@sema-agent/server 1.313.0 → 1.315.0

package/dist/approval-hmac.d.ts

@@ -0,0 +1,17 @@
+import type { ApprovalHmacKey } from "./auth-keys.js";
+export declare function approvalHmacMessage(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+    reason?: string | null;
+}): string;
+export declare const MAX_APPROVAL_REASON_CHARS = 4096;
+export declare function verifyApprovalHmac(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+    reason?: string | null;
+}, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
+//# sourceMappingURL=approval-hmac.d.ts.map

package/dist/approval-hmac.js

@@ -0,0 +1,27 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export function approvalHmacMessage(env) {
+    return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
+}
+export const MAX_APPROVAL_REASON_CHARS = 4_096;
+export function verifyApprovalHmac(env, mac, kid, keys) {
+    if (keys.length === 0)
+        return false;
+    let supplied;
+    try {
+        supplied = Buffer.from(mac, "hex");
+    }
+    catch {
+        return false;
+    }
+    if (supplied.length === 0)
+        return false;
+    const ordered = kid ? [...keys.filter((k) => k.kid === kid), ...keys.filter((k) => k.kid !== kid)] : keys;
+    const msg = approvalHmacMessage(env);
+    for (const k of ordered) {
+        const expected = createHmac("sha256", k.key).update(msg).digest();
+        if (expected.length === supplied.length && timingSafeEqual(expected, supplied))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=approval-hmac.js.map

package/dist/auth-bridge.d.ts

@@ -23,7 +23,8 @@ export type VerifyOutcome = {
     ok: false;
     error: AuthBridgeErrorCode;
 };
-export declare function createRegistryJwtVerifier(opts: RegistryJwtVerifierOptions): {
+export interface RegistryJwtVerifier {
     verify: (bearer: string) => Promise<VerifyOutcome>;
-};
+}
+export declare function createRegistryJwtVerifier(opts: RegistryJwtVerifierOptions): RegistryJwtVerifier;
 //# sourceMappingURL=auth-bridge.d.ts.map

package/dist/bench/s1/live-deps.js

@@ -4,7 +4,7 @@ import { createBrain } from "../../brain.js";
 import { buildPricing } from "../../budget.js";
 import { RemoteContainerExecutionEnv } from "../../plugins/remote-env-e2b.js";
 import { createDurableAskPolicy } from "../../approval.js";
-import { buildLeaderRunner } from "../../leader/wire.js";
+import { createLeaderRunner } from "../../leader/wire.js";
 import { runOracle as runStandaloneOracle } from "./oracle.js";
 import { makeRepairOracle } from "./repair-oracle-adapter.js";
 import { assertDistinctEnvs } from "./runner-ctx.js";
@@ -358,7 +358,7 @@ async function runLeaderForTrap(rt, brain, models, roles, pricing, trap, cellId,
     process.env.LEADER_ENABLED = "true";
     process.env.LEADER_WORKER_BUDGET_USD = String((rt.maxCostUsd ?? 1.0) / 2);
     process.env.LEADER_CONFLICT_ROUNDS = process.env.LEADER_CONFLICT_ROUNDS ?? "2";
-    const run = buildLeaderRunner({
+    const run = createLeaderRunner({
         brain, models, roles, pricing, e2bApiKey: rt.e2bApiKey, workspace: W,
         ...(process.env.S1_DEBUG_GIT ? { logger: { warn: (m, x) => console.error(`[S1_DEBUG_LEADER warn] ${m}`, x ? JSON.stringify(x).slice(0, 300) : ""), info: (m, x) => console.error(`[S1_DEBUG_LEADER info] ${m}`, x ? JSON.stringify(x).slice(0, 200) : "") } } : {}),
     });

