@sema-agent/server 7.123.0 → 7.124.1

package/dist/config-lkg.d.ts

@@ -1,6 +1,7 @@
-/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(3 = 载荷的被丢目录条目记录是全的)。 */
+import { type MigrationReceipt } from "@sema-agent/settings-schema/one-time-migrations";
+/** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。`formatVersion` 的语义见头注(4 = 载荷是 settings-schema 11 的形)。 */
 export interface PersistedLkg {
-    formatVersion: 3;
+    formatVersion: 4;
     savedAt: string;
     worker: string;
     /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
@@ -46,19 +47,38 @@ export declare function lkgReadDenyRows(configLkgPath: string | undefined): {
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
 export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
+/** 一次读回做过的一次性迁移(调用方响亮打一行 `config_lkg_migrated`,并按 4 写回原位):`fromFormat` = 盘上的版本号;`note` = 信封层的说明
+ *  (2 → 3 那一步,{@link migrateV2Lkg});`receipts` = 载荷层 settings-schema 迁移的收据(只点名坐标与处置,不带值)。 */
+export interface LkgReadMigration {
+    readonly fromFormat: 2 | 3 | 4;
+    readonly note?: string;
+    readonly receipts: readonly MigrationReceipt[];
+}
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
  * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
- * 单一路径时这是唯一的一道)/prompts 面复判失败。
- * `migrated`:读回时做过一次性迁移({@link migrateV2Lkg})—— 调用方响亮打一行。
+ * 单一路径时这是唯一的一道)/载荷有迁不动的旧形({@link migrateLkgPayload})/prompts 面复判失败。
+ * `migrated`:读回时做过一次性迁移(信封 2 → 3 或载荷的 settings-schema 迁移)—— 调用方响亮打一行,并把交回的 4 写回原位。
  */
 export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
-    migrated?: string;
+    migrated?: LkgReadMigration;
 } | {
     lkg?: undefined;
     reason: string;
 }>;
+/**
+ * LKG 载荷(一份冻结的 effective)→ settings-schema 11 的形:调契约的 `migrateEffectiveSnapshot`(本仓不写任何一条改写规则;只认形、幂等,
+ * `version` / `updatedAt` 与其余信封键原样)。有收据 `refused`(迁不动 —— 例:同一份文档里 `atModelAllowlist` 与 `atMention` 并存、
+ * `runtime` 文档读不进)⇒ 交回拒因(**点名迁移 id 与契约的拒句**,不带值),调用方不读回这份 LKG:本仓应用 LKG 不经契约读腿,迁不动的旧形
+ * 留在载荷里就会被下游当作缺席静默略过(例:`atModelAllowlist` 不再有读者 = 限制被静默放宽)。
+ */
+export declare function migrateLkgPayload(effective: Record<string, unknown>): {
+    effective: Record<string, unknown>;
+    receipts: readonly MigrationReceipt[];
+} | {
+    refused: string;
+};
 /** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
 export declare function legacyV1LkgPath(config: {
     readonly agentConfigDir?: string;
@@ -84,7 +104,7 @@ export type LegacyLkgMigration = {
  *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
  *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
  *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
- *     对得上、载荷过 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
+ *     对得上、载荷过 {@link migrateLkgPayload}(迁成 11 的形;迁不动 ⇒ 响亮拒、不写箱)与 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
  *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
  *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
  *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本

package/dist/config-lkg.js

@@ -1,4 +1,6 @@
 import { promises as fs } from "node:fs";
+import { migrateEffectiveSnapshot } from "@sema-agent/settings-schema/one-time-migrations";
+import { formatConfigPath } from "@sema-agent/settings-schema";
 import { join, dirname, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { validatePromptsDomain } from "./prompts-domain-validate.js";
@@ -25,7 +27,7 @@ export function lkgReadDenyRows(configLkgPath) {
     return [{ pattern: configLkgPath, caseSensitive: false }];
 }
 export async function saveLkg(path, worker, identity, effective, etag) {
-    const body = { formatVersion: 3, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
+    const body = { formatVersion: 4, savedAt: new Date().toISOString(), worker: worker ?? "global", identity, ...(etag !== undefined ? { etag } : {}), effective };
