@sema-agent/server 1.314.0 → 1.315.0

package/dist/approval-hmac.d.ts

@@ -0,0 +1,17 @@
+import type { ApprovalHmacKey } from "./auth-keys.js";
+export declare function approvalHmacMessage(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+    reason?: string | null;
+}): string;
+export declare const MAX_APPROVAL_REASON_CHARS = 4096;
+export declare function verifyApprovalHmac(env: {
+    sessionId: string;
+    boundCallId?: string | null;
+    boundInputHash?: string | null;
+    decision: string;
+    reason?: string | null;
+}, mac: string, kid: string | undefined, keys: ApprovalHmacKey[]): boolean;
+//# sourceMappingURL=approval-hmac.d.ts.map

package/dist/approval-hmac.js

@@ -0,0 +1,27 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+export function approvalHmacMessage(env) {
+    return JSON.stringify([env.sessionId, env.boundCallId ?? null, env.boundInputHash ?? null, env.decision, env.reason ?? null]);
+}
+export const MAX_APPROVAL_REASON_CHARS = 4_096;
+export function verifyApprovalHmac(env, mac, kid, keys) {
+    if (keys.length === 0)
+        return false;
+    let supplied;
+    try {
+        supplied = Buffer.from(mac, "hex");
+    }
+    catch {
+        return false;
+    }
+    if (supplied.length === 0)
+        return false;
+    const ordered = kid ? [...keys.filter((k) => k.kid === kid), ...keys.filter((k) => k.kid !== kid)] : keys;
+    const msg = approvalHmacMessage(env);
+    for (const k of ordered) {
+        const expected = createHmac("sha256", k.key).update(msg).digest();
+        if (expected.length === supplied.length && timingSafeEqual(expected, supplied))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=approval-hmac.js.map

package/dist/config-center/apply-effective.d.ts

@@ -0,0 +1,22 @@
+import type { ServiceConfig } from "../config-types.js";
+import { type SealedKeyOpener } from "../sealed-key.js";
+import type { Logger } from "../observability/logger.js";
+import type { EffectiveConfig } from "./types.js";
+export declare function mutateInPlace<V>(target: Record<string, V>, source: Record<string, V>): void;
+export declare function applyEffective(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger, opts?: {
+    teamsOnly?: boolean;
+    sealedKeys?: SealedKeyOpener;
+    deferModelPlane?: boolean;
+}): void;
+export declare const RUNTIME_GATE_KEYS: readonly ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export type RuntimeGateKey = (typeof RUNTIME_GATE_KEYS)[number];
+export declare function runtimeGatePresent(rt: NonNullable<EffectiveConfig["runtime"]>, key: RuntimeGateKey): boolean;
+export declare function applyRuntimeGates(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function applyRuntimeHot(config: ServiceConfig, rt: EffectiveConfig["runtime"], logger?: Logger): void;
+export declare function resolveDefaultModelName(eff: EffectiveConfig, has: (name: string) => boolean, fallback: string, onDangling?: (source: string, name: string) => void): {
+    name: string;
+    source: string;
+};
+export declare function logEffectiveDiff(config: ServiceConfig, eff: EffectiveConfig, logger?: Logger): void;
+export declare function runtimeHasActiveGate(rt: EffectiveConfig["runtime"]): boolean;
+//# sourceMappingURL=apply-effective.d.ts.map