package/dist/budget.d.ts

@@ -3,6 +3,7 @@ import type { Metrics } from "./observability/metrics.js";
 import type { QuotaTracker } from "./observability/cost-quota.js";
 import type { FleetUsageAccumulator } from "./fleet-client.js";
 import type { FleetLeaseManager } from "./fleet-lease.js";
+import { type PromptManifestTracker } from "./observability/prompt-manifest.js";
 export declare function buildPricing(models: Record<string, Model>): Record<string, ModelPricing>;
 export declare function cardinalityGuard(cap: number, onOverflow: () => void): (value: string) => string;
 export interface ModelUsageDelta {
@@ -20,88 +21,15 @@ export declare class ModelUsageTracker {
     drain(taskId: string): Record<string, ModelUsageDelta> | undefined;
     clear(taskId: string): void;
 }
-export interface PromptManifestRecord {
-    constitution: string;
-    blocks: Array<{
-        id: string;
-        chars: number;
-        hash: string;
-    }>;
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
-    tools?: Array<{
-        wireName: string;
-        aliases: string[];
-        contractId: string;
-        implementationRevision: string;
-        cardId: string;
-        shapeDigest: string;
-        wireSchemaDigest: string;
-    }>;
-    totalChars: number;
-}
-export declare function promptManifestRecordOf(e: {
-    constitution: string;
-    blocks: Array<{
-        id: string;
-        chars: number;
-        hash: string;
-    }>;
-    sections?: Array<{
-        id: string;
-        slot: string;
-        carrier: string;
-        cadence: string;
-        cacheClass: string;
-        chars: number;
-        hash: string;
-        contentHash?: string;
-    }>;
-    tools?: Array<{
-        wireName: string;
-        aliases: string[];
-        contractId: string;
-        implementationRevision: string;
-        cardId: string;
-        shapeDigest: string;
-        wireSchemaDigest: string;
-    }>;
-    totalChars: number;
-}): PromptManifestRecord;
-export declare function configAssembledRecordOf(e: {
-    catalogVersion?: unknown;
-    fields?: unknown;
-    overrideReasons?: unknown;
-    ts?: unknown;
-}): Record<string, unknown> | undefined;
-export declare class PromptManifestTracker {
-    private readonly byTask;
-    private readonly configByTask;
-    private readonly active;
-    private leaseCounter;
-    register(taskId: string): number;
-    record(taskId: string, m: PromptManifestRecord): void;
-    recordConfig(taskId: string, rec: Record<string, unknown>): void;
-    drainConfig(taskId: string): Array<Record<string, unknown>> | undefined;
-    drain(taskId: string): PromptManifestRecord[] | undefined;
-    clear(taskId: string, lease: number): void;
-}
-export declare function buildTracer(metrics: Pick<Metrics, "inc" | "observe">, costQuota?: QuotaTracker, modelUsage?: ModelUsageTracker, fleetUsage?: FleetUsageAccumulator, fleetLease?: FleetLeaseManager, quotaWeightFor?: (model: string) => number, promptManifests?: PromptManifestTracker): TracerHook;
+export { type PromptManifestRecord, promptManifestRecordOf, configAssembledRecordOf, PromptManifestTracker, } from "./observability/prompt-manifest.js";
+export declare function createTracer(metrics: Pick<Metrics, "inc" | "observe">, costQuota?: QuotaTracker, modelUsage?: ModelUsageTracker, fleetUsage?: FleetUsageAccumulator, fleetLease?: FleetLeaseManager, quotaWeightFor?: (model: string) => number, promptManifests?: PromptManifestTracker): TracerHook;
 export declare function cacheFamilyOfMirror(model: {
     api?: string;
     params?: {
         promptCacheFamily?: string;
     };
 } | undefined): "input-includes-cached" | "input-excludes-cached" | undefined;
-export declare function buildSideQueryAccountant(metrics: Pick<Metrics, "inc">, costQuota?: QuotaTracker, fleetUsage?: FleetUsageAccumulator, fleetLease?: FleetLeaseManager, quotaWeightFor?: (model: string) => number): (principal: string | undefined, r: {
+export declare function createSideQueryAccountant(metrics: Pick<Metrics, "inc">, costQuota?: QuotaTracker, fleetUsage?: FleetUsageAccumulator, fleetLease?: FleetLeaseManager, quotaWeightFor?: (model: string) => number): (principal: string | undefined, r: {
     model: string;
     family?: "input-includes-cached" | "input-excludes-cached";
     usage?: {