     const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
     await fs.mkdir(dirname(path), { recursive: true });
     await fs.writeFile(tmp, JSON.stringify(body), { mode: 0o600 });
@@ -52,16 +54,44 @@ export async function loadLkg(path, worker, identity) {
     const formatVersion = p.formatVersion;
     if (formatVersion === 1)
         return { reason: "pre-identity LKG (formatVersion 1) — not read back: it cannot prove whose credential fetched it (S-651); the next clean candidate rewrites it" };
-    if (formatVersion !== 2 && formatVersion !== 3)
+    if (formatVersion !== 2 && formatVersion !== 3 && formatVersion !== 4)
         return { reason: `unknown formatVersion ${String(formatVersion)}` };
     if (typeof p.worker !== "string" || p.worker !== (worker ?? "global"))
         return { reason: `worker mismatch (file=${String(p.worker)})` };
     if (typeof p.identity !== "string" || p.identity !== identity)
         return { reason: "credential identity mismatch (the LKG was fetched under another credential identity — not read back)" };
-    const problem = lkgPayloadProblem(p.effective, p.etag);
+    if (p.effective === null || typeof p.effective !== "object" || Array.isArray(p.effective))
+        return { reason: "bad effective" };
+    let envelope = p;
+    let note;
+    if (formatVersion === 2) {
+        const v2 = migrateV2Lkg(envelope);
+        if (v2.lkg === undefined)
+            return v2;
+        envelope = v2.lkg;
+        note = v2.migrated;
+    }
+    const payload = migrateLkgPayload(envelope.effective);
+    if ("refused" in payload)
+        return { reason: payload.refused };
+    const problem = lkgPayloadProblem(payload.effective, envelope.etag);
     if (problem !== undefined)
         return { reason: problem };
-    return formatVersion === 2 ? migrateV2Lkg(p) : { lkg: p };
+    const lkg = { ...envelope, formatVersion: 4, effective: payload.effective };
+    const migrated = formatVersion !== 4 || payload.receipts.length > 0;
+    return migrated ? { lkg, migrated: { fromFormat: formatVersion, ...(note !== undefined ? { note } : {}), receipts: payload.receipts } } : { lkg };
+}
+export function migrateLkgPayload(effective) {
+    const m = migrateEffectiveSnapshot(effective);
+    const refused = m.receipts.filter((r) => r.appliedAs === "refused");
+    if (refused.length > 0) {
+        return {
+            refused: "settings-schema one-time migration refused part of this LKG's payload (" +
+                refused.map((r) => `${r.migration} ${r.document}:${formatConfigPath(r.path)} — ${r.reason}`).join("; ") +
+                ") — not read back: the engine applies an LKG without the contract's reader, so a form the migration cannot rewrite would be silently skipped; the next clean candidate rewrites it",
+        };
+    }
+    return { effective: m.effective, receipts: m.receipts };
 }
 const RETIRED_CATALOG_COORDINATE = /^models\.(0|[1-9][0-9]*)$/;
 function migrateDroppedIdentityRow(row) {
@@ -87,7 +117,7 @@ function migrateV2Lkg(lkg) {
         effective = { ...lkg.effective, models: { ...rest, droppedCatalogEntries: Array.isArray(retired) ? retired.map(migrateDroppedIdentityRow) : retired } };
     }
     return {
-        lkg: { ...envelope, formatVersion: 3, effective },
+        lkg: { ...envelope, effective },
         migrated: "formatVersion 2 → 3 (one-time): this LKG was written before every dropped catalog entry was recorded, so its etag is not reused — the next pull re-reads the whole candidate and re-mints the full record" +
             (hasRetired ? "; the retired carrier models.droppedIdentities was moved to models.droppedCatalogEntries" : ""),
