@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9

package/dist/core/egress/classify.js

@@ -19,165 +19,183 @@ const COST = [
     "tiers[].cacheWrite",
 ];
 const PERCENTILES = ["", ".p50", ".p75", ".p90", ".p99"];
-const COMPAT = [
-    "supportsWebSearch",
-    "supportsStore",
-    "supportsDeveloperRole",
-    "supportsReasoningEffort",
-    "supportsUsageInStreaming",
-    "supportsFinishReason",
-    "maxTokensField",
-    "requiresToolResultName",
-    "requiresAssistantAfterToolResult",
-    "requiresThinkingAsText",
-    "requiresReasoningContentOnAssistantMessages",
-    "supportsDisabledThinking",
-    "thinkingFormat",
-    "chatTemplateKwargs.{key}",
-    "chatTemplateKwargs.*",
-    "chatTemplateKwargs.*.$var",
-    "chatTemplateKwargs.*.omitWhenOff",
-    "cacheControlFormat",
-    ...[
-        "allow_fallbacks",
-        "require_parameters",
-        "data_collection",
-        "zdr",
-        "enforce_distillable_text",
-        "order[]",
-        "only[]",
-        "ignore[]",
-        "quantizations[]",
-        "sort",
-        "sort.by",
-        "sort.partition",
-        ...["prompt", "completion", "image", "audio", "request"].map((part) => `max_price.${part}`),
-        ...PERCENTILES.map((suffix) => `preferred_min_throughput${suffix}`),
-        ...PERCENTILES.map((suffix) => `preferred_max_latency${suffix}`),
-    ].map((field) => `openRouterRouting.${field}`),
-    "vercelGatewayRouting.only[]",
-    "vercelGatewayRouting.order[]",
-    "zaiToolStream",
-    "supportsStrictMode",
-    "toolCallFormat",
-    "sendSessionAffinityHeaders",
-    "deferredToolsMode",
-    "sessionAffinityFormat",
-    "supportsLongCacheRetention",
-    "supportsForcedToolChoice",
-    "webSearchToolType",
-    "supportsWebSocket",
-    "supportsRemoteCompactionV2",
-    "supportsWebSearchPreview",
-    "supportsToolSearch",
-    "supportsEagerToolInputStreaming",
-    "supportsCacheControlOnTools",
-    "supportsTemperature",
-    "supportsToolChoice",
-    "forceAdaptiveThinking",
-    "allowEmptySignature",
-    "supportsToolReferences",
-    "allowedFallbackModels[].provider",
-    "allowedFallbackModels[].model",
-    ...COST.map((field) => `allowedFallbackModels[].cost.${field}`),
+function compatFields() {
+    return [
+        "supportsWebSearch",
+        "supportsStore",
+        "supportsDeveloperRole",
+        "supportsReasoningEffort",
+        "supportsUsageInStreaming",
+        "supportsFinishReason",
+        "maxTokensField",
+        "requiresToolResultName",
+        "requiresAssistantAfterToolResult",
+        "requiresThinkingAsText",
+        "requiresReasoningContentOnAssistantMessages",
+        "supportsDisabledThinking",
+        "thinkingFormat",
+        "chatTemplateKwargs.{key}",
+        "chatTemplateKwargs.*",
+        "chatTemplateKwargs.*.$var",
+        "chatTemplateKwargs.*.omitWhenOff",
+        "cacheControlFormat",
+        ...[
+            "allow_fallbacks",
+            "require_parameters",
+            "data_collection",
+            "zdr",
+            "enforce_distillable_text",
+            "order[]",
+            "only[]",
+            "ignore[]",
+            "quantizations[]",
+            "sort",
+            "sort.by",
+            "sort.partition",
+            ...["prompt", "completion", "image", "audio", "request"].map((part) => `max_price.${part}`),
+            ...PERCENTILES.map((suffix) => `preferred_min_throughput${suffix}`),
+            ...PERCENTILES.map((suffix) => `preferred_max_latency${suffix}`),
+        ].map((field) => `openRouterRouting.${field}`),
+        "vercelGatewayRouting.only[]",
+        "vercelGatewayRouting.order[]",
+        "zaiToolStream",
+        "supportsStrictMode",
+        "toolCallFormat",
+        "sendSessionAffinityHeaders",
+        "deferredToolsMode",
+        "sessionAffinityFormat",
+        "supportsLongCacheRetention",
