@sema-agent/server 7.4.0 → 7.6.0

package/dist/boot/lexical-path-env.js

@@ -1,88 +0,0 @@
-/**
- * #156 —— 非 host lane(e2b/k8s/ssh/adb/local-docker)写门的**纯路径规则**过渡形所用的裁决 env。
- *
- * ## 它解决的缺口
- *
- * core 的 `createFsWriteGatePolicy` / `createSensitivePathPolicy` 都把写目标交给
- * `canonicalizeTarget(env, …)` 去「问 fs 要真身」。host lane 上那个 env 就是 hand 工具真正写的那块盘,
- * 答案可信。沙箱 lane 不是:per-task 的沙箱 env 由 core 的 `executionEnvFactory` 在 spec **之后**才铸,
- * spec 期手边只有 worker 本机的 fs——拿它去裁沙箱里的路径会答错(exists/symlink 全是别人机器上的事实),
- * 而**错误的 allow 比没有门更糟**。所以 [816]/[820] 当年在沙箱 lane 诚实不挂门(wiring=undefined ⇒
- * 三个模式臂全回落 base 规则,写门整条缺席)。#153 的 ③ 号注把这笔记成了余款,#156 是它的过渡还款。
- *
- * ## 这个 env 是什么
- *
- * 一个**没有文件系统**的 env:除 `absolutePath` 外的每一个 fs 面(exists / canonicalPath / fileInfo /
- * read* / write* / listDir / createDir / …)与 shell 面都继承 core 的 `StubExecutionEnv`,
- * 恒返回 `not_supported` 错误(`readLink` 是可选面,Stub 干脆没有——core 把缺席当「symlink 不可解」,
- * 且该分支在本 env 恒不可达:exists 先错就进了 canonicalizeNewPath)——这不是伪装,这就是本 env 的诚实回答:**spec 期我们确实不知道沙箱里
- * 那块盘上有什么**。`absolutePath` 是唯一被赋予真实语义的一面,而它本来就是纯路径运算(不碰盘):
- * POSIX 绝对路径做词法归一后原样奉还,其余一律「不知道」。
- *
- * ## 由此得到的裁决语义(core dist 亲读推出,`tools/fs/safety.js` canonicalizeTarget)
- *
- *  · 绝对路径(`/…`):`absolutePath` ok ⇒ core 进 exists 探测 ⇒ 我们返回错误 ⇒ core 按「该路径尚不存在」
- *    走 `canonicalizeNewPath`,那里逐级 exists 也全错 ⇒ 原样返回我们给的词法绝对路径。于是 canonical key
- *    = **词法归一后的路径**,`canonicalPath` / `fileInfo` / `readLink` 三面在这条路上根本不可达。
- *  · 相对路径 / `~/…` / Windows 盘符形:`absolutePath` 返回错误 ⇒ `canon.ok=false` ⇒ 写门直接
- *    `ask`(fail-closed)。沙箱的 cwd 在 spec 期不可知,这正是我们要的偏置——**不猜沙箱工作目录**。
- *  · 反斜杠 UNC 形(`\\host\share\…`)是唯一**不经过**本 env 的形:core 的 `canonicalizeTarget` 在入口
- *    就把它短路成 `ok:true, key=原样`(复审 2026-08-05 dist 亲读+实测)。结果不变——写门无放行域可越,
- *    落 defaultWrite 的 `ask`;sensitive 段匹配按 `[\\/]` 双分隔符切段,`\\host\share\.env` 照样 deny。
- *  · sensitivePatterns 的 deny 腿照常施加:它按 canonical key 的**路径段**做 glob 匹配,词法 key 足够,
- *    且在 `combinePolicies` 折叠里 deny 恒胜(session 豁免 / accept 域越不过)。
- *  · `isExempt`(会话「本会话不再询问」探针)是 name-keyed 的,不做 fs 裁决,任何 lane 都安全,照接。
- *
- * ## 已知残余面(过渡形的边界,不是疏漏)
- *
- *  · **symlink 形**:词法裁决看不见符号链接。沙箱里一个名字普通的软链可以指向守卫段(`.ssh` 等),
- *    我们只会给 `ask` 而不是 `deny`;host lane 上 core 会 canonicalize 出真身并 deny。相应地,core 的
- *    `unresolvedSymlink ⇒ deny` 那条腿在本 env 下永不触发。注意豁免会话下的口径(codex 复审 E):
- *    name-keyed 豁免不看路径,这类词法无害的软链目标在豁免会话里是 **allow** 而非 ask——这是本残余面
- *    在「操作员已授 don't-ask-again」情形下的完整代价,host lane 同情形仍会 deny。
- *  · **exempt/accept 域**:沙箱 lane 既无可信 cwd 也无 scratchpad 对应物,故本过渡形**一个自动放行域都
- *    不铸**(见 resolve-spec 的 wiring)。代价是 acceptEdits 在沙箱 lane 退化成与 default 同形(全 ask);
- *    这是 fail-safe 方向,与 host lane「accept 域解析不出 ⇒ 该域不生效」的哨兵先例同口径。
- *  · **`cwd` 字段**:继承 `StubExecutionEnv` 的 `"/"` 占位。本 env 只活在 policy 折叠里,core 的两个
- *    policy 都不读 `env.cwd`(相对路径基准走 `rootPath` 形参,而我们不给)——它不代表沙箱的工作目录。
- *
- * ## 终局 seam
- *
- * 正解是让写门在**工具执行时刻**拿到真沙箱 env:core [2751] 已排期给 `HookToolContext` 加一个只读的
- * env 能力窄面(174/#22 窗)。那一面到货后,本过渡形整体退役换正解——届时沙箱 lane 与 host lane 走同
- * 一条真 fs 裁决,上面三条残余面一并消失。
- */
-import { posix } from "node:path";
-import { FileError, StubExecutionEnv, err, ok } from "@sema-agent/core";
-/** 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,不碰 fs。
- *  `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「沙箱根之上没有东西」的语义一致。
- *  尾部分隔符统一剥掉(根 `/` 除外),让同一目标只有一个 key ——前缀判域靠的就是 key 的唯一性。
- *  (core 内部有同形的 `normalizeAbsPathLexically`,但未从包根导出;此处是 Node 标准库的等价运算,
- *   不是它的抄本——若日后 core 导出,这里应改为直接复用。) */
-function normalizeAbsolutePathLexically(path) {
-    const collapsed = posix.normalize(path.replace(/^\/+/, "/"));
-    return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
-}
-/**
- * 无文件系统的路径裁决 env(见文件头)。只覆写 `absolutePath` 一面,其余全部继承 `StubExecutionEnv`
- * 的 `not_supported` ——**继承而非逐一手写**是刻意的:core 日后给 `ExecutionEnv` 加必填面时,新面会
- * 随 `StubExecutionEnv` 一起到位并保持同一个诚实答案,不会在这里留下一个悄悄编出来的假答案。
- */
-export class LexicalPathExecutionEnv extends StubExecutionEnv {
-    absolutePath(path) {
-        // POSIX 绝对形是沙箱 lane(全 Linux)上 hand 工具的书面契约形。其余一切——相对路径、`~`、
-        // `C:\…`——在 spec 期都无法诚实解析成一个沙箱内的绝对路径,返回错误让 core 落 ask。
-        // (反斜杠 UNC 形根本到不了这里:core 在 canonicalizeTarget 入口短路,见文件头「由此得到的裁决语义」。)
-        // codex 复审 A(2026-08-05):含 NUL 的字符串不是合法 POSIX 路径(任何 fs 面都写不进去),但词法归一
-        // 会照样给它铸出 canonical key——`\0` 尾巴让守卫段 glob 失配,豁免会话下还能拿 allow。拒收让 canon
-        // 在豁免咨询**之前**就失败 ⇒ 恒 ask。
-        if (path.includes("\u0000")) {
-            return Promise.resolve(err(new FileError("not_supported", "this environment adjudicates paths lexically and rejects a path containing a NUL byte (not a representable POSIX path)", path)));
-        }
-        if (!path.startsWith("/")) {
-            return Promise.resolve(err(new FileError("not_supported", "this environment adjudicates paths lexically and cannot resolve a non-absolute path (the sandbox working directory is unknown at spec time)", path)));
-        }
-        return Promise.resolve(ok(normalizeAbsolutePathLexically(path)));
-    }
-}
-//# sourceMappingURL=lexical-path-env.js.map

