@sema-agent/settings-schema 4.0.0 → 5.0.0

package/CHANGELOG.md

@@ -6,6 +6,34 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 5.0.0 — 2026-09-23 — `DeviceCodeResponse.verification_uri_complete` 改为**可选**(BREAKING,校验放宽;S-615)
+
+> **版号裁定(发布方)**:本批只有一处改动 —— 设备码授权响应里 `verification_uri_complete` 由必填改为可选。
+> 照下方「发版纪律」的「校验收紧**或放宽** = major」判 **5.0.0**:按上一版契约写的读方可能把它当恒在的
+> `string` 用,放宽后同一份响应在本包下解析得出、到它那里却是 `undefined`。**零别名、零双读**:推导型由
+> `string` 变 `string | undefined`,读方若把它当 `string` 直接用会在 tsc 上红 —— 那一格红就是通知。
+> 持久数据面**零影响**(不碰任何存储形)。
+
+**三问**:
+- **谁需要** = 读方与 RFC 8628 §3.2 对齐:该字段在 RFC 里是 **OPTIONAL**。本包此前写成 `z.string().min(1)`
+  必填,而 CLI 读方在运行期本来就按「可能没有」加了守卫 —— 型面说必填、运行期说可缺,是同一件事的两种读法
+  (clay 裁 C-R91 C⑥:型面改可选,单源说真话)。
+- **谁受伤** = 把它当恒在 `string` 读的消费方。逐仓亲读(`git grep`,不含 test/ 与 dist):**生产方**管理台
+  `sema-web-admin` 2 处(`src/app/api/v1/auth/device/code/route.ts` 照发不变、`src/app/activate/page.tsx`);
+  **读方**CLI `sema-cli` 1 处真读(`src/cli/handlers/cloud.ts:70`,已有 `if (device.verification_uri_complete)`
+  守卫,另 `src/sema/cloudAuth.ts:4` 是注释)、client-core `src/model/providerAuth.ts:174` 读的是它**自己声明**的
+  `verification_uri_complete?: unknown`(不经本包推导型,已守卫);SDK 源码 0 处(只有 `docs/manual/ch7-registry-control.md:59`
+  文档一行与 3 处测试夹具);worker 服务 / core / 测试仓 0。⇒ 预计**零处** tsc 红;SDK 手册那一行要跟着说「可选」。
+- **什么补偿** = 生产方行为不变(管理台照发该字段);读方的正确读法 = 「在场 ⇒ 一键 / 二维码路径;缺席 ⇒ 展示
+  `verification_uri` + `user_code`」。**在场但为空串仍拒**(`min(1)` 不变)—— 可选是本批**唯一**的放宽。
+
+**迁移三句**:① 读 `verification_uri_complete` 的代码按 `string | undefined` 处理(缺席时退回 `verification_uri`
++ `user_code`);② 生产方无需改动;③ 手写了该响应 JSON Schema / OpenAPI 的消费方把它移出 `required`
+(本包 `docs/openapi-auth.yaml` 已同步)。
+
+**红先**:`test/api-auth.test.ts` 新格(缺席可解析 / 在场原样 / 空串仍拒)修前 **1 failed / 34 passed**
+(缺席被拒 `Required`)→ 修后 35/35。
+
 ## 4.0.0 — 2026-09-22 — 引用完整性的**域闭集发成运行期值**(additive)+ `RefIssue.path` 六臂坐标**统一成以域键起手**(BREAKING,值形)+ 诊断面回**真实总数**(BREAKING,返回形)+ 告警投影改**机器派生**并搬回属主(BREAKING,模块面)+ `fileSchedulerStore` → `createFileSchedulerStore`(BREAKING,重命名,零别名)+ 一致性门来源律改**运行期拒**+ prompts 摘要搬出调度存储并合并铸点 + 四道机器门
 
 > **版号裁定(发布方)**:本批两件里有一件是**值形**破坏性改动 —— `refIntegrityIssues` 返回的

package/conformance/VERSION

@@ -1 +1 @@
-4.0.0
+5.0.0

package/dist/api/auth.d.ts

@@ -121,8 +121,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */
@@ -134,8 +135,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */
@@ -147,8 +149,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */

package/dist/api/auth.js

@@ -146,8 +146,9 @@ export const DeviceCodeResponse = z
     user_code: z.string().min(1),
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.string().min(1),
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.string().min(1),
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.string().min(1).optional(),
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.number().int().positive(),
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",