@sema-agent/settings-schema 4.0.0 → 6.0.0

package/CHANGELOG.md

@@ -6,6 +6,61 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 6.0.0 — 2026-09-24 — `crossSessionInbound` 词表随 core 7.30.0 改为 `wake / next-turn / hold / refuse`,`accept` 退役(BREAKING,枚举改词;server S-616 提货同批)
+
+> **版号裁定(发布方)**:本批只有一处改动 —— `CROSS_SESSION_INBOUND_VALUES` 由 `["accept","hold","refuse"]`
+> 改为 `["wake","next-turn","hold","refuse"]`(顺序即收紧秩)。照「发版纪律」的「枚举重排 / 让同一份配置解析出
+> 不同结果 = major」判 **6.0.0**:写着 `accept` 的 `settings.json` 在 5.0.0 下合法,在本版下 `ok:false` / zod 拒。
+> **零别名、零双读**(clay 宪法 2026-09-12「硬 breaking 三句」):本包不把 `accept` 折成 `next-turn` ——
+> core 在**自己的**层里做那一步(`CROSS_SESSION_INBOUND_DEPRECATED_SPELLINGS`,读成 `next-turn` 并 `onError`
+> 一次),那是 core 的持久数据窗;本包的文件层响亮拒,那一格红就是通知。持久数据面**只此一键**(`settings.json`
+> 的 `crossSessionInbound`),迁移 = 把 `accept` 改写成 `next-turn`(原义)或 `wake`(新档)。
+
+**锁步序(core 发车帖 [8223] 的 order law)**:core 7.30.0 先 → 本包 6.0.0 → server 的锁步钉与 `CROSS_SESSION_INBOUND`
+env 词表(server 7.100.0,车NK)→ 之后宿主才可写 `wake`;一台还在读 5.0.0 的宿主写 `wake` 会被本包拒(`ok:false`),
+一台 pre-7.30 core 读 `wake` 会 `invalid-setting` 全 hold —— 两个方向都响亮,没有静默档。
+
+**三问**:
+- **谁需要** = 装了 core ≥ 7.30.0 的消费方:两份词表**必须逐字相等**(`src/cross-session.ts` 头注「与引擎词表
+  的锁步」),server 的锁步钉 `test/cross-session-settings-s111.test.ts` 在 core 7.30.1 提货后对着 5.0.0 真红。
+- **谁受伤** = (a) `settings.json` 里写了 `crossSessionInbound: "accept"` 的用户 / 仓:本包层响亮拒,改写成
+  `next-turn`;(b) 钉着旧三值的消费方测试(逐仓 `git grep` origin/main,2026-09-24 08:5x):**cli / web-admin /
+  client-core 均 0 处读本闭集**(只需抬 pin `^6.0.0`,由 server 的 settings-schema 值班门 1.9 催);**test 仓 7 处**
+  夹具引用(@test 自校);**server** 锁步钉 + env 词表(车NK 同批翻);core 14 处是它自己的词表源。
+- **补偿** = 拒因点名键与合法词(`readCrossSessionInbound` → `ok:false`,宿主的受理面 400 / 文件层告警照旧);
+  core 侧对旧拼写的一次性读兼容仍在(见上),所以**已落盘**的 `accept` 在 core 层不会突然变成 hold。
+
+**红先**:`test/cross-session-1.6.test.ts` ① 四值逐字 / ② 受理 wake、next-turn / ② `accept` 响亮拒 —— 翻钉后对
+5.0.0 源 **4 红 / 18 绿**,改源后 22 绿。文档同批:README 跨会话段、llms.txt / llms-full.txt 4.5b 段。
