@sema-agent/server 1.313.0 → 1.315.0

package/dist/question.js

@@ -8,7 +8,7 @@ export const DEFAULT_QUESTION_THROTTLE = {
     ttlMs: 5 * 60_000,
 };
 const NO_HUMAN = { answers: [] };
-export function parseQuestionAnswer(body) {
+export function parseQuestionResponse(body) {
     if (body === null || typeof body !== "object" || Array.isArray(body))
         return { ok: false, error: "body must be an object" };
     const answers = body.answers;
@@ -30,6 +30,7 @@ export function parseQuestionAnswer(body) {
     }
     return { ok: true, value: { answers: out } };
 }
+export const parseQuestionAnswer = parseQuestionResponse;
 function boundQuestions(questions) {
     const redacted = redactDeep(questions);
     try {
@@ -115,7 +116,7 @@ export class QuestionCoordinator {
         return answer;
     };
     respond(id, principal, body) {
-        const parsed = parseQuestionAnswer(body);
+        const parsed = parseQuestionResponse(body);
         if (!parsed.ok)
             return { status: 400, body: { error: parsed.error } };
         const entry = this.pending.get(id);

package/dist/run-local.js

@@ -21,7 +21,7 @@ import { buildScenarios, selectScenario, centerScenarios } from "./capabilities/
 import { HttpError, memoryEngineBackendFor, memorySpecForRequest } from "./security.js";
 import { createMemorySyncRunner, createMemorySyncTransport } from "./memory-sync-client.js";
 import { buildPricing } from "./budget.js";
-import { buildKeyResolver } from "./key-resolver.js";
+import { createKeyResolver } from "./key-resolver.js";
 import { createLogger } from "./observability/logger.js";
 import { createMetrics } from "./observability/metrics.js";
 export function parseArgs(argv) {
@@ -183,7 +183,7 @@ export async function runLocal(argv, deps = {}) {
         return 2;
     }
     const sessionStore = fileBackend.sessionStore;
-    const keyResolver = buildKeyResolver(config.modelApiKeyEnv);
+    const keyResolver = createKeyResolver(config.modelApiKeyEnv);
     const hostRx = config.remoteExec?.provider === "host" ? config.remoteExec : undefined;
     const workspaceDir = args.workspace ?? hostRx?.workspaceBase ?? process.cwd();
     const executionEnvFactory = hostRx

package/dist/runtime-caps-resolver.d.ts

@@ -2,7 +2,7 @@ import type { RuntimeCaps } from "@sema-agent/core";
 import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
 import { fetchPrincipalCaps, type ExecutionRuling } from "./sema-registry.js";
 import type { ScenarioRuling } from "./capabilities/scenarios.js";
-export interface RuntimeCapsResolverOpts {
+export interface EntitlementsResolverOpts {
     baseUrl: string;
     token: string;
     worker?: string;
@@ -15,18 +15,18 @@ export interface RuntimeCapsResolverOpts {
 }
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 export declare function scopedTokenNeedsWorker(token: string, worker: string | undefined): boolean;
-export interface PrincipalCapsClient {
+export interface PrincipalEntitlementsClient {
     resolveRuntimeCaps: (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
     scenarioRuling: (principal: string | undefined) => Promise<ScenarioRuling | undefined>;
     executionRuling: (principal: string | undefined) => Promise<ExecutionRuling | undefined>;
 }
 export declare function gateExecutionLane(ruling: ExecutionRuling | undefined, ownLane: string): void;
-export declare function createPrincipalCapsClient(opts: RuntimeCapsResolverOpts): PrincipalCapsClient;
-export declare function createRuntimeCapsResolver(opts: RuntimeCapsResolverOpts): (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
-export type RuntimeCapsResolverFn = (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
-export declare function applyObserverEnvOptIn(centerResolver: RuntimeCapsResolverFn | undefined, opts: {
+export declare function createPrincipalEntitlementsClient(opts: EntitlementsResolverOpts): PrincipalEntitlementsClient;
+export declare function createEntitlementsResolver(opts: EntitlementsResolverOpts): (principal: string | undefined) => Promise<RuntimeCaps | undefined>;
+export type EntitlementsResolverFn = (principal: string | undefined) => RuntimeCaps | undefined | Promise<RuntimeCaps | undefined>;
+export declare function applyObserverEnvOptIn(centerResolver: EntitlementsResolverFn | undefined, opts: {
     experimentalObserverAgents: boolean;
     requirePrincipal: boolean;
     warn?: (msg: string, fields?: Record<string, unknown>) => void;
-}): RuntimeCapsResolverFn | undefined;
+}): EntitlementsResolverFn | undefined;
 //# sourceMappingURL=runtime-caps-resolver.d.ts.map