     };
@@ -100,7 +130,7 @@ function lkgPayloadProblem(effective, etag) {
     const eff = effective;
     if (typeof eff.version !== "number")
         return "bad effective.version";
-    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["runtime", null]]) {
+    for (const [domain, arrayKey] of [["models", "models"], ["skills", "skills"], ["mcp", "servers"], ["scenarios", "scenarios"], ["limits", null]]) {
         const v = eff[domain];
         if (v === undefined)
             continue;
@@ -112,12 +142,6 @@ function lkgPayloadProblem(effective, etag) {
                 return `bad effective.${domain}.${arrayKey}`;
         }
     }
-    {
-        const rt = eff.runtime;
-        if (rt && (rt.autonomy !== undefined || rt.commandPolicy !== undefined || rt.approvalRequire !== undefined)) {
-            return "legacy runtime governance keys (pre-0.7.1 mirror shape; no contract producer since LKG shipped) — refusing rather than silently dropping governance";
-        }
-    }
     const promptsRaw = eff.prompts;
     if (promptsRaw !== undefined && !validatePromptsDomain(promptsRaw).ok)
         return "prompts face fails re-validation";
@@ -168,7 +192,12 @@ export async function migrateV1Lkg(o) {
     if (o.identity !== pullTokenIdentity(o.worker)) {
         return refuse("its envelope records only the worker, and only a pull-token credential's identity (= the worker) can be derived from that — the current credential is not this worker's pull token, so the file cannot prove whose credential fetched it");
     }
-    const problem = lkgPayloadProblem(v1.effective, v1.etag);
+    if (v1.effective === null || typeof v1.effective !== "object" || Array.isArray(v1.effective))
+        return refuse("its payload is unusable (bad effective)");
+    const payload = migrateLkgPayload(v1.effective);
+    if ("refused" in payload)
+        return refuse(`its payload cannot be migrated to the current settings form (${payload.refused})`);
+    const problem = lkgPayloadProblem(payload.effective, v1.etag);
     if (problem !== undefined)
         return refuse(`its payload is unusable (${problem})`);
     const retiredTo = `${o.legacyPath}.migrated-v1`;
@@ -182,7 +211,7 @@ export async function migrateV1Lkg(o) {
         }
     }
     try {
-        await saveLkg(o.binPath, o.worker, o.identity, v1.effective, undefined);
+        await saveLkg(o.binPath, o.worker, o.identity, payload.effective, undefined);
     }
     catch (err) {
         return refuse(`writing it into this credential identity's bin failed (${String(err)}) — the old file is left in place and the migration retries on the next LKG read`);

package/dist/config-provider.d.ts

@@ -1,10 +1,10 @@
-import { type DroppedConfigEntry } from "./config-center/read-warnings.js";
+import { type DroppedConfigEntry } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
 import { type EffectiveConfig as AgentConfigEffective, type EffectiveReadWarning } from "@sema-agent/settings-schema";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./config-center/facade.js";
-import type { CenterEndpoint } from "./config-center/center-request.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, type EffectiveConfig } from "./web-admin-client/facade.js";
+import type { CenterEndpoint } from "./web-admin-client/center-request.js";
 import type { ConfigProviderWord } from "./config-types.js";
-/** Result of a `fetchEffective` — EXACTLY the config-center's return: the effective config + its etag, or
+/** Result of a `fetchEffective` — EXACTLY the web-admin's return: the effective config + its etag, or
  *  `null` for "unchanged" (remote 304; local: the version matched the caller's prior etag).