package/dist/budget.js

@@ -1,5 +1,6 @@
 import { modelCostToPricing } from "@sema-agent/core";
 import { currentPrincipal } from "./observability/principal-context.js";
+import { promptManifestRecordOf, configAssembledRecordOf } from "./observability/prompt-manifest.js";
 export function buildPricing(models) {
     const pricing = {};
     for (const m of Object.values(models))
@@ -61,88 +62,8 @@ export class ModelUsageTracker {
     }
     clear(taskId) { this.byTask.delete(taskId); this.active.delete(taskId); }
 }
-export function promptManifestRecordOf(e) {
-    return {
-        constitution: String(e.constitution),
-        blocks: (Array.isArray(e.blocks) ? e.blocks : []).map((b) => ({ id: String(b.id), chars: b.chars, hash: String(b.hash) })),
-        ...(Array.isArray(e.sections)
-            ? { sections: e.sections.map((s) => ({ id: String(s.id), slot: String(s.slot), carrier: String(s.carrier), cadence: String(s.cadence), cacheClass: String(s.cacheClass), chars: s.chars, hash: String(s.hash), ...(typeof s.contentHash === "string" ? { contentHash: s.contentHash } : {}) })) }
-            : {}),
-        ...(Array.isArray(e.tools)
-            ? { tools: e.tools.map((t) => ({ wireName: String(t.wireName), aliases: (Array.isArray(t.aliases) ? t.aliases : []).map(String), contractId: String(t.contractId), implementationRevision: String(t.implementationRevision), cardId: String(t.cardId), shapeDigest: String(t.shapeDigest), wireSchemaDigest: String(t.wireSchemaDigest) })) }
-            : {}),
-        totalChars: e.totalChars,
-    };
-}
-export function configAssembledRecordOf(e) {
-    const rec = {
-        catalogVersion: e.catalogVersion,
-        fields: e.fields,
-        ...(e.overrideReasons !== undefined ? { overrideReasons: e.overrideReasons } : {}),
-        ts: e.ts,
-    };
-    try {
-        if (JSON.stringify(rec).length > 32_768)
-            return undefined;
-    }
-    catch {
-        return undefined;
-    }
-    return rec;
-}
-export class PromptManifestTracker {
-    byTask = new Map();
-    configByTask = new Map();
-    active = new Map();
-    leaseCounter = 0;
-    register(taskId) {
-        if (!taskId)
-            return 0;
-        const lease = ++this.leaseCounter;
-        this.active.set(taskId, lease);
-        return lease;
-    }
-    record(taskId, m) {
-        if (!taskId || !this.active.has(taskId))
-            return;
-        const q = this.byTask.get(taskId);
-        if (q)
-            q.push(m);
-        else
-            this.byTask.set(taskId, [m]);
-    }
-    recordConfig(taskId, rec) {
-        if (!taskId || !this.active.has(taskId))
-            return;
-        const q = this.configByTask.get(taskId);
-        if (q)
-            q.push(rec);
-        else
-            this.configByTask.set(taskId, [rec]);
-    }
-    drainConfig(taskId) {
-        const q = this.configByTask.get(taskId);
-        if (!q || q.length === 0)
-            return undefined;
-        this.configByTask.delete(taskId);
-        return q;
-    }
-    drain(taskId) {
-        const q = this.byTask.get(taskId);
-        if (!q || q.length === 0)
-            return undefined;
-        this.byTask.delete(taskId);
-        return q;
-    }
-    clear(taskId, lease) {
-        if (this.active.get(taskId) !== lease)
-            return;
-        this.byTask.delete(taskId);
-        this.active.delete(taskId);
-        this.configByTask.delete(taskId);
-    }
-}
-export function buildTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLease, quotaWeightFor, promptManifests) {
+export { promptManifestRecordOf, configAssembledRecordOf, PromptManifestTracker, } from "./observability/prompt-manifest.js";
+export function createTracer(metrics, costQuota, modelUsage, fleetUsage, fleetLease, quotaWeightFor, promptManifests) {
     const toolName = cardinalityGuard(256, () => metrics.inc("metric_label_overflow_total", { label: "tool_name" }));
     const modelId = cardinalityGuard(256, () => metrics.inc("metric_label_overflow_total", { label: "model" }));
     const providerName = cardinalityGuard(64, () => metrics.inc("metric_label_overflow_total", { label: "provider" }));
@@ -200,7 +121,7 @@ export function cacheFamilyOfMirror(model) {
         return "input-includes-cached";
     return model.api === "anthropic-messages" || model.api === "bedrock-converse-stream" ? "input-excludes-cached" : "input-includes-cached";
 }
-export function buildSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, quotaWeightFor) {
+export function createSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, quotaWeightFor) {
     return (principal, r) => {
         const input = typeof r.usage?.input === "number" ? r.usage.input : 0;
         const output = typeof r.usage?.output === "number" ? r.usage.output : 0;

package/dist/capabilities/sandbox-file-send.d.ts

@@ -16,8 +16,9 @@ export interface SandboxFileSendDeps {
     prepare: (filename: string | undefined, scope?: string) => PreparedDirectUpload;
     maxBytes: number;
 }
-export declare function createSandboxFileSend(deps: SandboxFileSendDeps): (path: string, ctx: {
+export type SandboxFileSend = (path: string, ctx: {
     taskId?: string;
     principal?: string;
 }) => Promise<IssuedFileLink>;
+export declare function createSandboxFileSend(deps: SandboxFileSendDeps): SandboxFileSend;
 //# sourceMappingURL=sandbox-file-send.d.ts.map