package/dist/config-center/apply-effective.js

@@ -0,0 +1,283 @@
+import { isThinkingLevel } from "@sema-agent/core";
+import { resolveActiveTiers, SEALED_BOX_ALG } from "@sema-agent/registry-core";
+import { sealedKeyPoison } from "../sealed-key.js";
+import { applyAutoCompactWindow, parseAutonomy } from "../config.js";
+import { validateCommandRules } from "../runtime-governance.js";
+import { projectCollabToWorkflows, registerCollabWorkflows } from "../capabilities/collab-workflows.js";
+import { registerTeams } from "../capabilities/team.js";
+const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
+const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
+function toModel(m, envDefaults = {}) {
+    const thinkingDefault = asModelThinking(m.defaultThinking) ?? envDefaults.defaultThinking;
+    const effortLevels = (m.reasoningEffortLevels ? m.reasoningEffortLevels.map(asModelThinking).filter((x) => x !== undefined) : undefined) ?? envDefaults.reasoningEffortLevels ?? [];
+    const model = {
+        id: m.id,
+        name: m.name,
+        provider: m.provider,
+        api: m.api,
+        baseUrl: m.baseUrl ?? "",
+        reasoning: m.reasoning !== undefined ? Boolean(m.reasoning) : (envDefaults.reasoning ?? true),
+        input: m.vision ? ["text", "image"] : ["text"],
+        contextWindow: m.contextWindow ?? envDefaults.contextWindow ?? 262144,
+        maxTokens: m.maxTokens ?? envDefaults.maxTokens ?? 4096,
+        ...(charsPerTokenOf(m.charsPerToken) !== undefined || envDefaults.charsPerToken !== undefined
+            ? { charsPerToken: charsPerTokenOf(m.charsPerToken) ?? envDefaults.charsPerToken }
+            : {}),
+        cost: m.cost
+            ? { input: m.cost.input, output: m.cost.output, cacheRead: m.cost.cacheRead ?? 0, cacheWrite: m.cost.cacheWrite ?? 0 }
+            : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        params: { ...(m.tier ? { tier: m.tier } : {}), promptCacheFamily: m.provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
+        ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
+        ...(effortLevels.length > 0 && m.provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
+        ...(m.extraBody ? { extraBody: m.extraBody } : {}),
+        ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
+    };
+    const explicitAct = m.autoCompactTokens;
+    applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);
+    return model;
+}
+export function mutateInPlace(target, source) {
+    for (const k of Object.keys(target))
+        delete target[k];
+    Object.assign(target, source);
+}
+export function applyEffective(config, eff, logger, opts = {}) {
+    if (!opts.teamsOnly && !eff.version) {
+        logger?.warn("sema_registry_unpublished", {
+            version: eff.version,
+            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
+        });
+    }
+    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    if (enabled.length > 0 && opts.deferModelPlane !== true) {
+        const models = {};
+        const modelApiKeyEnv = {};
+        const modelApiKeys = {};
+        const envDefaults = { maxTokens: config.model.maxTokens, contextWindow: config.model.contextWindow, reasoning: config.model.reasoning, charsPerToken: config.model.charsPerToken, defaultThinking: config.model.defaultThinking, reasoningEffortLevels: config.model.compat?.reasoningEffortLevels };
+        for (const m of enabled) {
+            const rawBaseUrl = m.baseUrl;
+            let safeUrl = rawBaseUrl;
+            if (rawBaseUrl) {
+                let ok = false;
+                try {
+                    const u = new URL(rawBaseUrl);
+                    ok = u.protocol === "http:" || u.protocol === "https:";
+                }
+                catch {
+                    ok = false;
+                }
+                if (ok)
+                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: rawBaseUrl, hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
+                else {
+                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: String(rawBaseUrl).slice(0, 120), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
+                    safeUrl = undefined;
+                }
+            }
+            models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults);
+            if (m.sealedApiKey) {
+                const s = m.sealedApiKey;
+                if (s.alg !== SEALED_BOX_ALG) {
+                    logger?.warn("sema_registry_model_sealed_key_bad_alg", { model: m.name, alg: String(s.alg), expected: SEALED_BOX_ALG, hint: "unsupported sealed-box alg — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback; contract v1 pins the alg)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "unsupported_alg");
