@sema-agent/server 7.122.0 → 7.124.0

package/dist/config-lkg.js

@@ -1,10 +1,11 @@
-import { promises as fs, lstatSync, realpathSync } from "node:fs";
-import { basename, join, dirname, resolve } from "node:path";
+import { promises as fs } from "node:fs";
+import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
+import { formatConfigPath } from "@sema-agent/settings-schema";
+import { join, dirname, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
 import { centerStateBin, pullTokenIdentity } from "./center-credential.js";
 import { configRootOf } from "./sema-config-dir.js";
-import { recordFailOpen } from "./observability/fail-open.js";
 export function defaultSkillCacheDir(config) {
     return join(configRootOf(config), "skill-cache");
 }
@@ -23,41 +24,10 @@ export function lkgPathOverrideOf(raw) {
 export function lkgReadDenyRows(configLkgPath) {
     if (configLkgPath === undefined)
         return [];
-    return [...new Set([configLkgPath, landedPathOf(configLkgPath)])].map((pattern) => ({ pattern, caseSensitive: false }));
-}
-function landedPathOf(p) {
-    const rest = [];
-    let landed = p;
-    let unresolved;
-    for (let head = p;; head = dirname(head)) {
-        try {
-            landed = join(realpathSync(head), ...rest);
-            break;
-        }
-        catch {
-            if (unresolved === undefined && head !== p && segmentPresent(head))
-                unresolved = head;
-            if (dirname(head) === head)
-                break;
-            rest.unshift(basename(head));
-        }
-    }
-    if (unresolved !== undefined)
-        recordFailOpen("server.config-lkg.landed-path-unresolved", `segment=${unresolved}`);
-    return landed;
-}
-function segmentPresent(p) {
-    try {
-        lstatSync(p);
-        return true;
-    }
-    catch (e) {
-        const code = e.code;
-        return code !== "ENOENT" && code !== "ENOTDIR";
-    }
+    return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 2, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 4, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -84,14 +54,73 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2)
+    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
     if (typeof p.identity !== "string" || p.identity !== identity)
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
-    const problem = lkgPayloadProblem(p.effective, p.etag);
-    return problem === undefined ? { lkg: p } : { reason: problem };
+    if (p.effective === null || typeof p.effective !== "object" || Array.isArray(p.effective))
+        return { reason: "bad effective" };
+    let envelope = p;
+    let note;
+    if (formatVersion === 2) {
+        const v2 = migrateV2Lkg(envelope);
+        if (v2.lkg === undefined)
+            return v2;
+        envelope = v2.lkg;
+        note = v2.migrated;
+    }
+    const payload = migrateLkgPayload(envelope.effective);
+    if ("refused" in payload)
+        return { reason: payload.refused };
+    const problem = lkgPayloadProblem(payload.effective, envelope.etag);
+    if (problem !== undefined)
+        return { reason: problem };
+    const lkg = { ...envelope, formatVersion: 4, effective: payload.effective };
+    const migrated = formatVersion !== 4 || payload.receipts.length > 0;
+    return migrated ? { lkg, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg };
+}
+export function migrateLkgPayload(effective) {
+    const m = migrateEffectiveSnapshot(effective);
+    const refused = m.receipts.filter((r) => r.appliedAs === "refused");
+    if (refused.length > 0) {
+        return {
+            refused: "settings-schema one-time migration refused part of this LKG's payload (" +
+                refused.map((r) => `${r.migration} ${r.document}:${formatConfigPath(r.path)} — ${r.reason}`).join("; ") +
+                ") — not read back: the engine applies an LKG without the contract's reader, so a form the migration cannot rewrite would be silently skipped; the next clean candidate rewrites it",
+        };
+    }
+    return { effective: m.effective, receipts: m.receipts };
+}
+const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
+function migrateDroppedIdentityRow(row) {
+    if (row === null || typeof row !== "object")
+        return row;
+    const r = row;
+    const at = typeof r.entry === "string" ? RETIRED_CATALOG_COORDINATE.exec(r.entry) : null;
+    const fields = r.fields;
+    if (at === null || typeof r.name !== "string" || (r.id !== undefined && typeof r.id !== "string") || !Array.isArray(fields) || !fields.every((f) => typeof f === "string") || typeof r.issues !== "string")
+        return row;
+    return { index: Number(at[1]), reasonCode: "entry-schema-invalid", identity: { name: r.name, ...(typeof r.id === "string" ? { id: r.id } : {}) }, fields: [...fields], issues: r.issues };
+}
+function migrateV2Lkg(lkg) {
+    const { etag: _incompleteCarrierValidator, ...envelope } = lkg;
+    const models = lkg.effective.models;
+    const hasRetired = models !== undefined && models !== null && typeof models === "object" && Object.hasOwn(models, "droppedIdentities");
+    let effective = lkg.effective;
+    if (hasRetired) {