package/dist/config-center/apply-effective.d.ts

@@ -0,0 +1,22 @@
+import type { ServiceConfig } from "../config-types.js";
+import { type SealedKeyOpener } from "../sealed-key.js";
+import type { Logger } from "../observability/logger.js";
+import type { EffectiveConfig } from "./types.js";
+export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
+export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
+    teamsOnly?: boolean;
+    sealedKeys?: SealedKeyOpener;
+    deferModelPlane?: boolean;
+}): void;
+export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
+export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
+export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name: string) => boolean, fallback: string, onDangling?: (source: string, name: string) => void): {
+    name: string;
+    source: string;
+};
+export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
+export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
+//# sourceMappingURL=apply-effective.d.ts.map

package/dist/config-center/apply-effective.js

@@ -0,0 +1,283 @@
+import { isThinkingLevel } from "@sema-agent/core";
+import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/registry-core";
+import { sealedKeyPoison } from "../sealed-key.js";
+import { applyAutoCompactWindow, parseAutonomy } from "../config.js";
+import { validateCommandRules } from "../runtime-governance.js";
+import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
+import { registerTeams } from "../capabilities/team.js";
+const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
+const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
+function toModel(m, envDefaults = {}) {
+    const thinkingDefault = asModelThinking(m.defaultThinking) ?? envDefaults.defaultThinking;
+    const effortLevels = (m.reasoningEffortLevels ? m.reasoningEffortLevels.map(asModelThinking).filter((x) => x !== undefined) : undefined) ?? envDefaults.reasoningEffortLevels ?? [];
+    const model = {
+        id: m.id,
+        name: m.name,
+        provider: m.provider,
+        api: m.api,
+        baseUrl: m.baseUrl ?? "",
+        reasoning: m.reasoning !== undefined ? Boolean(m.reasoning) : (envDefaults.reasoning ?? true),
+        input: m.vision ? ["text", "image"] : ["text"],
+        contextWindow: m.contextWindow ?? envDefaults.contextWindow ?? 262144,
+        maxTokens: m.maxTokens ?? envDefaults.maxTokens ?? 4096,
+        ...(charsPerTokenOf(m.charsPerToken) !== undefined || envDefaults.charsPerToken !== undefined
+            ? { charsPerToken: charsPerTokenOf(m.charsPerToken) ?? envDefaults.charsPerToken }
+            : {}),
+        cost: m.cost
+            ? { input: m.cost.input, output: m.cost.output, cacheRead: m.cost.cacheRead ?? 0, cacheWrite: m.cost.cacheWrite ?? 0 }
+            : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        params: { ...(m.tier ? { tier: m.tier } : {}), promptCacheFamily: m.provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
+        ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
+        ...(effortLevels.length > 0 && m.provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
+        ...(m.extraBody ? { extraBody: m.extraBody } : {}),
+        ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
+    };
+    const explicitAct = m.autoCompactTokens;
+    applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);
+    return model;
+}
+export function mutateInPlace(target, source) {
+    for (const k of Object.keys(target))
+        delete target[k];
+    Object.assign(target, source);
+}
+export function applyEffective(config, eff, logger, opts = {}) {
+    if (!opts.teamsOnly && !eff.version) {
+        logger?.warn("sema_registry_unpublished", {
+            version: eff.version,
+            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
+        });
+    }
+    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    if (enabled.length > 0 && opts.deferModelPlane !== true) {
+        const models = {};
+        const modelApiKeyEnv = {};
+        const modelApiKeys = {};
+        const envDefaults = { maxTokens: config.model.maxTokens, contextWindow: config.model.contextWindow, reasoning: config.model.reasoning, charsPerToken: config.model.charsPerToken, defaultThinking: config.model.defaultThinking, reasoningEffortLevels: config.model.compat?.reasoningEffortLevels };
+        for (const m of enabled) {
+            const rawBaseUrl = m.baseUrl;
+            let safeUrl = rawBaseUrl;
+            if (rawBaseUrl) {
+                let ok = false;
+                try {
+                    const u = new URL(rawBaseUrl);
+                    ok = u.protocol === "http:" || u.protocol === "https:";
+                }
+                catch {
+                    ok = false;
+                }
+                if (ok)
+                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: rawBaseUrl, hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+                else {
+                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: String(rawBaseUrl).slice(0, 120), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
+                    safeUrl = undefined;
+                }
+            }
