@sema-agent/server 1.314.0 → 1.315.0

package/dist/sema-registry.js

@@ -1,568 +1,5 @@
-import { createHash } from "node:crypto";
-import { isThinkingLevel } from "@sema-agent/core";
-import { resolveActiveTiers, skillContentHash, SEALED_BOX_ALG } from "@sema-agent/registry-core";
-import { sealedKeyPoison } from "./sealed-key.js";
-import { applyAutoCompactWindow, parseAutonomy } from "./config.js";
-import { validateCommandRules } from "./runtime-governance.js";
-import { projectCollabToWorkflows, registerCollabWorkflows } from "./capabilities/collab-workflows.js";
-import { registerTeams } from "./capabilities/team.js";
-export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
-    if (res.status === 304)
-        return null;
-    if (!res.ok)
-        throw new Error(`sema-registry HTTP ${res.status}`);
-    return { effective: (await res.json()), etag: res.headers.get("etag") ?? undefined };
-}
-export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const params = new URLSearchParams({ principal });
-    if (worker)
-        params.set("worker", worker);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
-    if (res.status === 304) {
-        if (!etag)
-            throw new Error("sema-registry returned 304 to a non-conditional principal-caps request");
-        return null;
-    }
-    if (!res.ok)
-        throw new Error(`sema-registry principal-caps HTTP ${res.status}`);
-    const body = (await res.json());
-    return {
-        runtimeCaps: body.runtimeCaps ?? null,
-        configured: Boolean(body.configured),
-        ...("scenario" in body || "allowlist" in body
-            ? {
-                scenario: {
-                    scenario: typeof body.scenario === "string" ? body.scenario : null,
-                    allowlist: Array.isArray(body.allowlist) ? body.allowlist.filter((s) => typeof s === "string") : [],
-                },
-            }
-            : {}),
-        ...((() => {
-            const ex = body.execution;
-            if (ex === undefined || ex === null)
-                return {};
-            if (typeof ex.required !== "boolean")
-                return { executionDrift: `execution.required is ${typeof ex.required}, expected boolean — ruling dropped (fail-open)` };
-            if (!Array.isArray(ex.allowedLanes))
-                return { executionDrift: `execution.allowedLanes is ${typeof ex.allowedLanes}, expected string[] — ruling dropped (fail-open)` };
-            const execution = { required: ex.required, allowedLanes: ex.allowedLanes.filter((s) => typeof s === "string") };
-            if (ex.sessionMirror !== undefined && ex.sessionMirror !== null) {
-                const sm = ex.sessionMirror;
-                const smOk = typeof sm === "object" && typeof sm.engineUrl === "string" && sm.engineUrl.length > 0 && (sm.required === undefined || typeof sm.required === "boolean");
-                if (smOk)
-                    execution.sessionMirror = { engineUrl: sm.engineUrl, required: sm.required === true };
-                else
-                    return { execution, executionDrift: "execution.sessionMirror malformed — mirror observation dropped (fail-open; lane ruling kept)" };
-            }
-            return { execution };
-        })()),
-        etag: res.headers.get("etag") ?? undefined,
-    };
-}
-const asModelThinking = (v) => (v && isThinkingLevel(v) && v !== "off" ? v : undefined);
-const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
-function toModel(m, envDefaults = {}) {
-    const thinkingDefault = asModelThinking(m.defaultThinking) ?? envDefaults.defaultThinking;
-    const effortLevels = (m.reasoningEffortLevels ? m.reasoningEffortLevels.map(asModelThinking).filter((x) => x !== undefined) : undefined) ?? envDefaults.reasoningEffortLevels ?? [];
-    const model = {
-        id: m.id,
-        name: m.name,
-        provider: m.provider,
-        api: m.api,
-        baseUrl: m.baseUrl ?? "",
-        reasoning: m.reasoning !== undefined ? Boolean(m.reasoning) : (envDefaults.reasoning ?? true),
-        input: m.vision ? ["text", "image"] : ["text"],
-        contextWindow: m.contextWindow ?? envDefaults.contextWindow ?? 262144,
-        maxTokens: m.maxTokens ?? envDefaults.maxTokens ?? 4096,
