@sema-agent/server 1.185.0

package/dist/security.js

@@ -0,0 +1,292 @@
+import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cryptoVerify } from "node:crypto";
+import { join } from "node:path";
+import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
+const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function isUuidV7(s) {
+    return UUIDV7_RE.test(s);
+}
+const UUID_ANY_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export function isUuidShape(s) {
+    return UUID_ANY_RE.test(s);
+}
+export class HttpError extends Error {
+    status;
+    code;
+    extra;
+    constructor(status, message, opts) {
+        super(message);
+        this.status = status;
+        this.name = "HttpError";
+        if (opts?.code !== undefined)
+            this.code = opts.code;
+        if (opts?.extra !== undefined)
+            this.extra = opts.extra;
+    }
+}
+export function createAuthorizer(config, sessionStore) {
+    return async ({ req, body }) => {
+        const principal = verifiedPrincipal(req, config);
+        if (config.requirePrincipal && !principal) {
+            throw new HttpError(401, `missing principal header '${config.principalHeader}'`);
+        }
+        let projectId;
+        if (body.projectId !== undefined) {
+            if (typeof body.projectId !== "string" || !PROJECT_ID_REGEX.test(body.projectId)) {
+                throw new HttpError(422, "projectId must be a lowercase UUID (the center project registry's id shape)", { code: "invalid_project_id" });
+            }
+            projectId = body.projectId;
+        }
+        const requireExisting = body.requireExistingSession === true;
+        const ownerOf = sessionStore.ownerOf?.bind(sessionStore);
+        const register = sessionStore.register?.bind(sessionStore);
+        const requested = typeof body.sessionId === "string" && body.sessionId ? body.sessionId : undefined;
+        let sessionId;
+        if (requested) {
+            if (ownerOf && register) {
+                let owner = await ownerOf(requested);
+                if (owner === undefined) {
+                    if (requireExisting) {
+                        throw new HttpError(404, "requireExistingSession: session does not exist (resume.session_not_found)");
+                    }
+                    await register(requested, principal ?? null);
+                    owner = await ownerOf(requested);
+                }
+                if (owner != null && owner !== principal) {
+                    throw principal
+                        ? new HttpError(403, "session does not belong to this principal")
+                        : new HttpError(401, `session is principal-owned; missing principal header '${config.principalHeader}'`);
+                }
+            }
+            sessionId = requested;
+        }
+        else {
+            if (requireExisting) {
+                throw new HttpError(422, "requireExistingSession requires a sessionId — there is no existing session to resume (resume.session_not_found)");
+            }
+            sessionId = uuidv7();
+            if (register)
+                await register(sessionId, principal ?? null);
+        }
+        return { principal, sessionId, memoryScope: memoryScopeFor(config, principal, projectId), resolvedProjectId: projectId };
+    };
+}
+export function principalFrom(req, config) {
+    if (!config.principalHeader)
+        return undefined;
+    const raw = req.headers[config.principalHeader.toLowerCase()];
+    return (Array.isArray(raw) ? raw[0] : raw)?.trim() || undefined;
+}
+export const PRINCIPAL_TOKEN_HEADER = "x-approval-principal-token";
+const SSO_PRINCIPAL = Symbol.for("sema.ssoVerifiedPrincipal");
+export function setSsoPrincipal(req, principal) {
+    req[SSO_PRINCIPAL] = principal;
+}
+export function ssoVerifiedPrincipal(req) {
+    const v = req[SSO_PRINCIPAL];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+const SSO_SCOPE = Symbol.for("sema.ssoVerifiedScope");
+export function setSsoScope(req, scope) {
+    req[SSO_SCOPE] = scope;
+}
+export function ssoVerifiedScope(req) {
+    const v = req[SSO_SCOPE];
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+export function verifiedPrincipal(req, config) {
+    const sso = ssoVerifiedPrincipal(req);
+    if (sso)
+        return sso;
+    if (!config.directDoorActive)
+        return principalFrom(req, config);
+    const h = req.headers[PRINCIPAL_TOKEN_HEADER];
+    const token = (Array.isArray(h) ? h[0] : h) ?? "";
+    return verifyPrincipalJwt(token, config.principalJwtPubkeys, {
+        iss: config.principalJwtIss ?? "\0",
+        aud: config.principalJwtAud ?? "\0",
+        maxTtlSec: config.principalJwtMaxTtlSec,
