@sema-agent/server 7.128.0 → 7.129.0

package/dist/task-settings.d.ts

@@ -50,6 +50,7 @@
 import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import { type KeyClosureIssue } from "./request-key-closure.js";
+import { type EntryPermissionMode } from "./runtime-governance.js";
 /**
  * 请求面 `permissionMode` 的闭集 = core `PERMISSION_MODES` **全集**(顶层 `permissionMode` / `settings.permissions.defaultMode` /
  * `?permissionMode=` 查询串三处同读)。本仓不持有第二份词表,也不持有「收 / 不收」的表态:判据 = core 的 `isPermissionMode`,型 = core 的
@@ -111,6 +112,7 @@ export declare function planReviewDecisionExitsPlan(decision: "approve" | "edit"
  * 入口词 = `runtime-governance.ts` `entryPermissionMode(体的生效词, 地板).effective`(「词在地板下变成什么」的唯一一只函数;秩是 core 的)。本函数只加
  * 「写进体」这一半:地板缺席 ⇒ 体**原物**交回(零字节变化);地板在场 ⇒ 新体 `{ ...body, permissionMode: 入口词 }`,调用方的对象不改;bundle 的
  * `settings.permissions.defaultMode` 不动 —— 顶层赢过它({@link effectivePermissionMode} 的优先序),再改它就是同一语义的第二个写者。
+ * 同时交回**这一次求值的读数**(`entry`:请求词 / 地板 / 生效词 / 折没折)—— 披露这一折的通告(`entry-mode-clamp-notice.ts`)读它,不另判一遍。
  *
  * 调用点一个:提交入口(`http/admission.ts` 的 `prepareSpec`:值形门全部判完之后、`resolveSpec` 之前)。那一份体就是首跑装配读的体,也是
  * `buildCheckpointCtx` 持久化的体 ⇒ 一处盖章同时覆盖首跑与每一次续跑重建;装配腿与续跑腿都不读地板(两处读 = 两个源)。
@@ -120,7 +122,10 @@ export declare function planReviewDecisionExitsPlan(decision: "approve" | "edit"
 export declare function stampEntryPermissionMode<B extends {
     permissionMode?: unknown;
     settings?: unknown;
-}>(body: B, floor: PermissionMode | undefined): B;
+}>(body: B, floor: PermissionMode | undefined): {
+    readonly body: B;
+    readonly entry: EntryPermissionMode;
+};
 /**
  * S-433 —— **一条已持久化的提交体的生效 permission mode**,单点。
  *

package/dist/task-settings.js

@@ -35,7 +35,7 @@ export function planReviewDecisionExitsPlan(decision) {
 }
 export function stampEntryPermissionMode(body, floor) {
     const entry = entryPermissionMode(storedBodyPermissionMode(body), floor);
-    return entry.floor === undefined ? body : { ...body, permissionMode: entry.effective };
+    return { body: entry.floor === undefined ? body : { ...body, permissionMode: entry.effective }, entry };
 }
 export function storedBodyPermissionMode(body) {
     return effectivePermissionMode(body, parseTaskSettings(body.settings).settings);