  *  `domainErrors`([ref] registry-core 0.10.12 tolerant seam,local lane only):catalog 域坏文件不再
  *  连坐全包回落 env——坏域按该域 schema default 落+错误单列,好域照常生效;caller(main.ts)对每条打
@@ -13,10 +13,8 @@ import type { ConfigProviderWord } from "./config-types.js";
 /** 壳写在 `config.d/models.json` 条目上的装饰键(`sema*`)自 settings-schema 1.5.0 起是**声明过的扩展命名空间**
  *  (`EXTENSION_NAMESPACES`):schema 照旧 strip、但不再报「未知键」,所以本函数收到的每一个未知键都是拼错/越界 ⇒ 候选门错误。
  *  此前把这类键当「通知」放行的整套下游机制(域豁免/键路径闭集/满额特判/单独的通知面)已全部撤回——意图在声明处说,消费方不猜。 */
-/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义。折叠是有损的——
- *  `hosts-grandfathered` / `legacy-governance-lifted` 按律折成 `null`,只看 `domainErrors` 的人永远看不见
- *  兼容臂还开着,而契约铸出 `legacy-governance-lifted` 的理由正是「关窗的前提是有人知道它还开着」
- *  (`legacyGovernanceFromRuntime` SUNSET 注)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
+/** `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),两条读腿同键同义 —— 读者是一致性门的读腿适配器(它要逐条对契约语料的
+ *  告警多重集,折叠后的诊断面带不回 `kind` / 坐标段)。恒在场(空数组 = 这次读零告警),不用缺席表达「没有」
  *  ——缺席/空两形并存就是又一处二义。
  *  🔐 原流的 `error` 未经 {@link redactConfigError}(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上),
  *  路由进日志/审计流的消费者必须自己先脱敏。 */
@@ -52,6 +50,12 @@ export type FetchEffectiveResult = {
  * 不回声值(上游 settings-schema)。
  */
 export declare function redactConfigError(text: string): string;
+/**
+ * 一个配置值的单向短指纹(`#` + 8 位十六进制;HMAC 的钥匙每进程一把 —— 只在同一条日志流里可对照,不是一份可查字典的摘要)。
+ * 句子由契约从**结构化操作数**铸的地方(settings-schema 11 的 `renderRefIssue(issue, show)`)把它当 `show` 传进去:值逐个换成指纹,
+ * 句子的固定词与坐标原样 —— 不需要 {@link redactConfigError} 那种从引号猜值边界的读法。
+ */
+export declare function fingerprintConfigOperand(operand: string): string;
 /** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
  *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export declare const BOOT_FETCH_DEFERRED: unique symbol;
@@ -71,7 +75,7 @@ export declare function raceBootFetch<T>(fetch: Promise<T>, budgetMs: number): P
  * et al. (main.ts does not swap on this seam yet — see the NOT-YET-WIRED note at the top of this module).
  */
 export interface ConfigProvider {
-    /** "remote" = config-center HTTP; "local" = on-disk FileConfigStore. */
+    /** "remote" = web-admin HTTP; "local" = on-disk FileConfigStore. */
     readonly kind: "remote" | "local";
     /**
      * Pull the effective config. `etag` is the caller's last-seen version token (`if-none-match` on remote;
@@ -90,10 +94,10 @@ export interface ConfigProvider {
 /** The config-provider knobs read off ServiceConfig (a structural subset — avoids importing the whole
  *  ServiceConfig type and keeps this module testable with a plain object). */
 export interface ConfigProviderInput {
-    /** Set when SEMA_REGISTRY_URL (legacy CONFIG_CENTER_URL now boot-rejects, no dual-read) is configured (config.ts `configCenter`). `dryRun` is carried through so a
+    /** Set when SEMA_WEB_ADMIN_URL is configured (config.ts `webAdmin`). `dryRun` is carried through so a
      *  remote↔local swap via this seam does NOT drop the dry-run posture main.ts branches on (config.ts
-     *  `configCenter.dryRun`); the provider itself does not consume it (the caller still branches on it). */
-    configCenter?: CenterEndpoint & {
+     *  `webAdmin.dryRun`); the provider itself does not consume it (the caller still branches on it). */
+    webAdmin?: CenterEndpoint & {
         worker?: string;
         dryRun?: boolean;
     };
@@ -108,10 +112,10 @@ export interface ConfigProviderInput {
     localDir: string;
 }
 /**
- * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
+ * RemoteConfigProvider — DELEGATES to the exported web-admin HTTP functions. No HTTP is reimplemented;
  * the center endpoint (baseUrl + credential SOURCE — S-651: read per request, never a bound token) and worker
  * are passed through. The two delegate fns are injectable (defaulting
- * to the real config-center exports) so a unit test can assert delegation without module-mocking.
+ * to the real web-admin exports) so a unit test can assert delegation without module-mocking.
