@sema-agent/server 7.79.1 → 7.79.3

package/dist/boot/stage-08-reapers.d.ts

@@ -0,0 +1,172 @@
+/**
+ * 装配第 8 段 —— **后台 reaper**(§3-8)。
+ * 维护 tick(startReapers)+ 托管留存 lane(独立定时器)+ OTLP 导出 + 限额座换代口 + 五只 boot Runner 的
+ * 原子换代闭包 + config-center 刷新环与 key resolver 首建。
+ * ⚠️ 位置即契约:刷新环必须在 `new Runner` 之后(runnerTierFrozen 与构造函数读同一 config 代际);
+ * key resolver 首建读的必须是 boot apply 之后的 config。
+ * 🔴 `runDenySweep` 的 holder 住在 `late-binds.ts`(赋值点在第十段的 server 之后)。
+ */
+import { Runner } from "@sema-agent/core";
+import type { runStage07 } from "./stage-07-capability-layer.js";
+export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>): {
+    otelExporter: {
+        stop(): void;
+    } | undefined;
+    reaper: NodeJS.Timeout;
+    retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
+    approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
+    approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
+    authorize: (ctx: {
+        req: import("http").IncomingMessage;
+        body: import("../index.js").TaskRequestBody;
+    }) => Promise<import("../security.js").AuthContext>;
+    imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
+    imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
+    parkedReviveInheritedGate: ((row: import("@sema-agent/core").BackgroundAgentRecord, identity: import("./parked-revive-gate.js").ParkedReviveIdentity) => Promise<import("./parked-revive-gate.js").RebuiltInheritedGate>) | undefined;
+    parkedReviveTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    rateLimiter: import("../index.js").RateLimiter | import("../plugins/pg-rate-limiter.js").PgRateLimiter | import("../plugins/tidb-rate-limiter.js").TiDBRateLimiter;
+    resumeAnchorStore: import("../plugins/store-backend.js").ResumeAnchorStore | undefined;
+    runStore: import("../plugins/store-backend.js").RunStore | undefined;
+    scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
+    scenarios: Record<string, import("../index.js").Scenario>;
+    selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    singleUserAutoAcceptBaseline: boolean;
+    taskLimitCaps: {
+        timeoutSec: number | undefined;
+        maxOutputTokens: number | undefined;
+        maxTurns: number | undefined;
+    };
+    taskTimeoutSec: number;
+    approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
+    centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
+    checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    durableEnabled: boolean;
+    elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
+    fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
+    governanceSeams: import("./governance-seams.js").GovernanceSeams;
+    handslessRunner: Runner;
+    handslessSubRunner: Runner;
+    hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
+    hookAgentRunner: Runner;
+    hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
+    mcpRevocations: import("../config-center/mcp-revocation.js").McpRevocationLedger;
+    memoryConsolidationFaces: import("./memory-consolidation.js").MemoryConsolidationFaces | undefined;
+    memoryOptOutGrantStore: import("../plugins/memory-optout-grant-store-sql.js").MemoryOptOutGrantStore | undefined;
+    orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
+    principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
+    question: import("../question.js").QuestionCoordinator | undefined;
+    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
+    runner: Runner;
+    runnerDeps: import("@sema-agent/core").RunnerDeps;
+    runnerTierFrozen: boolean;
+    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
+    sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
+    sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    sessionShellGateRegistry: import("./session-shell-gate-registry.js").SessionShellGateRegistry;
+    sessionTitler: import("../session-titler.js").SessionTitler | undefined;
+    sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
+    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    subRunner: Runner;
+    subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
+    subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
+    toolApproval: import("../tool-approval.js").ToolApprovalCoordinator | undefined;
