@sema-agent/client-core 0.102.0 → 0.104.0

package/dist/generated/settingsSchemaMcpRequestEntry.js

@@ -1,22 +1,47 @@
-export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme, echoCallerText) => {
+export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWithHttpScheme, echoCallerText, UNINSPECTABLE, captureStringArray, dataDescriptor, inspect, ownFieldsOf, ownValueOf, readKey, isJsonArray, jsonShapeOf, isReservedMcpServerName, RESERVED_MCP_SERVER_NAME_REASON) => {
+    function describeKindWord(v) {
+        const shape = jsonShapeOf(v);
+        switch (shape) {
+            case "null":
+                return "null";
+            case "array":
+                return "array";
+            case "uninspectable":
+                return UNINSPECTABLE;
+            case "plain":
+            case "non_plain_object":
+            case "primitive":
+                return typeof v;
+            default: {
+                const unhandled = shape;
+                throw new Error(`describeKindWord: unhandled shape ${String(unhandled)}`);
+            }
+        }
+    }
     function describeValueShape(v) {
         if (v === undefined)
             return "nothing (the key is absent)";
-        if (v === null)
-            return "null";
-        if (Array.isArray(v))
-            return "an array";
-        if (typeof v === "string")
-            return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
-        if (typeof v === "object")
-            return "an object";
-        return `a ${typeof v}`;
+        const shape = jsonShapeOf(v);
+        switch (shape) {
+            case "null":
+                return "null";
+            case "array":
+                return "an array";
+            case "uninspectable":
+                return UNINSPECTABLE;
+            case "plain":
+            case "non_plain_object":
+                return typeof v === "function" ? "a function" : "an object";
+            case "primitive":
+                return typeof v === "string" ? (v.length === 0 ? "an empty string" : `a string of ${v.length} characters`) : `a ${typeof v}`;
+            default: {
+                const unhandled = shape;
+                throw new Error(`describeValueShape: unhandled shape ${String(unhandled)}`);
+            }
+        }
     }
     function describeNotStringArray(v) {
-        return Array.isArray(v) ? "an array with a non-string element" : describeValueShape(v);
-    }
-    function isStringArray(v) {
-        return Array.isArray(v) && v.every((a) => typeof a === "string");
+        return isJsonArray(v) ? "an array with a non-string element" : describeValueShape(v);
     }
     function quotedCallerText(text) {
         return `"${echoCallerText(text)}"`;
@@ -28,7 +53,7 @@ export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWi
     }
     function describeBadWireName(v) {
         if (typeof v !== "string")
-            return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+            return describeKindWord(v);
         if (v.length === 0)
             return "empty";
         const head = quotedCallerText(v);
@@ -37,120 +62,215 @@ export const SETTINGS_MCP_REQUEST_ENTRY_CLOSURE = (MCP_CONTENT_ORIGINS, startsWi
             return `${head} (${tooLong})`;
         return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
     }
+    function isUsableMcpServerName(v) {
+        return isUsableWireName(v) && !isReservedMcpServerName(v);
+    }
+    function describeBadMcpServerName(v) {
+        if (!isUsableWireName(v))
+            return describeBadWireName(v);
+        return `${quotedCallerText(v)} (${RESERVED_MCP_SERVER_NAME_REASON})`;
+    }
     const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
     function isContentOriginWord(v) {
         return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
     }
     function describeBadContentOrigin(v) {
-        return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+        return typeof v === "string" ? quotedCallerText(v) : describeKindWord(v);
     }
     function readMcpIdentityHeaders(transport) {
+        const ids = identityFieldsOf(transport);
+        if (!ids.ok)
+            return {};
+        const { principalHeader, assertionHeader } = ids.value;
+        return {
+            ...(typeof principalHeader === "string" ? { principalHeader } : {}),
+            ...(typeof assertionHeader === "string" ? { assertionHeader } : {}),
+        };
+    }
+    function identityFieldsOf(record) {
+        const principal = readKey(record, "principalHeader");
+        if (principal.presence === "unreadable")