+                }
+                else if (!opts.sealedKeys) {
+                    logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "no_key_store");
+                }
+                else if (!opts.sealedKeys.has(s.publicKeyId)) {
+                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: opts.sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
+                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "stale_ciphertext");
+                }
+                else {
+                    try {
+                        modelApiKeys[m.name] = opts.sealedKeys.open(s.ciphertext, s.publicKeyId);
+                    }
+                    catch (err) {
+                        logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
+                        modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "sealed_decrypt_failed", err instanceof Error ? err.name : "unknown");
+                    }
+                }
+            }
+            else if (m.apiKeyEnv) {
+                if (process.env[m.apiKeyEnv])
+                    modelApiKeyEnv[m.name] = m.apiKeyEnv;
+                else
+                    logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
+            }
+            if (m.provider === "anthropic" && !config.anthropic) {
+                logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
+            }
+        }
+        config.modelApiKeyEnv = modelApiKeyEnv;
+        config.modelApiKeys = modelApiKeys;
+        const quotaWeights = {};
+        for (const m of enabled) {
+            const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
+            if (qw !== undefined) {
+                quotaWeights[m.name] = qw;
+                if (m.id && m.id !== m.name)
+                    quotaWeights[m.id] = qw;
+            }
+        }
+        mutateInPlace(config.modelQuotaWeights, quotaWeights);
+        const roles = {};
+        for (const [role, tgt] of Object.entries(eff.models.roles ?? {})) {
+            if ("model" in tgt)
+                roles[role] = tgt.model;
+            else if ("select" in tgt)
+                roles[role] = { select: tgt.select };
+        }
+        const activeTiers = resolveActiveTiers(eff.models) ?? {};
+        const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
+        const defaultName = picked.name;
+        const defaultSource = picked.source;
+        models.default = models[defaultName];
+        mutateInPlace(config.models, models);
+        config.model = config.models.default;
+        if (Object.keys(roles).length > 0)
+            mutateInPlace(config.roles, roles);
+        mutateInPlace(config.tiers, activeTiers);
+        logger?.info("sema_registry_models", { count: enabled.length, default: config.model.id, defaultSource, roles: Object.keys(roles), tiers: Object.keys(config.tiers), sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length });
+    }
+    const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
+    if (!opts.teamsOnly)
+        applyRuntimeGates(config, gatesView, logger);
+    applyRuntimeHot(config, gatesView, logger);
+    if (opts.deferModelPlane !== true) {
+        const teams = {};
+        for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
+            teams[t.name] = {
+                name: t.name,
+                members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
+                rounds: t.rounds,
+                synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
+            };
+        }
+        registerTeams(teams);
+        if (Object.keys(teams).length > 0)
+            logger?.info("sema_registry_teams", { teams: Object.keys(teams) });
+        const projected = projectCollabToWorkflows(eff.collab?.templates);
+        registerCollabWorkflows(projected.workflows);
+        if (Object.keys(projected.workflows).length > 0)
+            logger?.info("sema_registry_collab_workflows", { workflows: Object.keys(projected.workflows) });
+        if (projected.skipped.length > 0)
+            logger?.warn("sema_registry_collab_skipped", { skipped: projected.skipped });
+        if (projected.notes.length > 0)
+            logger?.info("sema_registry_collab_notes", { notes: projected.notes });
+    }
+    const projDomain = eff.projects;
+    const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain)
+        ? "projects" in projDomain && typeof projDomain.projects === "object"
+            ? (projDomain.projects ?? {})
+            : projDomain
+        : {}) ?? {};
+    const projects = {};
+    for (const [pid, reg] of Object.entries(rawProjects)) {
+        if (!reg || typeof reg !== "object" || Array.isArray(reg))