+        const { droppedIdentities: retired, ...rest } = models;
+        if (Object.hasOwn(rest, "droppedCatalogEntries")) {
+            return { reason: "both the retired dropped-entry carrier (models.droppedIdentities) and its successor (models.droppedCatalogEntries) are present — no writer produces that shape; not read back" };
+        }
+        effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
+    }
+    return {
+        lkg: { ...envelope, effective },
+        migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
+            (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
+    };
 }
 function lkgPayloadProblem(effective, etag) {
     if (effective === null || typeof effective !== "object")
@@ -101,7 +130,7 @@ function lkgPayloadProblem(effective, etag) {
     const eff = effective;
     if (typeof eff.version !== "number")
         return "bad effective.version";
-    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["limits", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
@@ -113,12 +142,6 @@ function lkgPayloadProblem(effective, etag) {
                 return `bad effective.${domain}.${arrayKey}`;
         }
     }
-    {
-        const rt = eff.runtime;
-        if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
-        }
-    }
     const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
         return "prompts face fails re-validation";
@@ -169,7 +192,12 @@ export async function migrateV1Lkg(o) {
     if (o.identity !== pullTokenIdentity(o.worker)) {
         return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
     }
-    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (v1.effective === null || typeof v1.effective !== "object" || Array.isArray(v1.effective))
+        return refuse("its payload is unusable (bad effective)");
+    const payload = migrateLkgPayload(v1.effective);
+    if ("refused" in payload)
+        return refuse(`its payload cannot be migrated to the current settings form (${payload.refused})`);
+    const problem = lkgPayloadProblem(payload.effective, v1.etag);
     if (problem !== undefined)
         return refuse(`its payload is unusable (${problem})`);
     const retiredTo = `${o.legacyPath}.migrated-v1`;
@@ -183,7 +211,7 @@ export async function migrateV1Lkg(o) {
         }
     }
     try {
-        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, typeof v1.etag === "string" ? v1.etag : undefined);
+        await saveLkg(o.binPath, o.worker, o.identity, payload.effective, undefined);
     }
     catch (err) {
         return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);

package/dist/config-provider.d.ts

@@ -1,10 +1,10 @@
-import { type DroppedConfigEntry } from "./config-center/read-warnings.js";
+import { type DroppedConfigEntry } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
-import type { CenterEndpoint } from "./config-center/center-request.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
+import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ConfigProviderWord } from "./config-types.js";
-/** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
+/** Result of a `fetchEffective` — EXACTLY the web-admin's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
  *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
@@ -13,17 +13,16 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
-/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义。折叠是有损的——
- *  `hosts-grandfathered` / `legacy-governance-lifted` 按律折成 `null`,只看 `domainErrors` 的人永远看不见
- *  兼容臂还开着,而契约铸出 `legacy-governance-lifted` 的理由正是「关窗的前提是有人知道它还开着」
- *  (`legacyGovernanceFromRuntime` SUNSET 注)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
+/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
+ *  告警多重集,折叠后的诊断面带不回 `kind` / 坐标段)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
 /** `credentialIdentity`(S-651 / [ref] E-15):远程腿恒在场 = 这次拉取所用凭证的身份(分箱键来源);本地腿
  *  缺席(没有凭证 —— config.d 就在本机盘上)。 */
-/** `droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断,已脱敏)—— **不**进候选门,调用方逐条响亮
- *  点名、其余照用;缺席 = 这次读零逐条丢弃(与 `domainErrors` 同一种缺席即无的形)。 */
+/** `droppedEntries`(S-704 ②):schema 逐条丢掉的条目(坐标 + 字段诊断,已脱敏;S-1295 起每行带闭集词 `reasonCode`)—— **不**进候选门,
+ *  调用方逐条响亮点名、其余照用;缺席 = 这次读零逐条丢弃(与 `domainErrors` 同一种缺席即无的形)。其中的目录条目同一次折叠另记进
+ *  `effective.models.droppedCatalogEntries`(`GET /v1/models.droppedEntries` 的源,与 `models` 同世代)。 */
 export type FetchEffectiveResult = {
     effective: EffectiveConfig;
     etag?: string;
@@ -51,6 +50,12 @@ export type FetchEffectiveResult = {
  * 不回声值(上游 settings-schema)。
  */
 export declare function redactConfigError(text: string): string;
+/**
+ * 一个配置值的单向短指纹(`#` + 8 位十六进制;HMAC 的钥匙每进程一把 —— 只在同一条日志流里可对照,不是一份可查字典的摘要)。
+ * 句子由契约从**结构化操作数**铸的地方(settings-schema 11 的 `renderRefIssue(issue, show)`)把它当 `show` 传进去:值逐个换成指纹,
+ * 句子的固定词与坐标原样 —— 不需要 {@link redactConfigError} 那种从引号猜值边界的读法。
+ */
+export declare function fingerprintConfigOperand(operand: string): string;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export declare const BOOT_FETCH_DEFERRED: unique symbol;
@@ -70,7 +75,7 @@ export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): P
  * et al. (main.ts does not swap on this seam yet — see the NOT-YET-WIRED note at the top of this module).