package/dist/capabilities/oa-tools.d.ts

@@ -1,15 +0,0 @@
-import type { ToolSpec } from "@sema-agent/core";
-/**
- * OA scenario — tools are thin HTTP clients to the OA backend's existing APIs (read = /api/v1/*,
- * write = /api/assets/*). The shared service token + the request's principal are forwarded so OA
- * enforces THAT end-user's RBAC + audit (the service never holds per-user creds). Decoupled: the
- * service knows no OA schema/DB — OA stays the source of truth (its /api/v1/meta is self-describing).
- */
-export interface OaCtx {
-    baseUrl: string;
-    token: string;
-    principal?: string;
-}
-export declare function oaTools(ctx: OaCtx): ToolSpec[];
-export declare const oaPrompt: import("@sema-agent/core").PromptProvider;
-//# sourceMappingURL=oa-tools.d.ts.map

package/dist/capabilities/oa-tools.js

@@ -1,54 +0,0 @@
-import { Type } from "typebox";
-import { stablePrompt } from "./prompt.js";
-async function oaFetch(ctx, path, init) {
-    if (!ctx.baseUrl || !ctx.token)
-        return "OA 后端未配置(OA_API_BASEURL / OA_SERVICE_TOKEN)";
-    try {
-        const res = await fetch(ctx.baseUrl + path, {
-            method: init?.method ?? "GET",
-            headers: {
-                "content-type": "application/json",
-                authorization: `Bearer ${ctx.token}`,
-                ...(ctx.principal ? { "x-agent-principal": ctx.principal } : {}),
-            },
-            body: init?.body !== undefined ? JSON.stringify(init.body) : undefined,
-        });
-        const text = await res.text();
-        if (!res.ok)
-            return `OA ${res.status}: ${text.slice(0, 600)}`;
-        return text.slice(0, 60_000);
-    }
-    catch (e) {
-        return `调用 OA 失败：${e.message}`;
-    }
-}
-const needWrite = (ctx) => (!ctx.principal ? "缺少身份(principal)，无法代表用户写库；请让调用方带上 x-agent-principal。" : null);
-export function oaTools(ctx) {
-    const obj = Type.Object({}, { additionalProperties: true });
-    return [
-        { name: "oa_schema", effect: "read", description: "取 OA 数据结构(每类资产的字段/必填/条件必填 requiredWhen/联动 showWhen/枚举、生命周期、表名)。建/改前先调它，别凭记忆。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/meta") },
-        { name: "oa_alerts", effect: "read", description: "派生告警：GP 闲置(已注册未变现) / APP 未上架(已接广告未 LIVE)。", parameters: Type.Object({}), execute: () => oaFetch(ctx, "/api/v1/alerts") },
-        { name: "oa_list", effect: "read", description: "列出某类资产。type∈gp/package/ad-platform/ad-unit/email/environment/proxy。可选 q 关键字。", parameters: Type.Object({ type: Type.String(), q: Type.Optional(Type.String()) }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}${x.q ? `?q=${encodeURIComponent(x.q)}` : ""}`); } },
-        { name: "oa_get", effect: "read", description: "取某资产详情(敏感字段为掩码)。", parameters: Type.Object({ type: Type.String(), id: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/entities/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`); } },
-        { name: "oa_lookup", effect: "read", description: "约定字段值反查(同手机/证件=同一实物)。field: phone|idCardNo|bizLicenseNo。", parameters: Type.Object({ field: Type.String(), value: Type.String() }), execute: (a) => { const x = a; return oaFetch(ctx, `/api/v1/lookup?field=${encodeURIComponent(x.field)}&value=${encodeURIComponent(x.value)}`); } },
-        { name: "oa_create", effect: "write", description: "创建实体(走 OA 校验+当前用户 RBAC+审计)。type + data(字段对象，参照 oa_schema)。失败会返回缺失/非法字段。", parameters: Type.Object({ type: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}`, { method: "POST", body: x.data ?? {} }); } },
-        { name: "oa_update", effect: "write", description: "改字段(敏感留空=保持原值；状态字段改不动，用 oa_transition)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), data: obj }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}`, { method: "PATCH", body: x.data ?? {} }); } },
-        { name: "oa_transition", effect: "write", description: "受控状态流转(先 oa_schema 看可用迁移；风险/弃用等需 note)。", parameters: Type.Object({ type: Type.String(), id: Type.String(), to: Type.String(), note: Type.Optional(Type.String()) }), execute: (a) => { const e = needWrite(ctx); if (e)
-                return e; const x = a; return oaFetch(ctx, `/api/assets/${encodeURIComponent(x.type)}/${encodeURIComponent(x.id)}/transition`, { method: "POST", body: { to: x.to, note: x.note ?? null } }); } },
-    ];
-}
-// OA business prompt MOVED OUT — migration complete (design/29, 2026-06-05). Persona / 工作准则 / UI
-// markers (::FORM:: / ::GOTO:: / ::SUGGEST:: / ::ISSUE_FORM::) / 分级确认 / 报bug流程 are OA's business,
-// and OA now injects the WHOLE thing per request via `request.systemPrompt` (it holds the service token,
-// content is stable per OA version → cacheable prefix; page context still rides `objective`). Keeping
-// any of it here would just DUPLICATE OA's prompt, so the base is EMPTY — single source of truth = OA.
-// The service stays business-agnostic: it provides the oa_* tools (referenced by NAME from OA's prompt;
-// they carry their own descriptions) and nothing else. `stablePrompt` keeps STABLE→VARIABLE order —
-// OA's systemPrompt is appended after this (empty) base, before core's <user_memory>.
-// (::ISSUE_FORM:: is parsed/rendered + submitted entirely by OA's frontend via OA /api/ai/issue — the
-//  service never touches it; `open_gitea_issue` remains only as the unattended/automated fallback.)
-const OA_SYSTEM = "";
-export const oaPrompt = stablePrompt(OA_SYSTEM);
-//# sourceMappingURL=oa-tools.js.map

package/dist/finance/cost-taxonomy.d.ts

@@ -1,34 +0,0 @@
-export interface InfraCostRates {
-    toolCallMicroUsd: number;
-    sandboxSecMicroUsd: number;
-    egressGbMicroUsd: number;
-}
-export interface InfraUsage {
-    toolCalls: number;
-    sandboxWalltimeMs: number;
-    egressBytes: number;
-}
-export interface InfraCostBreakdown {
-    toolCallMicroUsd: number;
-    sandboxWalltimeMicroUsd: number;
-    egressMicroUsd: number;
-    totalMicroUsd: number;
-}
-export interface LlmCostBreakdown {
-    llmRootMicroUsd: number;
-    nestedSubagentMicroUsd: number;
-    memoryConsolidationMicroUsd: number;
-    compactionMicroUsd: number;
-}
-export interface SupervisorCostBreakdown {
-    llm: LlmCostBreakdown | null;
-    infra: InfraCostBreakdown;
-    totalMicroUsd: number;
-}
-export declare function infraCost(usage: InfraUsage, rates: InfraCostRates): InfraCostBreakdown;
-export declare function composeSupervisorCost(llm: LlmCostBreakdown | null, llmTotalMicroUsd: number, infra: InfraCostBreakdown): SupervisorCostBreakdown;
-export declare function hasInfraPricing(r: InfraCostRates): boolean;
-export declare function infraUsageFromEvents(events: ReadonlyArray<{
-    type?: string;
-}>, runDurationMs: number): InfraUsage;
-//# sourceMappingURL=cost-taxonomy.d.ts.map