+            continue;
+        const r = reg;
+        projects[pid] = {
+            ...(typeof r.displayName === "string" ? { displayName: r.displayName } : {}),
+            ...(Array.isArray(r.gitRemotes) ? { gitRemotes: r.gitRemotes.filter((x) => typeof x === "string") } : {}),
+            ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
+        };
+    }
+    mutateInPlace(config.projects, projects);
+    if (Object.keys(projects).length > 0)
+        logger?.info("sema_registry_projects", { projects: Object.keys(projects) });
+}
+export const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+export function runtimeGatePresent(rt, key) {
+    const v = rt[key];
+    if (key === "approvalRequire")
+        return Array.isArray(v);
+    if (key === "costQuotaWindowSec")
+        return typeof v === "number" && v > 0;
+    return typeof v === "number";
+}
+export function applyRuntimeGates(config, rt, logger) {
+    if (!rt)
+        return;
+    const applied = {};
+    for (const key of RUNTIME_GATE_KEYS) {
+        if (!runtimeGatePresent(rt, key))
+            continue;
+        config[key] = rt[key];
+        applied[key] = rt[key];
+    }
+    if (Object.keys(applied).length > 0)
+        logger?.info("sema_registry_runtime", applied);
+}
+export function applyRuntimeHot(config, rt, logger) {
+    const applied = {};
+    const envAutonomy = parseAutonomy(process.env.AUTONOMY);
+    const nextAutonomy = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
+    if (config.autonomy !== nextAutonomy) {
+        config.autonomy = nextAutonomy;
+        applied.autonomy = nextAutonomy ?? "(env-baseline)";
+    }
+    if (rt?.commandPolicy !== undefined) {
+        const errors = validateCommandRules(rt.commandPolicy);
+        if (errors.length > 0) {
+            logger?.error("sema_registry_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
+        }
+        else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
+            config.commandPolicy = rt.commandPolicy;
+            applied.commandPolicy = rt.commandPolicy.length;
+        }
+    }
+    else if (config.commandPolicy !== undefined) {
+        config.commandPolicy = undefined;
+        applied.commandPolicy = "(env-baseline)";
+    }
+    if (Object.keys(applied).length > 0)
+        logger?.info("sema_registry_runtime_hot", applied);
+}
+const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
+export function resolveDefaultModelName(eff, has, fallback, onDangling) {
+    const activeTiers = resolveActiveTiers(eff.models) ?? {};
+    const structural = eff.models?.default;
+    const rolesDefault = eff.models?.roles?.default?.model;
+    const candidates = [
+        { source: "models.default", name: typeof structural === "string" && structural.length > 0 ? structural : undefined },
+        { source: "roles.default", name: typeof rolesDefault === "string" && rolesDefault.length > 0 ? rolesDefault : undefined },
+        ...DEFAULT_ROLE_TIER_LADDER.map((t) => ({ source: `tierGroup.${t}`, name: activeTiers[t] })),
+    ];
+    for (const c of candidates) {
+        if (!c.name)
+            continue;
+        if (has(c.name))
+            return { name: c.name, source: c.source };
+        onDangling?.(c.source, c.name);
+    }
+    return { name: fallback, source: "enabled[0]" };
+}
+export function logEffectiveDiff(config, eff, logger) {
+    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
+    const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
+    const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
+    const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
+    const centerTeams = (eff.teams?.teams ?? []).filter((t) => t.enabled !== false).map((t) => t.name);
+    logger?.warn("sema_registry_dry_run", {
+        note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
+        version: eff.version,
+        wouldOverrideModels: enabled.length > 0,
+        wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
+        currentDefaultModel: config.model.id,
+        models: { center: centerModels, envDerived: envModels },
+        roles: { center: centerRoles, current: config.roles },
+        teams: { centerWouldRegister: centerTeams },
+        skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
+        mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
+        runtime: {
+            center: eff.runtime ?? null,
+            current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
+        },
+    });
+}
+export function runtimeHasActiveGate(rt) {
+    if (!rt)
+        return false;
+    return RUNTIME_GATE_KEYS.some((k) => runtimeGatePresent(rt, k));
+}
+//# sourceMappingURL=apply-effective.js.map