+            return { ok: false, sentence: UNINSPECTABLE };
+        if (principal.presence === "own" && principal.value !== undefined) {
+            return { ok: true, value: { principalHeader: principal.value, assertionHeader: undefined, principalInherited: false, assertionInherited: false } };
+        }
+        const assertion = readKey(record, "assertionHeader");
+        if (assertion.presence === "unreadable")
+            return { ok: false, sentence: UNINSPECTABLE };
         return {
-            ...(typeof transport.principalHeader === "string" ? { principalHeader: transport.principalHeader } : {}),
-            ...(transport.principalHeader === undefined && typeof transport.assertionHeader === "string" ? { assertionHeader: transport.assertionHeader } : {}),
+            ok: true,
+            value: {
+                principalHeader: undefined,
+                assertionHeader: assertion.presence === "own" ? assertion.value : undefined,
+                principalInherited: principal.presence === "inherited",
+                assertionInherited: assertion.presence === "inherited",
+            },
         };
     }
     const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
+    const inheritedIdentityIssue = (key) => ({
+        path: `transport.${key}`,
+        reason: "inherited key ignored (the key is visible only through the prototype chain; a transport's identity headers are read from its own keys)",
+    });
     function readRequestMcpTransport(t) {
-        if (!t || typeof t !== "object")
-            return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
-        const tr = t;
-        const lost = [];
-        if (tr.kind === "stdio") {
-            if (typeof tr.command !== "string" || tr.command.length === 0)
-                return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
-            if (tr.args !== undefined && !isStringArray(tr.args))
-                lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
-            const env = readTransportRecord("transport.env", tr.env, lost);
-            return {
-                ok: true,
-                transport: {
-                    kind: "stdio",
-                    command: tr.command,
-                    ...(isStringArray(tr.args) ? { args: tr.args } : {}),
-                    ...(env !== undefined ? { env } : {}),
-                },
-                lost,
-            };
+        const shape = jsonShapeOf(t);
+        switch (shape) {
+            case "plain":
+            case "array":
+                break;
+            case "null":
+            case "primitive":
+                return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
+            case "uninspectable":
+                return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${UNINSPECTABLE}`);
+            case "non_plain_object":
+                return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${typeof t === "function" ? describeValueShape(t) : "an object that is not plain data"}`);
+            default: {
+                const unhandled = shape;
+                throw new Error(`readRequestMcpTransport: unhandled shape ${String(unhandled)}`);
+            }
         }
-        if (tr.kind === "http") {
-            if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
-                return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
-            const ids = readMcpIdentityHeaders(tr);
-            const headers = readTransportRecord("transport.headers", tr.headers, lost);
-            if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
-                lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
+        const tr = t;
+        const snapshotRead = snapshotTransport(tr);
+        if (!snapshotRead.ok)
+            return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${snapshotRead.sentence}`);
+        const snap = snapshotRead.value;
+        switch (snap.kind) {
+            case "stdio": {
+                if (typeof snap.command !== "string" || snap.command.length === 0)
+                    return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(snap.command)}`);
+                const rawArgs = snap.args;
+                const args = rawArgs === undefined ? undefined : captureStringArray(rawArgs, "wide");
+                const argsIssue = rawArgs !== undefined && args === undefined ? { path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(rawArgs)}` } : undefined;
+                const env = readTransportRecord("transport.env", snap.env);
+                return {
+                    ok: true,