package/dist/finance/cost-taxonomy.js

@@ -1,26 +0,0 @@
-const nonNeg = (n) => (Number.isFinite(n) && n > 0 ? n : 0);
-export function infraCost(usage, rates) {
-    const toolCallMicroUsd = nonNeg(usage.toolCalls) * nonNeg(rates.toolCallMicroUsd);
-    const sandboxWalltimeMicroUsd = (nonNeg(usage.sandboxWalltimeMs) / 1000) * nonNeg(rates.sandboxSecMicroUsd);
-    const egressMicroUsd = (nonNeg(usage.egressBytes) / 1_000_000_000) * nonNeg(rates.egressGbMicroUsd);
-    return {
-        toolCallMicroUsd,
-        sandboxWalltimeMicroUsd,
-        egressMicroUsd,
-        totalMicroUsd: toolCallMicroUsd + sandboxWalltimeMicroUsd + egressMicroUsd,
-    };
-}
-export function composeSupervisorCost(llm, llmTotalMicroUsd, infra) {
-    return { llm, infra, totalMicroUsd: nonNeg(llmTotalMicroUsd) + infra.totalMicroUsd };
-}
-export function hasInfraPricing(r) {
-    return r.toolCallMicroUsd > 0 || r.sandboxSecMicroUsd > 0 || r.egressGbMicroUsd > 0;
-}
-export function infraUsageFromEvents(events, runDurationMs) {
-    return {
-        toolCalls: events.reduce((n, e) => (e.type === "tool_start" ? n + 1 : n), 0),
-        sandboxWalltimeMs: nonNeg(runDurationMs),
-        egressBytes: 0,
-    };
-}
-//# sourceMappingURL=cost-taxonomy.js.map

package/dist/plugins/approval-store-sql.d.ts

@@ -1,116 +0,0 @@
-/**
- * Durable approval store for the human-in-the-loop write gate (F4) — SINGLE-FILE DUAL-DIALECT
- * (design/158 A12 定型半场). ONE implementation, TWO dialects; the historical `TiDBApprovalStore` /
- * `PgApprovalStore` class names survive as thin ctor subclasses so every consumer (store-backend.ts,
- * src/index.ts, the approval/audit/security-coverage suites) is untouched.
- *
- * When a gated tool call is about to run, a `pending` row is recorded here; the instance running the
- * task polls it for a decision. Because the row is durable and shared, an operator's approve/deny can
- * land on ANY instance — critical under async runs + a load balancer, where the deciding request and
- * the waiting run are usually on different instances.
- *
- * Unlike the run/checkpoint PG store (whose schema is owned centrally by pg-pool.ts), this file also
- * exports a self-contained PG schema (`PG_APPROVAL_SCHEMA` + `ensureSchema`) — the `approval` table is
- * DISJOINT from the other PG stores' tables, so a CREATE IF NOT EXISTS here shadows nothing. Central
- * aggregation into pg-pool.ts composes it alongside the others. Kept in lock-step with the TiDB store
- * by the shared real-DB integration suite (test/pg-approval-store-integration.test.ts).
- *
- * ── Dialect deltas, kept EXPLICIT ────────────────────────────────────────────────────────────────────
- *   - `?` placeholders vs `$n`
- *   - null-safe scope compare: `<=>` vs `IS NOT DISTINCT FROM` (a NULL scope row — legacy/untenanted
- *     run — is matched by a NULL scope arg; one tenant's scope NEVER matches another's — the
- *     single-DB fleet read guard, defense-in-depth)
- *   - JSON binding: TiDB `JSON.stringify` verbatim vs PG `pgProtocolJsonStringify` (codex R4-H2: the
- *     persisted approval `args` is the operator's REVIEW surface and must agree byte-for-byte with the
- *     policy-executed args — a lossy/rewriting envelope would let an operator approve one payload while
- *     a different one runs)
- *   - affectedRows vs rowCount (via SqlDriver)
- *   - schema ownership: TiDB DDL lives in tidb-pool.ts SCHEMA_STATEMENTS; PG DDL is this file's own
- *     self-contained `PG_APPROVAL_SCHEMA` (see the PG twin's original header — unlike the other PG
- *     stores, `approval` is NOT centrally owned by pg-pool.ts's DDL array, only aggregated into its
- *     `ensureSchema` composition).
- *   - `getStatus` result shape: `RowDataPacket[]` (mysql2 typed query) vs a plain-record `pg` query —
- *     normalized to `SqlRow` by the shared driver, so both arms read the same field names.
- */
-import type { Pool as MySqlPool } from "mysql2/promise";
-import type { Pool as PgPool, PoolClient } from "pg";
-import { type SqlDriver } from "./sql-driver.js";
-export type ApprovalStatus = "pending" | "approved" | "denied" | "expired";
-export interface ApprovalRow {
-    id: string;
-    taskId: string | null;
-    sessionId: string | null;
-    owner: string | null;
-    /** Single-DB fleet scope guard (defense-in-depth): the run's tenant identity, owner-sourced. Reads filter on it. */