package/dist/config-center/http-client.d.ts

@@ -0,0 +1,23 @@
+import type { EntitlementRuntimeCaps } from "@sema-agent/registry-core";
+import type { ScenarioRuling } from "../capabilities/scenarios.js";
+import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    effective: EffectiveConfig;
+    etag?: string;
+} | null>;
+export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+    runtimeCaps: EntitlementRuntimeCaps | null;
+    configured: boolean;
+    scenario?: ScenarioRuling;
+    execution?: ExecutionRuling;
+    executionDrift?: string;
+    etag?: string;
+} | null>;
+export declare class ConfigCenterHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
+//# sourceMappingURL=http-client.d.ts.map

package/dist/config-center/http-client.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
+    const scheme = new URL(baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
+    const res = await fetchImpl(url, {
+        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
+        signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 304)
+        return null;
+    if (!res.ok)
+        throw new Error(`sema-registry HTTP ${res.status}`);
+    return { effective: (await res.json()), etag: res.headers.get("etag") ?? undefined };
+}
+export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
+    const scheme = new URL(baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const params = new URLSearchParams({ principal });
+    if (worker)
+        params.set("worker", worker);
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
+    const res = await fetchImpl(url, {
+        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
+        signal: AbortSignal.timeout(8000),
+    });
+    if (res.status === 304) {
+        if (!etag)
+            throw new Error("sema-registry returned 304 to a non-conditional principal-caps request");
+        return null;
+    }
+    if (!res.ok)
+        throw new Error(`sema-registry principal-caps HTTP ${res.status}`);
+    const body = (await res.json());
+    return {
+        runtimeCaps: body.runtimeCaps ?? null,
+        configured: Boolean(body.configured),
+        ...("scenario" in body || "allowlist" in body
+            ? {
+                scenario: {
+                    scenario: typeof body.scenario === "string" ? body.scenario : null,
+                    allowlist: Array.isArray(body.allowlist) ? body.allowlist.filter((s) => typeof s === "string") : [],
+                },
+            }
+            : {}),
+        ...((() => {
+            const ex = body.execution;
+            if (ex === undefined || ex === null)
+                return {};
+            if (typeof ex.required !== "boolean")
+                return { executionDrift: `execution.required is ${typeof ex.required}, expected boolean — ruling dropped (fail-open)` };
+            if (!Array.isArray(ex.allowedLanes))
+                return { executionDrift: `execution.allowedLanes is ${typeof ex.allowedLanes}, expected string[] — ruling dropped (fail-open)` };
+            const execution = { required: ex.required, allowedLanes: ex.allowedLanes.filter((s) => typeof s === "string") };
+            if (ex.sessionMirror !== undefined && ex.sessionMirror !== null) {
+                const sm = ex.sessionMirror;
+                const smOk = typeof sm === "object" && typeof sm.engineUrl === "string" && sm.engineUrl.length > 0 && (sm.required === undefined || typeof sm.required === "boolean");
+                if (smOk)
+                    execution.sessionMirror = { engineUrl: sm.engineUrl, required: sm.required === true };
+                else
+                    return { execution, executionDrift: "execution.sessionMirror malformed — mirror observation dropped (fail-open; lane ruling kept)" };
+            }
+            return { execution };
+        })()),
+        etag: res.headers.get("etag") ?? undefined,
+    };
+}
+export class ConfigCenterHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "ConfigCenterHttpError";
+    }
+}
+export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
+    const content = await res.text();
+    const want = contentHash.replace(/^sha256:/, "").toLowerCase();
+    const got = createHash("sha256").update(content, "utf8").digest("hex");
+    if (got !== want)
+        throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
+    return content;
+}
+export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
+    return await res.json();
+}
+export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
+    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+    if (!res.ok)
+        throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    const want = contentDigest.replace(/^sha256:/, "").toLowerCase();
+    const got = createHash("sha256").update(bytes).digest("hex");
+    if (got !== want)
+        throw new Error(`prompt blob hash mismatch for ${contentDigest}: computed sha256:${got}`);
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+//# sourceMappingURL=http-client.js.map