+    workflowAgentRegistry: import("../orchestration/workflow-agent-steer.js").WorkflowAgentRegistry | undefined;
+    workflowAgentSessionIndex: import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex | undefined;
+    workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
+    workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
+    workflowModelAllowlistSnapshot: readonly string[];
+    workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
+    workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
+    workflowRecoverOpts: {
+        orphanGraceMs?: number;
+        finalizeStartedBeforeMs?: number;
+        publishTerminalFleetRow?: (id: string, run: import("@sema-agent/core").WorkflowRun) => void;
+    };
+    workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
+    workflowsCapable: boolean;
+    deploymentHooks: import("@sema-agent/core").Hooks;
+    deviceLane: import("./device-lane.js").DeviceLane | undefined;
+    dropSessionScoped: (sid: string) => void;
+    executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    perSessionCwd: Map<string, string>;
+    perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
+    sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
+    setSessionCwd: (sid: string, cwd: string) => void;
+    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    worktreeReap: (() => Promise<void>) | undefined;
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error
+        /** 租约 TTL = 2× sweep 间隔(§3)。抢租与每 domain 的续租共用同一个值 —— 两处手抄迟早只改一处。 */
+        ?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+};
+//# sourceMappingURL=stage-08-reapers.d.ts.map

package/dist/boot/stage-08-reapers.js

@@ -0,0 +1,78 @@
+import { Runner } from "@sema-agent/core";
+import { startOtlpExporter } from "../observability/otel-exporter.js";
+import { startReapers } from "./reapers.js";
+import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane.js";
+import { createLimitSync } from "./limit-sync.js";
+import { runDenySweep } from "./late-binds.js";
+export function runStage08(ctx) {
+    const { approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, config, configCenter, costQuota, fileHistoryStore, handslessRunner, handslessSubRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, runnerTierFrozen, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
+    const reaper = startReapers({
+        config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore,
+        rateLimiter, costQuota, toolResultStore, fileHistoryStore, taskAttachmentStore, imageBakes, worktreeReap,
+        workflowNotifyGate, workflowRecoverOpts, workflowJournalStore, sqlWorkflowRunStore, workflowNotifyJournal, rosterStore,
+        backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore,
+        getRunDenySweep: () => runDenySweep,
+    });
+    const ttlMs = config.retentionSweep.intervalSec * 1000 * RETENTION_LEASE_TTL_FACTOR;
+    const retentionLaneStarted = retentionExecutor !== undefined && retentionLaneStore !== undefined && config.retentionPolicy !== undefined
+        ? startRetentionLane({
+            intervalSec: config.retentionSweep.intervalSec,
+            policy: config.retentionPolicy,
+            mode: config.retentionSweep.mode,
+            executor: retentionExecutor,
+            lease: {
+                acquire: async () => {
+                    const claim = await retentionLaneStore.acquire(instanceId, ttlMs, Date.now());
+                    return claim.held ? { held: true, fencingToken: claim.fencingToken } : { held: false };
+                },
+                renew: (fencingToken) => retentionLaneStore.renew(instanceId, fencingToken, ttlMs, Date.now()),
+                release: () => retentionLaneStore.release(instanceId),
+            },
+            audit: { append: (row) => retentionLaneStore.appendAudit(row, Date.now()) },
+            holdInForce: (domain) => retentionLaneStore.holdInForce(domain),
+            logger,
+            metrics,
+            now: () => Date.now(),
+        })
+        : undefined;
+    if (retentionLaneStarted !== undefined) {
+        logger.info("retention_lane_started", {
+            intervalSec: config.retentionSweep.intervalSec,
+            mode: config.retentionSweep.mode,