-    scope: string | null;
-    toolName: string;
-    args: unknown;
-    status: ApprovalStatus;
-    reason: string | null;
-    decidedBy: string | null;
-    createdAt: string;
-    decidedAt: string | null;
-}
-/** PG translation of the `approval` DDL in tidb-pool.ts SCHEMA_STATEMENTS (JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3),
- *  inline KEY→separate CREATE INDEX).
- *
- *  SCHEMA POLICY: see the header of pg-pool.ts — the code is the single source of truth, schema changes are
- *  drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead. */
-export declare const PG_APPROVAL_SCHEMA: string[];
-/** Idempotent self-contained schema apply (for the integration test; central aggregation is done separately). */
-export declare function ensureSchema(pool: PgPool | PoolClient): Promise<void>;
-/** Dual-dialect durable approval store. See the file header for the dialect-delta ledger. */
-export declare class SqlApprovalStore {
-    protected readonly db: SqlDriver;
-    constructor(db: SqlDriver);
-    /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
-    private q;
-    /** JSON column binding: TiDB stores the string verbatim; PG goes through the LOSSLESS protocol envelope
-     *  (codex R4-H2 — the approval `args` is the operator's review surface and must agree with the
-     *  policy-executed args at the NUL position). */
-    private json;
-    createPending(id: string, scope: string | null, ctx: {
-        taskId?: string | null;
-        sessionId?: string | null;
-        owner?: string | null;
-        toolName: string;
-        args: unknown;
-    }): Promise<void>;
-    getStatus(id: string, scope: string | null): Promise<{
-        status: ApprovalStatus;
-        reason: string | null;
-        decidedBy: string | null;
-    } | undefined>;
-    /** Apply a terminal decision, but only to a still-pending row (CAS). Returns whether it applied. The scope
-     *  guard (null-safe) is carried on the operator path too for consistency with the read paths. */
-    decide(id: string, scope: string | null, decision: "approved" | "denied" | "expired", reason: string | null, decidedBy: string | null): Promise<boolean>;
-    /** Pending approvals (operator queue), scoped to one tenant (single-DB fleet read guard, null-safe), optionally
-     *  further filtered to one owner. */
-    listPending(scope: string | null, owner?: string): Promise<ApprovalRow[]>;
-    get(id: string, scope: string | null): Promise<ApprovalRow | undefined>;
-    /** Operator-only CROSS-tenant by-id read (no scope filter). The F4 operator queue serves/decides across
-     *  tenants by design; the HTTP layer gates this to an operator and then re-binds decide() to the row's OWN
-     *  scope. Tenants NEVER reach this — they use the scope-bound {@link get}. */
-    getById(id: string): Promise<ApprovalRow | undefined>;
-    /** Operator-only CROSS-tenant pending list (no scope filter) — the unfiltered operator queue across all
-     *  tenants. Tenants use the scope-bound {@link listPending}; this is HTTP-gated to an operator.
-     *  🔴 identical SQL text on both dialects (no placeholders, nothing dialect-specific) — kept as ONE literal
-     *  rather than a `q()` pair so a reader isn't misled into looking for a divergence that isn't there. */
-    listPendingAll(): Promise<ApprovalRow[]>;
-    /** Expire pending approvals older than `olderThanMs` (a never-answered operator request). Deliberately GLOBAL
-     *  (NOT scope-filtered): staleness expiry is fleet-level maintenance that protects the worker regardless of
-     *  tenant — a stale row in any scope must be reaped. Scope isolation applies to the per-tenant READ paths, not
-     *  to this maintenance sweep. */
-    expireStale(olderThanMs: number): Promise<number>;
-}
-/** approval row → {@link ApprovalRow} — shared by BOTH dialects. design/158 S8 归位 / A12 收编. */
-export declare function mapRow(r: Record<string, unknown>): ApprovalRow;
-/** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
-export declare class TiDBApprovalStore extends SqlApprovalStore {
-    constructor(pool: MySqlPool);
-}
-/** PostgreSQL binding — historical class name + ctor shape preserved. */
-export declare class PgApprovalStore extends SqlApprovalStore {
-    constructor(pool: PgPool);
-}
-//# sourceMappingURL=approval-store-sql.d.ts.map