+        "supportsForcedToolChoice",
+        "webSearchToolType",
+        "supportsWebSocket",
+        "supportsRemoteCompactionV2",
+        "supportsWebSearchPreview",
+        "supportsToolSearch",
+        "supportsEagerToolInputStreaming",
+        "supportsCacheControlOnTools",
+        "supportsTemperature",
+        "supportsToolChoice",
+        "forceAdaptiveThinking",
+        "allowEmptySignature",
+        "supportsToolReferences",
+        "allowedFallbackModels[].provider",
+        "allowedFallbackModels[].model",
+        ...COST.map((field) => `allowedFallbackModels[].cost.${field}`),
+    ];
+}
+const THINKING_LEVEL_MAP = [
+    "thinkingLevelMap.off",
+    "thinkingLevelMap.minimal",
+    "thinkingLevelMap.low",
+    "thinkingLevelMap.medium",
+    "thinkingLevelMap.high",
+    "thinkingLevelMap.xhigh",
+    "thinkingLevelMap.max",
 ];
-const THINKING_LEVEL_MAP = ["off", "minimal", "low", "medium", "high", "xhigh", "max"].map((level) => `thinkingLevelMap.${level}`);
 const INPUT_LIMITS = [
-    "maxRequestBytes",
-    "images.resize.maxWidth",
-    "images.resize.maxHeight",
-    "images.resize.maxBytes",
-    "images.resize.jpegQuality",
-    "images.maxPerMessage",
-    "images.maxPerRequest",
-].map((field) => `inputLimits.${field}`);
-const MODEL_DEFINITION = {
-    ...fields("public", [
-        "id",
-        "name",
-        "upstreamModelId",
-        "serviceTier",
-        "promptPreset",
-        "recoverTextToolCalls",
-        "api",
-        "reasoning",
-        ...THINKING_LEVEL_MAP,
-        "defaultThinkingLevel",
-        "input[]",
-        ...INPUT_LIMITS,
-        ...COST.map((field) => `cost.${field}`),
-        "promptCache.short",
-        "promptCache.long",
-        "contextWindow",
-        "maxTokens",
-        "cacheRetention",
-        ...COMPAT.map((field) => `compat.${field}`),
-        "headers.{key}",
-        "extraBody.{key}",
-    ]),
-    baseUrl: "endpoint",
-    "headers.*": "sealed",
-    "extraBody.*": "forces-device",
-};
-const MODEL_OVERRIDE = {
-    ...fields("public", [
-        "name",
-        "promptPreset",
-        "recoverTextToolCalls",
-        "reasoning",
-        ...THINKING_LEVEL_MAP,
-        "thinkingLevelMapMode",
-        "input[]",
-        ...INPUT_LIMITS,
-        ...COMPAT.map((field) => `compat.${field}`),
-        ...COST.map((field) => `cost.${field}`),
-        "promptCache.short",
-        "promptCache.long",
-        "contextWindow",
-        "maxTokens",
-        "cacheRetention",
-        "headers.{key}",
-        "extraBody.{key}",
-    ]),
-    "headers.*": "sealed",
-    "extraBody.*": "forces-device",
-};
-const PROVIDER = {
-    ...fields("public", [
-        "name",
-        "disabled",
-        "api",
-        "headers.{key}",
-        "extraBody.{key}",
-        "cacheRetention",
-        "authHeader",
-        "whitelist[]",
-        "blacklist[]",
-        "hideFreeModels",
-        ...COMPAT.map((field) => `compat.${field}`),
-        "credentials.rotation",
-        "credentials.affinity",
-        "credentials.accountStrategy",
-        "credentials.cooldownBaseMs",
-        "credentials.cooldownCapMs",
-        "credentials.slots.{key}",
-        "modelOverrides.{key}",
-    ]),
-    baseUrl: "endpoint",
-    apiKey: "sealed",
-    "headers.*": "sealed",
-    "extraBody.*": "forces-device",
-    "credentials.slots.*.value": "sealed",
-    "credentials.slots.*.env": "device-only",
-    ...prefixed("models[].", MODEL_DEFINITION),
-    ...prefixed("modelOverrides.*.", MODEL_OVERRIDE),
-};
+    "inputLimits.maxRequestBytes",
+    "inputLimits.images.resize.maxWidth",
+    "inputLimits.images.resize.maxHeight",
+    "inputLimits.images.resize.maxBytes",
+    "inputLimits.images.resize.jpegQuality",
+    "inputLimits.images.maxPerMessage",
+    "inputLimits.images.maxPerRequest",
+];
+function modelDefinition() {
+    return {
+        ...fields("public", [