-        ...(charsPerTokenOf(m.charsPerToken) !== undefined || envDefaults.charsPerToken !== undefined
-            ? { charsPerToken: charsPerTokenOf(m.charsPerToken) ?? envDefaults.charsPerToken }
-            : {}),
-        cost: m.cost
-            ? { input: m.cost.input, output: m.cost.output, cacheRead: m.cost.cacheRead ?? 0, cacheWrite: m.cost.cacheWrite ?? 0 }
-            : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        params: { ...(m.tier ? { tier: m.tier } : {}), promptCacheFamily: m.provider === "anthropic" ? "input-excludes-cached" : "input-includes-cached" },
-        ...(thinkingDefault ? { defaultThinking: thinkingDefault } : {}),
-        ...(effortLevels.length > 0 && m.provider !== "anthropic" ? { compat: { reasoningEffortLevels: effortLevels } } : {}),
-        ...(m.extraBody ? { extraBody: m.extraBody } : {}),
-        ...(Array.isArray(m.promptGuidance) && m.promptGuidance.length > 0 ? { promptGuidance: m.promptGuidance.map(String) } : {}),
-    };
-    const explicitAct = m.autoCompactTokens;
-    applyAutoCompactWindow(model, typeof explicitAct === "number" ? explicitAct : undefined);
-    return model;
-}
-export function mutateInPlace(target, source) {
-    for (const k of Object.keys(target))
-        delete target[k];
-    Object.assign(target, source);
-}
-export function applyEffective(config, eff, logger, opts = {}) {
-    if (!opts.teamsOnly && !eff.version) {
-        logger?.warn("sema_registry_unpublished", {
-            version: eff.version,
-            note: "empty/unpublished effective config — using env + built-in fallback; publish a config or unset CONFIG_PUBLISH_MODE",
-        });
-    }
-    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    if (enabled.length > 0 && opts.deferModelPlane !== true) {
-        const models = {};
-        const modelApiKeyEnv = {};
-        const modelApiKeys = {};
-        const envDefaults = { maxTokens: config.model.maxTokens, contextWindow: config.model.contextWindow, reasoning: config.model.reasoning, charsPerToken: config.model.charsPerToken, defaultThinking: config.model.defaultThinking, reasoningEffortLevels: config.model.compat?.reasoningEffortLevels };
-        for (const m of enabled) {
-            const rawBaseUrl = m.baseUrl;
-            let safeUrl = rawBaseUrl;
-            if (rawBaseUrl) {
-                let ok = false;
-                try {
-                    const u = new URL(rawBaseUrl);
-                    ok = u.protocol === "http:" || u.protocol === "https:";
-                }
-                catch {
-                    ok = false;
-                }
-                if (ok)
-                    logger?.warn("sema_registry_model_base_url", { model: m.name, baseUrl: rawBaseUrl, hint: "registry-directed gateway override — this model's key authenticates AGAINST THIS URL" });
-                else {
-                    logger?.warn("sema_registry_model_base_url_rejected", { model: m.name, baseUrl: String(rawBaseUrl).slice(0, 120), hint: "only http(s) URLs are honored — falling back to the boot-env gateway" });
-                    safeUrl = undefined;
-                }
-            }
-            models[m.name] = toModel(safeUrl === rawBaseUrl ? m : { ...m, baseUrl: safeUrl }, envDefaults);
-            if (m.sealedApiKey) {
-                const s = m.sealedApiKey;
-                if (s.alg !== SEALED_BOX_ALG) {
-                    logger?.warn("sema_registry_model_sealed_key_bad_alg", { model: m.name, alg: String(s.alg), expected: SEALED_BOX_ALG, hint: "unsupported sealed-box alg — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback; contract v1 pins the alg)" });
-                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "unsupported_alg");
-                }
-                else if (!opts.sealedKeys) {
-                    logger?.warn("sema_registry_model_sealed_key_no_store", { model: m.name, publicKeyId: s.publicKeyId, hint: "no sealed-key store on this host (boot custody init failed or lane unwired) — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
-                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "no_key_store");
-                }