package/dist/plugins/approval-store-sql.js

@@ -1,151 +0,0 @@
-import { parseJsonStrict as parseJson, toIsoOrNull as iso } from "./sql-row-helpers.js";
-import { pgProtocolJsonStringify } from "./pg-safe-json.js";
-import { mysqlDriver, pgDriver } from "./sql-driver.js";
-/** PG translation of the `approval` DDL in tidb-pool.ts SCHEMA_STATEMENTS (JSON→JSONB, DATETIME(3)→TIMESTAMPTZ(3),
- *  inline KEY→separate CREATE INDEX).
- *
- *  SCHEMA POLICY: see the header of pg-pool.ts — the code is the single source of truth, schema changes are
- *  drop-and-recreate, and NO new `ALTER TABLE` seams are added here; fold into the CREATE instead. */
-export const PG_APPROVAL_SCHEMA = [
-    `CREATE TABLE IF NOT EXISTS approval (
-     id          VARCHAR(64)  NOT NULL,
-     task_id     VARCHAR(64),
-     session_id  VARCHAR(64),
-     owner       VARCHAR(190),
-     -- Single-DB fleet scope guard (tenant isolation). NULLABLE on purpose: a NULL-scope row is an untenanted
-     -- run, and every read/decide path matches it with \`scope IS NOT DISTINCT FROM $n\` (the PG twin of TiDB
-     -- \`<=>\`) so NULL matches only NULL and one tenant's scope NEVER matches another's.
-     scope       VARCHAR(190),
-     tool_name   VARCHAR(190) NOT NULL,
-     args        JSONB,
-     status      VARCHAR(16)  NOT NULL,
-     reason      TEXT,
-     decided_by  VARCHAR(190),
-     created_at  TIMESTAMPTZ(3) NOT NULL,
-     decided_at  TIMESTAMPTZ(3),
-     PRIMARY KEY (id)
-   )`,
-    `CREATE INDEX IF NOT EXISTS idx_approval_owner_status ON approval (owner, status)`,
-    `CREATE INDEX IF NOT EXISTS idx_approval_status ON approval (status)`,
-    `CREATE INDEX IF NOT EXISTS idx_approval_scope_status ON approval (scope, status)`,
-];
-/** Idempotent self-contained schema apply (for the integration test; central aggregation is done separately). */
-export async function ensureSchema(pool) {
-    for (const stmt of PG_APPROVAL_SCHEMA)
-        await pool.query(stmt);
-}
-/** Dual-dialect durable approval store. See the file header for the dialect-delta ledger. */
-export class SqlApprovalStore {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    /** Pick the dialect's SQL text. Both statements stay written out at the call site ON PURPOSE. */
-    q(tidb, pg) {
-        return this.db.dialect === "tidb" ? tidb : pg;
-    }
-    /** JSON column binding: TiDB stores the string verbatim; PG goes through the LOSSLESS protocol envelope
-     *  (codex R4-H2 — the approval `args` is the operator's review surface and must agree with the
-     *  policy-executed args at the NUL position). */
-    json(value, label) {
-        return this.db.dialect === "tidb" ? JSON.stringify(value) : pgProtocolJsonStringify(value, label);
-    }
-    async createPending(id, scope, ctx) {
-        await this.db.query(this.q("INSERT INTO approval (id, task_id, session_id, owner, scope, tool_name, args, status, created_at) " +
-            "VALUES (?,?,?,?,?,?,?,'pending',?)", "INSERT INTO approval (id, task_id, session_id, owner, scope, tool_name, args, status, created_at) " +
-            "VALUES ($1,$2,$3,$4,$5,$6,$7::jsonb,'pending',$8)"), [
-            id,
-            ctx.taskId ?? null,
-            ctx.sessionId ?? null,
-            ctx.owner ?? null,
-            scope,
-            ctx.toolName,
-            ctx.args == null ? null : this.json(ctx.args, "approval args"),
-            new Date(),
-        ]);
-    }
-    async getStatus(id, scope) {
-        // null-safe scope match (`<=>` / `IS NOT DISTINCT FROM`): a NULL scope row (legacy / untenanted run) is
-        // matched by a NULL scope arg, and a tenant's scope NEVER matches another tenant's — the single-DB fleet
-        // read guard (defense-in-depth).
-        const { rows } = await this.db.query(this.q("SELECT status, reason, decided_by FROM approval WHERE id = ? AND scope <=> ?", "SELECT status, reason, decided_by FROM approval WHERE id = $1 AND scope IS NOT DISTINCT FROM $2"), [id, scope]);
-        const r = rows[0];
-        if (!r)
-            return undefined;
-        return { status: r.status, reason: r.reason ?? null, decidedBy: r.decided_by ?? null };
-    }
-    /** Apply a terminal decision, but only to a still-pending row (CAS). Returns whether it applied. The scope
-     *  guard (null-safe) is carried on the operator path too for consistency with the read paths. */
-    async decide(id, scope, decision, reason, decidedBy) {