package/dist/config-center/restart-signal.d.ts

@@ -0,0 +1,12 @@
+import type { EffectiveConfig } from "./types.js";
+export type RestartSlice = "skills" | "mcp" | "scenarios" | "runtime-gates" | "models-tiers";
+export interface RestartSignal {
+    restartRequired: true;
+    reasons: RestartSlice[];
+    version: number;
+    since: number;
+}
+export declare function restartReasons(boot: EffectiveConfig | undefined, current: EffectiveConfig): RestartSlice[];
+export declare function planeHasActiveTiers(eff: EffectiveConfig): boolean;
+export declare function modelPlaneChanged(prev: EffectiveConfig | undefined, next: EffectiveConfig): boolean;
+//# sourceMappingURL=restart-signal.d.ts.map

package/dist/config-center/restart-signal.js

@@ -0,0 +1,70 @@
+import { resolveActiveTiers } from "@sema-agent/registry-core";
+import { RUNTIME_GATE_KEYS, runtimeGatePresent, resolveDefaultModelName } from "./apply-effective.js";
+const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers"];
+function stableStringify(v) {
+    if (v === null || typeof v !== "object")
+        return JSON.stringify(v) ?? "null";
+    if (Array.isArray(v))
+        return `[${v.map(stableStringify).join(",")}]`;
+    const obj = v;
+    return `{${Object.keys(obj)
+        .sort()
+        .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)
+        .join(",")}}`;
+}
+function enabledOnly(rows) {
+    if (!rows)
+        return null;
+    return rows.filter((r) => r.enabled !== false);
+}
+function restartSliceValue(eff, slice) {
+    if (!eff)
+        return null;
+    switch (slice) {
+        case "skills":
+            return enabledOnly(eff.skills?.skills);
+        case "mcp":
+            return enabledOnly(eff.mcp?.servers);
+        case "scenarios":
+            return enabledOnly(eff.scenarios?.scenarios);
+        case "runtime-gates": {
+            const rt = eff.runtime;
+            if (!rt)
+                return null;
+            const present = {};
+            for (const k of RUNTIME_GATE_KEYS)
+                if (runtimeGatePresent(rt, k))
+                    present[k] = rt[k];
+            return Object.keys(present).length ? present : null;
+        }
+        case "models-tiers": {
+            const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
+            if (!active || Object.keys(active).length === 0)
+                return null;
+            const enabled = enabledOnly(eff.models?.models);
+            const names = new Set((enabled ?? []).map((m) => m.name));
+            const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
+            return { models: enabled, tiers: active, default: def.name };
+        }
+    }
+}
+export function restartReasons(boot, current) {
+    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s)) !== stableStringify(restartSliceValue(current, s)));
+}
+export function planeHasActiveTiers(eff) {
+    const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
+    return active !== undefined && Object.keys(active).length > 0;
+}
+export function modelPlaneChanged(prev, next) {
+    if (!prev)
+        return true;
+    const fp = (e) => {
+        const enabled = enabledOnly(e.models?.models);
+        const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
+        const names = new Set((enabled ?? []).map((m) => m.name));
+        const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
+        return stableStringify({ models: enabled, tiers: active, default: def.name });
+    };
+    return fp(prev) !== fp(next);
+}
+//# sourceMappingURL=restart-signal.js.map

package/dist/config-center/skills-mcp.d.ts

@@ -0,0 +1,13 @@
+import type { McpServerSpec } from "@sema-agent/core";
+import type { ScopedMcpServer } from "../config-types.js";
+import type { Logger } from "../observability/logger.js";
+import type { LoadedSkill } from "../capabilities/skills.js";
+import type { CenterMcpServer, CenterSkillManifest } from "./types.js";
+export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
+    skills: CenterSkillManifest[];
+}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, diskCacheDir?: string): Promise<LoadedSkill[]>;
+export declare function resolveMcpServers(mcp: {
+    servers: CenterMcpServer[];
+}, logger?: Logger): ScopedMcpServer[];
+export declare function mcpForScenario(servers: ScopedMcpServer[] | undefined, scenario: string): McpServerSpec[] | undefined;
+//# sourceMappingURL=skills-mcp.d.ts.map