@sema-agent/server 7.104.0 → 7.106.0

package/dist/plugins/session-policy-store-sql.js

@@ -22,25 +22,42 @@ function readRulesBody(text, where) {
         throw new SessionPolicyError("corrupt", `${e.message} — an unreadable rules body served as an EMPTY rule set would silently drop every tightening this session carries`);
     }
 }
+function isStoredCounter(n, floor) {
+    return Number.isSafeInteger(n) && n >= floor;
+}
 function rowToStored(r, where) {
+    const counters = readRowCounters(r, where);
+    if ("problem" in counters)
+        throw new SessionPolicyError("corrupt", counters.problem);
+    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev: counters.rev, gen: counters.gen };
+}
+function readRowCounters(r, where) {
     const rev = Number(r.rev);
-    if (!Number.isFinite(rev) || !Number.isInteger(rev) || rev < 1) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always ≥ 1 (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules`);
+    if (!isStoredCounter(rev, 1)) {
+        return { problem: `session rules row ${where} carries rev ${String(r.rev)} — a stored row's rev is always a whole number ≥ 1 within the safe-integer range (the stamp is floor+1), and rev 0 is the live reader's synthetic empty seed; refusing rather than serve it as rules` };
     }
     if (r.gen === undefined || r.gen === null) {
         throw new Error(`session_policy row ${where} came back without a \`gen\` column — a read leg did not project it (the column is BIGINT NOT NULL on both dialects). ` +
             "Refusing rather than judge this row's lineage as generation 0, which is a value nothing minted.");
     }
     const gen = Number(r.gen);
-    if (!Number.isFinite(gen) || !Number.isInteger(gen) || gen < 0) {
-        throw new SessionPolicyError("corrupt", `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0; refusing rather than let a reader judge lineage by a value nothing minted`);
+    if (!isStoredCounter(gen, 0)) {
+        return { problem: `session rules row ${where} carries lineage gen ${String(r.gen)} — a generation is a whole number ≥ 0 within the safe-integer range; refusing rather than let a reader judge lineage by a value nothing minted` };
     }
-    return { ...readRulesBody(r.rules, `session_policy.rules ${where}`), rev, gen };
+    return { rev, gen };
+}
+const SEALED_MARK_REV = Number.MAX_SAFE_INTEGER;
+const SEALED_EVENT = "session_policy_erase_sealed_keys";
+const NO_SEALED_KEYS = [];
+function sealedKeyError(sessionId, what) {
+    return new SessionPolicyError("corrupt", `session rules for session ${JSON.stringify(sessionId)}: ${what} is sealed — an erase removed a row whose counters were unreadable (session_policy_rev_mark.rev = ${SEALED_MARK_REV}), so its rule state is unknown; refusing rather than serve it as "no rules" until an operator unseals it (USAGE §9.11)`);
 }
 export class SqlSessionPolicyStore {
     db;
-    constructor(db) {
+    logger;
+    constructor(db, logger) {
         this.db = db;
+        this.logger = logger;
     }
     q(tidb, pg) {
         return this.db.dialect === "tidb" ? tidb : pg;
@@ -49,13 +66,23 @@ export class SqlSessionPolicyStore {
         return isDupKeyError(this.db.dialect, e);
     }
     async getRules(sessionId, principal) {
-        const { rows } = await this.db.query(this.q(`SELECT ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?`, `SELECT ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1`), [policyKey(sessionId, principal)]);
-        if (!rows[0])
+        const key = policyKey(sessionId, principal);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE policy_key = ?` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = ? AND rev = ?", `SELECT 'row' AS src, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE policy_key = $1` +
+            " UNION ALL SELECT 'seal', NULL, rev, gen FROM session_policy_rev_mark WHERE policy_key = $2 AND rev = $3"), [key, key, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, `key ${key}`);
+        const row = rows.find((r) => r.src === "row");
+        if (row === undefined)
             return null;
-        return rowToStored(rows[0], `for session ${JSON.stringify(sessionId)}`);
+        return rowToStored(row, `for session ${JSON.stringify(sessionId)}`);
     }
     async listBySession(sessionId) {
-        const { rows } = await this.db.query(this.q(`SELECT principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?`, `SELECT principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1`), [sessionId]);
+        const { rows } = await this.db.query(this.q(`SELECT 'row' AS src, principal, ${jsonColumnText("tidb", "rules")}, rev, gen FROM session_policy WHERE session_id = ?` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = ? AND rev = ?", `SELECT 'row' AS src, principal, ${jsonColumnText("pg", "rules")}, rev, gen FROM session_policy WHERE session_id = $1` +
+            " UNION ALL SELECT 'seal', NULL, NULL, rev, gen FROM session_policy_rev_mark WHERE session_id = $2 AND rev = $3"), [sessionId, sessionId, SEALED_MARK_REV]);
+        if (rows.some((r) => r.src === "seal"))
+            throw sealedKeyError(sessionId, "one of its keys");
         return rows.map((r) => ({
             principal: r.principal == null ? undefined : String(r.principal),
             rules: rowToStored(r, `for session ${JSON.stringify(sessionId)} (enumeration)`),
