} | {
+    readonly ops: BlobBackendOps & {
+        readonly delete: ObjectStoreOp;
+    };
+    readonly owner: Pick<SessionBlobNamespace, "assertOwned">;
+});
 /** 鲁棒性批2 C2/C3/C6(2026-08-03):S3 兼容端点 IO 的统一 abort 上界(fleet-client C1 定常量形
  *  先例)。半开端点此前各挂 undici 默认 ~300s headersTimeout——blob GET 卡住 restore/session-import
  *  同步路径,SendUserFile 工具调用永不返回。120s 对慢链路 ~64MiB 单 PUT/GET 仍宽裕(presignTtlSec
@@ -56,11 +88,14 @@ export type BucketProbe = {
 export declare class MinioBlobBackend implements BlobBackend {
     private readonly cfg;
     private readonly keyPrefix;
+    /** The configured TTL, or nothing (the seat then takes the row's own). */
     private readonly ttl;
     /** 六个站点(put / get / delete / listObjects / headObject / probeBucket)的唯一出口:端点回重定向 ⇒ 拒,预签名 URL 与对象体不被带去 `Location`。 */
     private readonly egressFetch;
     constructor(cfg: MinioBlobBackendConfig);
     private objectKey;
+    /** The table row this backend signs `verb` under; none ⇒ throw (a request this backend's domain never makes). */
+    private opFor;
     private presign;
     /** PUT the bytes under the key. A non-2xx PUT throws (an upload failure must surface — a silent drop would later read_failed on
      *  restore). NOTE no post-PUT read-back verify on the live path (perf): a corrupted PUT is caught at the next read's content-address
@@ -75,7 +110,8 @@ export declare class MinioBlobBackend implements BlobBackend {
     /** DELETE every key's object, at most {@link MINIO_OP_CONCURRENCY} in flight (no FD / throttle storm). Each key is independent: a
      *  2xx or a 404 (already gone) is a success; any other answer or a network failure is a failure. Every key is tried; then, if any
      *  failed, the call REJECTS naming how many (🔴 复审 F4 的同一判据:对象存储完全不可写时绝不报「清理成功」—— 失败只在这里说出来,
-     *  调用方据此记账,不吞)。 */
+     *  调用方据此记账,不吞)。The namespace's ownership is read first on every call, an empty `keys` included (that call is the precondition
+     *  alone: the port contract, {@link BlobBackend}). */
     delete(keys: readonly string[]): Promise<void>;
     /** D-1 孤儿对象 GC(clay 拍 2026-07-28):列举本后端 keyPrefix 下的全部对象(ListObjectsV2 分页,
      *  零依赖 XML 取 <Key>/<LastModified>/<NextContinuationToken>)。**server 端 sweep 专用**——presign 的
@@ -95,4 +131,44 @@ export declare class MinioBlobBackend implements BlobBackend {
      *  都**证明不了**缺桶 ⇒ `unknown`,调用方不拒启、只报一次。总函数:不抛。`timeoutMs`:boot 期调用方给的单次上界(黑洞端点不许把起服拖到 120s)。 */
     probeBucket(timeoutMs?: number): Promise<BucketProbe>;
 }
+/** The blob domains of the session snapshot bucket (closed set) → the table rows each signs. File history reads, writes and sweeps; attachments also list
+ *  and HEAD (their orphan sweep); the retired snapshot epoch only deletes (its sweep). */
+export declare const SESSION_BLOB_DOMAIN_OPS: {
+    readonly "file-history": {
+        readonly put: "file-history/blob:PUT";
+        readonly get: "file-history/blob:GET";
+        readonly delete: "file-history/blob:DELETE";
+    };
+    readonly attachments: {
+        readonly put: "attachments/blob:PUT";
+        readonly get: "attachments/blob:GET";
+        readonly head: "attachments/blob:HEAD";
+        readonly delete: "attachments/blob:DELETE";
+        readonly list: "attachments/prefix:LIST";
+    };
+    readonly "legacy-blobs": {
+        readonly delete: "legacy-blobs/blob:DELETE";
+    };
+};
+export type SessionBlobDomain = keyof typeof SESSION_BLOB_DOMAIN_OPS;
+/** The session snapshot bucket's store config (`config.snapshotBlobStore`: `SESSION_SNAPSHOT_BUCKET`, `SESSION_SNAPSHOT_PREFIX`, `SESSION_SNAPSHOT_TTL_SEC`). */
+export interface SessionBlobStoreConfig {
+    endpoint: string;
+    bucket: string;
+    accessKey: string;
+    secretKey: string;
+    region?: string;
+    keyPrefix?: string;
+    presignTtlSec?: number;
+}
+/** The key prefix of a session blob domain, or the key of the namespace's claim — the ONE place each composes `SESSION_SNAPSHOT_PREFIX` with its
+ *  segment (the table's key forms `{sessionPrefix}file-history/…`, `{sessionPrefix}attachments/…`, `{legacyBlobRoot}…`, `{sessionPrefix}blob-namespace-claim`).