package/dist/tool-approval.d.ts

@@ -58,7 +58,7 @@
 import { type ParkedGateFace } from "./approval-content-kind.js";
 import { type ApprovalDecidedBy, type HostSettledBy, type RetiredDecisionKeyFacts } from "./host-decision.js";
 import type { IncomingMessage } from "node:http";
-import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundSkillGrants, type ToolApprovalCard } from "@sema-agent/core";
+import { type AskClass, type AskRequest, type AskOutcome, type PermissionResult, type CheckpointGate, type PendingAction, type PersistedRuleMandate, type ReadRootGrantCandidate, type RuleOffer, type AutoModeFallbackCause, type BoundGrantAbsence, type BoundSkillGrants, type ToolApprovalCard } from "@sema-agent/core";
 import { type CardRulePersisted, type RuleConsentLane } from "./rules-consent.js";
 import { type AllowRuleShadowProjection, type DenialLimitFallback, type RuleOffersAbsence, type ApprovalRequestFrame, type ApprovalRevokeFrame, type RuleEvidenceProjection } from "./approval-card.js";
 import { type ApprovalAskStore, type AskRow } from "./plugins/approval-ask-store-sql.js";
@@ -67,7 +67,7 @@ import { type AskRowEndingCause, type SettleCause, type SettleOutcome } from "./
 import type { ParkCommitWatch } from "./plugins/park-commit-watch.js";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernancePosture } from "./runtime-governance.js";
-import { type GrantBinding, type StandingAnswerGrantCarrier } from "./standing-answer-grant.js";
+import { type GrantBinding, type StandingAnswerCall } from "./standing-answer-grant.js";
 import { type ApprovalExemptionStore } from "./plugins/approval-exemption-store.js";
 /** [ref]:审批 gate kind 闭集(core gateMatch 的 `human`/`irreversible_ask` ↔ outcome.gate "policy_ask")。
  *  此前 7 份手写副本散在两只 checkpoint store 的数组/SQL 字面与 /decide 守卫——core 加审批味 kind 时
@@ -192,9 +192,10 @@ export declare function carriesDeploymentListQuestion(deploymentListAsks: boolea
  * (`task-settings.ts`,`false`)—— 它们在交出这一问之前先读按工具名记的耐久豁免店(「本会话不再询问」在本层兑现,继承链上的同一问才够得着;审批席依约不退役
  * 继承问),而**能不能读**与审批席 / 回决写侧是同一只判据({@link standingAnswerDurablyRecordable}):记得下的才代答,记不下的(带授予绑定的问 ……)不代答,
  * 存量行也不例外 —— 一事一读。事实取自**这一问本身**:类集经 core 包根唯一的类派生 `classifyAsk`({@link NO_GATE_FACTS});`requiresRealApproval` /
- * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读调用(`grantBindingOf`)。
+ * `mandated` 读这一问自报的成员;治理位恒假(本层不是治理层);授予绑定读**调用**(`callGrantBindingOf` —— 本层手里还没有引擎铸的卡,core 7.51.0 不在
+ * `ToolCallRequest` 上盖绑定词,S-1493 载体问题见 `standing-answer-grant.ts` 头注)。
  */
-export declare function policyAskStandingAnswerFacts(req: StandingAnswerGrantCarrier, ask: Extract<PermissionResult, {
+export declare function policyAskStandingAnswerFacts(req: StandingAnswerCall, ask: Extract<PermissionResult, {
     action: "ask";
 }>, deploymentListQuestion: boolean): StandingAnswerFacts;
 /**
@@ -216,7 +217,8 @@ export interface StandingAnswerFacts {
     readonly mandated: boolean;
     /** 这一问的应答**授不授予**这一次调用之外的东西、授予的话绑定是什么(批准引擎的 `Skill` = 激活技能 + 本 run 内清单免问)。