@@ -73,7 +100,7 @@ export class SqlSessionPolicyStore {
             const { rows: markRows } = await conn.query(this.q("SELECT rev, gen FROM session_policy_rev_mark WHERE policy_key = ? FOR UPDATE", "SELECT rev, gen FROM session_policy_rev_mark WHERE policy_key = $1 FOR UPDATE"), [key]);
             const markRev = markRows[0] ? Number(markRows[0].rev) : 0;
             const markGen = markRows[0] ? Number(markRows[0].gen) : 0;
-            if (markRows[0] !== undefined && (!Number.isInteger(markGen) || markGen < 0 || !Number.isFinite(markRev) || markRev < 0)) {
+            if (markRows[0] !== undefined && (!isStoredCounter(markGen, 0) || !isStoredCounter(markRev, 0))) {
                 throw new SessionPolicyError("corrupt", `the session rules rev mark for session ${JSON.stringify(sessionId)} is unreadable (rev ${String(markRows[0].rev)}, gen ${String(markRows[0].gen)}) — refusing rather than stamp a rev/lineage nothing proves`);
             }
             const clean = normalizeRules(stripRev(rules));
@@ -88,6 +115,9 @@ export class SqlSessionPolicyStore {
             }
             const nextRev = Math.max(priorRev, markRev) + 1;
             const nextGen = prior?.gen ?? markGen;
+            if (!isStoredCounter(nextRev, 1) || !isStoredCounter(nextGen, 0)) {
+                throw new SessionPolicyError("corrupt", `session rules for session ${JSON.stringify(sessionId)}: the next stamp (rev ${nextRev}, gen ${nextGen}) would leave the safe-integer range this store reads back — refusing before writing a row nothing could read`);
+            }
             const json = JSON.stringify(clean);
             const now = new Date();
             if (prior) {
@@ -114,15 +144,20 @@ export class SqlSessionPolicyStore {
         }
     }
     async deleteBySession(sessionId) {
-        await this.retrying(() => this.tx(async (conn) => {
+        const sealed = await this.retrying(() => this.tx(async (conn) => {
             const { rows } = await conn.query(this.q("SELECT policy_key, rev, gen FROM session_policy WHERE session_id = ? ORDER BY policy_key FOR UPDATE", "SELECT policy_key, rev, gen FROM session_policy WHERE session_id = $1 ORDER BY policy_key FOR UPDATE"), [sessionId]);
             if (rows.length === 0)
-                return;
+                return NO_SEALED_KEYS;
             const now = new Date();
             const keys = rows.map((r) => String(r.policy_key));
             const params = [];
+            const sealedKeys = [];
             const tuples = rows.map((r) => {
-                params.push(String(r.policy_key), sessionId, Number(r.rev), Number(r.gen ?? 0) + 1, now);
+                const counters = readRowCounters(r, `for session ${JSON.stringify(sessionId)} (erase)`);
+                const readable = !("problem" in counters) && isStoredCounter(counters.gen + 1, 0);
+                if (!readable)
+                    sealedKeys.push({ policyKey: String(r.policy_key), rev: String(r.rev), gen: String(r.gen) });
+                params.push(String(r.policy_key), sessionId, readable ? counters.rev : SEALED_MARK_REV, readable ? counters.gen + 1 : 0, now);
                 const base = params.length - 5;
                 return this.db.dialect === "tidb" ? "(?,?,?,?,?)" : `($${base + 1},$${base + 2},$${base + 3},$${base + 4},$${base + 5})`;
             });
@@ -131,7 +166,27 @@ export class SqlSessionPolicyStore {
                 " ON CONFLICT (policy_key) DO UPDATE SET rev = GREATEST(session_policy_rev_mark.rev, EXCLUDED.rev), gen = GREATEST(session_policy_rev_mark.gen + 1, EXCLUDED.gen), erased_at = EXCLUDED.erased_at"), params);
             const holes = keys.map((_, i) => (this.db.dialect === "tidb" ? "?" : `$${i + 1}`)).join(",");
             await conn.query(`DELETE FROM session_policy WHERE policy_key IN (${holes})`, keys);
+            return sealedKeys;
         }));
+        if (sealed.length > 0)
+            this.discloseSealed(sessionId, sealed);
+    }
+    discloseSealed(sessionId, keys) {
+        const fields = {
+            sessionId,
+            keys,
+            note: "these rows' counters were unreadable, so the erase could not end their lineage: each key now carries a sealed rev mark and answers every read and write with SessionPolicyError corrupt until an operator unseals its session_policy_rev_mark row in place (USAGE §9.11)",
+        };
+        if (this.logger === undefined) {
+            console.warn(`[session-policy] ${SEALED_EVENT}`, fields);
+            return;
+        }
+        try {
+            this.logger.warn(SEALED_EVENT, fields);
+        }
+        catch (err) {
+            console.warn(`[session-policy] ${SEALED_EVENT} — the injected logger threw (${err instanceof Error ? err.message : String(err)})`, fields);
+        }
     }
     async tx(fn) {
         const conn = await this.db.connect();
@@ -155,13 +210,13 @@ export class SqlSessionPolicyStore {
     }
 }
 export class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(mysqlDriver(pool));
+    constructor(pool, logger) {
+        super(mysqlDriver(pool), logger);
     }
 }
 export class PgSessionPolicyStore extends SqlSessionPolicyStore {
-    constructor(pool) {
-        super(pgDriver(pool));
+    constructor(pool, logger) {
+        super(pgDriver(pool), logger);
     }
 }
 //# sourceMappingURL=session-policy-store-sql.js.map