+            "id",
+            "name",
+            "upstreamModelId",
+            "serviceTier",
+            "promptPreset",
+            "recoverTextToolCalls",
+            "api",
+            "reasoning",
+            ...THINKING_LEVEL_MAP,
+            "defaultThinkingLevel",
+            "input[]",
+            ...INPUT_LIMITS,
+            ...COST.map((field) => `cost.${field}`),
+            "promptCache.short",
+            "promptCache.long",
+            "contextWindow",
+            "maxTokens",
+            "cacheRetention",
+            ...compatFields().map((field) => `compat.${field}`),
+            "headers.{key}",
+            "extraBody.{key}",
+        ]),
+        baseUrl: "endpoint",
+        "headers.*": "sealed",
+        "extraBody.*": "forces-device",
+    };
+}
+function modelOverride() {
+    return {
+        ...fields("public", [
+            "name",
+            "promptPreset",
+            "recoverTextToolCalls",
+            "reasoning",
+            ...THINKING_LEVEL_MAP,
+            "thinkingLevelMapMode",
+            "input[]",
+            ...INPUT_LIMITS,
+            ...compatFields().map((field) => `compat.${field}`),
+            ...COST.map((field) => `cost.${field}`),
+            "promptCache.short",
+            "promptCache.long",
+            "contextWindow",
+            "maxTokens",
+            "cacheRetention",
+            "headers.{key}",
+            "extraBody.{key}",
+        ]),
+        "headers.*": "sealed",
+        "extraBody.*": "forces-device",
+    };
+}
+function providerFields() {
+    return {
+        ...fields("public", [
+            "name",
+            "disabled",
+            "api",
+            "headers.{key}",
+            "extraBody.{key}",
+            "cacheRetention",
+            "authHeader",
+            "whitelist[]",
+            "blacklist[]",
+            "hideFreeModels",
+            ...compatFields().map((field) => `compat.${field}`),
+            "credentials.rotation",
+            "credentials.affinity",
+            "credentials.accountStrategy",
+            "credentials.cooldownBaseMs",
+            "credentials.cooldownCapMs",
+            "credentials.slots.{key}",
+            "modelOverrides.{key}",
+        ]),
+        baseUrl: "endpoint",
+        apiKey: "sealed",
+        "headers.*": "sealed",
+        "extraBody.*": "forces-device",
+        "credentials.slots.*.value": "sealed",
+        "credentials.slots.*.env": "device-only",
+        ...prefixed("models[].", modelDefinition()),
+        ...prefixed("modelOverrides.*.", modelOverride()),
+    };
+}
 /** models.json, keyed by schema path: `.` nests, `[]` is an array item, `.{key}` a record key, `.*` a record value. */
-export const MODELS_JSON_FIELD_CLASSES = {
-    "disabledProviders[]": "public",
-    "providers.{key}": "public",
-    ...prefixed("providers.*.", PROVIDER),
-};
+export function modelsJsonFieldClasses() {
+    return {
+        "disabledProviders[]": "public",
+        "providers.{key}": "public",
+        ...prefixed("providers.*.", providerFields()),
+    };
+}
 /** Fields the runtime types add on top of the models.json schema (`model-config.ts`). */
 export const MODELS_JSON_TYPE_ONLY_FIELDS = {
     "providers.*.models[].samplingParams.{key}": "public",
@@ -185,8 +203,9 @@ export const MODELS_JSON_TYPE_ONLY_FIELDS = {
     "providers.*.modelOverrides.*.samplingParams.{key}": "public",
     "providers.*.modelOverrides.*.samplingParams.*": "forces-device",
 };
-export function classifyModelsJsonField(path) {
-    return MODELS_JSON_FIELD_CLASSES[path] ?? MODELS_JSON_TYPE_ONLY_FIELDS[path];
+export function classifyModelsJsonField(path, classes = modelsJsonFieldClasses()) {
+    const typeOnly = MODELS_JSON_TYPE_ONLY_FIELDS;
+    return classes[path] ?? typeOnly[path];
 }
 function fields(fieldClass, paths) {
     return Object.fromEntries(paths.map((path) => [path, fieldClass]));