-                else if (!opts.sealedKeys.has(s.publicKeyId)) {
-                    logger?.warn("sema_registry_model_sealed_key_no_private_key", { model: m.name, publicKeyId: s.publicKeyId, held: opts.sealedKeys.ids(), hint: "ciphertext targets a private key this host doesn't hold (rotated away / other host) — key POISONED: tasks on this model fail loud until the operator re-pastes the key in the web UI (it seals against the newest registered public key)" });
-                    modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "stale_ciphertext");
-                }
-                else {
-                    try {
-                        modelApiKeys[m.name] = opts.sealedKeys.open(s.ciphertext, s.publicKeyId);
-                    }
-                    catch (err) {
-                        logger?.warn("sema_registry_model_sealed_key_open_failed", { model: m.name, publicKeyId: s.publicKeyId, err: String(err), hint: "corrupt/foreign ciphertext — key POISONED: tasks on this model fail loud (no apiKeyEnv fallback, no gateway fallback)" });
-                        modelApiKeys[m.name] = sealedKeyPoison(s.publicKeyId, "sealed_decrypt_failed", err instanceof Error ? err.name : "unknown");
-                    }
-                }
-            }
-            else if (m.apiKeyEnv) {
-                if (process.env[m.apiKeyEnv])
-                    modelApiKeyEnv[m.name] = m.apiKeyEnv;
-                else
-                    logger?.warn("sema_registry_model_key_env_missing", { model: m.name, apiKeyEnv: m.apiKeyEnv, hint: "env var not set in this service — model falls back to the gateway key" });
-            }
-            if (m.provider === "anthropic" && !config.anthropic) {
-                logger?.warn("sema_registry_model_no_brain", { model: m.name, provider: m.provider, hint: "set ANTHROPIC_API_KEY in this service's env, else it mis-routes to the gateway brain" });
-            }
-        }
-        config.modelApiKeyEnv = modelApiKeyEnv;
-        config.modelApiKeys = modelApiKeys;
-        const quotaWeights = {};
-        for (const m of enabled) {
-            const qw = typeof m.quotaWeight === "number" && Number.isFinite(m.quotaWeight) && m.quotaWeight > 0 ? m.quotaWeight : undefined;
-            if (qw !== undefined) {
-                quotaWeights[m.name] = qw;
-                if (m.id && m.id !== m.name)
-                    quotaWeights[m.id] = qw;
-            }
-        }
-        mutateInPlace(config.modelQuotaWeights, quotaWeights);
-        const roles = {};
-        for (const [role, tgt] of Object.entries(eff.models.roles ?? {})) {
-            if ("model" in tgt)
-                roles[role] = tgt.model;
-            else if ("select" in tgt)
-                roles[role] = { select: tgt.select };
-        }
-        const activeTiers = resolveActiveTiers(eff.models) ?? {};
-        const picked = resolveDefaultModelName(eff, (n) => models[n] !== undefined, enabled[0].name, (source, name) => logger?.warn("sema_registry_default_dangling", { source, name, hint: "explicit default names a model that is not in the enabled catalog — falling to the next source" }));
-        const defaultName = picked.name;
-        const defaultSource = picked.source;
-        models.default = models[defaultName];
-        mutateInPlace(config.models, models);
-        config.model = config.models.default;
-        if (Object.keys(roles).length > 0)
-            mutateInPlace(config.roles, roles);
-        mutateInPlace(config.tiers, activeTiers);
-        logger?.info("sema_registry_models", { count: enabled.length, default: config.model.id, defaultSource, roles: Object.keys(roles), tiers: Object.keys(config.tiers), sealedKeys: Object.values(modelApiKeys).filter((v) => typeof v === "string").length, sealedPoisoned: Object.values(modelApiKeys).filter((v) => typeof v !== "string").length });
-    }
-    const gatesView = eff.governance ? { ...eff.runtime, ...eff.governance } : eff.runtime;
-    if (!opts.teamsOnly)
-        applyRuntimeGates(config, gatesView, logger);
-    applyRuntimeHot(config, gatesView, logger);
-    if (opts.deferModelPlane !== true) {
-        const teams = {};
-        for (const t of (eff.teams?.teams ?? []).filter((t) => t.enabled !== false)) {