+    })?.sub;
+}
+export function memoryScopeFor(config, principal, projectId) {
+    if (config.requirePrincipal === true) {
+        if (config.memoryEngineBackend === "pg" || config.memoryEngineBackend === "tidb") {
+            if (!principal)
+                return undefined;
+            return projectId ? formatProjScope(principal, projectId) : formatUserScope(principal);
+        }
+        return undefined;
+    }
+    return config.memoryScope;
+}
+export function memoryEngineRemoteLanePosture(config) {
+    const lane = config.remoteExec?.provider;
+    if (lane === undefined || lane === "host")
+        return undefined;
+    return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
+}
+export function memoryEngineBackendFor(config, fallbackRoot) {
+    if (config.requirePrincipal === true || !config.memoryEngineEnabled)
+        return undefined;
+    if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
+        return undefined;
+    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
+    const dir = join(root, "memory");
+    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
+}
+export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
+    if (!scope)
+        return undefined;
+    const isV2 = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
+    const extras = (defaultScopes ?? []).filter((s, i, arr) => typeof s === "string" && s.length > 0 && s !== scope && arr.indexOf(s) === i);
+    const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : {};
+    const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
+    return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
+}
+export function parseApprovalHmacKeys(raw) {
+    if (!raw)
+        return [];
+    try {
+        const v = JSON.parse(raw);
+        if (!Array.isArray(v))
+            return [];
+        return v.filter((k) => !!k && typeof k.kid === "string" && typeof k.key === "string");
+    }
+    catch {
+        return [];
+    }
+}
+export function approvalHmacMessage(env) {
+    return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision]);
+}
+export function verifyApprovalHmac(env, mac, kid, keys) {
+    if (keys.length === 0)
+        return false;
+    let supplied;
+    try {
+        supplied = Buffer.from(mac, "hex");
+    }
+    catch {
+        return false;
+    }
+    if (supplied.length === 0)
+        return false;
+    const ordered = kid ? [...keys.filter((k) => k.kid === kid), ...keys.filter((k) => k.kid !== kid)] : keys;
+    const msg = approvalHmacMessage(env);
+    for (const k of ordered) {
+        const expected = createHmac("sha256", k.key).update(msg).digest();
+        if (expected.length === supplied.length && timingSafeEqual(expected, supplied))
+            return true;
+    }
+    return false;
+}
+export function parsePrincipalJwks(raw) {
+    if (!raw)
+        return [];
+    const ALGS = new Set(["EdDSA", "RS256", "ES256"]);
+    try {
+        const v = JSON.parse(raw);
+        if (!Array.isArray(v))
+            return [];
+        return v.filter((k) => {
+            const e = k;
+            return !!e && typeof e.kid === "string" && typeof e.key === "string" && typeof e.alg === "string" && ALGS.has(e.alg);
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function b64urlToBuf(s) {
+    return Buffer.from(s, "base64url");
+}
+function verifyJwsSignature(alg, signingInput, sig, pub) {
+    try {
+        if (alg === "EdDSA")
+            return cryptoVerify(null, signingInput, pub, sig);
+        if (alg === "RS256")
+            return cryptoVerify("sha256", signingInput, pub, sig);
+        if (alg === "ES256")
+            return cryptoVerify("sha256", signingInput, { key: pub, dsaEncoding: "ieee-p1363" }, sig);
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyPrincipalJwt(token, keys, expect) {
+    if (keys.length === 0)
+        return null;
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return null;
+    const [h, p, s] = parts;
+    let header;
+    let payload;
+    let sig;
+    try {
+        header = JSON.parse(b64urlToBuf(h).toString("utf8"));
+        payload = JSON.parse(b64urlToBuf(p).toString("utf8"));
+        sig = b64urlToBuf(s);
+    }
+    catch {
+        return null;
+    }
+    if (typeof header !== "object" || header === null || typeof payload !== "object" || payload === null)
+        return null;
+    if (typeof header.alg !== "string" || typeof header.kid !== "string" || sig.length === 0)
+        return null;
+    const key = keys.find((k) => k.kid === header.kid);
+    if (!key || key.alg !== header.alg)
+        return null;
+    let pub;
+    try {
+        pub = createPublicKey(key.key);
+    }
+    catch {