      *  `bound` ⇒ 站着的答案按「工具 + 绑定」记、只代答绑定相同的问(core 7.43.0 #1348 / #1357:活的问与停驻行同带 `boundGrantDigest`);
-     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 的 `grantBindingOf`(唯一读口)折这一位。 */
+     *  `unreadable` ⇒ 不可记、不被代答(fail-closed)。读者一律经 `standing-answer-grant.ts` 折这一位:载体由问的属主定(`questionGrantBindingOf`)——
+     *  引擎铸的问读卡上引擎的词(`grantBindingOf`),部署名单自己的问与策略层的调用读 `callGrantBindingOf`(S-1493)。 */
     readonly grantBinding: GrantBinding;
     /** 引擎盖在这一问上的**类集**(`AskRequest.classes` / 停驻行孪生座;经 core 的屏 `screenAskClassMembers` 读)。`undefined` = 卡上没有类
      *  (老引擎 / 不盖类的站)或屏拒 —— 读不出的类不是「无类」。 */
@@ -275,7 +277,7 @@ export declare function standingAnswerHome(facts: StandingAnswerFacts): Standing
  * `seat` 还得没有授予绑定 —— 耐久店按 `(会话, 工具名)` 记,没有绑定这一维,记下一张带绑定的答案就会代答同名工具的每一种绑定
  * (`plugins/approval-exemption-store.ts`);`none` 记不住。读者:耐久 `/decide` 腿的 remember 可记性(`http/resume-legs.ts`)与运维队列行的
  * `rememberRefused`(`http/routes/approvals-assistant.ts`)—— 两处同答;策略层的豁免读面(部署名单门、workflow 问句门)经本函数 + {@link policyAskStandingAnswerFacts}
- * 决定读不读店。读侧同理:耐久店不代答带绑定的问(`standingGrantSettles` 经 `answerGrantsBeyondCall`)。
+ * 决定读不读店。读侧同理:耐久店不代答带绑定的问(`standingGrantSettles` 读这一问的 `grantBinding`,不是 `none` 就不读店)。
  */
 export declare function standingAnswerDurablyRecordable(facts: StandingAnswerFacts): boolean;
 /**
@@ -306,7 +308,7 @@ export declare function standingAnswerDurablyRecordable(facts: StandingAnswerFac
  *    (`SENSITIVE_WRITE_PATTERNS`)、`commandPolicy`、`AUTONOMY` 内层策略产的门与 shellGate `classify` 档,park 行上没有取证格
  *    (live 腿靠进程内标记表,跨副本 / 重启后够不着),本折法读不到它们的治理出身。
  */
-export declare function parkRowStandingAnswerFacts(pending: Extract<PendingAction, {
+export declare function parkRowStandingAnswerFacts(stored: Extract<PendingAction, {
     kind: "tool_approval";
 }>, gate: CheckpointGate, governance: GovernancePosture | undefined, 
 /** 部署名单门对这一行的调用出不出它自己的问(`approval.ts` 的 `deploymentListAsks`,调用方现读活配置;停驻行上只有 wire 名)。 */
@@ -467,6 +469,11 @@ export interface ToolApprovalFrame {
     /** 上一位哈希的那一份值:`{ skill, allowedTools, disallowedTools }`(`skill: null` = 调用没点名任何已载技能)。与摘要同在同缺;**部署文本**,
      *  壳按上下文转义渲染(core:display metadata)。逐字过境。 */
     boundGrants?: BoundSkillGrants;
+    /** S-1493(core 7.51.0 #1688,**ADDITIVE**,`"tool_approval"` only):这张卡为什么没有 {@link boundGrantDigest} —— 引擎铸的每张卡恰带两者之一:
+     *  `not_bindable`(这一问不是引擎 `Skill` 工具的激活,不绑任何授予 ⇒ 应答可按工具记)/ `unreadable`(绑着却读不出;活卡上引擎恒给摘要,这一词
+     *  只出现在读存量行的面上)。闭集经 `readClosedWordSeat(req, "boundGrantAbsence")` 窄读(筛 = core `BOUND_GRANT_ABSENCES`),集外 ⇒ 缺席 + 计一次。
+     *  与停驻行 / 运维队列行 / inbox 行的同名位同值;站着的答案的授予绑定(引擎铸的问那一家;部署名单自己的问读调用口)读它(`standing-answer-grant.ts` `grantBindingOf`)。display。 */
+    boundGrantAbsence?: BoundGrantAbsence;
     /** core 7.43.0 #1353:分类器没给判词的成因词(`error` / `timeout` / `parse_error`;只在类 `classifier_no_ruling` 的卡上)。闭集经 core 的
      *  `readClosedWordSeat(req, "classifierNoRuling")` 窄读(筛 = core `isAutoModeFallbackCause`),集外 ⇒ 缺席 + 计一次。display:本仓不按它裁决。 */
     classifierNoRuling?: AutoModeFallbackCause;