-            teams[t.name] = {
-                name: t.name,
-                members: t.members.map((mm) => ({ role: mm.role, ...(mm.model ? { model: mm.model } : {}), modelRole: mm.modelRole, systemPrompt: mm.systemPrompt })),
-                rounds: t.rounds,
-                synthesizer: t.synthesizer ? { role: t.synthesizer.role, modelRole: t.synthesizer.modelRole, systemPrompt: t.synthesizer.systemPrompt } : undefined,
-            };
-        }
-        registerTeams(teams);
-        if (Object.keys(teams).length > 0)
-            logger?.info("sema_registry_teams", { teams: Object.keys(teams) });
-        const projected = projectCollabToWorkflows(eff.collab?.templates);
-        registerCollabWorkflows(projected.workflows);
-        if (Object.keys(projected.workflows).length > 0)
-            logger?.info("sema_registry_collab_workflows", { workflows: Object.keys(projected.workflows) });
-        if (projected.skipped.length > 0)
-            logger?.warn("sema_registry_collab_skipped", { skipped: projected.skipped });
-        if (projected.notes.length > 0)
-            logger?.info("sema_registry_collab_notes", { notes: projected.notes });
-    }
-    const projDomain = eff.projects;
-    const rawProjects = (projDomain && typeof projDomain === "object" && !Array.isArray(projDomain)
-        ? "projects" in projDomain && typeof projDomain.projects === "object"
-            ? (projDomain.projects ?? {})
-            : projDomain
-        : {}) ?? {};
-    const projects = {};
-    for (const [pid, reg] of Object.entries(rawProjects)) {
-        if (!reg || typeof reg !== "object" || Array.isArray(reg))
-            continue;
-        const r = reg;
-        projects[pid] = {
-            ...(typeof r.displayName === "string" ? { displayName: r.displayName } : {}),
-            ...(Array.isArray(r.gitRemotes) ? { gitRemotes: r.gitRemotes.filter((x) => typeof x === "string") } : {}),
-            ...(Array.isArray(r.defaultScopes) ? { defaultScopes: r.defaultScopes.filter((x) => typeof x === "string") } : {}),
-        };
-    }
-    mutateInPlace(config.projects, projects);
-    if (Object.keys(projects).length > 0)
-        logger?.info("sema_registry_projects", { projects: Object.keys(projects) });
-}
-const RUNTIME_GATE_KEYS = ["rateLimitPerMin", "approvalRequire", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
-function runtimeGatePresent(rt, key) {
-    const v = rt[key];
-    if (key === "approvalRequire")
-        return Array.isArray(v);
-    if (key === "costQuotaWindowSec")
-        return typeof v === "number" && v > 0;
-    return typeof v === "number";
-}
-export function applyRuntimeGates(config, rt, logger) {
-    if (!rt)
-        return;
-    const applied = {};
-    for (const key of RUNTIME_GATE_KEYS) {
-        if (!runtimeGatePresent(rt, key))
-            continue;
-        config[key] = rt[key];
-        applied[key] = rt[key];
-    }
-    if (Object.keys(applied).length > 0)
-        logger?.info("sema_registry_runtime", applied);
-}
-export function applyRuntimeHot(config, rt, logger) {
-    const applied = {};
-    const envAutonomy = parseAutonomy(process.env.AUTONOMY);
-    const nextAutonomy = rt?.autonomy !== undefined ? rt.autonomy : envAutonomy;
-    if (config.autonomy !== nextAutonomy) {
-        config.autonomy = nextAutonomy;
-        applied.autonomy = nextAutonomy ?? "(env-baseline)";
-    }
-    if (rt?.commandPolicy !== undefined) {
-        const errors = validateCommandRules(rt.commandPolicy);
-        if (errors.length > 0) {
-            logger?.error("sema_registry_commandpolicy_invalid", { errors, kept: config.commandPolicy?.length ?? 0 });
-        }
-        else if (JSON.stringify(config.commandPolicy) !== JSON.stringify(rt.commandPolicy)) {
-            config.commandPolicy = rt.commandPolicy;
-            applied.commandPolicy = rt.commandPolicy.length;
-        }
-    }
-    else if (config.commandPolicy !== undefined) {
-        config.commandPolicy = undefined;
-        applied.commandPolicy = "(env-baseline)";
-    }
-    if (Object.keys(applied).length > 0)
-        logger?.info("sema_registry_runtime_hot", applied);
-}
-const DEFAULT_ROLE_TIER_LADDER = ["pro", "flash", "lite"];