package/dist/plugins/sql-driver.d.ts

@@ -59,7 +59,7 @@
  *    `INTRA_TXN_PLAIN_READS` 每条带理由);真值神谕:`test/sql-txn-semantics-integration.test.ts`(三引擎)。
  *
  * **④ 引擎事实不进店** —— `SqlDriver.facts` 是**运维读面**(`GET /v1/diagnostics/wiring` 的 `sqlEngine`
- *    段与 `GET /v1/capabilities` 的 `sql` 位)的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
+ *    段与 `GET /v1/capabilities` 的 `store.sql` 位(7.106.0 起;此前顶层 `sql`,S-866 ①))的料。店里不许出现 `if (engine === …)`:引擎判别在全仓
  *    只有连接初始化这一处,机器门 G-A 守着。`SqlDialect`(SQL **文本**方言,两值)与 `engine`(运行期
  *    引擎事实,三值)是两条轴,刻意不合成一个三值。
  *

package/dist/plugins/store-backend.d.ts

@@ -13,6 +13,7 @@ import { type ApprovalAskStore as ApprovalAskStoreType } from "./approval-ask-st
 import { type MemoryOptOutGrantStore } from "./memory-optout-grant-store-sql.js";
 import { type SendFileLedger } from "./send-file-ledger.js";
 import { TiDBResumeAnchorStore, PgResumeAnchorStore } from "./resume-anchor-store-sql.js";
+import { type SessionPolicyStoreLogger } from "./session-policy-store-sql.js";
 import type { ServiceConfig } from "../config-types.js";
 import { TiDBRunStore, PgRunStore } from "./run-store-sql.js";
 import { TiDBCheckpointStore, PgCheckpointStore } from "./checkpoint-store-sql.js";
@@ -31,6 +32,7 @@ import { type AdoptionLogStore } from "./adoption-log-sql.js";
 import { type SqlRetentionStore, type SqlRetentionStoreOptions } from "./retention-store-sql.js";
 import { type RetentionLaneStore } from "./retention-lane-store-sql.js";
 import type { PermissionRuleStoreBundle } from "../rules-consent.js";
+import { type StoreDegradedReason } from "../store-posture.js";
 /** boot 期的一条日志座(级别由**座位**决定,不由参数携带):`createStoreBackend` 的 `onWarn` / `onError`
  *  两参与 `LocalBackend` 的同名字段共用此形。装配层把它们分别接到 `logger.warn` / `logger.error` 上。 */
 export type BootLogSink = (msg: string, meta?: Record<string, unknown>) => void;
@@ -44,9 +46,11 @@ export type { ApprovalNonceStore } from "./approval-nonce-store.js";
 /** [ref]([ref] v3.1 §3.0-§3.2 流内审批协议持久层):`ApprovalAskStore` 接口 + 行/补丁类型。
  *  车3 刀 3a 起 `StoreBackend.approvalAsk()` 已在(见接口体的那条注)。 */
 export type { ApprovalAskStore, AskRow, NewAskRow, AskTransitionPatch, DecideAskInput, DecideResult, ExpireResult, BindGateInput, BatchRow, AskDecision } from "./approval-ask-store-sql.js";
-/** E6 SessionPolicyStore — core's interface PLUS the service `deleteBySession` (E21 purge; only the durable twins carry
- *  it, core's InMemory omits it → optional). tidb/pg = durable twins; local = core's InMemorySessionPolicyStore (works
- *  local — rules need no cloud-only infra). The shared env-gated equivalence suite keeps the twins byte-matched to InMemory. */
+/** E6 SessionPolicyStore — core's interface, incl. its optional `deleteBySession` / `listBySession` seams (E21 purge / 2c
+ *  export; core's File and InMemory stores carry both since core 7.25.0 — S-546 A7 retired the service's own in-memory
+ *  twin that existed only because they once did not). tidb/pg = the SQL twin; local = core's FileSessionPolicyStore
+ *  (works local — rules need no cloud-only infra). The rev-line contract kit runs the SQL twin against core's InMemory
+ *  as oracle (`test/helpers/session-policy-rev-line-contract.ts`). */
 export type ServiceSessionPolicyStore = SessionPolicyStore;
 /** [ref] per-edited-file rewind FileHistoryStore — core's interface PLUS the service extras only the SQL twins
  *  carry (optional so the local lane's core `FileFileHistoryStore` still fits). Replaces the retired E19
@@ -192,8 +196,9 @@ export interface StoreBackend {
      *  mapping from URLs). REQUIRED on all backends (works local — one JSONL, like approvalExemption). */
     sendFileLedger(): SendFileLedger;
     /** E6 durable SessionPolicyStore (operator-tightened per-session tool rules). REQUIRED on all backends — works local
-     *  (local = core's InMemorySessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore. */
-    sessionPolicy(): ServiceSessionPolicyStore;
+     *  (local = core's FileSessionPolicyStore), like resumeAnchor. Backs core's RunnerDeps.sessionPolicyStore.
+     *  `logger`:SQL 孪生抹除封键那一臂(S-891)的点名口(缺席 ⇒ 店退回 `console.warn`);local(core 的 File 店)不收。 */
+    sessionPolicy(logger?: SessionPolicyStoreLogger): ServiceSessionPolicyStore;
     /** [ref] per-edited-file rewind FileHistoryStore (trackEdit/annulTrack/snapshot/restore over the tracked set;
      *  also the 2c history-transfer store). REQUIRED on all backends (local = core's file-backed
      *  `FileFileHistoryStore` under the data root). Backs core's RunnerDeps.fileHistoryStore. */
@@ -392,6 +397,12 @@ export declare function openStoreBackendWithFallback(config: ServiceConfig, logg
     error?: (msg: string, meta?: Record<string, unknown>) => void;
 }): Promise<{
     backend: StoreBackend | undefined;
-    degraded: boolean;
+    degradedReason: StoreDegradedReason | undefined;
 }>;
+/**
+ * S-866 ⑤c / G4 —— SQL 族「显式要了持久而店打不开」的拒启句(唯一铸点)。点名 `DB_BACKEND=<引擎>`,给三条出路:修坐标 / 连通性;
+ * `SESSION_BACKEND=auto`(尽力而为:店不可达时以内存起服,什么都不持久);`DB_BACKEND=memory`(显式内存部署)。驱动原文只取 message
+ * (与修前 `fatalExit` 打出的同一句),凭据不在其中(驱动不回显口令)。
+ */
+export declare function buildSqlStoreOpenRefusal(engine: "mysql" | "pg", err: unknown): string;
 //# sourceMappingURL=store-backend.d.ts.map