package/dist/tool-approval.js

@@ -9,13 +9,13 @@ import { approvalPayloadFingerprint } from "./plugins/approval-payload-fingerpri
 import { createLogger } from "./observability/logger.js";
 import { recordFailOpen } from "./observability/fail-open.js";
 import { deriveAskId, deriveAskScopedBatchId, deriveBatchId, MAX_DECISION_NOTE_CHARS } from "./approval-ask-machine.js";
-import { ApprovalCardEnvelopeSchema, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
+import { currentParkArm, MAX_RULE_OFFERS, buildApprovalCard, buildApprovalCardEnvelope, buildApprovalRequestFrame, buildRevokeFrame, readDenialLimitFallback, readProbeCause, readProbeReason, readReadRootCandidate, readStoredCardEnvelope, readRuleEvidence, readAllowRuleShadowed, readRuleOffersAbsence, readRuleOffersAbsenceSeat, readParkRowTrueSeat, readAskClassPair, readClosedWordSeat, RuleOfferRawSchema, backfillLegacyBatchMemberKind, screenUncoveredDetailSeat, } from "./approval-card.js";
 import { POLICY_REFUSAL_DECISION, projectAskTerminalClaimTruth } from "./plugins/approval-ask-store-sql.js";
 import { APPROVAL_ENDING_CAUSES, SETTLE_OUTCOME, causeOfAskRow } from "./approval-deny-reasons.js";
 import { settleByPolicy } from "./approval-policy-settlement.js";
 import { governanceAskMarksFor, runWithGovernanceAskScope } from "./governance-ask-marks.js";
 import { governanceOriginOf } from "./runtime-governance.js";
-import { answerGrantsBeyondCall, grantBindingOf } from "./standing-answer-grant.js";
+import { callGrantBindingOf, questionGrantBindingOf } from "./standing-answer-grant.js";
 import { operatorAsk } from "./operator-ask.js";
 import { APPROVAL_EXEMPTED_EVENT } from "./plugins/approval-exemption-store.js";
 const defaultLogger = createLogger();
@@ -99,13 +99,14 @@ function sessionAllowKey(owner, sessionId, category, binding) {
 }
 function askStandingAnswerFacts(req, governanceForced, deploymentListAsks) {
     const classes = screenAskClassMembers(req.askClass, req.classes)?.classes;
+    const deploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, classes);
     return {
         governanceForced,
         requiresRealApproval: req.requiresRealApproval === true,
         mandated: req.mandated === true,
-        grantBinding: grantBindingOf(req),
+        grantBinding: questionGrantBindingOf(req, deploymentListQuestion),
         classes,
-        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
+        deploymentListQuestion,
     };
 }
 const NO_GATE_FACTS = { contentQuestion: false, markedUnresolvable: false, org: undefined, tightened: undefined, mandateMarks: {} };
@@ -118,7 +119,7 @@ export function policyAskStandingAnswerFacts(req, ask, deploymentListQuestion) {
         governanceForced: false,
         requiresRealApproval: ask.requiresRealApproval === true,
         mandated: ask.mandated === true,
-        grantBinding: grantBindingOf(req),
+        grantBinding: callGrantBindingOf(req),
         classes: [...classifyAsk(ask, NO_GATE_FACTS).classes],
         deploymentListQuestion,
     };
@@ -146,16 +147,18 @@ export function standingAnswerDurablyRecordable(facts) {
         }
     }
 }
-export function parkRowStandingAnswerFacts(pending, gate, governance, deploymentListAsks) {
+export function parkRowStandingAnswerFacts(stored, gate, governance, deploymentListAsks) {