  */
 export interface ConfigProvider {
-    /** "remote" = config-center HTTP; "local" = on-disk FileConfigStore. */
+    /** "remote" = web-admin HTTP; "local" = on-disk FileConfigStore. */
     readonly kind: "remote" | "local";
     /**
      * Pull the effective config. `etag` is the caller's last-seen version token (`if-none-match` on remote;
@@ -89,10 +94,10 @@ export interface ConfigProvider {
 /** The config-provider knobs read off ServiceConfig (a structural subset — avoids importing the whole
  *  ServiceConfig type and keeps this module testable with a plain object). */
 export interface ConfigProviderInput {
-    /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
+    /** Set when SEMA_WEB_ADMIN_URL is configured (config.ts `webAdmin`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
-     *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: CenterEndpoint & {
+     *  `webAdmin.dryRun`); the provider itself does not consume it (the caller still branches on it). */
+    webAdmin?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -107,10 +112,10 @@ export interface ConfigProviderInput {
     localDir: string;
 }
 /**
- * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
+ * RemoteConfigProvider — DELEGATES to the exported web-admin HTTP functions. No HTTP is reimplemented;
  * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
  * are passed through. The two delegate fns are injectable (defaulting
- * to the real config-center exports) so a unit test can assert delegation without module-mocking.
+ * to the real web-admin exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
@@ -155,7 +160,7 @@ export declare class LocalConfigProvider implements ConfigProvider {
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
  * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
+ * `CONFIG_PROVIDER=local`, OR when no web-admin URL is configured (a lone box with config.d/ on disk
  * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
  * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
  * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
@@ -167,7 +172,7 @@ export declare function mapToServiceEffective(eff: AgentConfigEffective, version
 export declare function createConfigProvider(input: ConfigProviderInput): ConfigProvider;
 /**
  * S-841 —— **本地配置根的唯一来源**:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`。两个入口(HTTP 服务的第 1 段、
- * run-local)各调一次,算出来的那一个值同时交给 config-center 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
+ * run-local)各调一次,算出来的那一个值同时交给 web-admin 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
  * (`composeExecutionLane` 的 `localRoot`)—— 修前两个入口各写一份这条链(run-local 还多一个与之等价的三元),工厂又在
  * 字面 `"local"` 之外回落 `process.cwd()`。
  *
@@ -184,14 +189,14 @@ export declare function configLocalRoot(config: {
  */
 export declare function configProviderKind(input: {
     readonly provider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote";
 /**
- * HTTP 服务这一侧的配置源:config-center 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
+ * HTTP 服务这一侧的配置源:web-admin 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
  * `undefined` = 纯 env 部署(没有配置源)。工厂与执行车道合成步读这同一只(车PI 修复轮 ①:合成步排在工厂之前)。
  */
 export declare function serviceConfigSourceKind(config: {
     readonly configProvider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote" | undefined;
 //# sourceMappingURL=config-provider.d.ts.map

package/dist/config-provider.js

@@ -1,10 +1,10 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { splitFoldedReadWarnings, withDroppedIdentities } from "./config-center/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
+import { danglingRefs, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
@@ -14,12 +14,16 @@ export function redactConfigError(text) {
     if (first === -1)
         return s;
     const count = (q) => s.split(q).length - 1;
-    const fingerprint = (operand) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}"`;
+    const fingerprint = (operand) => `"${fingerprintConfigOperand(operand)}"`;
     if (count('"') % 2 === 1 || count("'") % 2 === 1)
         return `${s.slice(0, first)}${fingerprint(s.slice(first + 1))}`;
     const last = Math.max(s.lastIndexOf('"'), s.lastIndexOf("'"));
     return `${s.slice(0, first)}${fingerprint(s.slice(first + 1, last))}${s.slice(last + 1)}`;
 }
+export function fingerprintConfigOperand(operand) {
+    return `#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}`;
+}
+const redactDroppedEntry = (d) => ({ ...d, error: redactSecrets(d.error) });
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
@@ -47,7 +51,7 @@ export class RemoteConfigProvider {
         return {
             ...r,
             ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
-            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) })) } : {}),
+            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map(redactDroppedEntry) } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
@@ -56,7 +60,7 @@ export class RemoteConfigProvider {
             return await fn(this.cc, contentHash);
         }
         catch (err) {
-            if (err instanceof ConfigCenterHttpError && err.status === 404)
+            if (err instanceof WebAdminHttpError && err.status === 404)
                 return undefined;
             throw err;
         }
@@ -85,18 +89,20 @@ export class LocalConfigProvider {
         if (etag !== undefined && etag === tag)
             return null;
         const refErrors = [];
-        const resolve = createSiblingResolver(store, eff);
-        for (const d of REF_CHECKED_DOMAINS) {
-            const issues = await refIntegrityIssues(d, eff[d], resolve);
-            if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
+        const byReferrer = new Map();
+        for (const issue of danglingRefs(eff)) {
+            const rows = byReferrer.get(issue.referrer.domain) ?? [];
+            rows.push(renderRefIssue(issue, fingerprintConfigOperand));
+            byReferrer.set(issue.referrer.domain, rows);
         }
+        for (const [domain, rows] of byReferrer)
+            refErrors.push({ domain, error: rows.join("; ") });
         const folded = splitFoldedReadWarnings(readWarnings);
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
-        const droppedEntries = folded.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) }));
+        const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return {
-            effective: withDroppedIdentities(mapToServiceEffective(eff, eff.version), folded.droppedIdentities),
+            effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
             etag: tag,
             readWarnings,
             ...(errors.length > 0 ? { domainErrors: errors } : {}),
@@ -139,8 +145,7 @@ export function mapToServiceEffective(eff, version) {
                 enabled: m.enabled,
             })),
             roles: eff.models.roles ?? {},
-            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
-            ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
+            atMention: eff.models.atMention,
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },
@@ -199,13 +204,6 @@ export function mapToServiceEffective(eff, version) {
                 enabled: sc.enabled,
             })),
         },
-        runtime: {
-            ...(eff.runtime.rateLimitPerMin !== undefined ? { rateLimitPerMin: eff.runtime.rateLimitPerMin } : {}),
-            ...(eff.runtime.maxTaskCostUsd !== undefined ? { maxTaskCostUsd: eff.runtime.maxTaskCostUsd } : {}),
-            ...(eff.runtime.maxTaskTokens !== undefined ? { maxTaskTokens: eff.runtime.maxTaskTokens } : {}),
-            ...(eff.runtime.maxPrincipalCostUsd !== undefined ? { maxPrincipalCostUsd: eff.runtime.maxPrincipalCostUsd } : {}),
-            ...(eff.runtime.costQuotaWindowSec !== undefined ? { costQuotaWindowSec: eff.runtime.costQuotaWindowSec } : {}),
-        },
         ...(eff.limits !== undefined ? { limits: eff.limits } : {}),
         governance: {
             ...(eff.governance.autonomy !== undefined ? { autonomy: eff.governance.autonomy } : {}),
@@ -215,21 +213,21 @@ export function mapToServiceEffective(eff, version) {
     };
 }
 export function createConfigProvider(input) {
-    return configProviderKind(input) === "remote" && input.configCenter !== undefined
-        ? new RemoteConfigProvider(input.configCenter)
+    return configProviderKind(input) === "remote" && input.webAdmin !== undefined
+        ? new RemoteConfigProvider(input.webAdmin)
         : new LocalConfigProvider(input.localDir);
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
 }
 export function configProviderKind(input) {
-    if (input.provider === "local" || input.configCenter === undefined)
+    if (input.provider === "local" || input.webAdmin === undefined)
         return "local";
     return "remote";
 }
 export function serviceConfigSourceKind(config) {
-    if (config.configCenter === undefined && config.configProvider !== "local")
+    if (config.webAdmin === undefined && config.configProvider !== "local")
         return undefined;
-    return configProviderKind({ provider: config.configProvider, configCenter: config.configCenter });
+    return configProviderKind({ provider: config.configProvider, webAdmin: config.webAdmin });
 }
 //# sourceMappingURL=config-provider.js.map