package/dist/core/egress/console-redactor.d.ts

@@ -0,0 +1,7 @@
+import type { Redactor } from "./redact.ts";
+type ConsoleTarget = object;
+export declare function sealedWindowCount(): number;
+export declare function runSealed<T>(redactor: Redactor, work: () => Promise<T>): Promise<T>;
+export declare function installConsoleRedactor(target: ConsoleTarget): void;
+export {};
+//# sourceMappingURL=console-redactor.d.ts.map

package/dist/core/egress/console-redactor.js

@@ -0,0 +1,74 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { format } from "node:util";
+const INSTALLED = Symbol.for("senpi.egress.consoleRedactorInstalled");
+// no-module-state: console-redactor-install
+const sealedContext = new AsyncLocalStorage();
+// no-module-state: sealed-window-counter
+let sealedWindows = 0;
+export function sealedWindowCount() {
+    return sealedWindows;
+}
+export async function runSealed(redactor, work) {
+    sealedWindows++;
+    try {
+        return await sealedContext.run(redactor, work);
+    }
+    finally {
+        sealedWindows--;
+    }
+}
+/** Console members that never write a line; wrapping them would only break them (Node and Bun consoles). */
+const NON_WRITING_MEMBERS = [
+    "context",
+    "createTask",
+    "profile",
+    "profileEnd",
+    "timeStamp",
+    "takeHeapSnapshot",
+    "record",
+    "recordEnd",
+    "screenshot",
+];
+/**
+ * The console members to wrap: every function-valued member except constructors (`Console`), `_`-prefixed
+ * stream internals (`_stdoutErrorHandler`) and the known non-writing members. Anything unknown is wrapped, so a
+ * writing method no list names (Bun's `console.write`) cannot bypass the redactor.
+ */
+function consoleMethods(target) {
+    const names = new Set();
+    for (let level = target; level !== null && level !== Object.prototype; level = Object.getPrototypeOf(level)) {
+        for (const name of Object.getOwnPropertyNames(level)) {
+            if (name === "constructor" || name.startsWith("_") || /^[A-Z]/u.test(name))
+                continue;
+            if (NON_WRITING_MEMBERS.some((member) => member === name))
+                continue;
+            if (typeof target[name] === "function")
+                names.add(name);
+        }
+    }
+    return [...names];
+}
+export function installConsoleRedactor(target) {
+    const console = target;
+    if (console[INSTALLED])
+        return;
+    console[INSTALLED] = true;
+    for (const method of consoleMethods(target)) {
+        const original = console[method];
+        const keepsCondition = method === "assert";
+        console[method] = (...args) => {
+            const redactor = sealedContext.getStore();
+            if (redactor === undefined) {
+                if (sealedWindows > 0)
+                    return;
+                return original.apply(target, args);
+            }
+            if (keepsCondition) {
+                const [condition, ...message] = args;
+                return original.call(target, condition, redactor.redact(format(...message)));
+            }
+            return original.call(target, redactor.redact(format(...args)));
+        };
+    }
+}
+//# sourceMappingURL=console-redactor.js.map