     const riskDescriptor = "riskDescriptor" in gate ? gate.riskDescriptor : undefined;
+    const pending = currentParkArm(stored);
     const classes = screenAskClassMembers(pending.askClass, pending.classes)?.classes;
+    const deploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, classes);
     return {
         governanceForced: governanceOriginOf({ riskDescriptor }, governance) === true,
         requiresRealApproval: readParkRowTrueSeat(pending, "requiresRealApproval"),
         mandated: readParkRowTrueSeat(pending, "mandated") || mandatedFromSeat(readRuleOffersAbsenceSeat(pending)),
-        grantBinding: grantBindingOf(pending),
+        grantBinding: questionGrantBindingOf(pending, deploymentListQuestion),
         classes,
-        deploymentListQuestion: carriesDeploymentListQuestion(deploymentListAsks, classes),
+        deploymentListQuestion,
     };
 }
 function pendingEntryStandingAnswerFacts(entry) {
@@ -831,7 +834,7 @@ export class ToolApprovalCoordinator {
         if (!sessionId)
             return false;
         const live = this.allowAllSessions.has(sessionAllowKey(origin.owner, sessionId, sessionAllowCategory(req.toolName), facts.grantBinding));
-        const durable = !live && !answerGrantsBeyondCall(req) && (await this.durableGrantHas(sessionId, req.toolName));
+        const durable = !live && facts.grantBinding.kind === "none" && (await this.durableGrantHas(sessionId, req.toolName));
         if (!live && !durable)
             return false;
         if (!(await this.sessionGrantUncontestedByRow(origin, req)))
@@ -1154,6 +1157,7 @@ export class ToolApprovalCoordinator {
         let ruleLaneMaterial = this.buildRuleLaneMaterial(req, origin.owner, governanceForced, origin.sessionId);
         const mandateWord = readClosedWordSeat(req, "mandate");
         const noRulingCause = readClosedWordSeat(req, "classifierNoRuling");
+        const grantAbsence = readClosedWordSeat(req, "boundGrantAbsence");
         const cardWord = readApprovalCard(req.approvalCard);
         const originWord = typeof req.origin === "string" && req.origin.length > 0 ? req.origin : undefined;
         const askClassPair = readAskClassPair(req);
@@ -1185,6 +1189,7 @@ export class ToolApprovalCoordinator {
             ...(standingAnswerHome(askStandingAnswerFacts(req, governanceForced, deploymentListAsks)) === "none" ? { rememberRefused: true } : {}),
             ...(typeof req.boundGrantDigest === "string" ? { boundGrantDigest: req.boundGrantDigest, ...(req.boundGrants !== undefined ? { boundGrants: req.boundGrants } : {}) } : {}),
             ...(noRulingCause !== undefined ? { classifierNoRuling: noRulingCause } : {}),
+            ...(grantAbsence !== undefined ? { boundGrantAbsence: grantAbsence } : {}),
             ...(cardWord !== undefined ? { approvalCard: cardWord } : {}),
             ...(mandateWord !== undefined ? { mandate: mandateWord } : {}),
             ...(originWord !== undefined ? { origin: originWord } : {}),
@@ -1273,20 +1278,20 @@ export class ToolApprovalCoordinator {
                     releaseAdmission();
                     return replayTerminalRow(existingOrCreated.row);
                 }
-                const persistedEnvelope = ApprovalCardEnvelopeSchema.safeParse(existingOrCreated.row.cardJson);