package/dist/runtime-caps-resolver.js

@@ -36,7 +36,7 @@ export function gateExecutionLane(ruling, ownLane) {
         });
     }
 }
-export function createPrincipalCapsClient(opts) {
+export function createPrincipalEntitlementsClient(opts) {
     const ttlMs = opts.ttlMs ?? 60_000;
     const denyTtlMs = opts.denyTtlMs ?? Math.min(ttlMs, 10_000);
     const fetchImpl = opts.fetchImpl ?? fetch;
@@ -115,8 +115,8 @@ export function createPrincipalCapsClient(opts) {
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),
     };
 }
-export function createRuntimeCapsResolver(opts) {
-    return createPrincipalCapsClient(opts).resolveRuntimeCaps;
+export function createEntitlementsResolver(opts) {
+    return createPrincipalEntitlementsClient(opts).resolveRuntimeCaps;
 }
 export function applyObserverEnvOptIn(centerResolver, opts) {
     if (!opts.experimentalObserverAgents)

package/dist/security.d.ts

@@ -1,9 +1,8 @@
 import type { IncomingMessage } from "node:http";
-import { FileMemoryEngineBackend, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
+import { type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
-import type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 export type { ApprovalHmacKey, PrincipalJwtKey } from "./auth-keys.js";
 export interface SessionListItem {
@@ -80,76 +79,7 @@ export declare function ssoVerifiedPrincipal(req: IncomingMessage): string | und
 export declare function setSsoScope(req: IncomingMessage, scope: string): void;
 export declare function ssoVerifiedScope(req: IncomingMessage): string | undefined;
 export declare function verifiedPrincipal(req: IncomingMessage, config: ServiceConfig): string | undefined;
-export declare function memoryScopeFor(config: ServiceConfig, principal?: string, projectId?: string): string | undefined;
-export declare function memoryEngineRemoteLanePosture(config: ServiceConfig): {
-    lane: string;
-    posture: "dark" | "forced";
-} | undefined;
-export declare function memoryEngineBackendFor(config: ServiceConfig, fallbackRoot?: string): {
-    backend: FileMemoryEngineBackend;
-    root: string;
-} | undefined;
-export declare function memorySpecForRequest(scope: string | undefined, memoryWrite: boolean | undefined, defaultScopes?: string[]): {
-    scope: string;
-    scopes?: string[];
-    writeScope?: string | null;
-    scopeContract?: "v2";
-} | undefined;
-export declare function approvalHmacMessage(env: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}): string;
-export declare const MAX_APPROVAL_REASON_CHARS = 4096;
-export declare function verifyApprovalHmac(env: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
-export declare function verifyPrincipalJwt(token: string, keys: PrincipalJwtKey[], expect: {
-    iss: string;
-    aud: string;
-    nowSec?: number;
-    skewSec?: number;
-    maxTtlSec?: number;
-}): {
-    sub: string;
-    bnd?: string;
-} | null;
-export declare function approvalBnd(env: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-}): string;
-export declare function verifyDirectDoorProof(proof: {
-    jwt?: string;
-    mac?: string;
-    kid?: string;
-}, envelope: {
-    sessionId: string;
-    boundCallId?: string | null;
-    boundInputHash?: string | null;
-    decision: string;
-    reason?: string | null;
-}, config: {
-    principalJwtPubkeys: PrincipalJwtKey[];
-    principalJwtIss?: string;
-    principalJwtAud?: string;
-    principalJwtMaxTtlSec?: number;
-    approvalHmacKeys: ApprovalHmacKey[];
-}, opts?: {
-    actionBinding?: boolean;
-}): {
-    ok: true;
-    principal: string;
-} | {
-    ok: false;
-    status: number;
-    errorCode: string;
-    error: string;
-};
+export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
+export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
 //# sourceMappingURL=security.d.ts.map