+                    transport: {
+                        kind: "stdio",
+                        command: snap.command,
+                        ...(args !== undefined ? { args } : {}),
+                        ...(env.record !== undefined ? { env: env.record } : {}),
+                    },
+                    lost: issuesOf(argsIssue, ...env.issues),
+                };
+            }
+            case "http": {
+                if (typeof snap.url !== "string" || !startsWithHttpScheme(snap.url))
+                    return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
+                const ids = readMcpIdentityHeaders({ principalHeader: snap.principalHeader, assertionHeader: snap.assertionHeader });
+                const headers = readTransportRecord("transport.headers", snap.headers);
+                const principalIssue = snap.principalHeader !== undefined && ids.principalHeader === undefined
+                    ? { path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(snap.principalHeader)}` }
+                    : undefined;
+                return {
+                    ok: true,
+                    transport: {
+                        kind: "http",
+                        url: snap.url,
+                        ...(headers.record !== undefined ? { headers: headers.record } : {}),
+                        ...ids,
+                    },
+                    lost: issuesOf(...headers.issues, principalIssue, snap.principalInherited ? inheritedIdentityIssue("principalHeader") : undefined, snap.assertionInherited ? inheritedIdentityIssue("assertionHeader") : undefined),
+                };
+            }
+            case "other":
+                return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(snap.value)}`);
+            default: {
+                const unhandled = snap;
+                throw new Error(`readRequestMcpTransport: unhandled transport kind ${String(unhandled.kind)}`);
             }
-            return {
-                ok: true,
-                transport: {
-                    kind: "http",
-                    url: tr.url,
-                    ...(headers !== undefined ? { headers } : {}),
-                    ...ids,
-                },
-                lost,
-            };
         }
-        return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
     }
-    const RESERVED_MEMBER_NAME = "__proto__";
-    const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
-    function readPlainStringRecord(v) {
-        if (v === null || typeof v !== "object" || Array.isArray(v))
-            return { ok: false, fault: "not_plain_record", detail: v === null ? "got null" : Array.isArray(v) ? "got an array" : `got a ${typeof v}` };
-        let proto;
-        let names;
-        try {
-            proto = Object.getPrototypeOf(v);
-            names = Object.getOwnPropertyNames(v);
+    function snapshotTransport(tr) {
+        const kind = ownValueOf(tr, "kind");
+        if (!kind.ok)
+            return kind;
+        if (kind.value === "stdio") {
+            const fields = ownFieldsOf(tr, ["command", "args", "env"]);
+            if (!fields.ok)
+                return fields;
+            return { ok: true, value: { kind: "stdio", command: fields.value.command, args: fields.value.args, env: fields.value.env } };
         }
-        catch {
-            return { ok: false, fault: "not_plain_record", detail: "got an object that could not be inspected (a proxy trap threw)" };
+        if (kind.value === "http") {
+            const fields = ownFieldsOf(tr, ["url", "headers"]);
+            if (!fields.ok)
+                return fields;
+            const ids = identityFieldsOf(tr);
+            if (!ids.ok)
+                return ids;
+            return { ok: true, value: { kind: "http", url: fields.value.url, headers: fields.value.headers, principalHeader: ids.value.principalHeader, assertionHeader: ids.value.assertionHeader, principalInherited: ids.value.principalInherited, assertionInherited: ids.value.assertionInherited } };
         }
-        if (proto !== Object.prototype && proto !== null) {
-            return { ok: false, fault: "not_plain_record", detail: "got an object that is not plain data (a class instance, a Map, process.env, or a record built on a prototype; copy it into a plain object)" };
+        return { ok: true, value: { kind: "other", value: kind.value } };
+    }
+    const PLAIN_STRING_RECORD_RESERVED_MEMBER = "__proto__";
+    const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${PLAIN_STRING_RECORD_RESERVED_MEMBER}"`;
+    function notPlainDetail(shape, v) {