+                const persistedEnvelope = readStoredCardEnvelope(existingOrCreated.row.cardJson);
                 const maxMintableWindowMs = Math.max(effectiveWindowMs, this.unreachedTtlMs);
                 const sanePersistedDeadline = Number.isFinite(existingOrCreated.row.expiresAtMs) && existingOrCreated.row.expiresAtMs <= Date.now() + maxMintableWindowMs + DURABLE_CALL_TIMEOUT_MS;
-                if (!persistedEnvelope.success || !sanePersistedDeadline) {
-                    this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope.success}, deadlineOk=${sanePersistedDeadline}, ` +
+                if (persistedEnvelope === undefined || !sanePersistedDeadline) {
+                    this.noteStoreError(new Error(`persisted approval row is unusable (envelopeOk=${persistedEnvelope !== undefined}, deadlineOk=${sanePersistedDeadline}, ` +
                         `origin=${existingOrCreated.inserted ? "row-this-call-just-inserted" : "row-hit-idempotently"})`), "ensureAsk(persisted-row-unusable)");
                     releaseAdmission();
                     const unattended = this.unattendedOutcome({ arm: "persisted_row_unusable", taskId: origin.taskId, ...(origin.owner !== null ? { owner: origin.owner } : {}), toolName: req.toolName, reachability });
                     return existingOrCreated.inserted ? this.landUnattendedOutcome(unattended, existingOrCreated.row) : unattended;
                 }
                 persistedExpiresAtMs = existingOrCreated.row.expiresAtMs;
-                wireApprovalId = persistedEnvelope.data.approvalId;
+                wireApprovalId = persistedEnvelope.approvalId;
                 frame.approvalId = wireApprovalId;
-                cardForFrame = persistedEnvelope.data.card;
+                cardForFrame = persistedEnvelope.card;
                 if (cardForFrame.governanceForced === true)
                     frame.governanceForced = true;
                 else
@@ -1726,9 +1731,9 @@ export class ToolApprovalCoordinator {
                 return shapeOutcome(await allowedP);
             }
         }
-        const entryGrantBinding = grantBindingOf(req);
         const entryClasses = askClassPair?.classes;
         const entryDeploymentListQuestion = carriesDeploymentListQuestion(deploymentListAsks, entryClasses);
+        const entryGrantBinding = questionGrantBindingOf(req, entryDeploymentListQuestion);
         const rememberRefused = standingAnswerHome(pendingEntryStandingAnswerFacts({
             ...(effectiveGovernanceForced ? { governanceForced: true } : {}),
             ...(req.requiresRealApproval === true ? { requiresRealApproval: true } : {}),
@@ -2145,10 +2150,10 @@ export class ToolApprovalCoordinator {
         if (lane === undefined || row.owner === null)
             return flag(false, "rule_lane_unavailable");
         const owner = row.owner;
-        const envelope = ApprovalCardEnvelopeSchema.safeParse(row.cardJson);
-        if (!envelope.success)
+        const envelope = readStoredCardEnvelope(row.cardJson);
+        if (envelope === undefined)
             return flag(false, "rule_material_absent");
-        const card = envelope.data.card;
+        const card = envelope.card;
         if (card.governanceForced === true)
             return flag(false, "rule_governance_forced");
         const command = row.ruleCommand;