+ *  An empty prefix reads as unset (the env loader's reading of the knob, kept for a hand-built config too): file history, attachments and the claim then
+ *  sit at the bucket root, the retired epoch at its own root `blobs/` (where its objects were written). */
+export declare function sessionBlobKeyPrefixOf(store: Pick<SessionBlobStoreConfig, "keyPrefix">, part: SessionBlobDomain | "claim"): string;
+/** The byte port of one session blob domain over the session snapshot bucket: its key prefix ({@link sessionBlobKeyPrefixOf}), its table rows
+ *  ({@link SESSION_BLOB_DOMAIN_OPS}) and the namespace's ownership its deletes wait for — the one construction every production domain uses, and it
+ *  takes the namespace (one database's), not a bare bucket config. */
+export declare function createSessionBlobBackend(namespace: SessionBlobNamespace, domain: SessionBlobDomain): MinioBlobBackend;
+export {};
 //# sourceMappingURL=blob-backend.d.ts.map

package/dist/plugins/blob-backend.js

@@ -2,12 +2,16 @@ import { createHash } from "node:crypto";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { isNoSuchBucketAnswer } from "./s3-answer.js";
 import { createEgressFetch } from "../egress-redirect.js";
+import { ATTACHMENT_BLOB_SEGMENT, FILE_HISTORY_BLOB_SEGMENT, LEGACY_BLOB_ROOT_DEFAULT, SESSION_BLOB_CLAIM_KEY } from "../object-store-buckets.js";
 export async function readAtAddress(port, hash) {
     const bytes = await port.get(hash);
     if (bytes === undefined)
         return undefined;
     return createHash("sha256").update(bytes).digest("hex") === hash ? bytes : undefined;
 }
+export function isContentAddress(name) {
+    return /^[0-9a-f]{64}$/.test(name);
+}
 const MINIO_OP_CONCURRENCY = 16;
 async function mapBounded(items, limit, fn) {
     let i = 0;
@@ -27,23 +31,30 @@ export class MinioBlobBackend {
     egressFetch;
     constructor(cfg) {
         this.cfg = cfg;
-        this.keyPrefix = cfg.keyPrefix ?? "blobs/";
-        this.ttl = cfg.presignTtlSec ?? 3600;
+        this.keyPrefix = cfg.keyPrefix;
+        this.ttl = cfg.presignTtlSec !== undefined ? { expiresSec: cfg.presignTtlSec } : {};
         this.egressFetch = createEgressFetch("declare the final object-store address as MINIO_ENDPOINT / S3_ENDPOINT", cfg.fetchImpl);
     }
     objectKey(key) {
         return `${this.keyPrefix}${key}`;
     }
+    opFor(verb) {
+        const op = this.cfg.ops[verb];
+        if (op === undefined)
+            throw new Error(`MinioBlobBackend: this blob domain (prefix ${JSON.stringify(this.keyPrefix)}) signs no ${verb.toUpperCase()} — no object-store action row for it`);
+        return op;
+    }
     presign(key, method) {
         return presignS3Url({
+            op: this.opFor(method === "GET" ? "get" : method === "PUT" ? "put" : method === "HEAD" ? "head" : "delete"),
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,
             key: this.objectKey(key),
-            method: method,
+            method,
             accessKey: this.cfg.accessKey,
             secretKey: this.cfg.secretKey,