+        return null;
+    }
+    const signingInput = Buffer.from(`${h}.${p}`, "utf8");
+    if (!verifyJwsSignature(key.alg, signingInput, sig, pub))
+        return null;
+    if (payload.iss !== expect.iss)
+        return null;
+    const aud = payload.aud;
+    const audOk = aud === expect.aud || (Array.isArray(aud) && aud.includes(expect.aud));
+    if (!audOk)
+        return null;
+    if (typeof payload.sub !== "string" || payload.sub.length === 0)
+        return null;
+    const now = expect.nowSec ?? Math.floor(Date.now() / 1000);
+    const skew = expect.skewSec ?? 30;
+    if (typeof payload.exp !== "number" || payload.exp + skew < now)
+        return null;
+    if (payload.nbf !== undefined && (typeof payload.nbf !== "number" || payload.nbf - skew > now))
+        return null;
+    if (expect.maxTtlSec && payload.exp - now > expect.maxTtlSec + skew)
+        return null;
+    const bnd = typeof payload.cnf?.bnd === "string" ? payload.cnf.bnd : undefined;
+    return { sub: payload.sub, bnd };
+}
+export function approvalBnd(env) {
+    return createHash("sha256").update(JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null])).digest("hex");
+}
+export function verifyDirectDoorProof(proof, envelope, config, opts) {
+    const actionBinding = opts?.actionBinding ?? true;
+    if (!proof.jwt)
+        return { ok: false, status: 401, errorCode: "principal_unverified", error: "direct door requires a signed principal token (X-Approval-Principal-Token)" };
+    const verified = verifyPrincipalJwt(proof.jwt, config.principalJwtPubkeys, { iss: config.principalJwtIss ?? "\0", aud: config.principalJwtAud ?? "\0", maxTtlSec: config.principalJwtMaxTtlSec });
+    if (!verified)
+        return { ok: false, status: 401, errorCode: "principal_unverified", error: "principal token failed verification" };
+    if (actionBinding && !envelope.boundInputHash)
+        return { ok: false, status: 400, errorCode: "approval_mac_required", error: "direct door requires boundInputHash (the bound action) in the body" };
+    if (verified.bnd !== approvalBnd(envelope))
+        return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
+    if (!proof.mac)
+        return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
+    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision }, proof.mac, proof.kid, config.approvalHmacKeys);
+    if (!ok)
+        return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
+    return { ok: true, principal: verified.sub };
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,IAAI,YAAY,EAAkB,MAAM,aAAa,CAAC;AAC/H,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,eAAe,EAAE,eAAe,EAA4C,MAAM,kBAAkB,CAAC;AAC/L,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AA8F7D,MAAM,SAAS,GAAG,uEAAuE,CAAC;AAG1F,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAOD,MAAM,WAAW,GAAG,2EAA2E,CAAC;AAChG,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAMD,MAAM,OAAO,SAAU,SAAQ,KAAK;IAIvB;IAHF,IAAI,CAAU;IACd,KAAK,CAA2B;IACzC,YACW,MAAc,EACvB,OAAe,EACf,IAAyD;QAEzD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QAKvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACpD,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzD,CAAC;CACF;AAkCD,MAAM,UAAU,gBAAgB,CAC9B,MAAqB,EACrB,YAAoC;IAEpC,OAAO,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAwB,EAAE;QAMnD,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,6BAA6B,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;QACnF,CAAC;QAOD,IAAI,SAA6B,CAAC;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,6EAA6E,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC1I,CAAC;YACD,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC;QAYD,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,KAAK,IAAI,CAAC;QAE7D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpG,IAAI,SAAiB,CAAC;QACtB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;gBACxB,IAAI,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,IAAI,eAAe,EAAE,CAAC;wBAQpB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2EAA2E,CAAC,CAAC;oBACxG,CAAC;oBACD,MAAM,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;oBAI7C,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;gBAMD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACzC,MAAM,SAAS;wBACb,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,2CAA2C,CAAC;wBACjE,CAAC,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,yDAAyD,MAAM,CAAC,eAAe,GAAG,CAAC,CAAC;gBAC7G,CAAC;YACH,CAAC;YACD,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,CAAC;YAGN,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,iHAAiH,CAAC,CAAC;YAC9I,CAAC;YACD,SAAS,GAAG,MAAM,EAAE,CAAC;YACrB,IAAI,QAAQ;gBAAE,MAAM,QAAQ,CAAC,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