package/dist/trace/core-keyset-guard.d.ts

@@ -36,14 +36,14 @@ type _GuardProvenanceReverse = AssertAllKeysHandled<Exclude<ProvenanceProjected
 type AgentMessageProjected = "from" | "body";
 type _GuardAgentMessage = AssertAllKeysHandled<Exclude<keyof NonNullable<TaskNotificationPayload["agentMessage"]>, AgentMessageProjected>>;
 type _GuardAgentMessageReverse = AssertAllKeysHandled<Exclude<AgentMessageProjected, keyof NonNullable<TaskNotificationPayload["agentMessage"]>>>;
-type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId" | "spawnName";
+type BgNotifProjected = "taskId" | "sessionId" | "seq" | "status" | "summary" | "stoppedBy" | "resumable" | "recentSteps" | "editedFiles" | "usage" | "transcriptId" | "rootSessionId" | "parentTaskId" | "parentToolCallId" | "completionId" | "spawnName" | "result";
 type BgNotifExcluded = "kind" | "sessionScoped" | "owner" | "scope" | "description" | "agentType" | "name" | "currentAction" | "currentTool" | "parentSessionId" | "startedAt" | "workflowRunId" | "progressTaskId" | "progressParentTaskId" | "model";
 type _GuardBgNotif = AssertAllKeysHandled<Exclude<keyof BackgroundChildEvent, BgNotifProjected | BgNotifExcluded>>;
 type _GuardBgNotifReverse = AssertAllKeysHandled<Exclude<BgNotifProjected | BgNotifExcluded, keyof BackgroundChildEvent>>;
 type RosterProjected = "name" | "agentId" | "sessionId" | "toolUseId" | "owner" | "scope" | "sessionScoped" | "rootSessionId" | "model" | "modelFallback" | "createdAt";
 type _GuardRoster = AssertAllKeysHandled<Exclude<keyof RosterEntry, RosterProjected>>;
 type _GuardRosterReverse = AssertAllKeysHandled<Exclude<RosterProjected, keyof RosterEntry>>;
-type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard";
+type AskProjected = "toolName" | "toolCallId" | "args" | "message" | "sourceTaskId" | "fromSubagent" | "sourceAgentName" | "delegation" | "ruleOffers" | "ruleOffersAbsence" | "allowRuleShadowed" | "probeCause" | "probeReason" | "ruleEvidence" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "readRootCandidate" | "mandated" | "mandate" | "askClass" | "classes" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "approvalCard" | "boundGrantAbsence";
 type AskExcluded = "preview" | "principal" | "riskAxes" | "boundInputHash" | "isDelegatedChild" | "hasBidiControls" | "previewWithheld" | "execCwd" | "authoredBy";
 type _GuardAsk = AssertAllKeysHandled<Exclude<keyof AskRequest, AskProjected | AskExcluded>>;
 type _GuardAskReverse = AssertAllKeysHandled<Exclude<AskProjected | AskExcluded, keyof AskRequest>>;
@@ -136,7 +136,7 @@ type _GuardPermissionTraceReverse = AssertAllKeysHandled<Exclude<PermissionTrace
 /** `T` 非 `never` 时收敛到 `never`(空集 ⇒ 残留 `"EMPTY"` ⇒ tsc 红)。 */
 type AssertNonEmpty<T> = [T] extends [never] ? "EMPTY" : never;
 type _GuardPermissionTraceNonEmpty = AssertAllKeysHandled<AssertNonEmpty<PermissionTraceKind>>;
-type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling";
+type SummaryProjected = "sessionId" | "scope" | "createdAt" | "gateKind" | "severity" | "spentMicroUsd" | "deadline" | "hasBidiControls" | "requiresRealApproval" | "denialLimitFallback" | "origin" | "mandated" | "mandate" | "boundGrantDigest" | "boundGrants" | "classifierNoRuling" | "boundGrantAbsence";
 type SummaryExcluded = "token" | "toolInput" | "toolName" | "toolCallId" | "preview" | "principal" | "sourceTaskId" | "approvalCard" | "restoreMode" | "checkpointId" | "previewWithheld" | "authoredBy";
 type _GuardInboxSummary = AssertAllKeysHandled<Exclude<keyof CheckpointSummary, SummaryProjected | SummaryExcluded>>;
 type _GuardInboxSummaryReverse = AssertAllKeysHandled<Exclude<SummaryProjected | SummaryExcluded, keyof CheckpointSummary>>;