package/dist/security.js

@@ -1,8 +1,8 @@
-import { createHash, createHmac, createPublicKey, timingSafeEqual, verify as cryptoVerify } from "node:crypto";
-import { join } from "node:path";
-import { uuidv7, FileMemoryEngineBackend, resolveMemoryEngineRoot, deriveControlPlaneDir, formatUserScope, formatProjScope } from "@sema-agent/core";
+import { uuidv7 } from "@sema-agent/core";
 import { PROJECT_ID_REGEX } from "@sema-agent/registry-core";
 export { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
+import { memoryScopeFor } from "./memory-scope.js";
+import { verifyPrincipalJwt } from "./principal-jwt.js";
 const UUIDV7_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
 export function isUuidV7(s) {
     return UUIDV7_RE.test(s);
@@ -128,156 +128,7 @@ export function verifiedPrincipal(req, config) {
         assertPrincipalShape(sub);
     return sub;
 }
-export function memoryScopeFor(config, principal, projectId) {
-    if (config.requirePrincipal === true) {
-        if (config.memoryEngineBackend === "pg" || config.memoryEngineBackend === "tidb") {
-            if (!principal)
-                return undefined;
-            return projectId ? formatProjScope(principal, projectId) : formatUserScope(principal);
-        }
-        return undefined;
-    }
-    return config.memoryScope;
-}
-export function memoryEngineRemoteLanePosture(config) {
-    const lane = config.remoteExec?.provider;
-    if (lane === undefined || lane === "host")
-        return undefined;
-    return { lane, posture: config.memoryEngineRemoteLaneAllowed === true ? "forced" : "dark" };
-}
-export function memoryEngineBackendFor(config, fallbackRoot) {
-    if (config.requirePrincipal === true || !config.memoryEngineEnabled)
-        return undefined;
-    if (memoryEngineRemoteLanePosture(config)?.posture === "dark")
-        return undefined;
-    const root = resolveMemoryEngineRoot(config.memoryEngineDir ?? fallbackRoot);
-    const dir = join(root, "memory");
-    return { backend: new FileMemoryEngineBackend(dir, { controlDir: deriveControlPlaneDir(root, dir) }), root };
-}
-export function memorySpecForRequest(scope, memoryWrite, defaultScopes) {
-    if (!scope)
-        return undefined;
-    const isV2 = (k) => k.startsWith("user:") || k.startsWith("org:") || k.startsWith("proj:") || k.startsWith("userproj:");
-    const extras = (defaultScopes ?? []).filter((s, i, arr) => typeof s === "string" && s.length > 0 && s !== scope && arr.indexOf(s) === i);
-    const layered = extras.length > 0 ? { scopes: [scope, ...extras], writeScope: scope } : {};
-    const v2 = isV2(scope) || extras.some(isV2) ? { scopeContract: "v2" } : {};
-    return memoryWrite === false ? { scope, ...layered, writeScope: null, ...v2 } : { scope, ...layered, ...v2 };
-}
-export function approvalHmacMessage(env) {
-    return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
-}
-export const MAX_APPROVAL_REASON_CHARS = 4_096;
-export function verifyApprovalHmac(env, mac, kid, keys) {
-    if (keys.length === 0)
-        return false;
-    let supplied;
-    try {
-        supplied = Buffer.from(mac, "hex");
-    }
-    catch {
-        return false;
-    }
-    if (supplied.length === 0)
-        return false;
-    const ordered = kid ? [...keys.filter((k) => k.kid === kid), ...keys.filter((k) => k.kid !== kid)] : keys;
-    const msg = approvalHmacMessage(env);
-    for (const k of ordered) {
-        const expected = createHmac("sha256", k.key).update(msg).digest();
-        if (expected.length === supplied.length && timingSafeEqual(expected, supplied))
-            return true;
-    }
-    return false;
-}
-function b64urlToBuf(s) {
-    return Buffer.from(s, "base64url");
-}
-function verifyJwsSignature(alg, signingInput, sig, pub) {
-    try {
-        if (alg === "EdDSA")
-            return cryptoVerify(null, signingInput, pub, sig);
-        if (alg === "RS256")
-            return cryptoVerify("sha256", signingInput, pub, sig);
-        if (alg === "ES256")
-            return cryptoVerify("sha256", signingInput, { key: pub, dsaEncoding: "ieee-p1363" }, sig);
-        return false;
-    }
-    catch {
-        return false;
-    }
-}