             ...(this.cfg.region ? { region: this.cfg.region } : {}),
-            expiresSec: this.ttl,
+            ...this.ttl,
         });
     }
     async put(key, bytes) {
@@ -72,7 +83,13 @@ export class MinioBlobBackend {
         return new Uint8Array(await res.arrayBuffer());
     }
     async delete(keys) {
+        const owner = this.cfg.owner;
+        if (owner === undefined)
+            throw new Error(`MinioBlobBackend: this blob domain (prefix ${JSON.stringify(this.keyPrefix)}) has no namespace ownership to delete under — a port that signs DELETE is built from a proven namespace`);
+        await owner.assertOwned();
         const distinct = [...new Set(keys)];
+        if (distinct.length === 0)
+            return;
         let failed = 0;
         let firstFailure;
         await mapBounded(distinct, MINIO_OP_CONCURRENCY, async (key) => {
@@ -100,6 +117,7 @@ export class MinioBlobBackend {
             if (++pages > MAX_PAGES)
                 throw new Error(`listObjects: exceeded ${MAX_PAGES} pages (max-keys 1000/page) — the backend is looping its continuation-token or the prefix is unexpectedly large; refusing to report a partial orphan set`);
             const url = presignS3ListUrl({
+                op: this.opFor("list"),
                 endpoint: this.cfg.endpoint,
                 bucket: this.cfg.bucket,
                 prefix: this.keyPrefix,
@@ -108,7 +126,7 @@ export class MinioBlobBackend {
                 accessKey: this.cfg.accessKey,
                 secretKey: this.cfg.secretKey,
                 ...(this.cfg.region ? { region: this.cfg.region } : {}),
-                expiresSec: this.ttl,
+                ...this.ttl,
             });
             const res = await f(url, { method: "GET", signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
             if (!res.ok)
@@ -141,6 +159,7 @@ export class MinioBlobBackend {
     async probeBucket(timeoutMs = OBJECT_STORE_IO_TIMEOUT_MS) {
         const f = this.egressFetch;
         const url = presignS3ListUrl({
+            op: this.opFor("list"),
             endpoint: this.cfg.endpoint,
             bucket: this.cfg.bucket,
             prefix: this.keyPrefix,
@@ -148,7 +167,7 @@ export class MinioBlobBackend {
             accessKey: this.cfg.accessKey,
             secretKey: this.cfg.secretKey,
             ...(this.cfg.region ? { region: this.cfg.region } : {}),
-            expiresSec: this.ttl,
+            ...this.ttl,
         });
         let res;
         try {
@@ -165,4 +184,36 @@ export class MinioBlobBackend {
         return { state: "unknown", detail: `HTTP ${res.status}` };
     }
 }
+export const SESSION_BLOB_DOMAIN_OPS = {
+    "file-history": { put: "file-history/blob:PUT", get: "file-history/blob:GET", delete: "file-history/blob:DELETE" },
+    attachments: { put: "attachments/blob:PUT", get: "attachments/blob:GET", head: "attachments/blob:HEAD", delete: "attachments/blob:DELETE", list: "attachments/prefix:LIST" },
+    "legacy-blobs": { delete: "legacy-blobs/blob:DELETE" },
+};
+export function sessionBlobKeyPrefixOf(store, part) {