-        const res = await this.db.query(this.q("UPDATE approval SET status = ?, reason = ?, decided_by = ?, decided_at = ? WHERE id = ? AND scope <=> ? AND status = 'pending'", "UPDATE approval SET status = $1, reason = $2, decided_by = $3, decided_at = $4 WHERE id = $5 AND scope IS NOT DISTINCT FROM $6 AND status = 'pending'"), [decision, reason, decidedBy, new Date(), id, scope]);
-        return res.affected === 1;
-    }
-    /** Pending approvals (operator queue), scoped to one tenant (single-DB fleet read guard, null-safe), optionally
-     *  further filtered to one owner. */
-    async listPending(scope, owner) {
-        const { rows } = owner
-            ? await this.db.query(this.q("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? AND owner = ? ORDER BY created_at ASC", "SELECT * FROM approval WHERE status = 'pending' AND scope IS NOT DISTINCT FROM $1 AND owner = $2 ORDER BY created_at ASC"), [scope, owner])
-            : await this.db.query(this.q("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? ORDER BY created_at ASC", "SELECT * FROM approval WHERE status = 'pending' AND scope IS NOT DISTINCT FROM $1 ORDER BY created_at ASC"), [scope]);
-        return rows.map(mapRow);
-    }
-    async get(id, scope) {
-        const { rows } = await this.db.query(this.q("SELECT * FROM approval WHERE id = ? AND scope <=> ?", "SELECT * FROM approval WHERE id = $1 AND scope IS NOT DISTINCT FROM $2"), [id, scope]);
-        return rows[0] ? mapRow(rows[0]) : undefined;
-    }
-    /** Operator-only CROSS-tenant by-id read (no scope filter). The F4 operator queue serves/decides across
-     *  tenants by design; the HTTP layer gates this to an operator and then re-binds decide() to the row's OWN
-     *  scope. Tenants NEVER reach this — they use the scope-bound {@link get}. */
-    async getById(id) {
-        const { rows } = await this.db.query(this.q("SELECT * FROM approval WHERE id = ?", "SELECT * FROM approval WHERE id = $1"), [id]);
-        return rows[0] ? mapRow(rows[0]) : undefined;
-    }
-    /** Operator-only CROSS-tenant pending list (no scope filter) — the unfiltered operator queue across all
-     *  tenants. Tenants use the scope-bound {@link listPending}; this is HTTP-gated to an operator.
-     *  🔴 identical SQL text on both dialects (no placeholders, nothing dialect-specific) — kept as ONE literal
-     *  rather than a `q()` pair so a reader isn't misled into looking for a divergence that isn't there. */
-    async listPendingAll() {
-        const { rows } = await this.db.query("SELECT * FROM approval WHERE status = 'pending' ORDER BY created_at ASC");
-        return rows.map(mapRow);
-    }
-    /** Expire pending approvals older than `olderThanMs` (a never-answered operator request). Deliberately GLOBAL
-     *  (NOT scope-filtered): staleness expiry is fleet-level maintenance that protects the worker regardless of
-     *  tenant — a stale row in any scope must be reaped. Scope isolation applies to the per-tenant READ paths, not
-     *  to this maintenance sweep. */
-    async expireStale(olderThanMs) {
-        const cutoff = new Date(Date.now() - olderThanMs);
-        const res = await this.db.query(this.q("UPDATE approval SET status = 'expired', reason = 'timed out before decision', decided_at = ? " +
-            "WHERE status = 'pending' AND created_at < ?", "UPDATE approval SET status = 'expired', reason = 'timed out before decision', decided_at = $1 " +
-            "WHERE status = 'pending' AND created_at < $2"), [new Date(), cutoff]);
-        return res.affected;
-    }
-}
-/** approval row → {@link ApprovalRow} — shared by BOTH dialects. design/158 S8 归位 / A12 收编. */
-export function mapRow(r) {
-    return {
-        id: String(r.id),
-        taskId: r.task_id ?? null,
-        sessionId: r.session_id ?? null,
-        owner: r.owner ?? null,
-        scope: r.scope ?? null,
-        toolName: String(r.tool_name),
-        args: parseJson(r.args),
-        status: r.status,
-        reason: r.reason ?? null,
-        decidedBy: r.decided_by ?? null,
-        createdAt: iso(r.created_at),
-        decidedAt: iso(r.decided_at),
-    };
-}
-/** MySQL-protocol (TiDB) binding — historical class name + ctor shape preserved. */
-export class TiDBApprovalStore extends SqlApprovalStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
-    }
-}
-/** PostgreSQL binding — historical class name + ctor shape preserved. */
-export class PgApprovalStore extends SqlApprovalStore {
-    constructor(pool) {
-        super(pgDriver(pool));
-    }
-}
-//# sourceMappingURL=approval-store-sql.js.map