-export function verifyPrincipalJwt(token, keys, expect) {
-    if (keys.length === 0)
-        return null;
-    const parts = token.split(".");
-    if (parts.length !== 3)
-        return null;
-    const [h, p, s] = parts;
-    let header;
-    let payload;
-    let sig;
-    try {
-        header = JSON.parse(b64urlToBuf(h).toString("utf8"));
-        payload = JSON.parse(b64urlToBuf(p).toString("utf8"));
-        sig = b64urlToBuf(s);
-    }
-    catch {
-        return null;
-    }
-    if (typeof header !== "object" || header === null || typeof payload !== "object" || payload === null)
-        return null;
-    if (typeof header.alg !== "string" || typeof header.kid !== "string" || sig.length === 0)
-        return null;
-    const key = keys.find((k) => k.kid === header.kid);
-    if (!key || key.alg !== header.alg)
-        return null;
-    let pub;
-    try {
-        pub = createPublicKey(key.key);
-    }
-    catch {
-        return null;
-    }
-    const signingInput = Buffer.from(`${h}.${p}`, "utf8");
-    if (!verifyJwsSignature(key.alg, signingInput, sig, pub))
-        return null;
-    if (payload.iss !== expect.iss)
-        return null;
-    const aud = payload.aud;
-    const audOk = aud === expect.aud || (Array.isArray(aud) && aud.includes(expect.aud));
-    if (!audOk)
-        return null;
-    if (typeof payload.sub !== "string" || payload.sub.length === 0)
-        return null;
-    const now = expect.nowSec ?? Math.floor(Date.now() / 1000);
-    const skew = expect.skewSec ?? 30;
-    if (typeof payload.exp !== "number" || payload.exp + skew < now)
-        return null;
-    if (payload.nbf !== undefined && (typeof payload.nbf !== "number" || payload.nbf - skew > now))
-        return null;
-    if (expect.maxTtlSec && payload.exp - now > expect.maxTtlSec + skew)
-        return null;
-    const bnd = typeof payload.cnf?.bnd === "string" ? payload.cnf.bnd : undefined;
-    return { sub: payload.sub, bnd };
-}
-export function approvalBnd(env) {
-    return createHash("sha256").update(JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null])).digest("hex");
-}
-export function verifyDirectDoorProof(proof, envelope, config, opts) {
-    const actionBinding = opts?.actionBinding ?? true;
-    if (!proof.jwt)
-        return { ok: false, status: 401, errorCode: "principal_unverified", error: "direct door requires a signed principal token (X-Approval-Principal-Token)" };
-    const verified = verifyPrincipalJwt(proof.jwt, config.principalJwtPubkeys, { iss: config.principalJwtIss ?? "\0", aud: config.principalJwtAud ?? "\0", maxTtlSec: config.principalJwtMaxTtlSec });
-    if (!verified)
-        return { ok: false, status: 401, errorCode: "principal_unverified", error: "principal token failed verification" };
-    if (actionBinding && !envelope.boundInputHash)
-        return { ok: false, status: 400, errorCode: "approval_mac_required", error: "direct door requires boundInputHash (the bound action) in the body" };
-    if (verified.bnd !== approvalBnd(envelope))
-        return { ok: false, status: 401, errorCode: "principal_unbound", error: "principal token is not bound to this decision (cnf.bnd mismatch)" };
-    if (!proof.mac)
-        return { ok: false, status: 401, errorCode: "approval_mac_required", error: "direct door requires an approval MAC (X-Approval-Mac)" };
-    const ok = verifyApprovalHmac({ sessionId: envelope.sessionId, boundCallId: envelope.boundCallId ?? null, boundInputHash: envelope.boundInputHash ?? null, decision: envelope.decision, reason: envelope.reason ?? null }, proof.mac, proof.kid, config.approvalHmacKeys);
-    if (!ok)
-        return { ok: false, status: 401, errorCode: "approval_mac_invalid", error: "approval envelope MAC invalid" };
-    return { ok: true, principal: verified.sub };
-}
+export { memoryScopeFor, memoryEngineRemoteLanePosture, memoryEngineBackendFor, memorySpecForRequest } from "./memory-scope.js";
+export { approvalHmacMessage, MAX_APPROVAL_REASON_CHARS, verifyApprovalHmac } from "./approval-hmac.js";
+export { verifyPrincipalJwt, approvalBnd, verifyDirectDoorProof } from "./principal-jwt.js";
 //# sourceMappingURL=security.js.map