+            maxAgeDays: config.retentionPolicy?.maxAgeDays,
+            holder: instanceId,
+        });
+    }
+    const otelExporter = config.otel
+        ? startOtlpExporter(metrics, {
+            ...config.otel,
+            onError: (err) => logger.warn("otel_export_failed", { err: String(err) }),
+        })
+        : undefined;
+    const limitSync = createLimitSync({ config, rateGate: rateLimiter, quota: costQuota, logger });
+    limitSync.sync();
+    const bootRunners = [
+        ["runner", runner],
+        ["handsless", handslessRunner],
+        ["hookAgent", hookAgentRunner],
+        ["sub", subRunner],
+        ["handslessSub", handslessSubRunner],
+    ];
+    const swapRunnerDeps = (next) => {
+        for (let i = 0; i < bootRunners.length; i++) {
+            const [name, rn] = bootRunners[i];
+            try {
+                rn.swapDeps(next);
+            }
+            catch (err) {
+                if (i > 0)
+                    logger.error("runner_deps_swap_split", { failedAt: name, seats: Object.keys(next), swapped: bootRunners.slice(0, i).map(([n]) => n), err: String(err) });
+                throw err;
+            }
+        }
+    };
+    configCenter.startRefreshLoop({ runnerTierFrozen, pricing, limitSync, swapRunnerDeps, ceilingVerdict });
+    configCenter.initKeyResolver();
+    return { ...ctx, otelExporter, reaper, retentionLaneStarted };
+}
+//# sourceMappingURL=stage-08-reapers.js.map

package/dist/boot/stage-09-leader.d.ts

@@ -0,0 +1,204 @@
+import type { runStage08 } from "./stage-08-reapers.js";
+export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>): {
+    drainState: {
+        draining: boolean;
+        since?: number;
+        reason?: string;
+        inflight?: () => number;
+        lastActivityAt?: () => number;
+        attachedStreams?: () => number;
+        lastAttachEndedAt?: () => number;
+    };
+    hookWakeBus: {
+        deliver?: (sessionId: string, text: string) => Promise<boolean>;
+    };
+    instrumentDegenerate: ((result: import("@sema-agent/core").TaskResult) => void) | undefined;
+    leaderEndpoint: import("../leader/endpoint.js").LeaderEndpoint | undefined;
+    ownerAware: import("../security.js").OwnerAwareSessionStore;
+    planCacheProbe: import("../plan-cache-probe.js").PlanCacheProbe;
+    purgeSession: ((sessionId: string, owner: string | null) => Promise<{
+        deleted: boolean;
+    } | {
+        active: string;
+    }>) | undefined;
+    registryJwtVerifier: import("../auth-bridge.js").RegistryJwtVerifier | undefined;
+    sessionAudit: ((sessionId: string) => Promise<{
+        owner: string | null;
+        sessionId: string;
+        createdAt: string;
+        floorEntryId: string | null;
+        thinkingLevel: string;
+        model: {
+            provider: string;
+            modelId: string;
+        } | null;
+        messages: unknown[];
+        promptEpoch?: {
+            epoch: number;
+            artifactDigest: string;
+            packId: string;
+            assemblyApi: number;
+            activatedBy: "session_start" | "compaction" | "legacy_migration";
+        };
+    } | undefined>) | undefined;
+    sessionWatchRegistry: import("../session-watch.js").SessionWatchRegistry | undefined;
+    staticWiring: import("@sema-agent/core").WiringManifest;
+    otelExporter: {
+        stop(): void;
+    } | undefined;
+    reaper: NodeJS.Timeout;
+    retentionLaneStarted: import("./retention-lane.js").RetentionLaneController | undefined;
+    approvalExemptionStore: import("../plugins/approval-exemption-store.js").ApprovalExemptionStore | undefined;
+    approvalNonceStore: import("../plugins/approval-nonce-store.js").ApprovalNonceStore | undefined;
+    authorize: (ctx: {
+        req: import("http").IncomingMessage;
+        body: import("../index.js").TaskRequestBody;
+    }) => Promise<import("../security.js").AuthContext>;
+    imageBakes: import("../plugins/store-backend.js").ImageBake | undefined;
+    imageIndex: import("../plugins/store-backend.js").ImageIndex | undefined;
+    parkedReviveInheritedGate: ((row: import("@sema-agent/core").BackgroundAgentRecord, identity: import("./parked-revive-gate.js").ParkedReviveIdentity) => Promise<import("./parked-revive-gate.js").RebuiltInheritedGate>) | undefined;