+        switch (shape) {
+            case "null":
+                return "got null";
+            case "array":
+                return "got an array";
+            case "primitive":
+                return `got a ${typeof v}`;
+            case "uninspectable":
+                return `got ${UNINSPECTABLE}`;
+            case "non_plain_object":
+                if (typeof v === "function")
+                    return "got a function";
+                return "got an object that is not plain data (a class instance, a Map, process.env, or any object whose prototype has a prototype of its own; copy it into a plain object)";
+            default: {
+                const unhandled = shape;
+                throw new Error(`notPlainDetail: unhandled shape ${String(unhandled)}`);
+            }
         }
-        const record = {};
+    }
+    function readPlainStringRecord(v) {
+        const shape = jsonShapeOf(v);
+        if (shape !== "plain")
+            return { ok: false, fault: "not_plain_record", detail: notPlainDetail(shape, v) };
+        const namesRead = inspect(() => Object.getOwnPropertyNames(v));
+        if (!namesRead.ok)
+            return { ok: false, fault: "not_plain_record", detail: `got ${namesRead.sentence}` };
+        const names = namesRead.value;
+        const members = Object.create(null);
         let reservedMember = false;
         for (const name of names) {
-            let value;
-            let unreadable = false;
-            try {
-                const d = Object.getOwnPropertyDescriptor(v, name);
-                value = d === undefined ? undefined : Object.hasOwn(d, "value") ? d.value : d.get === undefined ? undefined : Reflect.apply(d.get, v, []);
-            }
-            catch {
-                unreadable = true;
-            }
+            const read = readKey(v, name);
+            const unreadable = read.presence === "unreadable";
+            const value = read.presence === "own" ? read.value : undefined;
             if (unreadable || typeof value !== "string") {
                 const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
-                const reserved = name === RESERVED_MEMBER_NAME;
+                const reserved = name === PLAIN_STRING_RECORD_RESERVED_MEMBER;
+                const fault = reserved ? "member_name_reserved" : "member_not_string";
                 return {
                     ok: false,
-                    fault: reserved ? "member_name_reserved" : "member_not_string",
+                    fault,
                     member: echoCallerText(name),
                     detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
                 };
             }
-            if (name === RESERVED_MEMBER_NAME)
+            if (name === PLAIN_STRING_RECORD_RESERVED_MEMBER)
                 reservedMember = true;
             else
-                record[name] = value;
+                Object.defineProperty(members, name, dataDescriptor(value));
         }
-        return { ok: true, record, reservedMember };
+        return { ok: true, record: { ...members }, reservedMember };
     }
-    function readTransportRecord(path, raw, lost) {
+    const issuesOf = (...candidates) => candidates.filter((c) => c !== undefined);
+    function readTransportRecord(path, raw) {
         if (raw === undefined)
-            return undefined;
+            return { record: undefined, issues: [] };
         const read = readPlainStringRecord(raw);
         if (!read.ok) {
-            lost.push({ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault });
-            return undefined;
+            return {
+                record: undefined,
+                issues: [{ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault }],
+            };
         }
-        if (read.reservedMember)
-            lost.push({ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" });
-        return read.record;
+        return {
+            record: read.record,
+            issues: read.reservedMember ? [{ path: `${path}.${PLAIN_STRING_RECORD_RESERVED_MEMBER}`, reason: RESERVED_MEMBER_FAULT, member: PLAIN_STRING_RECORD_RESERVED_MEMBER, fault: "member_name_reserved" }] : [],
+        };
     }
-    return { readRequestMcpTransport, readMcpIdentityHeaders, isUsableWireName, describeBadWireName, isContentOriginWord, describeBadContentOrigin, TOOL_WIRE_NAME_MAX_CHARS };
+    return { readRequestMcpTransport, readMcpIdentityHeaders, isUsableWireName, describeBadWireName, isUsableMcpServerName, describeBadMcpServerName, isContentOriginWord, describeBadContentOrigin, TOOL_WIRE_NAME_MAX_CHARS };
 };