-export function resolveDefaultModelName(eff, has, fallback, onDangling) {
-    const activeTiers = resolveActiveTiers(eff.models) ?? {};
-    const structural = eff.models?.default;
-    const rolesDefault = eff.models?.roles?.default?.model;
-    const candidates = [
-        { source: "models.default", name: typeof structural === "string" && structural.length > 0 ? structural : undefined },
-        { source: "roles.default", name: typeof rolesDefault === "string" && rolesDefault.length > 0 ? rolesDefault : undefined },
-        ...DEFAULT_ROLE_TIER_LADDER.map((t) => ({ source: `tierGroup.${t}`, name: activeTiers[t] })),
-    ];
-    for (const c of candidates) {
-        if (!c.name)
-            continue;
-        if (has(c.name))
-            return { name: c.name, source: c.source };
-        onDangling?.(c.source, c.name);
-    }
-    return { name: fallback, source: "enabled[0]" };
-}
-export function logEffectiveDiff(config, eff, logger) {
-    const enabled = (eff.models?.models ?? []).filter((m) => m.enabled !== false);
-    const centerModels = enabled.map((m) => ({ name: m.name, id: m.id, provider: m.provider, apiKeyEnv: m.apiKeyEnv ?? null, tier: m.tier ?? null }));
-    const envModels = Object.entries(config.models).map(([name, m]) => ({ name, id: m.id, provider: m.provider }));
-    const centerRoles = Object.fromEntries(Object.entries(eff.models?.roles ?? {}).map(([r, t]) => [r, "model" in t ? t.model : { select: t.select }]));
-    const centerTeams = (eff.teams?.teams ?? []).filter((t) => t.enabled !== false).map((t) => t.name);
-    logger?.warn("sema_registry_dry_run", {
-        note: "DRY RUN — registry config NOT applied; unset SEMA_REGISTRY_DRY_RUN to go live",
-        version: eff.version,
-        wouldOverrideModels: enabled.length > 0,
-        wouldDefaultModel: enabled.length > 0 ? resolveDefaultModelName(eff, (n) => enabled.some((m) => m.name === n), enabled[0].name).name : null,
-        currentDefaultModel: config.model.id,
-        models: { center: centerModels, envDerived: envModels },
-        roles: { center: centerRoles, current: config.roles },
-        teams: { centerWouldRegister: centerTeams },
-        skills: { centerWouldLoad: (eff.skills?.skills ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
-        mcp: { centerWouldRegister: (eff.mcp?.servers ?? []).filter((s) => s.enabled !== false).map((s) => s.name) },
-        runtime: {
-            center: eff.runtime ?? null,
-            current: Object.fromEntries(RUNTIME_GATE_KEYS.map((k) => [k, config[k]])),
-        },
-    });
-}
-export function runtimeHasActiveGate(rt) {
-    if (!rt)
-        return false;
-    return RUNTIME_GATE_KEYS.some((k) => runtimeGatePresent(rt, k));
-}
-const RESTART_SLICES = ["skills", "mcp", "scenarios", "runtime-gates", "models-tiers"];
-function stableStringify(v) {
-    if (v === null || typeof v !== "object")
-        return JSON.stringify(v) ?? "null";
-    if (Array.isArray(v))
-        return `[${v.map(stableStringify).join(",")}]`;
-    const obj = v;
-    return `{${Object.keys(obj)
-        .sort()
-        .map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`)
-        .join(",")}}`;
-}
-function enabledOnly(rows) {
-    if (!rows)
-        return null;
-    return rows.filter((r) => r.enabled !== false);
-}
-function restartSliceValue(eff, slice) {
-    if (!eff)
-        return null;
-    switch (slice) {
-        case "skills":
-            return enabledOnly(eff.skills?.skills);
-        case "mcp":
-            return enabledOnly(eff.mcp?.servers);
-        case "scenarios":
-            return enabledOnly(eff.scenarios?.scenarios);
-        case "runtime-gates": {
-            const rt = eff.runtime;
-            if (!rt)
-                return null;
-            const present = {};
-            for (const k of RUNTIME_GATE_KEYS)
-                if (runtimeGatePresent(rt, k))
-                    present[k] = rt[k];
-            return Object.keys(present).length ? present : null;
-        }
-        case "models-tiers": {
-            const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-            if (!active || Object.keys(active).length === 0)
-                return null;