  */
 export declare class RemoteConfigProvider implements ConfigProvider {
     private readonly cc;
@@ -156,7 +160,7 @@ export declare class LocalConfigProvider implements ConfigProvider {
 export declare function mapToServiceEffective(eff: AgentConfigEffective, version: number): EffectiveConfig;
 /**
  * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
+ * `CONFIG_PROVIDER=local`, OR when no web-admin URL is configured (a lone box with config.d/ on disk
  * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
  * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
  * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
@@ -168,7 +172,7 @@ export declare function mapToServiceEffective(eff: AgentConfigEffective, version
 export declare function createConfigProvider(input: ConfigProviderInput): ConfigProvider;
 /**
  * S-841 —— **本地配置根的唯一来源**:`CONFIG_LOCAL_DIR` → `AGENT_DATA_DIR` → `~/.ai-agent`。两个入口(HTTP 服务的第 1 段、
- * run-local)各调一次,算出来的那一个值同时交给 config-center 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
+ * run-local)各调一次,算出来的那一个值同时交给 web-admin 工厂(`createConfigProvider` 的 `localDir`)与执行车道合成步
  * (`composeExecutionLane` 的 `localRoot`)—— 修前两个入口各写一份这条链(run-local 还多一个与之等价的三元),工厂又在
  * 字面 `"local"` 之外回落 `process.cwd()`。
  *
@@ -185,14 +189,14 @@ export declare function configLocalRoot(config: {
  */
 export declare function configProviderKind(input: {
     readonly provider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote";
 /**
- * HTTP 服务这一侧的配置源:config-center 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
+ * HTTP 服务这一侧的配置源:web-admin 工厂**建不建** provider(`CONFIG_PROVIDER=local` 或配了中心才建)、建出来是哪一种。
  * `undefined` = 纯 env 部署(没有配置源)。工厂与执行车道合成步读这同一只(车PI 修复轮 ①:合成步排在工厂之前)。
  */
 export declare function serviceConfigSourceKind(config: {
     readonly configProvider?: ConfigProviderWord | undefined;
-    readonly configCenter?: unknown;
+    readonly webAdmin?: unknown;
 }): "local" | "remote" | undefined;
 //# sourceMappingURL=config-provider.d.ts.map

package/dist/config-provider.js

@@ -1,10 +1,10 @@
 import { readMcpSourceLabel } from "./mcp-source-label.js";
 import { createHmac, randomBytes } from "node:crypto";
-import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./config-center/read-warnings.js";
+import { splitFoldedReadWarnings, withDroppedCatalogEntries } from "./web-admin-client/read-warnings.js";
 import { FileConfigStore } from "@sema-agent/settings-schema/node";
-import { findSkillContent, skillContentHash, refIntegrityIssues, createSiblingResolver, formatConfigPath, REF_CHECKED_DOMAINS, } from "@sema-agent/settings-schema";
+import { danglingRefs, findSkillContent, renderRefIssue, skillContentHash, } from "@sema-agent/settings-schema";
 import { redactSecrets } from "./trace/redact.js";
-import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
+import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, WebAdminHttpError, } from "./web-admin-client/facade.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
@@ -14,12 +14,16 @@ export function redactConfigError(text) {
     if (first === -1)
         return s;
     const count = (q) => s.split(q).length - 1;
-    const fingerprint = (operand) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}"`;
+    const fingerprint = (operand) => `"${fingerprintConfigOperand(operand)}"`;
     if (count('"') % 2 === 1 || count("'") % 2 === 1)
         return `${s.slice(0, first)}${fingerprint(s.slice(first + 1))}`;
     const last = Math.max(s.lastIndexOf('"'), s.lastIndexOf("'"));
     return `${s.slice(0, first)}${fingerprint(s.slice(first + 1, last))}${s.slice(last + 1)}`;
 }
+export function fingerprintConfigOperand(operand) {
+    return `#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(operand).digest("hex").slice(0, 8)}`;
+}
+const redactDroppedEntry = (d) => ({ ...d, error: redactSecrets(d.error) });
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
@@ -47,7 +51,7 @@ export class RemoteConfigProvider {
         return {
             ...r,
             ...(r.domainErrors !== undefined ? { domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) } : {}),
-            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) })) } : {}),
+            ...(r.droppedEntries !== undefined ? { droppedEntries: r.droppedEntries.map(redactDroppedEntry) } : {}),
         };
     }
     async fetchSkillContent(contentHash) {
@@ -56,7 +60,7 @@ export class RemoteConfigProvider {
             return await fn(this.cc, contentHash);