package/dist/plugins/store-backend.js

@@ -52,6 +52,7 @@ import { TiDBRetentionLaneStore, PgRetentionLaneStore } from "./retention-lane-s
 import { createSqlPermissionRuleStores } from "./permission-rule-store-sql.js";
 import { createFilePermissionRuleStores } from "./permission-rule-store-file.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
+import { storeDegradedReasonFor } from "../store-posture.js";
 function historyBlobBackend(config, dialect, pool) {
     const s = config.snapshotBlobStore;
     if (!s)
@@ -122,7 +123,7 @@ class TiDBBackend {
     approvalAsk() { return new TiDBApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(mysqlDriver(this.pool)); }
     sendFileLedger() { return new TiDBSendFileLedger(this.pool); }
-    sessionPolicy() { return new TiDBSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new TiDBSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new TiDBFileHistoryStore(this.pool, historyBlobBackend(this.config, "tidb", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new TiDBMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new TiDBSessionCaptureRecordStore(this.pool)); }
@@ -170,7 +171,7 @@ class PgBackend {
     approvalAsk() { return new PgApprovalAskStore(this.pool); }
     permissionRule() { return createSqlPermissionRuleStores(pgDriver(this.pool)); }
     sendFileLedger() { return new PgSendFileLedger(this.pool); }
-    sessionPolicy() { return new PgSessionPolicyStore(this.pool); }
+    sessionPolicy(logger) { return new PgSessionPolicyStore(this.pool, logger); }
     fileHistory() { return new PgFileHistoryStore(this.pool, historyBlobBackend(this.config, "pg", this.pool), this.config.fileHistory); }
     memoryOptOutGrant() { return new PgMemoryOptOutGrantStore(this.pool); }
     sessionCaptureRecords() { return () => (this.captureRecordsInst ??= new PgSessionCaptureRecordStore(this.pool)); }
@@ -346,15 +347,25 @@ export async function openStoreBackendWithFallback(config, logger) {
             throw err;
         if (err instanceof StoreBootRefusalError)
             throw err;
-        if (!mayFallback)
+        if (!mayFallback) {
+            if (config.dbBackend === "mysql" || config.dbBackend === "pg")
+                throw new Error(buildSqlStoreOpenRefusal(config.dbBackend, err), { cause: err });
             throw err;
+        }
         logger.warn("store_db_unreachable_fallback_memory", {
             backend: backend?.kind ?? config.dbBackend,
             error: err instanceof Error ? err.message : String(err),
         });
         await backend?.close().catch(() => undefined);
-        return { backend: undefined, degraded: true };
+        return { backend: undefined, degradedReason: storeDegradedReasonFor(config.dbBackend) };
     }
-    return { backend, degraded: false };
+    return { backend, degradedReason: undefined };
+}
+export function buildSqlStoreOpenRefusal(engine, err) {
+    const coords = engine === "pg" ? "PG_*" : "MYSQL_*";
+    const detail = err instanceof Error ? err.message : String(err);
+    return (`DB_BACKEND=${engine}: cannot open the configured ${engine === "pg" ? "PostgreSQL" : "MySQL-protocol"} store (${detail}) — refusing to boot, because DB_BACKEND asks for a durable store and SESSION_BACKEND does not allow running without it. ` +
+        `Next: fix the ${coords} coordinates or the store's reachability; or set SESSION_BACKEND=auto to boot in memory while the store is unreachable (best effort — nothing persists, and /health reports storeDegraded); ` +
+        `or set DB_BACKEND=memory for an explicitly in-memory deployment.`);
 }
 //# sourceMappingURL=store-backend.js.map

package/dist/plugins/tidb-pool.js

@@ -387,17 +387,18 @@ export const SCHEMA_STATEMENTS = [
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS session_policy_rev_mark (
      policy_key CHAR(64)     NOT NULL,
-     -- 被删会话。记号的读写一律按 policy_key 单键;这一列是**运维可读性 + 未来按会话/按龄回收**的那条腿
-     -- 的抓手(今天没有任何生产查询按它选行 —— 留存腿与收编腿都不碰本表,理由见上面那段)。
+     -- 被删会话(**明文**会话 id —— 所以它必须随会话一起走,见上)。记号的读写按 policy_key 单键;托管留存的整树
+     -- 清扫按本列删(S-546 A9,索引 idx_session_policy_rev_mark_session)。
      session_id VARCHAR(64)  NOT NULL,
-     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。
+     -- 抹除时刻该键带过的最高 rev(GREATEST 合并:记号只升不降)。= 安全整数上界 ⇒ 封键(S-891:被抹行的计数读不出;运营方原地解封,见 USAGE §9.11)。
      rev        BIGINT       NOT NULL,
      -- 这把键的**下一行从第几代开始**(每次抹除 +1;与 core File 侧车 <stem>.hwm.json 的 __gen 同义)。
      -- 血统必须比它终结的那一行活得久,理由与 rev 完全一样:留在行里就等于跟着行一起消失。
      -- DEFAULT 0 = 本列到货前落下的记号(那些键的行也都是第 0 代 ⇒ 下一次抹除把它们抬到 1,前后自洽)。
      gen        BIGINT       NOT NULL DEFAULT 0,
      erased_at  DATETIME(3)  NOT NULL,
-     PRIMARY KEY (policy_key)
+     PRIMARY KEY (policy_key),
+     KEY idx_session_policy_rev_mark_session (session_id)
    ) COLLATE utf8mb4_bin`,
     `CREATE TABLE IF NOT EXISTS snapshot_blob (
      blob_hash  CHAR(64)    NOT NULL,