package/dist/sema-registry.d.ts

@@ -1,201 +1,6 @@
-import type { McpServerSpec } from "@sema-agent/core";
-import { type EntitlementRuntimeCaps } from "@sema-agent/registry-core";
-import type { ScopedMcpServer, ServiceConfig } from "./config-types.js";
-import { type SealedKeyOpener } from "./sealed-key.js";
-import type { Autonomy, CommandRule } from "./runtime-governance.js";
-import type { Logger } from "./observability/logger.js";
-import type { LoadedSkill } from "./capabilities/skills.js";
-import type { ScenarioRuling } from "./capabilities/scenarios.js";
-import type { CollabTemplateWire } from "./capabilities/collab-wire.js";
-interface CenterModel {
-    name: string;
-    id: string;
-    provider: string;
-    api: "openai-completions" | "anthropic-messages";
-    baseUrl?: string;
-    apiKeyEnv?: string;
-    sealedApiKey?: {
-        ciphertext: string;
-        publicKeyId: string;
-        alg: string;
-        setAt?: string;
-    };
-    tier?: string;
-    reasoning?: boolean;
-    vision?: boolean;
-    contextWindow?: number;
-    maxTokens?: number;
-    autoCompactTokens?: number;
-    charsPerToken?: number;
-    cost?: {
-        input: number;
-        output: number;
-        cacheRead?: number;
-        cacheWrite?: number;
-    };
-    quotaWeight?: number;
-    defaultThinking?: string;
-    reasoningEffortLevels?: string[];
-    extraBody?: Record<string, unknown>;
-    promptGuidance?: string[];
-    enabled?: boolean;
-}
-type CenterRoleTarget = {
-    model: string;
-} | {
-    select: unknown;
-};
-interface CenterTeam {
-    name: string;
-    members: {
-        role: string;
-        modelRole?: string;
-        model?: string;
-        systemPrompt?: string;
-    }[];
-    rounds: number;
-    synthesizer?: {
-        role: string;
-        modelRole?: string;
-        systemPrompt?: string;
-    };
-    scenario?: string;
-    maxTranscriptTokens?: number;
-    enabled?: boolean;
-}
-export interface CenterSkillManifest {
-    name: string;
-    description: string;
-    scenarios: string[];
-    contentHash: string;
-    enabled?: boolean;
-}
-export interface CenterMcpServer {
-    name: string;
-    scenarios: string[];
-    enabled?: boolean;
-    allowTools?: string[];
-    elicitation?: boolean;
-    transport: {
-        kind: "stdio";
-        command: string;
-        args?: string[];
-        envRefs?: Record<string, string>;
-    } | {
-        kind: "http";
-        url: string;
-        headerRefs?: Record<string, string>;
-        principalHeader?: string;
-    };
-}
-export interface EffectiveConfig {
-    version: number;
-    updatedAt: string;
-    models: {
-        models: CenterModel[];
-        roles: Record<string, CenterRoleTarget>;
-        atModelAllowlist?: string[];
-    };
-    teams?: {
-        teams: CenterTeam[];
-    };
-    collab?: {
-        templates: CollabTemplateWire[];
-    };
-    skills?: {
-        skills: CenterSkillManifest[];
-    };
-    mcp?: {
-        servers: CenterMcpServer[];
-    };
-    scenarios?: {
-        scenarios: Array<{
-            name: string;
-            toolset: string;
-            enabled?: boolean;
-        }>;
-    };
-    runtime?: {
-        rateLimitPerMin?: number;
-        approvalRequire?: string[];
-        maxTaskCostUsd?: number;