package/dist/generated/settingsSchemaMcpServerName.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_MCP_SERVER_NAME_CLOSURE: () => any;

package/dist/generated/settingsSchemaMcpServerName.js

@@ -0,0 +1,8 @@
+export const SETTINGS_MCP_SERVER_NAME_CLOSURE = () => {
+    const REMOTE_MCP_SERVER_NAME_PREFIX = "remote-";
+    function isReservedMcpServerName(name) {
+        return name.startsWith(REMOTE_MCP_SERVER_NAME_PREFIX);
+    }
+    const RESERVED_MCP_SERVER_NAME_REASON = `the "${REMOTE_MCP_SERVER_NAME_PREFIX}" prefix is reserved for the remote MCP servers a device executor offers`;
+    return { isReservedMcpServerName, REMOTE_MCP_SERVER_NAME_PREFIX, RESERVED_MCP_SERVER_NAME_REASON };
+};

package/dist/generated/settingsSchemaOwnKeyRead.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_OWN_KEY_READ_CLOSURE: (isJsonArray: (v: unknown) => v is unknown[]) => any;

package/dist/generated/settingsSchemaOwnKeyRead.js

@@ -0,0 +1,172 @@
+export const SETTINGS_OWN_KEY_READ_CLOSURE = (isJsonArray) => {
+    const UNINSPECTABLE = "an object that could not be inspected (a proxy trap threw)";
+    function inspect(read) {
+        try {
+            return { ok: true, value: read() };
+        }
+        catch (e) {
+            return { ok: false, sentence: sentenceOfMinted(e) ?? UNINSPECTABLE };
+        }
+    }
+    function readOwnDescriptor(record, key) {
+        const read = inspect(() => {
+            const descriptor = Object.getOwnPropertyDescriptor(record, key);
+            if (descriptor !== undefined)
+                return { presence: "own", descriptor };
+            return key in record ? { presence: "inherited" } : { presence: "absent" };
+        });
+        return read.ok ? read.value : { presence: "unreadable" };
+    }
+    const valueOfDescriptor = (record, d) => {
+        if (!isAccessorDescriptor(d))
+            return d.value;
+        const getter = d.get;
+        return getter === undefined ? undefined : Reflect.apply(getter, record, []);
+    };
+    function readKey(record, key) {
+        const read = readOwnDescriptor(record, key);
+        if (read.presence !== "own")
+            return read;
+        const descriptor = read.descriptor;
+        const value = inspect(() => valueOfDescriptor(record, descriptor));
+        return value.ok ? { presence: "own", value: value.value } : { presence: "unreadable" };
+    }
+    function ownValueOf(record, key) {
+        const read = readKey(record, key);
+        switch (read.presence) {
+            case "own":
+                return { ok: true, value: read.value };
+            case "inherited":
+            case "absent":
+                return { ok: true, value: undefined };
+            case "unreadable":
+                return { ok: false, sentence: UNINSPECTABLE };
+            default: {
+                const unhandled = read;
+                throw new Error(`ownValueOf: unhandled presence ${String(unhandled.presence)}`);
+            }
+        }
+    }
+    function ownFieldsOf(record, keys) {
+        const out = Object.create(null);
+        for (const key of keys) {
+            const read = ownValueOf(record, key);
+            if (!read.ok)
+                return read;
+            Object.defineProperty(out, key, dataDescriptor(read.value));
+        }
+        return { ok: true, value: out };
+    }
+    const MINTED = new WeakMap();
+    function sentenceOfMinted(thrown) {
+        return MINTED.get(thrown);
+    }
+    class UninspectableError extends TypeError {
+        constructor(sentence = UNINSPECTABLE) {
+            super(sentence);
+            this.name = "UninspectableError";
+            MINTED.set(this, sentence);
+        }
+    }
+    const isAccessorDescriptor = (d) => Object.hasOwn(d, "get") || Object.hasOwn(d, "set");
+    const NO_PRIOR_READS = new Map();
+    const containerView = (record, isArray, classification, prior = NO_PRIOR_READS) => {
+        const keys = inspect(() => Reflect.ownKeys(record));
+        if (!keys.ok)
+            throw new UninspectableError();
+        const members = [];
+        const add = (key, d) => appendOwn(members, [key, d]);