package/dist/read-face-posture.d.ts

@@ -25,10 +25,10 @@
  * 本模块**只**管 `face` 一档。内建读拒表(`readDenyPatterns` / `readDenyBuiltinTiers` /
  * `readDenyBuiltinExclude`)一个字节不动 —— 放开容纳面不等于放开那几档 deny,两者在 core 里是**并列
  * 机制**(有活行的 deny 表在 open 面上照样拦)。
- * ⚠️ **但别把这句话读成「凭证/shell 历史/钱包那几档一直在岗」**:core 7.22.0([ref])起内建表的**缺省
- * 选择是空** —— 一台没写 `READ_DENY_BUILTIN_TIERS` 的部署上,那张表**一行都不生效**(要老姿态就显式写
- * `credentials,browser,wallet,agent-config`;运维面全文见 `docs/DEPLOY-PREREQS.md` 的 core 7.22.0 段)。
- * 本模块的定界不变,变的是「并列的那一侧默认开着」这个**前提**。core 的 `config.read_face_deployment_clamped`
+ * ⚠️ **但别把这句话读成「每一档都一直在岗」**:内建表的缺省选择是 core 的 `READ_DENY_DEFAULT_TIERS` —— core 7.34.0 R-2 起
+ * = `credentials` + 家目录锚定的 `agent-config` 两档(7.22.0–7.33.x 是空选择 OFF;7.106.0 合并复审 X10-L2 改真)。一台没写
+ * `READ_DENY_BUILTIN_TIERS` 的部署上只有这两档生效(shell 历史 / 浏览器 / 钱包要显式写,`none` = 一行都不生效)。
+ * 本模块的定界不变:并列的那一侧开着哪几档,是那张表自己的缺省说了算。core 的 `config.read_face_deployment_clamped`
  * (只读挂载钳制)同样不受本件影响。
  */
 import { type PostureSource } from "./posture-source.js";
@@ -65,4 +65,25 @@ export declare function buildReadFaceWiring(facts: ReadFacePostureFacts): {
     source: ReadFaceSource;
     note: string;
 };
+/**
+ * S-176 —— posture 派生的档位在 **boot 期推送面**的那一行(`config.ts` 经既有 `CONFIG_NOTICES` 以 info 级排空)。
+ *
+ * 为什么要有:S-167 的补偿项是「升级即放开,得让运维看得见并知道怎么钉回」,可此前唯一看得见的是**拉取**面
+ * (`GET /v1/diagnostics/wiring`)—— 只对会去拉的人成立。单机 boot 日志里零字。
+ * 为什么只在 `posture` 一词上说:另外三词都不是「没人表态、服务替它选了一个更宽的档」——`env` 是运维自己写的,
+ * `engine-default` 是本服务没铸(引擎默认接管),`center` 在 boot 这一拍还没到货(它有自己的换席通告)。
+ * 为什么是 info 不是 warn:每一台照常配置的单机每次启动都成立,是常态事实不是异常(与执行车道落点同级)。
+ *
+ * 字段与极性表的 posture 行同名(`knob` / `value` / `source`),另带指路句;三格由 {@link buildReadFaceWiring} 投影出 ——
+ * 拉取面与推送面**同一只函数**,不各算一次。`value` 是字符串:只有 `face` 在场的那一形才会走到这里。
+ */
+export declare function buildReadFacePostureNotice(facts: ReadFacePostureFacts): {
+    event: "config_knob_posture_derived";
+    fields: {
+        knob: "READ_FACE";
+        value: string;
+        source: ReadFaceSource;
+        note: string;
+    };
+} | undefined;
 //# sourceMappingURL=read-face-posture.d.ts.map

package/dist/read-face-posture.js

@@ -14,4 +14,13 @@ export function readFaceSourceNote(source) {
 export function buildReadFaceWiring(facts) {
     return { face: facts.readFace ?? null, source: facts.readFaceSource, note: readFaceSourceNote(facts.readFaceSource) };
 }
+export function buildReadFacePostureNotice(facts) {
+    if (facts.readFaceSource !== "posture")
+        return undefined;
+    const wiring = buildReadFaceWiring(facts);
+    if (wiring.face === null) {
+        throw new Error("read-face posture notice: source is `posture` but no face was minted — readFaceForPosture's invariant broke");
+    }
+    return { event: "config_knob_posture_derived", fields: { knob: "READ_FACE", value: wiring.face, source: wiring.source, note: wiring.note } };
+}
 //# sourceMappingURL=read-face-posture.js.map

package/dist/request-key-closure.js

@@ -19,10 +19,10 @@ export function keyClosureClause(names, label) {
 }
 const TASK_BODY_DECLARED_KEYS = [
     "a2aPeers", "acceptPartialRestore", "additionalDirectories", "additionalReadDirectories", "agents",
-    "appendSystemPrompt", "approverPosture", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
+    "appendSystemPrompt", "attachmentIds", "attachments", "capabilitiesNeeded", "cascade", "clientContext",
     "compaction", "compactionModel", "council", "cwd", "debate", "deferTools", "deviceId", "enableFork",
     "excludeAllTools", "excludeTools", "fileHistory",
-    "finalVerification", "forwardSubagentEvents", "images", "interactiveTools", "jobId", "limits", "maxCostUsd",
+    "finalVerification", "forwardSubagentEvents", "images", "inheritEnv", "interactiveTools", "jobId", "limits", "maxCostUsd",
     "maxTokens", "mcpServers", "memory", "memoryCapture", "memoryWrite", "model", "objective", "oneShot", "outputRetries",
     "outputSchema", "permissionMode", "projectId", "promptProfile", "reasoningEffort", "requireExistingSession",
     "resilience", "restoreFiles", "resumeAt", "resumeAtMode", "retainBackgroundProcesses", "retainSubagentSessions",