-        maxTaskTokens?: number;
-        maxPrincipalCostUsd?: number;
-        costQuotaWindowSec?: number;
-        autonomy?: Autonomy;
-        commandPolicy?: CommandRule[];
-    };
-    projects?: {
-        projects?: Record<string, unknown>;
-    } | Record<string, unknown>;
-    governance?: {
-        autonomy?: Autonomy;
-        commandPolicy?: CommandRule[];
-        approvalRequire?: string[];
-    };
-    plugins?: {
-        plugins?: unknown[];
-    };
-    prompts?: unknown;
-}
-export interface ExecutionRuling {
-    required: boolean;
-    allowedLanes: string[];
-    sessionMirror?: SessionMirrorRuling;
-}
-export interface SessionMirrorRuling {
-    engineUrl: string;
-    required: boolean;
-}
-export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
-    effective: EffectiveConfig;
-    etag?: string;
-} | null>;
-export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
-    runtimeCaps: EntitlementRuntimeCaps | null;
-    configured: boolean;
-    scenario?: ScenarioRuling;
-    execution?: ExecutionRuling;
-    executionDrift?: string;
-    etag?: string;
-} | null>;
-export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
-export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
-    teamsOnly?: boolean;
-    sealedKeys?: SealedKeyOpener;
-    deferModelPlane?: boolean;
-}): void;
-export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
-export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
-export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name: string) => boolean, fallback: string, onDangling?: (source: string, name: string) => void): {
-    name: string;
-    source: string;
-};
-export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
-export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
-export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers";
-export interface RestartSignal {
-    restartRequired: true;
-    reasons: RestartSlice[];
-    version: number;
-    since: number;
-}
-export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
-export declare function planeHasActiveTiers(eff: EffectiveConfig): boolean;
-export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
-export declare class ConfigCenterHttpError extends Error {
-    readonly status: number;
-    constructor(message: string, status: number);
-}
-export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
-export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
-export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
-export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
-    skills: CenterSkillManifest[];
-}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, diskCacheDir?: string): Promise<LoadedSkill[]>;
-export declare function resolveMcpServers(mcp: {
-    servers: CenterMcpServer[];
-}, logger?: Logger): ScopedMcpServer[];
-export declare function mcpForScenario(servers: ScopedMcpServer[] | undefined, scenario: string): McpServerSpec[] | undefined;
-export {};
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, type RestartSlice, type RestartSignal, } from "./config-center/restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
+export type { CenterSkillManifest, CenterMcpServer, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./config-center/types.js";
 //# sourceMappingURL=sema-registry.d.ts.map