package/dist/plugins/file-workflow-journal-store.d.ts

@@ -1,12 +0,0 @@
-/**
- * SVC-2 — FILE-backed durable WorkflowJournalStore for the LOCAL (TOC) backend.
- *
- * Now a RE-EXPORT of core's copy (the write-here-then-core-adopts 剧本): the implementation was written here for server
- * 1.89.0, then adopted verbatim by core (`@sema-agent/core` 1.223.0, file
- * `src/stores/file/workflow-journal-store.ts` — crash-safe per-run JSONL, scope-guarded [CORE-9],
- * idempotent-per-ordinal, oversize skip-journal, traversal-runId load degrade, 0o600/0o700). One source of
- * truth in core; the SQL twins (tidb/pg) stay service-side (dialect = deployment glue). The service test
- * suite (test/file-workflow-journal-store.test.ts) keeps pinning the contract through this re-export.
- */
-export { FileWorkflowJournalStore } from "@sema-agent/core";
-//# sourceMappingURL=file-workflow-journal-store.d.ts.map

package/dist/plugins/file-workflow-journal-store.js

@@ -1,12 +0,0 @@
-/**
- * SVC-2 — FILE-backed durable WorkflowJournalStore for the LOCAL (TOC) backend.
- *
- * Now a RE-EXPORT of core's copy (the write-here-then-core-adopts 剧本): the implementation was written here for server
- * 1.89.0, then adopted verbatim by core (`@sema-agent/core` 1.223.0, file
- * `src/stores/file/workflow-journal-store.ts` — crash-safe per-run JSONL, scope-guarded [CORE-9],
- * idempotent-per-ordinal, oversize skip-journal, traversal-runId load degrade, 0o600/0o700). One source of
- * truth in core; the SQL twins (tidb/pg) stay service-side (dialect = deployment glue). The service test
- * suite (test/file-workflow-journal-store.test.ts) keeps pinning the contract through this re-export.
- */
-export { FileWorkflowJournalStore } from "@sema-agent/core";
-//# sourceMappingURL=file-workflow-journal-store.js.map

package/dist/plugins/pg-approval-store.d.ts

@@ -1,9 +0,0 @@
-/**
- * Thin re-export shim (design/158 A12 收编 — see src/plugins/approval-store-sql.ts for the
- * implementation, now SINGLE-FILE DUAL-DIALECT alongside the TiDB twin). Class name, ctor arity,
- * and every exported type/const/helper stay EXACTLY as they were so no consumer (pg-pool.ts's
- * central schema composition, store-backend.ts, test/pg-approval-store-integration.test.ts) has
- * to move.
- */
-export { PgApprovalStore, PG_APPROVAL_SCHEMA, ensureSchema, type ApprovalRow, type ApprovalStatus, } from "./approval-store-sql.js";
-//# sourceMappingURL=pg-approval-store.d.ts.map

package/dist/plugins/pg-approval-store.js

@@ -1,9 +0,0 @@
-/**
- * Thin re-export shim (design/158 A12 收编 — see src/plugins/approval-store-sql.ts for the
- * implementation, now SINGLE-FILE DUAL-DIALECT alongside the TiDB twin). Class name, ctor arity,
- * and every exported type/const/helper stay EXACTLY as they were so no consumer (pg-pool.ts's
- * central schema composition, store-backend.ts, test/pg-approval-store-integration.test.ts) has
- * to move.
- */
-export { PgApprovalStore, PG_APPROVAL_SCHEMA, ensureSchema, } from "./approval-store-sql.js";
-//# sourceMappingURL=pg-approval-store.js.map

package/dist/plugins/pg-breaker-state.d.ts

@@ -1,8 +0,0 @@
-/**
- * Re-export shim (design/158 A12 收编) — the real implementation moved to breaker-state-sql.ts
- * (single-file dual-dialect: `SqlBreakerState` + the `TiDBBreakerState`/`PgBreakerState` ctor subclasses).
- * Kept so every consumer's `from "./pg-breaker-state.js"` import (incl. pg-pool.ts's central ensureSchema
- * composition and the real dual-DB integration suite) keeps working unchanged.
- */
-export { PgBreakerState, PG_BREAKER_STATE_SCHEMA, ensureSchema } from "./breaker-state-sql.js";
-//# sourceMappingURL=pg-breaker-state.d.ts.map