;IAC3H,CAAC,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,aAAa,CAAC,GAAoB,EAAE,MAAqB;IACvE,IAAI,CAAC,MAAM,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAClE,CAAC;AAID,MAAM,CAAC,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAWnE,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAC9D,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,SAAiB;IACpE,GAAyC,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;AACxE,CAAC;AACD,MAAM,UAAU,oBAAoB,CAAC,GAAoB;IACvD,MAAM,CAAC,GAAI,GAA0C,CAAC,aAAa,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAKD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AACtD,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,KAAa;IAC5D,GAAyC,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;AAChE,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,CAAC,GAAI,GAA0C,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAoB,EAAE,MAAqB;IAG3E,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,gBAAgB;QAAE,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,mBAAmB,EAAE;QAC3D,GAAG,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QACnC,GAAG,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI;QACnC,SAAS,EAAE,MAAM,CAAC,qBAAqB;KACxC,CAAC,EAAE,GAAG,CAAC;AACV,CAAC;AAaD,MAAM,UAAU,cAAc,CAAC,MAAqB,EAAE,SAAkB,EAAE,SAAkB;IAC1F,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAcrC,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,IAAI,MAAM,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YACjF,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACjC,OAAO,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAcD,MAAM,UAAU,6BAA6B,CAC3C,MAAqB;IAErB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC;IACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,6BAA6B,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9F,CAAC;AAoBD,MAAM,UAAU,sBAAsB,CACpC,MAAqB,EACrB,YAAqB;IAErB,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,6BAA6B,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAEhF,MAAM,IAAI,GAAG,uBAAuB,CAAC,MAAM,CAAC,eAAe,IAAI,YAAY,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAMjC,OAAO,EAAE,OAAO,EAAE,IAAI,uBAAuB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AAC/G,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,WAAgC,EAChC,aAAwB;IAExB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAO7B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAKzI,MAAM,MAAM,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACzI,MAAM,OAAO,GAA+C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvI,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,aAAa,EAAE,IAAI,EAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAEtF,OAAO,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;AAC/G,CAAC;AAuBD,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IACxJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,GAAyG;IAC3I,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAChC,GAAyG,EACzG,GAAW,EACX,GAAuB,EACvB,IAAuB;IAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1G,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAqBD,MAAM,UAAU,kBAAkB,CAAC,GAAuB;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE;YAC1C,MAAM,CAAC,GAAG,CAAoB,CAAC;YAC/B,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AACrC,CAAC;AAID,SAAS,kBAAkB,CAAC,GAAW,EAAE,YAAoB,EAAE,GAAW,EAAE,GAAc;IACxF,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACvE,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/G,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,IAAuB,EACvB,MAA2F;IAE3F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;IACpD,IAAI,MAAwC,CAAC;IAC7C,IAAI,OAA+G,CAAC;IACpH,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtD,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClH,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtG,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,KAAK,GAAG,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAGlC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5G,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IACjF,MAAM,GAAG,GAAG,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAKD,MAAM,UAAU,WAAW,CAAC,GAAuF;IACjH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzI,CAAC;AAiBD,MAAM,UAAU,qBAAqB,CACnC,KAAmD,EACnD,QAA8G,EAC9G,MAA2K,EAC3K,IAAkC;IAElC,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,4EAA4E,EAAE,CAAC;IAC1K,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAClM,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAGlI,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;IAClM,IAAI,QAAQ,CAAC,GAAG,KAAK,WAAW,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,kEAAkE,EAAE,CAAC;IACzL,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC;IACtJ,MAAM,EAAE,GAAG,kBAAkB,CAC3B,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,IAAI,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAC1J,KAAK,CAAC,GAAG,EACT,KAAK,CAAC,GAAG,EACT,MAAM,CAAC,gBAAgB,CACxB,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,sBAAsB,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IACtH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/sema-registry.d.ts