         }
         catch (err) {
-            if (err instanceof ConfigCenterHttpError && err.status === 404)
+            if (err instanceof WebAdminHttpError && err.status === 404)
                 return undefined;
             throw err;
         }
@@ -85,15 +89,17 @@ export class LocalConfigProvider {
         if (etag !== undefined && etag === tag)
             return null;
         const refErrors = [];
-        const resolve = createSiblingResolver(store, eff);
-        for (const d of REF_CHECKED_DOMAINS) {
-            const issues = await refIntegrityIssues(d, eff[d], resolve);
-            if (issues.length > 0)
-                refErrors.push({ domain: d, error: issues.map((i) => `${formatConfigPath(i.path)}: ${redactConfigError(i.message)}`).join("; ") });
+        const byReferrer = new Map();
+        for (const issue of danglingRefs(eff)) {
+            const rows = byReferrer.get(issue.referrer.domain) ?? [];
+            rows.push(renderRefIssue(issue, fingerprintConfigOperand));
+            byReferrer.set(issue.referrer.domain, rows);
         }
+        for (const [domain, rows] of byReferrer)
+            refErrors.push({ domain, error: rows.join("; ") });
         const folded = splitFoldedReadWarnings(readWarnings);
         const parseErrors = folded.domainErrors.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
-        const droppedEntries = folded.droppedEntries.map((d) => ({ ...d, error: redactConfigError(d.error) }));
+        const droppedEntries = folded.droppedEntries.map(redactDroppedEntry);
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return {
             effective: withDroppedCatalogEntries(mapToServiceEffective(eff, eff.version), folded.droppedCatalogEntries),
@@ -139,8 +145,7 @@ export function mapToServiceEffective(eff, version) {
                 enabled: m.enabled,
             })),
             roles: eff.models.roles ?? {},
-            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
-            ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
+            atMention: eff.models.atMention,
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },
@@ -199,13 +204,6 @@ export function mapToServiceEffective(eff, version) {
                 enabled: sc.enabled,
             })),
         },
-        runtime: {
-            ...(eff.runtime.rateLimitPerMin !== undefined ? { rateLimitPerMin: eff.runtime.rateLimitPerMin } : {}),
-            ...(eff.runtime.maxTaskCostUsd !== undefined ? { maxTaskCostUsd: eff.runtime.maxTaskCostUsd } : {}),
-            ...(eff.runtime.maxTaskTokens !== undefined ? { maxTaskTokens: eff.runtime.maxTaskTokens } : {}),
-            ...(eff.runtime.maxPrincipalCostUsd !== undefined ? { maxPrincipalCostUsd: eff.runtime.maxPrincipalCostUsd } : {}),
-            ...(eff.runtime.costQuotaWindowSec !== undefined ? { costQuotaWindowSec: eff.runtime.costQuotaWindowSec } : {}),
-        },
         ...(eff.limits !== undefined ? { limits: eff.limits } : {}),
         governance: {
             ...(eff.governance.autonomy !== undefined ? { autonomy: eff.governance.autonomy } : {}),
@@ -215,21 +213,21 @@ export function mapToServiceEffective(eff, version) {
     };
 }
 export function createConfigProvider(input) {
-    return configProviderKind(input) === "remote" && input.configCenter !== undefined
-        ? new RemoteConfigProvider(input.configCenter)
+    return configProviderKind(input) === "remote" && input.webAdmin !== undefined
+        ? new RemoteConfigProvider(input.webAdmin)
         : new LocalConfigProvider(input.localDir);
 }
 export function configLocalRoot(config) {
     return config.configLocalDir ?? process.env.AGENT_DATA_DIR ?? join(homedir(), ".ai-agent");
 }
 export function configProviderKind(input) {
-    if (input.provider === "local" || input.configCenter === undefined)
+    if (input.provider === "local" || input.webAdmin === undefined)
         return "local";
     return "remote";
 }
 export function serviceConfigSourceKind(config) {
-    if (config.configCenter === undefined && config.configProvider !== "local")
+    if (config.webAdmin === undefined && config.configProvider !== "local")
         return undefined;
-    return configProviderKind({ provider: config.configProvider, configCenter: config.configCenter });
+    return configProviderKind({ provider: config.configProvider, webAdmin: config.webAdmin });
 }
 //# sourceMappingURL=config-provider.js.map