+
+## 5.0.0 — 2026-09-23 — `DeviceCodeResponse.verification_uri_complete` 改为**可选**(BREAKING,校验放宽;S-615)
+
+> **版号裁定(发布方)**:本批只有一处改动 —— 设备码授权响应里 `verification_uri_complete` 由必填改为可选。
+> 照下方「发版纪律」的「校验收紧**或放宽** = major」判 **5.0.0**:按上一版契约写的读方可能把它当恒在的
+> `string` 用,放宽后同一份响应在本包下解析得出、到它那里却是 `undefined`。**零别名、零双读**:推导型由
+> `string` 变 `string | undefined`,读方若把它当 `string` 直接用会在 tsc 上红 —— 那一格红就是通知。
+> 持久数据面**零影响**(不碰任何存储形)。
+
+**三问**:
+- **谁需要** = 读方与 RFC 8628 §3.2 对齐:该字段在 RFC 里是 **OPTIONAL**。本包此前写成 `z.string().min(1)`
+  必填,而 CLI 读方在运行期本来就按「可能没有」加了守卫 —— 型面说必填、运行期说可缺,是同一件事的两种读法
+  (clay 裁 C-R91 C⑥:型面改可选,单源说真话)。
+- **谁受伤** = 把它当恒在 `string` 读的消费方。逐仓亲读(`git grep`,不含 test/ 与 dist):**生产方**管理台
+  `sema-web-admin` 2 处(`src/app/api/v1/auth/device/code/route.ts` 照发不变、`src/app/activate/page.tsx`);
+  **读方**CLI `sema-cli` 1 处真读(`src/cli/handlers/cloud.ts:70`,已有 `if (device.verification_uri_complete)`
+  守卫,另 `src/sema/cloudAuth.ts:4` 是注释)、client-core `src/model/providerAuth.ts:174` 读的是它**自己声明**的
+  `verification_uri_complete?: unknown`(不经本包推导型,已守卫);SDK 源码 0 处(只有 `docs/manual/ch7-registry-control.md:59`
+  文档一行与 3 处测试夹具);worker 服务 / core / 测试仓 0。⇒ 预计**零处** tsc 红;SDK 手册那一行要跟着说「可选」。
+- **什么补偿** = 生产方行为不变(管理台照发该字段);读方的正确读法 = 「在场 ⇒ 一键 / 二维码路径;缺席 ⇒ 展示
+  `verification_uri` + `user_code`」。**在场但为空串仍拒**(`min(1)` 不变)—— 可选是本批**唯一**的放宽。
+
+**迁移三句**:① 读 `verification_uri_complete` 的代码按 `string | undefined` 处理(缺席时退回 `verification_uri`
++ `user_code`);② 生产方无需改动;③ 手写了该响应 JSON Schema / OpenAPI 的消费方把它移出 `required`
+(本包 `docs/openapi-auth.yaml` 已同步)。
+
+**红先**:`test/api-auth.test.ts` 新格(缺席可解析 / 在场原样 / 空串仍拒)修前 **1 failed / 34 passed**
+(缺席被拒 `Required`)→ 修后 35/35。
+
 ## 4.0.0 — 2026-09-22 — 引用完整性的**域闭集发成运行期值**(additive)+ `RefIssue.path` 六臂坐标**统一成以域键起手**(BREAKING,值形)+ 诊断面回**真实总数**(BREAKING,返回形)+ 告警投影改**机器派生**并搬回属主(BREAKING,模块面)+ `fileSchedulerStore` → `createFileSchedulerStore`(BREAKING,重命名,零别名)+ 一致性门来源律改**运行期拒**+ prompts 摘要搬出调度存储并合并铸点 + 四道机器门
 