package/dist/core/egress/credentials.d.ts

@@ -0,0 +1,73 @@
+import type { HpkeWrap, ProviderId, SecretField } from "./sealed-format.ts";
+export type { SecretField } from "./sealed-format.ts";
+export interface SecretLease extends Disposable {
+    /** Throws SecretNotLeased for a field outside this lease, or after dispose. */
+    value(field: SecretField): string;
+    readonly expiresAt?: number;
+    /** Drops references and zeroes the byte buffers (custody design 3.4). */
+    [Symbol.dispose](): void;
+}
+/** Audit only; asserted by the brain. */
+export interface ReleaseScope {
+    readonly sessionId: string;
+    readonly callId: string;
+    readonly purpose: "model-call" | "aux-call";
+}
+export interface CredentialSource {
+    resolve(providerId: ProviderId, entryDigest: string, fields: readonly SecretField[], scope: ReleaseScope): Promise<SecretLease>;
+}
+/** Registry-signed `{account, placementId, epoch, recipientPkHash, exp <= 60 s}`. */
+export interface EpochLeaseToken {
+    readonly token: string;
+}
+export interface ReleaseRequest {
+    readonly accountId: string;
+    readonly providerId: ProviderId;
+    /** Must equal the head entry's. */
+    readonly entryDigest: string;
+    readonly fields: readonly SecretField[];
+    readonly lease: EpochLeaseToken;
+    readonly recipientPk: Uint8Array;
+    readonly scope: ReleaseScope;
+}
+export interface ReleaseConfigRequest {
+    readonly accountId: string;
+    readonly objectHash: string;
+    readonly lease: EpochLeaseToken;
+    readonly recipientPk: Uint8Array;
+    readonly scope: ReleaseScope;
+}
+export type ReleaseFailure = "stale_snapshot" | "epoch_mismatch" | "owner_revoked" | "owner_withdrawn" | "unknown_field" | "unresolved_field" | "key_destroyed" | "wrap_missing" | "unavailable" | "denied";
+export interface HeadRef {
+    readonly version: number;
+    readonly objectHash: string;
+}
+export type ReleaseResult = {
+    readonly ok: true;
+    readonly items: readonly HpkeWrap[];
+    readonly head: HeadRef;
+} | {
+    readonly ok: false;
+    readonly code: ReleaseFailure;
+    readonly head?: HeadRef;
+};
+export interface Unsealer {
+    release(req: ReleaseRequest): Promise<ReleaseResult>;
+    /** One item: the ProviderConfigPlain sealed to recipientPk. K_cfg and K_proj are never released. */
+    releaseConfig(req: ReleaseConfigRequest): Promise<ReleaseResult>;
+}
+export declare class SecretNotLeased extends Error {
+    readonly field: SecretField;
+    constructor(field: SecretField);
+}
+export type CredentialWaitReason = ReleaseFailure | "config-churn";
+/**
+ * A sealed release that did not produce a value. It is never a plaintext fallback: the caller routes the step to a
+ * device or waits. `retryable` marks the refusals that clear on their own (custody design 3.3 and the L844 rule).
+ */
+export declare class CredentialWait extends Error {
+    readonly reason: CredentialWaitReason;
+    readonly retryable: boolean;
+    constructor(reason: CredentialWaitReason, retryable: boolean);
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/core/egress/credentials.js

@@ -0,0 +1,20 @@
+export class SecretNotLeased extends Error {
+    constructor(field) {
+        super(`secret not leased: ${field}`);
+        this.name = "SecretNotLeased";
+        this.field = field;
+    }
+}
+/**
+ * A sealed release that did not produce a value. It is never a plaintext fallback: the caller routes the step to a
+ * device or waits. `retryable` marks the refusals that clear on their own (custody design 3.3 and the L844 rule).
+ */
+export class CredentialWait extends Error {
+    constructor(reason, retryable) {
+        super(`sealed credential unavailable: ${reason}`);
+        this.name = "CredentialWait";
+        this.reason = reason;
+        this.retryable = retryable;
+    }
+}
+//# sourceMappingURL=credentials.js.map

package/dist/core/egress/device-custody.d.ts

@@ -2,7 +2,7 @@
  * Why a provider must stay on the device whatever the sidecar asks for (custody gate H1, M1).
  *
  * The models.json schema accepts unknown keys at every level, so the walk here applies
- * `MODELS_JSON_FIELD_CLASSES` to the concrete provider object with whitelist semantics: a key the
+ * `modelsJsonFieldClasses()` to the concrete provider object with whitelist semantics: a key the
  * table does not name, at any depth, keeps the provider on the device instead of reaching the brain.
  */
 import type { ModelsJsonProvider } from "../model-config-schema.ts";