+        for (const [key, read] of prior)
+            if (read.presence === "own")
+                add(key, dataDescriptor(read.value));
+        let length;
+        let foreign = false;
+        for (const key of keys.value) {
+            if (typeof key !== "string") {
+                foreign = true;
+                continue;
+            }
+            if (prior.has(key))
+                continue;
+            const isLength = isArray && key === "length";
+            if (isArray && !isLength && !isArrayIndexKey(key)) {
+                foreign = true;
+                continue;
+            }
+            const read = inspect(() => Object.getOwnPropertyDescriptor(record, key));
+            if (!read.ok)
+                throw new UninspectableError();
+            const d = read.value;
+            if (d === undefined)
+                continue;
+            if (isLength) {
+                length = valueOfDescriptor(record, d);
+                continue;
+            }
+            switch (classification) {
+                case "strict":
+                    if (d.enumerable !== true || isAccessorDescriptor(d))
+                        throw new UninspectableError(NOT_PLAIN_DATA);
+                    break;
+                case "wide":
+                    if (!isArray && d.enumerable !== true)
+                        continue;
+                    break;
+                default: {
+                    const unhandled = classification;
+                    throw new Error(`containerView: unhandled classification ${String(unhandled)}`);
+                }
+            }
+            add(key, d);
+        }
+        if (isArray)
+            members.sort(([a], [b]) => Number(a) - Number(b));
+        return { members, length, foreign };
+    };
+    function denseArrayView(array, classification) {
+        const view = containerView(array, true, classification);
+        const n = view.length;
+        if (typeof n !== "number" || !Number.isSafeInteger(n) || n < 0 || view.members.length !== n)
+            return undefined;
+        if (!view.members.every(([key], i) => key === String(i)))
+            return undefined;
+        return { descriptors: view.members.map(([, d]) => d), foreign: view.foreign };
+    }
+    const isArrayIndexKey = (key) => {
+        const n = Number(key);
+        return Number.isInteger(n) && n >= 0 && n < 2 ** 32 - 1 && String(n) === key;
+    };
+    const NOT_PLAIN_DATA = "a value that is not plain data (a class instance, a Map, a Date, a function, an object with a hidden — non-enumerable — or an accessor own property … — only plain objects, arrays and primitives are)";
+    function appendOwn(list, value) {
+        Object.defineProperty(list, list.length, dataDescriptor(value));
+    }
+    function dataDescriptor(value) {
+        const descriptor = Object.create(null);
+        descriptor.value = value;
+        descriptor.writable = true;
+        descriptor.enumerable = true;
+        descriptor.configurable = true;
+        return descriptor;
+    }
+    function captureStringArray(v, classification) {
+        return isJsonArray(v) ? captureDenseArray(v, classification, isStringEntry, "ignore") : undefined;
+    }
+    const isStringEntry = (entry) => typeof entry === "string";
+    function captureDenseArray(v, classification, isEntry, foreign) {
+        const read = inspect(() => {
+            const dense = denseArrayView(v, classification);
+            if (dense === undefined || (foreign === "refuse" && dense.foreign))
+                return undefined;
+            const copy = [];
+            for (let i = 0; i < dense.descriptors.length; i++) {
+                const entry = valueOfDescriptor(v, dense.descriptors[i]);
+                if (!isEntry(entry))
+                    return undefined;
+                Object.defineProperty(copy, i, dataDescriptor(entry));
+            }
+            return copy;
+        });
+        return read.ok ? read.value : undefined;
+    }
+    return { captureStringArray, UNINSPECTABLE, dataDescriptor, inspect, ownFieldsOf, ownValueOf, readKey };
+};