 > **版号裁定(发布方)**:本批两件里有一件是**值形**破坏性改动 —— `refIntegrityIssues` 返回的

package/README.md

@@ -135,7 +135,7 @@ sound). `npm ls --prod` therefore shows only `zod`. Node built-ins only (`node:c
   `HooksConfig` (the `settings.json` `hooks` shape — a CLOSED key set, so a typo is caught at the wire),
   and stop attribution (`StoppedBy` / `stopAttributionText`).
 - **Cross-session settings** (`cross-session.ts`): the two `settings.json` keys `crossSessionInbound`
-  (accept/hold/refuse, `default` = unset) and `dialogExpiry` (60s/5m/10m/never), each with a reader that
+  (wake/next-turn/hold/refuse — the core 7.30.0 vocabulary, `accept` retired in 6.0.0; `default` = unset) and `dialogExpiry` (60s/5m/10m/never), each with a reader that
   answers `ok:false` on a bad value instead of silently folding to the default.
 - **Scheduler store contract** (`scheduler-store.ts`, subpath `./scheduler-store`; the fs binding is in
   `./node`): the durable self-wake record shape + `parseSchedulerStore` / `serializeSchedulerStore`

package/conformance/VERSION

@@ -1 +1 @@
-4.0.0
+6.0.0

package/dist/api/auth.d.ts

@@ -121,8 +121,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */
@@ -134,8 +135,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */
@@ -147,8 +149,9 @@ export declare const DeviceCodeResponse: z.ZodObject<{
     user_code: z.ZodString;
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.ZodString;
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.ZodString;
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.ZodOptional<z.ZodString>;
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.ZodNumber;
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */

package/dist/api/auth.js

@@ -146,8 +146,9 @@ export const DeviceCodeResponse = z
     user_code: z.string().min(1),
     /** The /activate page the user opens (any device, any logged-in browser). */
     verification_uri: z.string().min(1),
-    /** verification_uri with ?user_code= pre-filled — one-click / QR path. */
-    verification_uri_complete: z.string().min(1),
+    /** verification_uri with ?user_code= pre-filled — one-click / QR path. **OPTIONAL** (RFC 8628 §3.2):
+     *  absent ⇒ the reader shows `verification_uri` + `user_code`; present-but-empty is still refused. (5.0.0, S-615) */
+    verification_uri_complete: z.string().min(1).optional(),
     /** Seconds until the handshake expires (DEVICE_CODE_TTL_SECONDS). */
     expires_in: z.number().int().positive(),
     /** Minimum seconds between polls (DEVICE_POLL_INTERVAL_SECONDS). */

package/dist/cross-session.d.ts

@@ -33,13 +33,20 @@
  * 的那一侧)用一格锁步钉住 —— 任一侧加词/改序,那一格先红。本包不 import 引擎(纯度不变量)。
  */
 import { z } from "zod";
-/** 显式三值,**顺序即收紧秩**(accept < hold < refuse):层次解析只许沿此序收紧,永不放宽。 */
-export declare const CROSS_SESSION_INBOUND_VALUES: readonly ["accept", "hold", "refuse"];
+/**
+ * 显式四值,**顺序即收紧秩**(wake < next-turn < hold < refuse):层次解析只许沿此序收紧,永不放宽。
+ *
+ * 6.0.0(BREAKING,随 core 7.30.0):`accept` **删除**,一分为二 —— `wake`(立刻唤醒收件方)与 `next-turn`
+ * (排到收件方下一轮;= 旧 `accept` 所指的那一档,也是 core 未设时的基线)。本包**零别名、零双读**:文件层写
+ * `accept` 的配置在本包响亮 `ok:false` / zod 拒 —— 那一格红就是通知;core 只在**自己的**层里把 `accept`
+ * 读成 `next-turn` 并经 `onError` 报一次(core 的旧拼写读表),那是 core 的持久数据窗,不是本包的契约。
+ */
+export declare const CROSS_SESSION_INBOUND_VALUES: readonly ["wake", "next-turn", "hold", "refuse"];
 export type CrossSessionInboundValue = (typeof CROSS_SESSION_INBOUND_VALUES)[number];
 /** 设置 UI 的「不设」拼写(见头注)——两键共用同一个字面量。 */
 export declare const CROSS_SESSION_INBOUND_UNSET: "default";
-/** 文件层受理面:三个显式值 + `"default"`(未设)。 */
-export declare const CrossSessionInboundSetting: z.ZodEnum<["accept", "hold", "refuse", "default"]>;
+/** 文件层受理面:四个显式值 + `"default"`(未设)。 */
+export declare const CrossSessionInboundSetting: z.ZodEnum<["wake", "next-turn", "hold", "refuse", "default"]>;
 export type CrossSessionInboundSettingValue = z.infer<typeof CrossSessionInboundSetting>;
 /** 四值闭集(CC 逐字)。`"never"` = 不设期限。 */
 export declare const DIALOG_EXPIRY_VALUES: readonly ["60s", "5m", "10m", "never"];
@@ -55,13 +62,13 @@ export type DialogExpirySettingValue = z.infer<typeof DialogExpirySetting>;
  * 值必合法**。
  */
 export declare const CrossSessionSettings: z.ZodObject<{
-    crossSessionInbound: z.ZodOptional<z.ZodEnum<["accept", "hold", "refuse", "default"]>>;
+    crossSessionInbound: z.ZodOptional<z.ZodEnum<["wake", "next-turn", "hold", "refuse", "default"]>>;
     dialogExpiry: z.ZodOptional<z.ZodEnum<["60s", "5m", "10m", "never", "default"]>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    crossSessionInbound: z.ZodOptional<z.ZodEnum<["accept", "hold", "refuse", "default"]>>;
+    crossSessionInbound: z.ZodOptional<z.ZodEnum<["wake", "next-turn", "hold", "refuse", "default"]>>;
     dialogExpiry: z.ZodOptional<z.ZodEnum<["60s", "5m", "10m", "never", "default"]>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    crossSessionInbound: z.ZodOptional<z.ZodEnum<["accept", "hold", "refuse", "default"]>>;
+    crossSessionInbound: z.ZodOptional<z.ZodEnum<["wake", "next-turn", "hold", "refuse", "default"]>>;
     dialogExpiry: z.ZodOptional<z.ZodEnum<["60s", "5m", "10m", "never", "default"]>>;
 }, z.ZodTypeAny, "passthrough">>;
 export type CrossSessionSettings = z.infer<typeof CrossSessionSettings>;