-            const enabled = enabledOnly(eff.models?.models);
-            const names = new Set((enabled ?? []).map((m) => m.name));
-            const def = resolveDefaultModelName(eff, (n) => names.has(n), enabled?.[0]?.name ?? "");
-            return { models: enabled, tiers: active, default: def.name };
-        }
-    }
-}
-export function restartReasons(boot, current) {
-    return RESTART_SLICES.filter((s) => stableStringify(restartSliceValue(boot, s)) !== stableStringify(restartSliceValue(current, s)));
-}
-export function planeHasActiveTiers(eff) {
-    const active = eff.models ? resolveActiveTiers(eff.models) : undefined;
-    return active !== undefined && Object.keys(active).length > 0;
-}
-export function modelPlaneChanged(prev, next) {
-    if (!prev)
-        return true;
-    const fp = (e) => {
-        const enabled = enabledOnly(e.models?.models);
-        const active = e.models ? (resolveActiveTiers(e.models) ?? null) : null;
-        const names = new Set((enabled ?? []).map((m) => m.name));
-        const def = resolveDefaultModelName(e, (n) => names.has(n), enabled?.[0]?.name ?? "");
-        return stableStringify({ models: enabled, tiers: active, default: def.name });
-    };
-    return fp(prev) !== fp(next);
-}
-export class ConfigCenterHttpError extends Error {
-    status;
-    constructor(message, status) {
-        super(message);
-        this.status = status;
-        this.name = "ConfigCenterHttpError";
-    }
-}
-export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
-    if (!res.ok)
-        throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
-    const content = await res.text();
-    const want = contentHash.replace(/^sha256:/, "").toLowerCase();
-    const got = createHash("sha256").update(content, "utf8").digest("hex");
-    if (got !== want)
-        throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
-    return content;
-}
-export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
-    if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
-    return await res.json();
-}
-export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
-    if (!res.ok)
-        throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
-    const bytes = new Uint8Array(await res.arrayBuffer());
-    const want = contentDigest.replace(/^sha256:/, "").toLowerCase();
-    const got = createHash("sha256").update(bytes).digest("hex");
-    if (got !== want)
-        throw new Error(`prompt blob hash mismatch for ${contentDigest}: computed sha256:${got}`);
-    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
-}
-export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
-    const { promises: fsp } = await import("node:fs");
-    const { join: joinPath } = await import("node:path");
-    const diskRead = async (hash) => {
-        if (!diskCacheDir)
-            return undefined;
-        const hex = hash.replace(/^sha256:/, "");
-        if (!/^[0-9a-f]{64}$/.test(hex))
-            return undefined;
-        try {
-            const text = await fsp.readFile(joinPath(diskCacheDir, hex), "utf8");
-            if (skillContentHash(text) === hash)
-                return text;
-            logger?.warn("sema_registry_skill_cache_corrupt", { hash, note: "on-disk body fails its own hash — ignored, refetching from center" });
-        }
-        catch {
-        }
-        return undefined;
-    };
-    const pendingWrites = [];
-    const diskWrite = (hash, content) => {
-        if (!diskCacheDir)
-            return;
-        const hex = hash.replace(/^sha256:/, "");
-        pendingWrites.push((async () => {
-            await fsp.mkdir(diskCacheDir, { recursive: true });
-            const tmp = joinPath(diskCacheDir, `${hex}.${Math.random().toString(36).slice(2, 8)}.tmp`);
-            await fsp.writeFile(tmp, content, { mode: 0o600 });
-            await fsp.rename(tmp, joinPath(diskCacheDir, hex));
-        })().catch((err) => logger?.warn("sema_registry_skill_cache_write_failed", { hash, err: String(err) })));
-    };
-    const byName = new Map(baseline.map((s) => [s.spec.name, s]));
-    const contentCache = new Map();
-    const seenNames = new Set();
-    for (const m of manifest.skills ?? []) {
-        if (m.enabled === false)