package/dist/generated/settingsSchemaPlainJsonObject.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_PLAIN_JSON_OBJECT_CLOSURE: () => any;

package/dist/generated/settingsSchemaPlainJsonObject.js

@@ -0,0 +1,28 @@
+export const SETTINGS_PLAIN_JSON_OBJECT_CLOSURE = () => {
+    function jsonShapeOf(v) {
+        try {
+            if (v === null)
+                return "null";
+            if (Array.isArray(v))
+                return "array";
+            if (typeof v === "function")
+                return "non_plain_object";
+            if (typeof v !== "object")
+                return "primitive";
+            const proto = Object.getPrototypeOf(v);
+            return proto === null || Object.getPrototypeOf(proto) === null ? "plain" : "non_plain_object";
+        }
+        catch {
+            return "uninspectable";
+        }
+    }
+    function isJsonArray(v) {
+        try {
+            return Array.isArray(v);
+        }
+        catch {
+            return false;
+        }
+    }
+    return { isJsonArray, jsonShapeOf };
+};

package/dist/generated/settingsSchemaSafetyMergeSpec.js

@@ -21,9 +21,9 @@ export const SETTINGS_SAFETY_MERGE_CLOSURE = (MIN_TRUST_WORDS) => {
             mergeShape: "denyFirst", minTrust: "global", tighten: { rule: "policyDenyWins" }, enforcement: "gate", fail: "closed",
             seam: "toolPolicy + deny-narrowing (SessionPolicyStore)", coreAxis: "permissionDecision",
             members: {
-                allow: { direction: "loosen", minTrust: "global" },
-                deny: { direction: "tighten", minTrust: "local" },
-                ask: { direction: "tighten", minTrust: "local" },
+                allow: { direction: "loosen", minTrust: "global", list: true },
+                deny: { direction: "tighten", minTrust: "local", list: true },
+                ask: { direction: "tighten", minTrust: "local", list: true },
             },
         },
         permissionMode: { mergeShape: "replace", minTrust: "global", tighten: { rule: "enumRank", order: ["bypassPermissions", "auto", "acceptEdits", "default", "dontAsk", "plan"] }, enforcement: "gate", fail: "closed", seam: "derive → toolPolicy / onAsk / handsReadOnly (§6.4); bypass = launch-flag only; the kill-switches are the killSwitches row" },
@@ -43,8 +43,8 @@ export const SETTINGS_SAFETY_MERGE_CLOSURE = (MIN_TRUST_WORDS) => {
                 "network.allowAllUnixSockets": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
                 "network.allowLocalBinding": { direction: "tighten", minTrust: "global", boolPole: { strict: false, minTrust: "local" } },
                 "filesystem.allowManagedReadPathsOnly": { direction: "tighten", minTrust: "global", boolPole: { strict: true, minTrust: "local" } },
-                "filesystem.denyWrite": { direction: "tighten", minTrust: "local" },
-                "filesystem.denyRead": { direction: "tighten", minTrust: "local" },
+                "filesystem.denyWrite": { direction: "tighten", minTrust: "local", list: true },
+                "filesystem.denyRead": { direction: "tighten", minTrust: "local", list: true },
             },
         },
         hooks: { mergeShape: "runAll", minTrust: "project", tighten: { rule: "none" }, enforcement: "gate", fail: "closed", seam: "hooks (single source or adapter-composed)" },
@@ -73,14 +73,17 @@ export const SETTINGS_SAFETY_MERGE_CLOSURE = (MIN_TRUST_WORDS) => {
         }
         return SAFETY_MERGE_SPEC[category];
     }
-    function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
+    function memberRow(spec, member, categoryLabel) {
         if (spec.members === undefined) {
             throw new RangeError(`SAFETY_MERGE_SPEC: category '${categoryLabel}' has no member-level admission — its minTrust applies to the whole key`);
         }
         if (!Object.hasOwn(spec.members, member)) {
             throw new RangeError(`SAFETY_MERGE_SPEC: unknown member '${member}' of category '${categoryLabel}' (members: ${Object.keys(spec.members).join(", ")})`);
         }
-        const row = spec.members[member];
+        return spec.members[member];
+    }
+    function resolveMemberAdmission(spec, member, categoryLabel = "(unnamed category)", value) {
+        const row = memberRow(spec, member, categoryLabel);
         const rowFloor = row.minTrust ?? spec.minTrust;
         if (row.boolPole !== undefined) {
             const floor = value === row.boolPole.strict ? row.boolPole.minTrust : rowFloor;

package/dist/generated/settingsSchemaTierWords.d.ts

@@ -0,0 +1 @@
+export declare const SETTINGS_TIER_WORDS_CLOSURE: () => any;

package/dist/generated/settingsSchemaTierWords.js

@@ -0,0 +1,7 @@
+export const SETTINGS_TIER_WORDS_CLOSURE = () => {
+    const TIER_ORDER = ["ultra", "max", "pro", "flash", "lite"];
+    function tierLadderFrom(tier) {
+        return TIER_ORDER.slice(TIER_ORDER.indexOf(tier));
+    }
+    return { tierLadderFrom };
+};