+            models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults);
+            if (m.sealedApiKey) {
+                const s = m.sealedApiKey;
+                if (s.alg !== SEALED_BOX_ALG) {
+                    logger?.warn("sema_registry_model_sealed_key_bad_alg", { model: m.name, alg: String(s.alg), expected: SEALED_BOX_ALG, hint: "unsupported sealed-box alg — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback; contract v1 pins the alg)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "unsupported_alg");
+                }
+                else if (!opts.sealedKeys) {
+                    logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "no_key_store");
+                }
+                else if (!opts.sealedKeys.has(s.publicKeyId)) {
+                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: opts.sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "stale_ciphertext");
+                }
+                else {
+                    try {
+                        modelApiKeys[m.name] = opts.sealedKeys.open(s.ciphertext, s.publicKeyId);
+                    }
+                    catch (err) {
+                        logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                        modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "sealed_decrypt_failed", err instanceof Error ? err.name : "unknown");
+                    }
+                }
+            }
+            else if (m.apiKeyEnv) {
+                if (process.env[m.apiKeyEnv])
+                    modelApiKeyEnv[m.name] = m.apiKeyEnv;
+                else
+                    logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
+            }
+            if (m.provider === "anthropic" && !config.anthropic) {
+                logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
+            }
+        }
+        config.modelApiKeyEnv = modelApiKeyEnv;
+        config.modelApiKeys = modelApiKeys;
+        const quotaWeights = {};
+        for (const m of enabled) {
+            const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
+            if (qw !== undefined) {
+                quotaWeights[m.name] = qw;
+                if (m.id && m.id !== m.name)
+                    quotaWeights[m.id] = qw;
+            }
+        }
+        mutateInPlace(config.modelQuotaWeights, quotaWeights);
+        const roles = {};
+        for (const [role, tgt] of Object.entries(eff.models.roles ?? {})) {
+            if ("model" in tgt)
+                roles[role] = tgt.model;
+            else if ("select" in tgt)
+                roles[role] = { select: tgt.select };
+        }
+        const activeTiers = resolveActiveTiers(eff.models) ?? {};
+        const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
+        const defaultName = picked.name;
+        const defaultSource = picked.source;
+        models.default = models[defaultName];
+        mutateInPlace(config.models, models);
+        config.model = config.models.default;
+        if (Object.keys(roles).length > 0)
+            mutateInPlace(config.roles, roles);
+        mutateInPlace(config.tiers, activeTiers);
+        logger?.info("sema_registry_models", { count: enabled.length, default: config.model.id, defaultSource, roles: Object.keys(roles), tiers: Object.keys(config.tiers), sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length });
+    }
+    const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
+    if (!opts.teamsOnly)
+        applyRuntimeGates(config, gatesView, logger);
+    applyRuntimeHot(config, gatesView, logger);
+    if (opts.deferModelPlane !== true) {
+        const teams = {};
+        for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
+            teams[t.name] = {
+                name: t.name,
+                members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
+                rounds: t.rounds,
+                synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
+            };
+        }
+        registerTeams(teams);
+        if (Object.keys(teams).length > 0)
+            logger?.info("sema_registry_teams", { teams: Object.keys(teams) });
+        const projected = projectCollabToWorkflows(eff.collab?.templates);
+        registerCollabWorkflows(projected.workflows);
+        if (Object.keys(projected.workflows).length > 0)
+            logger?.info("sema_registry_collab_workflows", { workflows: Object.keys(projected.workflows) });
+        if (projected.skipped.length > 0)
+            logger?.warn("sema_registry_collab_skipped", { skipped: projected.skipped });
+        if (projected.notes.length > 0)
+            logger?.info("sema_registry_collab_notes", { notes: projected.notes });
+    }
+    const projDomain = eff.projects;
+    const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain)
+        ? "projects" in projDomain && typeof projDomain.projects === "object"
+            ? (projDomain.projects ?? {})
+            : projDomain
+        : {}) ?? {};
+    const projects = {};
+    for (const [pid, reg] of Object.entries(rawProjects)) {
+        if (!reg || typeof reg !== "object" || Array.isArray(reg))
+            continue;
+        const r = reg;
+        projects[pid] = {