package/dist/cross-session.js

@@ -34,11 +34,18 @@
  */
 import { z } from "zod";
 // ── crossSessionInbound ────────────────────────────────────────────────────────────────────────────
-/** 显式三值,**顺序即收紧秩**(accept < hold < refuse):层次解析只许沿此序收紧,永不放宽。 */
-export const CROSS_SESSION_INBOUND_VALUES = ["accept", "hold", "refuse"];
+/**
+ * 显式四值,**顺序即收紧秩**(wake < next-turn < hold < refuse):层次解析只许沿此序收紧,永不放宽。
+ *
+ * 6.0.0(BREAKING,随 core 7.30.0):`accept` **删除**,一分为二 —— `wake`(立刻唤醒收件方)与 `next-turn`
+ * (排到收件方下一轮;= 旧 `accept` 所指的那一档,也是 core 未设时的基线)。本包**零别名、零双读**:文件层写
+ * `accept` 的配置在本包响亮 `ok:false` / zod 拒 —— 那一格红就是通知;core 只在**自己的**层里把 `accept`
+ * 读成 `next-turn` 并经 `onError` 报一次(core 的旧拼写读表),那是 core 的持久数据窗,不是本包的契约。
+ */
+export const CROSS_SESSION_INBOUND_VALUES = ["wake", "next-turn", "hold", "refuse"];
 /** 设置 UI 的「不设」拼写(见头注)——两键共用同一个字面量。 */
 export const CROSS_SESSION_INBOUND_UNSET = "default";
-/** 文件层受理面:三个显式值 + `"default"`(未设)。 */
+/** 文件层受理面:四个显式值 + `"default"`(未设)。 */
 export const CrossSessionInboundSetting = z.enum([...CROSS_SESSION_INBOUND_VALUES, CROSS_SESSION_INBOUND_UNSET]);
 // ── dialogExpiry ───────────────────────────────────────────────────────────────────────────────────
 /** 四值闭集(CC 逐字)。`"never"` = 不设期限。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "4.0.0",
+  "version": "6.0.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",