@@ -0,0 +1,187 @@
+import type { McpServerSpec } from "@sema-agent/core";
+import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import type { ScopedMcpServer, ServiceConfig } from "./config.js";
+import type { SealedKeyOpener } from "./sealed-key.js";
+import type { Autonomy, CommandRule } from "./runtime-governance.js";
+import type { Logger } from "./observability/logger.js";
+import type { LoadedSkill } from "./capabilities/skills.js";
+import type { ScenarioRuling } from "./capabilities/scenarios.js";
+import type { CollabTemplateWire } from "./capabilities/collab-wire.js";
+interface CenterModel {
+    name: string;
+    id: string;
+    provider: string;
+    api: "openai-completions" | "anthropic-messages";
+    baseUrl?: string;
+    apiKeyEnv?: string;
+    sealedApiKey?: {
+        ciphertext: string;
+        publicKeyId: string;
+        alg: string;
+        setAt?: string;
+    };
+    tier?: string;
+    reasoning?: boolean;
+    vision?: boolean;
+    contextWindow?: number;
+    maxTokens?: number;
+    charsPerToken?: number;
+    cost?: {
+        input: number;
+        output: number;
+        cacheRead?: number;
+        cacheWrite?: number;
+    };
+    quotaWeight?: number;
+    defaultThinking?: string;
+    reasoningEffortLevels?: string[];
+    extraBody?: Record<string, unknown>;
+    enabled?: boolean;
+}
+type CenterRoleTarget = {
+    model: string;
+} | {
+    select: unknown;
+};
+interface CenterTeam {
+    name: string;
+    members: {
+        role: string;
+        modelRole?: string;
+        model?: string;
+        systemPrompt?: string;
+    }[];
+    rounds: number;
+    synthesizer?: {
+        role: string;
+        modelRole?: string;
+        systemPrompt?: string;
+    };
+    scenario?: string;
+    maxTranscriptTokens?: number;
+    enabled?: boolean;
+}
+export interface CenterSkillManifest {
+    name: string;
+    description: string;
+    scenarios: string[];
+    contentHash: string;
+    enabled?: boolean;
+}
+export interface CenterMcpServer {
+    name: string;
+    scenarios: string[];
+    enabled?: boolean;
+    allowTools?: string[];
+    elicitation?: boolean;
+    transport: {
+        kind: "stdio";
+        command: string;
+        args?: string[];
+        envRefs?: Record<string, string>;
+    } | {
+        kind: "http";
+        url: string;
+        headerRefs?: Record<string, string>;
+        principalHeader?: string;
+    };
+}
+export interface EffectiveConfig {
+    version: number;
+    updatedAt: string;
+    models: {
+        models: CenterModel[];
+        roles: Record<string, CenterRoleTarget>;
+        atModelAllowlist?: string[];
+    };
+    teams?: {
+        teams: CenterTeam[];
+    };
+    collab?: {
+        templates: CollabTemplateWire[];
+    };
+    skills?: {
+        skills: CenterSkillManifest[];
+    };
+    mcp?: {
+        servers: CenterMcpServer[];
+    };
+    scenarios?: {
+        scenarios: Array<{
+            name: string;
+            toolset: string;
+            prompt?: string;
+            enabled?: boolean;
+        }>;
+    };
+    runtime?: {
+        rateLimitPerMin?: number;
+        approvalRequire?: string[];
+        maxTaskCostUsd?: number;
+        maxTaskTokens?: number;
+        maxPrincipalCostUsd?: number;
+        costQuotaWindowSec?: number;
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+    };
+    projects?: {
+        projects?: Record<string, unknown>;
+    } | Record<string, unknown>;
+    governance?: {
+        autonomy?: Autonomy;
+        commandPolicy?: CommandRule[];
+        approvalRequire?: string[];
+    };
+}
+export interface ExecutionRuling {
+    required: boolean;
+    allowedLanes: string[];
+    sessionMirror?: SessionMirrorRuling;
+}
+export interface SessionMirrorRuling {
+    engineUrl: string;
+    required: boolean;
+}
+export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    effective: EffectiveConfig;
+    etag?: string;
+} | null>;
+export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    runtimeCaps: EntitlementRuntimeCaps | null;
+    configured: boolean;
+    scenario?: ScenarioRuling;
+    execution?: ExecutionRuling;
+    executionDrift?: string;
+    etag?: string;
+} | null>;
+export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
+export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