+    parkedReviveTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    rateLimiter: import("../index.js").RateLimiter | import("../plugins/pg-rate-limiter.js").PgRateLimiter | import("../plugins/tidb-rate-limiter.js").TiDBRateLimiter;
+    resumeAnchorStore: import("../plugins/store-backend.js").ResumeAnchorStore | undefined;
+    runStore: import("../plugins/store-backend.js").RunStore | undefined;
+    scenarioDetails: Record<string, import("../capabilities/scenarios.js").ScenarioDetail>;
+    scenarios: Record<string, import("../index.js").Scenario>;
+    selectEnvTool: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    singleUserAutoAcceptBaseline: boolean;
+    taskLimitCaps: {
+        timeoutSec: number | undefined;
+        maxOutputTokens: number | undefined;
+        maxTurns: number | undefined;
+    };
+    taskTimeoutSec: number;
+    approvalAskAudit: import("../approval-ask-audit-store.js").FileApprovalAskAuditStore | undefined;
+    centerRuntimeCapsResolver: ((principal: string | undefined) => Promise<import("@sema-agent/core").RuntimeCaps | undefined>) | undefined;
+    checkpointStore: import("../plugins/store-backend.js").CheckpointStoreFull | undefined;
+    durableEnabled: boolean;
+    elicitation: import("../elicitation.js").ElicitationCoordinator | undefined;
+    fleetBus: import("../fleet/fleet-bus.js").FleetEventBus;
+    governanceSeams: import("./governance-seams.js").GovernanceSeams;
+    handslessRunner: import("@sema-agent/core").Runner;
+    handslessSubRunner: import("@sema-agent/core").Runner;
+    hookAgent: import("../hooks/hook-runner.js").HookLlmCall;
+    hookAgentRunner: import("@sema-agent/core").Runner;
+    hookLlm: import("../hooks/hook-runner.js").HookLlmCall;
+    mcpRevocations: import("../config-center/mcp-revocation.js").McpRevocationLedger;
+    memoryConsolidationFaces: import("./memory-consolidation.js").MemoryConsolidationFaces | undefined;
+    memoryOptOutGrantStore: import("../plugins/memory-optout-grant-store-sql.js").MemoryOptOutGrantStore | undefined;
+    orgMemoryAdmission: import("./org-memory.js").OrgMemoryAdmissionWiring;
+    outcomeSink: import("../plugins/file-outcome-sink.js").OutcomeSink | undefined;
+    principalCaps: import("../runtime-caps-resolver.js").PrincipalEntitlementsClient | undefined;
+    question: import("../question.js").QuestionCoordinator | undefined;
+    retentionExecutor: import("../plugins/retention-store-sql.js").SqlRetentionStore | undefined;
+    retentionLaneStore: import("../plugins/retention-lane-store-sql.js").RetentionLaneStore | undefined;
+    runner: import("@sema-agent/core").Runner;
+    runnerDeps: import("@sema-agent/core").RunnerDeps;
+    runnerTierFrozen: boolean;
+    runtimeCapsPeekResolver: import("../runtime-caps-resolver.js").EntitlementsResolverFn | undefined;
+    sendFileLedger: import("../plugins/send-file-ledger.js").SendFileLedger | undefined;
+    sendUserFileEmitter: import("../capabilities/send-user-file-tool.js").SendUserFileEmitter | undefined;
+    sendUserFileToolSpec: import("@sema-agent/core").ToolSpec<import("@sema-agent/core").TSchema> | undefined;
+    sessionShellGateRegistry: import("./session-shell-gate-registry.js").SessionShellGateRegistry;
+    sessionTitler: import("../session-titler.js").SessionTitler | undefined;
+    sharedMemoryStore: import("../plugins/shared-memory-store-sql.js").SqlSharedMemoryStore | undefined;
+    sqlWorkflowRunStore: import("@sema-agent/core").WorkflowRunStore | undefined;
+    streamApprovalGate: import("../tool-approval.js").StreamApprovalGate;
+    subRunner: import("@sema-agent/core").Runner;
+    subRunnerSessions: import("../plugins/fork-routing-session-store.js").ForkRoutingSessionStore;
+    subagentSteerRegistry: import("../orchestration/subagent-steer.js").SubagentSteerRegistry;
+    toolApproval: import("../tool-approval.js").ToolApprovalCoordinator | undefined;
+    workflowAgentRegistry: import("../orchestration/workflow-agent-steer.js").WorkflowAgentRegistry | undefined;
+    workflowAgentSessionIndex: import("../orchestration/workflow-agent-session-index.js").WorkflowAgentSessionIndex | undefined;
+    workflowCompletionInbox: import("../orchestration/workflow-completion-inbox.js").WorkflowCompletionInbox | undefined;