+    const prefix = store.keyPrefix === "" ? undefined : store.keyPrefix;
+    switch (part) {
+        case "file-history":
+            return `${prefix ?? ""}${FILE_HISTORY_BLOB_SEGMENT}`;
+        case "attachments":
+            return `${prefix ?? ""}${ATTACHMENT_BLOB_SEGMENT}`;
+        case "claim":
+            return `${prefix ?? ""}${SESSION_BLOB_CLAIM_KEY}`;
+        case "legacy-blobs":
+            return prefix ?? LEGACY_BLOB_ROOT_DEFAULT;
+    }
+}
+export function createSessionBlobBackend(namespace, domain) {
+    const store = namespace.store;
+    return new MinioBlobBackend({
+        endpoint: store.endpoint,
+        bucket: store.bucket,
+        accessKey: store.accessKey,
+        secretKey: store.secretKey,
+        ...(store.region ? { region: store.region } : {}),
+        keyPrefix: sessionBlobKeyPrefixOf(store, domain),
+        ops: SESSION_BLOB_DOMAIN_OPS[domain],
+        owner: namespace,
+        ...(store.presignTtlSec ? { presignTtlSec: store.presignTtlSec } : {}),
+    });
+}
 //# sourceMappingURL=blob-backend.js.map

package/dist/plugins/checkpoint-index-columns.d.ts

@@ -4,11 +4,11 @@
  *
  * ## 写:一只派生 = core `checkpointIndexFacts(cp)`(core 7.55.0 [ref] P1 阶段二)
  * 行上「core 铸下、此后不动」的十三个事实(令牌、scope、会话、格式版本、门型、卡、待决工具的名 / 调用 id / 入参摘要、deadline、铸行时刻、风险描述符、
- * 双向控制字符在场位),每一个都由 core 那一只函数答;本模块只把它们落到列名下({@link buildCheckpointIndexCells})。修前写口自己从寄存行 / 门上逐格读,
- * 对任何寄存臂、任何门都不分臂 —— 与 core 读法在契约外的行上答两样(计划门上的卡、审阅寄存行上的工具位)。键表对 core 的事实键闭合
- * ({@link CHECKPOINT_INDEX_COLUMNS} `satisfies Record<keyof CheckpointIndexFacts, …>`):core 加 / 删一个事实 ⇒ 编译红,由人决定它落不落列。
- * 不在这里的:CAS 面推动的状态(`status` / `rev` / `reopen_reason` / 执行记录)、部署铸的值(`terminal_at_ms` 兜底)、部署截长脱敏的展示投影(`tool_input` /
- * `rule_suggestions`)—— 它们不是行的不变事实,core 也不答。
+ * 双向控制字符在场位),每一个都由 core 那一只函数答;本模块只把**有读者找行 / 判到期**的那几个落到列名下({@link buildCheckpointIndexCells})。
+ * 键表对 core 的事实键闭合({@link CHECKPOINT_INDEX_COLUMNS} `satisfies Record<keyof CheckpointIndexFacts, string | null>`):core 加 / 删一个事实 ⇒ 编译红,
+ * 由人决定它落不落列。**不落列**(`null`)的三个 —— 工具名、风险描述符、bidi 位 —— 只是运维队列的展示材料:队列行在读时从续跑执行的同一份字节、同一次整行解码投影
+ * (`checkpoint-store-face.ts` 的 `buildQueueActionFacts`,同调这同一只 core 派生),落一份列就是同一事实的第二份存储(7.151.x 及以前落过,一次性迁移 M54 删)。
+ * 不在这里的:CAS 面推动的状态(`status` / `rev` / `reopen_reason` / 执行记录)、部署铸的值(`terminal_at_ms` 兜底)—— 它们不是行的不变事实,core 也不答。
  *
  * ## 写之前:一只判官 = {@link judgeCheckpointIndexCells}
  * 一份文档能不能落进这些列,在写之前由**同一只**判官答 —— 写口 `put` 与 M29 的存量回填都问它,界不抄第二份。三个答案:`cells`(放得下,列格在手);`unreadable`(门或待决动作
@@ -29,9 +29,13 @@
  * (`boot/stores.ts`,先于任何路由与收割器装配),跑不完就拒启 —— 所以每只副本的收割器只在本次起服的 M29 完成之后才运行。混跑期间旧副本新写的行
  * 不带卡列(它们不认这一列),由下一次起服的 M29 补上;升级序见 MIGRATION 7.135.0 节(同一只库不混跑两版)。
  */
-import { PAUSE_REGISTRY, type Checkpoint, type CheckpointIndexFacts, type GateKind, type RiskDescriptor } from "@sema-agent/core";
+import { PAUSE_REGISTRY, type Checkpoint, type CheckpointIndexFacts, type GateKind } from "@sema-agent/core";
 import type { SqlDialect } from "./sql-driver.js";
-/** 每个索引事实落在哪一列(键表对 core 的事实键闭合:core 加 / 删一个事实 ⇒ 编译红)。 */
+/**