package/dist/request-value-closure.d.ts

@@ -10,8 +10,8 @@
  * 一个敲错的隐私/收紧请求被静默丢掉(用户以为关了,其实没关),或者一个敲错的键把功能静默关掉。
  *
  * 🔴 **判别是「值域恰好是一个关断词」,不是「值域恰好是一个字面量」**(S-724 加 `fileHistory` 时定形):
- * `approverPosture` 的值域也只有一个词(`"bypass"`),但它是一句**姿态声明**、闭集属主在 core、本仓刻意**零判据**
- * (`http/wire-types.ts` 那一段逐字成文);把判别放宽成「单字面量」会把它也拖进本表 = 同一语义面第二个判官。
+ * 当年的反例是 `approverPosture`(值域也只有一个词 `"bypass"`,但它是一句**姿态声明**、闭集属主在 core,本仓刻意零判据);
+ * 那个请求键已随 core 7.34.0 退役(S-877,[ref] 裁 ③),判别式的理由不变 —— 一个非关断的单字面量键不属于本表。
  * 关断词全集 {@link OffSwitchWord} 是 core 的两种关断拼法,新增第三种拼法 = 加一个词(并逐键重判)。
  *
  * ## 为什么是一只判据函数,不是每处一抄
@@ -53,10 +53,14 @@ export declare const FILE_HISTORY_OFF_SPELLING_MESSAGE = "fileHistory must be th
 /**
  * S-724 b′(主会话裁,车PW codex r1 [high] 复现后)—— `fileHistory: "disabled"` 与还原**同体**的拒句(`request.field_conflict`)。
  * 与 `tool-approval.ts` 的 `SETTLED_BY_DENY_ONLY` / `READ_ROOT_GRANT_ALLOW_ONLY` **同一族**:「只看体就能判的矛盾,在裁决之前响亮说」。
- * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`),但它的拒
- * 落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
- * 且拒后不回滚 —— 拒传不回来。所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
+ * 这一对是调用方自己写出的矛盾(关掉这条 run 的文件历史,又要从文件历史还原);core 也拒(`rewind.capture_disabled`)。立门时(7.104.0)
+ * core 的拒落在 prepare 的**会话分叉之后**(`prepare-acquire-reconcile` 先按 `resumeAt` 把活动分支移过去,`prepare-file-history` 才判),
+ * 且拒后不回滚 —— 所以本层在任何副作用之前拒。**这不是替 core 再判一次「捕获关了能不能还原」**:判的是体里两个键
  * 能不能共存,不看部署、不看店。
+ * ⚠️ S-865 / S-877(core 7.35.0 #1195):core 起把只看请求体就判得出的拒因(本码在内)挪到**会话 acquire 之前**的请求门
+ * (`runner/file-history-request.js`),被拒的请求会话日志逐字节不动 —— 本门当年防的那个副作用在引擎侧已不存在。本门的 400
+ * 照旧有效(core wire 单:「the at-accept 400 stays valid」),退不退(退则 fresh 腿改落 core 的 422 `rewind.capture_disabled`)
+ * 列 7.106.0 收车档候裁。
  * 判据:{@link fileHistoryRestoreConflict}。**只在 fresh 受理门**(`http/admission.ts`);续跑腿不过这道门(RESUME 重放不过受理门,
  * 同律 —— 且续跑腿重建时整族剥掉一次性历史动作,矛盾在盘上的体里本就留不下来)。wire 可见、字节冻结。
  */
@@ -96,5 +100,13 @@ export interface SingleMemberOffFieldIssue {
  * 全部合法或全部缺席 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。
  */
 export declare function singleMemberOffFieldIssue(raw: unknown): SingleMemberOffFieldIssue | null;
+/** `inheritEnv` 的受理词表(闭集;**顺序 = 拒句里的列举顺序**)。 */
+export declare const INHERIT_ENV_WORDS: readonly ["all", "scrub"];
+/** 一条请求能声明的继承策略(wire 形,见 `TaskRequestBody.inheritEnv`)。 */
+export type TaskInheritEnv = (typeof INHERIT_ENV_WORDS)[number];
+/** 词表外的拒句(wire 可见;点名两词与各自的意思 —— 拿错的人要在同一条回执里读到该发什么)。 */
+export declare const INHERIT_ENV_VALUE_MESSAGE: string;
+/** `inheritEnv` 在场且不在词表里 ⇒ 拒句;缺席或合法 ⇒ `null`。**两腿(fresh admission / resume 重放)共用这一只**。 */
+export declare function inheritEnvFieldIssue(raw: unknown): string | null;
 export {};
 //# sourceMappingURL=request-value-closure.d.ts.map

package/dist/request-value-closure.js

@@ -23,4 +23,16 @@ export function singleMemberOffFieldIssue(raw) {
     }
     return null;
 }
+export const INHERIT_ENV_WORDS = ["all", "scrub"];
+export const INHERIT_ENV_VALUE_MESSAGE = `inheritEnv must be one of ${INHERIT_ENV_WORDS.map((w) => JSON.stringify(w)).join(" | ")} when present ` +
+    `("all" = the model-driven host shell inherits this machine's whole environment, honored only on a single-user host-lane deployment; ` +
+    `"scrub" = the default scrub of credential-shaped variables, accepted on every lane; absent = "scrub") — a name list is not a request value`;
+export function inheritEnvFieldIssue(raw) {
+    if (raw === null || raw === undefined || typeof raw !== "object" || Array.isArray(raw))
+        return null;
+    const value = raw.inheritEnv;
+    if (value === undefined)
+        return null;
+    return INHERIT_ENV_WORDS.includes(value) ? null : INHERIT_ENV_VALUE_MESSAGE;
+}
 //# sourceMappingURL=request-value-closure.js.map