+    workflowJournalStore: import("../plugins/store-backend.js").ServiceWorkflowJournalStore | undefined;
+    workflowModelAllowlistSnapshot: readonly string[];
+    workflowNotifyGate: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyGate | undefined;
+    workflowNotifyJournal: import("../orchestration/workflow-notify-journal.js").WorkflowNotifyJournalStore | undefined;
+    workflowRecoverOpts: {
+        orphanGraceMs?: number;
+        finalizeStartedBeforeMs?: number;
+        publishTerminalFleetRow?: (id: string, run: import("@sema-agent/core").WorkflowRun) => void;
+    };
+    workflowRunStore: import("../orchestration/workflow-notify-journal.js").JournalingWorkflowRunStore | undefined;
+    workflowsCapable: boolean;
+    deploymentHooks: import("@sema-agent/core").Hooks;
+    deviceLane: import("./device-lane.js").DeviceLane | undefined;
+    dropSessionScoped: (sid: string) => void;
+    executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
+    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    lspManager: import("../lsp/manager.js").E2bLspManager | import("@sema-agent/core").NodeLspManager | undefined;
+    perSessionCwd: Map<string, string>;
+    perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
+    sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;
+    sessionEnvSelection: import("../capabilities/select-environment-tool.js").SessionEnvironmentSelection;
+    setSessionCwd: (sid: string, cwd: string) => void;
+    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    worktreeReap: (() => Promise<void>) | undefined;
+    brain: import("@sema-agent/core").Brain;
+    costQuota: import("../observability/cost-quota.js").CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
+    counterDegradeHook: (info: {
+        table: string;
+        kind: string;
+        streak: number;
+        prevStreak: number;
+        error?: string;
+    }) => void;
+    fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
+    fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
+    memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
+    memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;
+    modelUsageTracker: import("../budget.js").ModelUsageTracker;
+    permissionRuleProvider: import("@sema-agent/core").PermissionRuleStoreProvider | undefined;
+    permissionRuleStores: import("../rules-consent.js").PermissionRuleStoreBundle | undefined;
+    pricing: Record<string, import("@sema-agent/core").ModelPricing>;
+    promptManifestTracker: import("../budget.js").PromptManifestTracker;
+    ruleConsent: import("../rules-consent.js").RuleConsentLane | undefined;
+    sessionMemoryStatusFace: import("../memory-operator-faces.js").SessionMemoryStatusFace | undefined;
+    sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
+    sideQueryAccounting: (principal: string | undefined, r: {
+        model: string;
+        usage?: {
+            input?: number;
+            output?: number;
+            cacheRead?: number;
+            cacheWrite?: number;
+            cost?: {
+                total?: number;
+            };
+        };
+    }) => void;
+    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    tracer: import("@sema-agent/core").TracerHook;
+    backend: import("../index.js").StoreBackend | undefined;
+    backgroundAgentStore: import("@sema-agent/core").BackgroundAgentStore | undefined;
+    breakerState: import("../plugins/breaker-state-sql.js").TiDBBreakerState | import("../plugins/breaker-state-sql.js").PgBreakerState | undefined;
+    instanceId: string;
+    mailboxStore: import("@sema-agent/core").MailboxStore | undefined;
+    memoryEngine: {
+        backend: import("@sema-agent/core").MemoryBackend;
+        root: string;
+    } | undefined;
+    memoryExportBackend: import("@sema-agent/core").MemoryBackend | undefined;
+    memoryPosture: import("../memory-posture.js").MemoryPosture;
+    memorySyncCursors: import("../plugins/memory-sync-store-pg.js").MemorySyncStore | undefined;
+    memorySyncRunner: import("../memory-sync-client.js").MemorySyncRunner | undefined;
+    rosterStore: import("@sema-agent/core").RosterStore | undefined;
+    sessionCaptureRecordStore: import("@sema-agent/core").SessionCaptureRecordStore | undefined;