+ * 每个索引事实落在哪一列;`null` = 不落列(键表对 core 的事实键闭合:core 加 / 删一个事实 ⇒ 编译红,由人定落不落)。
+ * 落列的判据只有一条:**有读者按它找行或判到期**(决断口的门型绑定、对账与决断回放的调用 id / 绑定摘要、到期 facet 的卡与门型、会话 / scope / 时刻 / 截止)。
+ * 只给人看的事实不落列 —— 队列在读时从同一次整行解码投影,一个事实一份存储。
+ */
 export declare const CHECKPOINT_INDEX_COLUMNS: {
     readonly token: "token";
     readonly scope: "scope";
@@ -39,21 +43,21 @@ export declare const CHECKPOINT_INDEX_COLUMNS: {
     readonly version: "version";
     readonly gateKind: "gate_kind";
     readonly approvalCard: "approval_card";
-    readonly toolName: "tool_name";
+    readonly toolName: null;
     readonly toolCallId: "tool_call_id";
     readonly boundInputHash: "bound_input_hash";
     readonly deadline: "deadline";
     readonly createdAt: "created_at_ms";
-    readonly riskDescriptor: "risk_descriptor";
-    readonly hasBidiControls: "has_bidi_controls";
+    readonly riskDescriptor: null;
+    readonly hasBidiControls: null;
 };
-type IndexColumnOf<K extends keyof CheckpointIndexFacts> = (typeof CHECKPOINT_INDEX_COLUMNS)[K];
-/**
- * 一行的索引列格:core 的事实落在列名下。值逐字是事实本身,只有一处换形:双向控制字符在场位落 `1` 或 NULL(列是 TINYINT / SMALLINT,恒不写 0 —— core 的契约
- * 是「`true` 或缺席」,0 会把「没检出」谎成「已确认干净」)。描述符是行自己的对象,写口负责编码(两方言的 JSON 编码器不同)。
- */
+/** 落列的那几个事实(键表上列名不是 `null` 的)。 */
+type StoredIndexFact = {
+    [K in keyof CheckpointIndexFacts]: (typeof CHECKPOINT_INDEX_COLUMNS)[K] extends string ? K : never;
+}[keyof CheckpointIndexFacts];
+/** 一行的索引列格:落列的 core 事实落在列名下,值逐字是事实本身。 */
 export type CheckpointIndexCells = {
-    readonly [K in keyof CheckpointIndexFacts as IndexColumnOf<K>]: K extends "hasBidiControls" ? 1 | null : K extends "riskDescriptor" ? RiskDescriptor | null : CheckpointIndexFacts[K];
+    readonly [K in StoredIndexFact as (typeof CHECKPOINT_INDEX_COLUMNS)[K] & string]: CheckpointIndexFacts[K];
 };
 /** 一行的索引列格(纯数据;写口与 M29 回填同调这一只 —— 回填不另读门子树自算)。 */
 export declare function buildCheckpointIndexCells(cp: Checkpoint): CheckpointIndexCells;

package/dist/plugins/checkpoint-index-columns.js

@@ -7,13 +7,13 @@ export const CHECKPOINT_INDEX_COLUMNS = {
     version: "version",
     gateKind: "gate_kind",
     approvalCard: "approval_card",
-    toolName: "tool_name",
+    toolName: null,
     toolCallId: "tool_call_id",
     boundInputHash: "bound_input_hash",
     deadline: "deadline",
     createdAt: "created_at_ms",
-    riskDescriptor: "risk_descriptor",
-    hasBidiControls: "has_bidi_controls",
+    riskDescriptor: null,
+    hasBidiControls: null,
 };
 export function buildCheckpointIndexCells(cp) {
     const f = checkpointIndexFacts(cp);
@@ -24,13 +24,10 @@ export function buildCheckpointIndexCells(cp) {
         version: f.version,
         gate_kind: f.gateKind,
         approval_card: f.approvalCard,
-        tool_name: f.toolName,
         tool_call_id: f.toolCallId,
         bound_input_hash: f.boundInputHash,
         deadline: f.deadline,
         created_at_ms: f.createdAt,
-        risk_descriptor: f.riskDescriptor,
-        has_bidi_controls: f.hasBidiControls === true ? 1 : null,
     };
 }
 export const APPROVAL_CARD_COLUMN_MAX_BYTES = {