package/dist/router/route-orchestration.d.ts

@@ -104,6 +104,17 @@ export declare function isIsolatedExecEnv(provider?: string, runtimeClass?: stri
  *  - `toolPolicy` — ALSO ask on the direct write hand tools `Edit`/`Write` (review HIGH: shellGate alone
  *    leaves a non-isolated SUP task able to mutate the real fs via write tools ungated). The worker's existing
  *    approval machinery (durable suspend / poll) enforces the `ask` — same precondition as `shellGate:"always"`.
+ *
+ * 🔴 S-897(7.106.0,[ref]):这些 ask 是**部署**(运维开的 `ROUTER_ENABLED` 路由)写下的门 ⇒ 盖 core 的部署出身位
+ * `authoredBy:"deployment"`,经**唯一**盖位函数(`operator-ask.ts` 的 `withDeploymentAuthorship`,经 `operatorAlwaysHumanAsk`
+ * 取用 —— 治理层 ask、`APPROVAL_NEVER_AUTO` / 预算耗尽 ask 同一只)。修前:写工具的 ask 只自报 `matchedAskRule`(非强制卡),
+ * shellGate always 的 shell ask 是 core 自铸的、没有出身位 ⇒ 卡上只剩单个强制词(`operator_always`;读边界探针命中时是
+ * `probe_mandate`,它把 always 藏在后面)⇒ bypass 下壳按那一个词放行(cli L-758 的规则面)。盖了之后 core 判 `mandated`、
+ * 不铸 `mandate` 词(表外的门)⇒ 活卡与 park 行两腿都读成「另有门在」,壳出卡。
+ * shell 那一问的出身只能由**策略的** ask 带进去(core 的 shell 座铸的 ask 没有出身位的写口)⇒ 策略对 shell 工具也问一次,
+ * core 把它与 shellGate always 折成同一只 ask(不是两问)。
+ * ⚠️ 连带(产品面,如实):写工具的 ask 从此也是强制卡 ⇒ 用户的「本会话放行」不再退役 SUP 路由的写门(shell 那一问修前就退不掉)。
+ * 不改路由判据本身(`routeServiceTask` 一字不动)。
  */
 export declare function supPostureOverrides(): Partial<TaskSpec>;
 //# sourceMappingURL=route-orchestration.d.ts.map

package/dist/router/route-orchestration.js

@@ -1,5 +1,5 @@
-import {} from "@sema-agent/core";
-import { operatorAsk } from "../operator-ask.js";
+import { COARSE_SHELL_TOOLS } from "@sema-agent/core";
+import { operatorAlwaysHumanAsk } from "../operator-ask.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -40,11 +40,12 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
     return false;
 }
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
+const SHELL_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function supPostureOverrides() {
-    const ask = (toolName) => operatorAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
-    const writeGate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
+    const ask = (toolName) => operatorAlwaysHumanAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
+    const gate = {
+        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) || SHELL_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
     };
-    return { shellGate: "always", toolPolicy: writeGate };
+    return { shellGate: "always", toolPolicy: gate };
 }
 //# sourceMappingURL=route-orchestration.js.map

package/dist/rules-consent.js

@@ -736,17 +736,6 @@ export function createRuleConsentLane(stores, opts) {
                 adds: [],
             };
             const rowOf = (rows) => rows.find((r) => sameWireRuleIdentity(r, { behavior: input.behavior, rule: written.rule.rule, scope: row.scope }));
-            let before;
-            try {
-                before = await lane.listRules(input.principal);
-            }
-            catch (e) {
-                localImportLogger.warn("direct_rule_write_pre_read_failed", { behavior: input.behavior, err: e instanceof Error ? e.message : String(e) });
-                return { status: "failed", detail: `the rule store could not be read before writing: ${e instanceof Error ? e.message : String(e)}`, committed: "no" };
-            }
-            const standing = rowOf(before.rows);
-            if (standing !== undefined)
-                return { status: "no-op", rev: before.rev, stillLive: "yes", row: standing };
             const screened = screenLocalImportRow(row);
             if ("reason" in screened)
                 return { status: "rejected", reason: screened.reason, detail: screened.detail };

package/dist/run-local.js

@@ -9,6 +9,7 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { Runner, uuidv7, FileStorageBackend, NodeExecutionEnv, TtlSessionStore, CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, defaultTaskRegistry } from "@sema-agent/core";
 import { singleUserAutoAcceptBaselineApplies } from "./approval.js";
+import { createUnattendedLeg, unattendedPermissionMode, withUnattendedLeg } from "./unattended-permission-mode.js";
 import { createBrain } from "./brain.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs, } from "./deployment-governance.js";
 import { applyRuntimeGovernance } from "./runtime-governance.js";
@@ -567,7 +568,8 @@ export async function runLocal(argv, deps = {}) {
         ...(maxCostUsd !== undefined ? { maxCostUsd } : {}),
         ...(maxTokens !== undefined ? { maxTokens } : {}),
     };
-    const spec = applyLocalGovernance({
+    const unattendedLeg = createUnattendedLeg(unattendedPermissionMode(config), runnerDeps);
+    const spec = withUnattendedLeg(applyLocalGovernance({
         objective: mention.cleanedObjective,
         sessionId,
         backgroundScope: "session",
@@ -583,7 +585,7 @@ export async function runLocal(argv, deps = {}) {
         ...(mcp ? { mcp } : {}),
         ...(a2a ? { a2a } : {}),
         ...(Object.keys(limits).length > 0 ? { limits } : {}),
-    }, config, workspaceDir, memoryEngine?.root);
+    }, config, workspaceDir, memoryEngine?.root), unattendedLeg);
     logger.info("run_local_start", { scenario: scenarioName, model: spec.model, sessionId, exec: executionLaneOf(config.remoteExec?.provider) });
     const settleSessionBackground = async () => {
         const reaped = defaultTaskRegistry.reapSessionBackground(sessionId, scope);