+    sessionCaptureRecords: import("../index.js").SessionCaptureRecordSource | undefined;
+    sessionStore: import("@sema-agent/core").SessionStore;
+    sqlEngineFacts: (() => import("../plugins/sql-driver.js").SqlEngineFacts | null) | undefined;
+    storeBackendDegraded: boolean;
+    taskAttachmentStore: import("../plugins/task-attachment-store.js").TaskAttachmentStore | undefined;
+    taskListLane: import("./task-list-lane.js").TaskListLane;
+    usageWindowStore: import("@sema-agent/core").UsageWindowStore | undefined;
+    ceilingVerdict: import("./unpriced-ceiling-verdict.js").UnpricedCeilingVerdict;
+    configCenter: import("./config-center.js").ConfigCenterRuntime;
+    config: import("../config-types.js").ServiceConfig;
+    localRoot: string;
+    logger: import("../index.js").Logger;
+    metrics: import("../index.js").Metrics;
+};
+//# sourceMappingURL=stage-09-leader.d.ts.map

package/dist/boot/stage-09-leader.js

@@ -0,0 +1,47 @@
+import { describeStaticWiring } from "@sema-agent/core";
+import { encodeCheckpointScope } from "../security.js";
+import { createRegistryJwtVerifier } from "../auth-bridge.js";
+import { createSessionFaces } from "./session-faces.js";
+import { createLeaderFace } from "./leader.js";
+import { assertStaticWiringConsistent } from "../http/routes/diagnostics.js";
+export function runStage09(ctx) {
+    const { approvalExemptionStore, backend, brain, checkpointStore, config, configCenter, deviceLane, dropSessionScoped, durableEnabled, executionEnvFactory, fileHistoryStore, governanceSeams, localRoot, logger, metrics, pricing, resumeAnchorStore, runStore, runnerDeps, sessionPolicyStore, sessionStore, streamApprovalGate, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore, workflowCompletionInbox } = ctx;
+    const { ownerAware, sessionAudit, sessionWatchRegistry, purgeSession, instrumentDegenerate, planCacheProbe } = createSessionFaces({
+        deviceStore: deviceLane?.store,
+        dropSessionScoped,
+        config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore,
+        resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryStore,
+        workflowCompletionInbox, taskListLane,
+    });
+    const leaderEndpoint = createLeaderFace({ config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, governanceSeams, backend, tracer, usageWindowStore, promptSource: configCenter.promptSource, onError: runnerDeps.onError });
+    const drainState = { draining: false };
+    const authBridgeIssuer = process.env.AUTH_BRIDGE_ISSUER || config.configCenter?.baseUrl;
+    const registryJwtVerifier = authBridgeIssuer
+        ? createRegistryJwtVerifier({
+            issuer: authBridgeIssuer,
+            ...(process.env.AUTH_BRIDGE_JWKS_URL ? { jwksUrl: process.env.AUTH_BRIDGE_JWKS_URL } : {}),
+            ...(process.env.AUTH_BRIDGE_AUDIENCE ? { audience: process.env.AUTH_BRIDGE_AUDIENCE } : {}),
+            logger,
+            metrics,
+        })
+        : undefined;
+    if (registryJwtVerifier)
+        logger.info("auth_bridge_enabled", { issuer: authBridgeIssuer });
+    const hookWakeBus = {};
+    const wiringSpecTemplate = durableEnabled
+        ? { checkpointStore, durableApproval: { scope: encodeCheckpointScope(undefined) } }
+        : {};
+    const staticWiring = describeStaticWiring(runnerDeps, wiringSpecTemplate);
+    assertStaticWiringConsistent({ manifest: staticWiring, parkFacility: durableEnabled, backendKind: backend?.kind }, logger);
+    logger.info("wiring_static", {
+        fingerprint: staticWiring.configFingerprint ?? null,
+        parkEffective: staticWiring.parkLane.effective,
+        sessionDurability: staticWiring.session.store,
+        posture: staticWiring.interaction.posture,
+        streamApproval: streamApprovalGate.active ? "active" : streamApprovalGate.reason,
+        subagentTranscripts: staticWiring.fleet.subagentTranscripts,
+        subagentTranscriptRetentionMs: config.backgroundAgentRetentionMs,
+    });
+    return { ...ctx, drainState, hookWakeBus, instrumentDegenerate, leaderEndpoint, ownerAware, planCacheProbe, purgeSession, registryJwtVerifier, sessionAudit, sessionWatchRegistry, staticWiring };
+}
+//# sourceMappingURL=stage-09-leader.js.map