+    teamsOnly?: boolean;
+    sealedKeys?: SealedKeyOpener;
+}): void;
+export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
+export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
+export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates";
+export interface RestartSignal {
+    restartRequired: true;
+    reasons: RestartSlice[];
+    version: number;
+    since: number;
+}
+export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
+export declare class ConfigCenterHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
+    skills: CenterSkillManifest[];
+}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch): Promise<LoadedSkill[]>;
+export declare function resolveMcpServers(mcp: {
+    servers: CenterMcpServer[];
+}, logger?: Logger): ScopedMcpServer[];
+export declare function mcpForScenario(servers: ScopedMcpServer[] | undefined, scenario: string): McpServerSpec[] | undefined;
+export {};
+//# sourceMappingURL=sema-registry.d.ts.map

package/dist/sema-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sema-registry.d.ts","sourceRoot":"","sources":["../src/sema-registry.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,aAAa,EAA0C,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAsC,KAAK,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC5G,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAIxE,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAKnB,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAIlF,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IAMjC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AACD,KAAK,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC;AAChE,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvF,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAKtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,EACL;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAIrF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAClG;AACD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAIxG,KAAK,CAAC,EAAE;QAAE,KAAK,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAIhC,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAC;IAC7C,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;KAAE,CAAC;IAC3C,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC;IAMrC,SAAS,CAAC,EAAE;QAAE,SAAS,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC;IAIxG,OAAO,CAAC,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAK5B,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;KAC/B,CAAC;IAMF,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAI5E,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;QAAC,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAIjG;AASD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IAMvB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAMD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAGD,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,SAAS,GAAE,OAAO,KAAa,EAC/B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,SAAS,EAAE,eAAe,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAe/D;AAqBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,SAAS,GAAE,OAAO,KAAa,EAC/B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,WAAW,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAsErL;AA2DD,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAG3F;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,eAAe,CAAA;CAAO,GAAG,IAAI,CAqLnK;AAoCD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAS9G;AAmBD,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAyB5G;AAOD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAyBnG;AAID,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,eAAe,CAAC,SAAS,CAAC,GAAG,OAAO,CAG5E;AAMD,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,GAAG,WAAW,GAAG,eAAe,CAAC;AAM5E,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,IAAI,CAAC;IAEtB,OAAO,EAAE,YAAY,EAAE,CAAC;IAExB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;CACf;AA8CD,wBAAgB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,EAAE,OAAO,EAAE,eAAe,GAAG,YAAY,EAAE,CAE1G;AAID,qBAAa,qBAAsB,SAAQ,KAAK;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAxC,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAIrD;AAUD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CASjB;AAUD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,WAAW,EAAE,EACvB,QAAQ,EAAE;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;CAAE,EAC3C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,EAAE,CAAC,CAsBxB;AA8BD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE;IAAE,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CA0BzG;AAGD,wBAAgB,cAAc,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE,GAAG,SAAS,CAIpH"}