+            ...(typeof r.displayName === "string" ? { displayName: r.displayName } : {}),
+            ...(Array.isArray(r.gitRemotes) ? { gitRemotes: r.gitRemotes.filter((x) => typeof x === "string") } : {}),
+            ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
+        };
+    }
+    mutateInPlace(config.projects, projects);
+    if (Object.keys(projects).length > 0)
+        logger?.info("sema_registry_projects", { projects: Object.keys(projects) });
+}
+export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export function runtimeGatePresent(rt, key) {
+    const v = rt[key];
+    if (key === "approvalRequire")
+        return Array.isArray(v);
+    if (key === "costQuotaWindowSec")
+        return typeof v === "number" && v > 0;
+    return typeof v === "number";
+}
+export function applyRuntimeGates(config, rt, logger) {
+    if (!rt)
+        return;
+    const applied = {};
+    for (const key of RUNTIME_GATE_KEYS) {
+        if (!runtimeGatePresent(rt, key))
+            continue;
+        config[key] = rt[key];
+        applied[key] = rt[key];
+    }
+    if (Object.keys(applied).length > 0)
+        logger?.info("sema_registry_runtime", applied);
+}
+export function applyRuntimeHot(config, rt, logger) {
+    const applied = {};
+    const envAutonomy = parseAutonomy(process.env.AUTONOMY);
+    const nextAutonomy = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
+    if (config.autonomy !== nextAutonomy) {
+        config.autonomy = nextAutonomy;
+        applied.autonomy = nextAutonomy ?? "(env-baseline)";
+    }
+    if (rt?.commandPolicy !== undefined) {
+        const errors = validateCommandRules(rt.commandPolicy);
+        if (errors.length > 0) {
+            logger?.error("sema_registry_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
+        }
+        else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
+            config.commandPolicy = rt.commandPolicy;
+            applied.commandPolicy = rt.commandPolicy.length;
+        }
+    }
+    else if (config.commandPolicy !== undefined) {
+        config.commandPolicy = undefined;
+        applied.commandPolicy = "(env-baseline)";
+    }
+    if (Object.keys(applied).length > 0)
+        logger?.info("sema_registry_runtime_hot", applied);
+}
+const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
+export function resolveDefaultModelName(eff, has, fallback, onDangling) {
+    const activeTiers = resolveActiveTiers(eff.models) ?? {};
+    const structural = eff.models?.default;
+    const rolesDefault = eff.models?.roles?.default?.model;
+    const candidates = [
+        { source: "models.default", name: typeof structural === "string" && structural.length > 0 ? structural : undefined },
+        { source: "roles.default", name: typeof rolesDefault === "string" && rolesDefault.length > 0 ? rolesDefault : undefined },
+        ...DEFAULT_ROLE_TIER_LADDER.map((t) => ({ source: `tierGroup.${t}`, name: activeTiers[t] })),
+    ];
+    for (const c of candidates) {
+        if (!c.name)
+            continue;
+        if (has(c.name))
+            return { name: c.name, source: c.source };
+        onDangling?.(c.source, c.name);
+    }
+    return { name: fallback, source: "enabled[0]" };
+}
+export function logEffectiveDiff(config, eff, logger) {
+    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
+    const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
+    const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
+    const centerTeams = (eff.teams?.teams ?? []).filter((t) => t.enabled !== false).map((t) => t.name);
+    logger?.warn("sema_registry_dry_run", {
+        note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
+        version: eff.version,
+        wouldOverrideModels: enabled.length > 0,
+        wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
+        currentDefaultModel: config.model.id,
+        models: { center: centerModels, envDerived: envModels },
+        roles: { center: centerRoles, current: config.roles },
+        teams: { centerWouldRegister: centerTeams },
+        skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
+        mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
+        runtime: {
+            center: eff.runtime ?? null,
+            current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
+        },
+    });
+}
+export function runtimeHasActiveGate(rt) {
+    if (!rt)
+        return false;
+    return RUNTIME_GATE_KEYS.some((k) => runtimeGatePresent(rt, k));
+}
+//# sourceMappingURL=apply-effective.js.map

package/dist/config-center/http-client.d.ts

@@ -0,0 +1,23 @@
+import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import type { ScenarioRuling } from "../capabilities/scenarios.js";
+import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    effective: EffectiveConfig;
+    etag?: string;
+} | null>;
+export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    runtimeCaps: EntitlementRuntimeCaps | null;
+    configured: boolean;
+    scenario?: ScenarioRuling;
+    execution?: ExecutionRuling;
+    executionDrift?: string;
+    etag?: string;
+} | null>;
+export declare class ConfigCenterHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
+//# sourceMappingURL=http-client.d.ts.map