package/dist/core/egress/device-custody.js

@@ -2,24 +2,26 @@
  * Why a provider must stay on the device whatever the sidecar asks for (custody gate H1, M1).
  *
  * The models.json schema accepts unknown keys at every level, so the walk here applies
- * `MODELS_JSON_FIELD_CLASSES` to the concrete provider object with whitelist semantics: a key the
+ * `modelsJsonFieldClasses()` to the concrete provider object with whitelist semantics: a key the
  * table does not name, at any depth, keeps the provider on the device instead of reaching the brain.
  */
-import { classifyModelsJsonField, MODELS_JSON_FIELD_CLASSES, MODELS_JSON_TYPE_ONLY_FIELDS, } from "./classify.js";
+import { classifyModelsJsonField, modelsJsonFieldClasses, MODELS_JSON_TYPE_ONLY_FIELDS, } from "./classify.js";
 import { splitEndpoint } from "./endpoint.js";
-const STOPS_WALK = new Set(["sealed", "device-only"]);
+const STOPS_WALK = ["sealed", "device-only"];
 /** Every path in the tables plus each of its ancestors (`a.b[].c` -> `a`, `a.b`, `a.b[]`, `a.b[].c`). */
-const KNOWN_PATHS = new Set([...Object.keys(MODELS_JSON_FIELD_CLASSES), ...Object.keys(MODELS_JSON_TYPE_ONLY_FIELDS)].flatMap((path) => [
-    ...[...path.matchAll(/[.[]/g)].map((boundary) => path.slice(0, boundary.index)),
-    path,
-]));
+function knownPaths(classes) {
+    return new Set([...Object.keys(classes), ...Object.keys(MODELS_JSON_TYPE_ONLY_FIELDS)].flatMap((path) => [
+        ...[...path.matchAll(/[.[]/g)].map((boundary) => path.slice(0, boundary.index)),
+        path,
+    ]));
+}
 /** A property name that would read as path syntax (`a.b`, `m[]`, `*`, `{key}`) is never a declared field. */
 const PATH_SYNTAX = /[.[\]*{}]/;
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function walk(value, path, reasons) {
-    const fieldClass = classifyModelsJsonField(path);
+function walk(value, path, reasons, known, classes) {
+    const fieldClass = classifyModelsJsonField(path, classes);
     if (fieldClass === "forces-device") {
         const sampling = path.endsWith("samplingParams.*");
         if (!sampling)
@@ -28,11 +30,11 @@ function walk(value, path, reasons) {
             reasons.add("sampling-params");
         return;
     }
-    if (fieldClass !== undefined && STOPS_WALK.has(fieldClass))
+    if (fieldClass !== undefined && STOPS_WALK.some((stop) => stop === fieldClass))
         return;
     if (Array.isArray(value)) {
         for (const item of value)
-            walk(item, `${path}[]`, reasons);
+            walk(item, `${path}[]`, reasons, known, classes);
         return;
     }
     if (!isPlainObject(value)) {
@@ -40,11 +42,11 @@ function walk(value, path, reasons) {
             reasons.add("undeclared-field");
         return;
     }
-    const isRecord = classifyModelsJsonField(`${path}.{key}`) !== undefined;
+    const isRecord = classifyModelsJsonField(`${path}.{key}`, classes) !== undefined;
     for (const [key, child] of Object.entries(value)) {
         const childPath = isRecord ? `${path}.*` : `${path}.${key}`;
-        if ((isRecord || !PATH_SYNTAX.test(key)) && KNOWN_PATHS.has(childPath))
-            walk(child, childPath, reasons);
+        if ((isRecord || !PATH_SYNTAX.test(key)) && known.has(childPath))
+            walk(child, childPath, reasons, known, classes);
         else
             reasons.add("undeclared-field");
     }
@@ -63,7 +65,8 @@ function hasModelHeaderCollision(provider) {
 /** Empty when sealed custody may serve the provider. */
 export function deviceCustodyReasons(provider) {
     const reasons = new Set();
-    walk(provider, "providers.*", reasons);
+    const classes = modelsJsonFieldClasses();
+    walk(provider, "providers.*", reasons, knownPaths(classes), classes);
     if (provider.baseUrl !== undefined && !splitEndpoint(provider.baseUrl).ok)
         reasons.add("unsplittable-base-url");
     for (const model of provider.models ?? []) {