-            continue;
-        if (seenNames.has(m.name))
-            logger?.warn("sema_registry_skill_duplicate_name", { name: m.name, note: "duplicate name in center manifest — last entry wins" });
-        seenNames.add(m.name);
-        try {
-            let content = contentCache.get(m.contentHash);
-            if (content === undefined)
-                content = await diskRead(m.contentHash);
-            if (content === undefined) {
-                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
-                diskWrite(m.contentHash, content);
-            }
-            contentCache.set(m.contentHash, content);
-            const overrodeBuiltin = byName.has(m.name);
-            byName.set(m.name, { spec: { name: m.name, description: m.description, content }, scenarios: m.scenarios ?? [] });
-            logger?.info("sema_registry_skill", { name: m.name, hash: m.contentHash, scenarios: m.scenarios, overrodeBuiltin });
-        }
-        catch (err) {
-            logger?.warn("sema_registry_skill_failed", { name: m.name, hash: m.contentHash, err: String(err), note: "keeping baseline if any; skipping center version" });
-        }
-    }
-    await Promise.all(pendingWrites);
-    return [...byName.values()];
-}
-function resolveRefs(refs, server, kind, logger) {
-    if (!refs)
-        return {};
-    const out = {};
-    for (const [key, envName] of Object.entries(refs)) {
-        const v = process.env[envName];
-        if (v === undefined) {
-            logger?.warn("sema_registry_mcp_env_missing", { server, kind, key, envName, note: "skipping this MCP server — referenced env var is unset in this service" });
-            return null;
-        }
-        out[key] = v;
-    }
-    return out;
-}
-export function resolveMcpServers(mcp, logger) {
-    const out = [];
-    for (const s of mcp.servers ?? []) {
-        if (s.enabled === false)
-            continue;
-        const allow = s.allowTools && s.allowTools.length > 0 ? { allowTools: s.allowTools } : {};
-        const elicit = s.elicitation === true ? { elicitation: true } : {};
-        if (s.transport.kind === "stdio") {
-            const env = resolveRefs(s.transport.envRefs, s.name, "env", logger);
-            if (env === null)
-                continue;
-            out.push({
-                scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "stdio", command: s.transport.command, args: s.transport.args, ...(Object.keys(env).length ? { env } : {}) }, ...allow, ...elicit },
-            });
-        }
-        else {
-            const headers = resolveRefs(s.transport.headerRefs, s.name, "header", logger);
-            if (headers === null)
-                continue;
-            out.push({
-                scenarios: s.scenarios ?? [],
-                spec: { name: s.name, transport: { kind: "http", url: s.transport.url, ...(Object.keys(headers).length ? { headers } : {}), ...(s.transport.principalHeader ? { principalHeader: s.transport.principalHeader } : {}) }, ...allow, ...elicit },
-            });
-        }
-    }
-    if (out.length > 0)
-        logger?.info("sema_registry_mcp", { servers: out.map((s) => s.spec.name) });
-    return out;
-}
-export function mcpForScenario(servers, scenario) {
-    if (!servers || servers.length === 0)
-        return undefined;
-    const hit = servers.filter((s) => s.scenarios.length === 0 || s.scenarios.includes(scenario)).map((s) => s.spec);
-    return hit.length > 0 ? hit : undefined;
-}
+export { fetchEffective, fetchPrincipalCaps, ConfigCenterHttpError, fetchSkillContent, fetchPromptArtifact, fetchPromptBlob, } from "./config-center/http-client.js";
+export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, resolveDefaultModelName, logEffectiveDiff, runtimeHasActiveGate, } from "./config-center/apply-effective.js";
+export { restartReasons, planeHasActiveTiers, modelPlaneChanged, } from "./config-center/restart-signal.js";
+export { applyCenterSkills, resolveMcpServers, mcpForScenario } from "./config-center/skills-mcp.js";
 //# sourceMappingURL=sema-registry.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.314.0",
+  "version": "1.315.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",