package/dist/plugins/pg-breaker-state.js

@@ -1,8 +0,0 @@
-/**
- * Re-export shim (design/158 A12 收编) — the real implementation moved to breaker-state-sql.ts
- * (single-file dual-dialect: `SqlBreakerState` + the `TiDBBreakerState`/`PgBreakerState` ctor subclasses).
- * Kept so every consumer's `from "./pg-breaker-state.js"` import (incl. pg-pool.ts's central ensureSchema
- * composition and the real dual-DB integration suite) keeps working unchanged.
- */
-export { PgBreakerState, PG_BREAKER_STATE_SCHEMA, ensureSchema } from "./breaker-state-sql.js";
-//# sourceMappingURL=pg-breaker-state.js.map

package/dist/plugins/pg-checkpoint-store.d.ts

@@ -1,10 +0,0 @@
-/**
- * PostgreSQL `CheckpointStore` — the implementation now lives in the single-file dual-dialect
- * `checkpoint-store-sql.ts` (design/158 A12 定型半场), alongside its TiDB twin so the dialect deltas
- * (placeholders, ON CONFLICT, `IS NOT DISTINCT FROM` + its placeholder-arity consequence, the lossless
- * JSON envelope) read side by side instead of drifting across two files.
- *
- * This file is the historical import path: class name and ctor shape unchanged.
- */
-export { PgCheckpointStore } from "./checkpoint-store-sql.js";
-//# sourceMappingURL=pg-checkpoint-store.d.ts.map

package/dist/plugins/pg-checkpoint-store.js

@@ -1,10 +0,0 @@
-/**
- * PostgreSQL `CheckpointStore` — the implementation now lives in the single-file dual-dialect
- * `checkpoint-store-sql.ts` (design/158 A12 定型半场), alongside its TiDB twin so the dialect deltas
- * (placeholders, ON CONFLICT, `IS NOT DISTINCT FROM` + its placeholder-arity consequence, the lossless
- * JSON envelope) read side by side instead of drifting across two files.
- *
- * This file is the historical import path: class name and ctor shape unchanged.
- */
-export { PgCheckpointStore } from "./checkpoint-store-sql.js";
-//# sourceMappingURL=pg-checkpoint-store.js.map

package/dist/plugins/pg-file-snapshot-store.d.ts

@@ -1,8 +0,0 @@
-/**
- * Thin re-export shim (design/158 A12 定型半场) — the real implementation collapsed into
- * `file-snapshot-store-sql.ts` (single file, dual dialect). Kept so every existing import path
- * (store-backend.ts, the migration script, the contract/integration/minio-equivalence suites) is
- * untouched: same class name, same ctor arity, same exported surface.
- */
-export { PgFileSnapshotStore } from "./file-snapshot-store-sql.js";
-//# sourceMappingURL=pg-file-snapshot-store.d.ts.map

package/dist/plugins/pg-file-snapshot-store.js

@@ -1,8 +0,0 @@
-/**
- * Thin re-export shim (design/158 A12 定型半场) — the real implementation collapsed into
- * `file-snapshot-store-sql.ts` (single file, dual dialect). Kept so every existing import path
- * (store-backend.ts, the migration script, the contract/integration/minio-equivalence suites) is
- * untouched: same class name, same ctor arity, same exported surface.
- */
-export { PgFileSnapshotStore } from "./file-snapshot-store-sql.js";
-//# sourceMappingURL=pg-file-snapshot-store.js.map

package/dist/plugins/pg-image-bake.d.ts

@@ -1,12 +0,0 @@
-/**
- * PostgreSQL BAKE store — the implementation now lives in the single-file dual-dialect
- * `image-bake-store-sql.ts` (design/158 A12 定型半场), alongside its TiDB twin so the dialect deltas
- * (placeholders, ON CONFLICT, jsonb casts, the admission-statement divergence, the PG-only
- * protocol-byte defenses) read side by side instead of drifting across two files.
- *
- * This file is the historical import path: class name, ctor shape, `PG_IMAGE_BAKE_SCHEMA` and
- * `ensureSchema` are unchanged, so pg-pool.ts / store-backend.ts / the integration suite are untouched.
- */
-export { PgImageBake, PG_IMAGE_BAKE_SCHEMA, ensurePgImageBakeSchema as ensureSchema } from "./image-bake-store-sql.js";
-export type { BakeStatus, BakeState, BakeErrorCode, BakeRecord, BakeEvent, CreateBakeInput, BakeTerminal, } from "./store-contracts.js";
-//# sourceMappingURL=pg-image-bake.d.ts.map

package/dist/plugins/pg-image-bake.js

@@ -1,11 +0,0 @@
-/**
- * PostgreSQL BAKE store — the implementation now lives in the single-file dual-dialect
- * `image-bake-store-sql.ts` (design/158 A12 定型半场), alongside its TiDB twin so the dialect deltas
- * (placeholders, ON CONFLICT, jsonb casts, the admission-statement divergence, the PG-only
- * protocol-byte defenses) read side by side instead of drifting across two files.
- *
- * This file is the historical import path: class name, ctor shape, `PG_IMAGE_BAKE_SCHEMA` and
- * `ensureSchema` are unchanged, so pg-pool.ts / store-backend.ts / the integration suite are untouched.
- */
-export { PgImageBake, PG_IMAGE_BAKE_SCHEMA, ensurePgImageBakeSchema as ensureSchema } from "./image-bake-store-sql.js";
-//# sourceMappingURL=pg-image-bake.js.map