package/dist/runs.d.ts

@@ -150,7 +150,8 @@ export declare function isSessionConflictResult(result: {
  * 逐码显式登记为债务,并由那道门看住不许陈腐。
  *
  * S-724(core 7.31.0 #1048 / #1050):`rewind.capture_disabled` → **422**(关断词与还原同体 = 自相矛盾;本服务的请求面上
- * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(core 这一拒落在会话分叉之后、不回滚);映射是分诊面完备性)、`rewind.store_unconfigured`
+ * 走不到它 —— fresh 受理门先 400 `request.field_conflict`(立门理由:core 这一拒落在会话分叉之后、不回滚;S-865 / core 7.35.0
+ * #1195 起 core 在分叉之前拒);映射是分诊面完备性)、`rewind.store_unconfigured`
  * → **409**(部署没有历史店;`FILE_HISTORY_CAPTURE=false` 自本版不再摘店 ⇒ 可达面只剩没有后端的部署形,那里
  * `capabilities.rewindFiles` 恒报 false —— 三问在 CHANGELOG 7.104.0)。
  */

package/dist/runs.js

@@ -1,7 +1,7 @@
 import { runWithVerification, runCascade, defaultTaskRegistry, taskNotificationDedupKey, DURABLE_AGENT_HANDLE_RE } from "@sema-agent/core";
 import { failureCodeOf, sealResultForExit, outwardPlane } from "./terminal.js";
 import { GOVERNANCE_HTTP_STATUS } from "./governance-http-status.js";
-import { ROSTER_BOUND_HTTP_STATUS } from "./roster-bound-http-status.js";
+import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js";
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
@@ -76,8 +76,8 @@ export function resumeAtHttpStatus(result) {
     if (Object.hasOwn(GOVERNANCE_HTTP_STATUS, code)) {
         return GOVERNANCE_HTTP_STATUS[code] ?? undefined;
     }
-    if (Object.hasOwn(ROSTER_BOUND_HTTP_STATUS, code)) {
-        return ROSTER_BOUND_HTTP_STATUS[code];
+    if (Object.hasOwn(TOOL_DECLARATION_HTTP_STATUS, code)) {
+        return TOOL_DECLARATION_HTTP_STATUS[code] ?? undefined;
     }
     if (isSessionErrorCode(code)) {
         const wire = sessionErrorHttp(code, "open");
@@ -208,7 +208,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
     if (approval) {
         const coordinator = approval.coordinator;
         spec.onAsk = approvalLeg.windowZero
-            ? (askReq) => Promise.resolve(coordinator.unattendedAskOutcome({ taskId, owner: elicitOwner ?? owner, toolName: askReq.toolName }))
+            ? coordinator.boundUnattendedAsk({ owner: elicitOwner ?? owner, taskId, ...(spec.sessionId ? { sessionId: spec.sessionId } : {}) })
             : coordinator.boundAsk({
                 owner: elicitOwner ?? owner,
                 taskId,

package/dist/runtime-caps-resolver.d.ts

@@ -113,18 +113,12 @@ export interface EntitlementsResolverOpts {
  *
  *  `autoMode`(core 1.276.0 `RuntimeCaps.autoMode`;**[ref] / core [ref] 起三态**,黑板 [ref]/[ref]):
  *  `undefined`(center 缺席/未答)= 不阻;`true` = 不阻;`false` = **org deny**(CC `permissions.disableAutoMode`
- *  镜像)。core 武装式 = `spec.autoModeRequested === true ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`
+ *  镜像)。core 武装式 = `spec.permissionMode === "auto" ∧ deps.autoMode !== undefined ∧ runtimeCaps?.autoMode !== false`(core 7.34.0 起;此前意图座是退役的 `autoModeRequested`)
  *  ——「用户开 + org 拒」极性(此前是 `=== true` 的「org 授予」极性,无 center 的本地部署零授予路径 ⇒ auto 永不
  *  武装,真实用户诊断的病根)。
- *  🔴 **上面那条武装式是 [ref] 的目标形,不是「本仓现在装的那版 core 的形」——引用它之前先看装的是哪版**
- *  ([ref]① 随 codex r2-[high] 补:我方在 WIRE 附录 F 照抄这一句,写成了「7.2.0 的行为」,而 npm **7.2.0
- *  不含 [ref]** —— 它的 `dist/core/runner/prepare-task.js` 逐字仍是 `runtimeCaps?.autoMode === true &&
- *  deps.autoMode !== undefined`,即旧「org 授予」极性、**缺键 ⇒ 不武装**)。判「现在是哪套极性」的唯一判据 =
- *  安装包探针 `CORE_ARMS_AUTO_ON_INTENT`(`src/auto-mode-face.ts`;实测本树 7.2.0 ⇒ **false** = 旧式臂),
- *  代码侧已按它分臂,失实的只是散落各处的散文。⚠️ 同形措辞在本文件 :209 / :362-364 / :548 与
- *  `src/boot/runtime-caps.ts:182` 还各有一处(均 [ref] 既有文字,本批未逐条改 —— 登记在 handoff 未闭环项)。
- *  所以**缺键=不写键**在这条轴上是行为承重的(在新式 core 上):补一个 false 就是替 org 说了一句
- *  它没说的 deny;在旧式 core 上两者同为「不武装」,差别不显形。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
+ *  ([ref]① 的历史:npm 7.2.0 不含 [ref]、是旧「org 授予」极性,本仓曾用安装包探针分臂;S-877 / core 7.34.0 起引擎只剩
+ *  上面这一种极性,探针随 7.106.0 退役 —— 本仓精确钉的 core 恒是它。)
+ *  所以**缺键=不写键**在这条轴上是行为承重的:补一个 false 就是替 org 说了一句它没说的 deny。[ref]B-6a:registry-core 0.13.0 已把 autoMode 收进 EntitlementRuntimeCaps——类型直读。 */
 export declare function toCoreRuntimeCaps(ent: EntitlementRuntimeCaps | null | undefined): RuntimeCaps | undefined;
 /**
  * #A5([ref] 件2)—— 「这台 worker 上**存在** per-principal entitlement 源吗」的**单一谓词**。