package/dist/trace/engine-notice-wire.d.ts

@@ -16,7 +16,7 @@
  * 同文件 G1 e2e 的全码扇出夹具、以及契约文档附录 D.3 那张表(含**小节标题里的码数** —— 那道门本批
  * 刚立,立完就在下一次加码时自己咬住了)。
  */
-export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored"];
+export declare const ENGINE_NOTICE_WIRE_CODES: readonly ["memory.session_polluted", "memory.harvest_quarantined", "memory.delegation_static_mark_waived", "memory.hold_opened", "memory.hold_released", "memory.hold_disposed", "task.turn_interrupted", "steering.parked_input_blocked", "task.user_steer_undrained", "task.user_followup_undrained", "memory.capture_opted_out", "memory.capture_optout_unpersisted", "task.halt_unconsumed", "task.late_approval", "config.durable_gate_unavailable", "peer.inbound_disposition", "peer.held_settled", "peer.idle_subscription", "classifier.denial_limit", "mcp.injection_dropped", "delegation.ask_unresolvable", "task.interrupt_unconsumed", "approval.read_root_granted", "approval.read_root_grant_rejected", "instructions.source_changed", "session.records_skipped", "server.model_unreachable", "permission.entry_mode_clamped", "classifier.unavailable", "config.permission_mode_unavailable", "permission.ask_released_by_mode", "permission.read_deny_unapplied", "permission.rule_store_unavailable", "permission.rule_row_dropped", "permission.allowed_tool_not_granted", "task.tool_turn_incomplete", "route.finish_reason_unknown", "route.stream_end_ignored"];
 export type EngineNoticeWireCode = (typeof ENGINE_NOTICE_WIRE_CODES)[number];
 /** 白名单谓词(单点):路由与门都读这一个,不许第二处手抄码串。 */
 export declare function isEngineNoticeWireCode(code: string): code is EngineNoticeWireCode;

package/dist/trace/engine-notice-wire.js

@@ -29,6 +29,7 @@ export const ENGINE_NOTICE_WIRE_CODES = [
     "instructions.source_changed",
     "session.records_skipped",
     "server.model_unreachable",
+    "permission.entry_mode_clamped",
     "classifier.unavailable",
     "config.permission_mode_unavailable",
     "permission.ask_released_by_mode",

package/dist/trace/project.d.ts

@@ -167,7 +167,8 @@ export declare function toolStartEventData(ev: {
  * `done` 永远到不了、重连恒复现同一处),而 `gate-outcome-defective` 那一格还不涨。
  *
  * ⇒ 兑现方式从「枚举」换成**结构**:任何逃出投影的异常同走既有的那一口 report + withhold。规则因此变少
- * (不是「守住已知的 N 种坏形」而是「坏字节一律 withhold」),上面那几道具名形门留着只为**诊断串更准**。
+ * (不是「守住已知的 N 种坏形」而是「坏字节一律 withhold」)。core 7.51.0 起筛本身对任意 JSON 形不抛(KL-1731-a:只覆盖 JSON ——
+ * 访问器 / Proxy 这类非 JSON 值仍可能抛),本仓此前叠在筛前的具名形门与成员门(第二读法)随之退役,诊断串就是筛给的缺陷句。
  * ⛔ **刻意不动**「先脱敏后截断」的次序:截断在前会把跨界的密钥切成半截明文留在输出里,而且它只治
  * `note` 一条叶(`approver` 同病)—— 那是给一个类打两个特判,正是本仓要消掉的形。
  */
@@ -188,11 +189,13 @@ export declare function screenedGate(v: unknown): GateOutcome | undefined;
  * 一律过 {@link screenedGate},零例外」。它按**型**分派而不是按调用点,所以将来第二个携带
  * `GateOutcome` 的账本型只需把 {@link GATE_BEARING_LEDGER_EVENT_TYPE} 扩成词表,读腿一行都不用改。
  *
- * ## 读腿与写腿现在是**同一只**筛(7.74.0 起,零双读)
+ * ## 读腿与写腿现在是**同一只**筛(零双读)
  * 7.72.0–7.73.0 期间读腿多一步「认本服务上一版写下的退役词旧拼法」(`unresolvable` → `ancestor_marked`),
  * 那是一条**长期双读臂**:同一份字节在写腿与读腿上有两种理解,而且没有到期日。7.74.0 把它换成**一次性
- * 迁移**(启动期把存量字节原地改名;窗关后已删码)⇒ 读腿退回写腿那只严格筛子,集外词一律整条 withhold + 计数,
- * 不再有第二种读法 —— 残留旧拼法的字节(local 车道引擎 File 店里不可改写的已决行)同走这一只筛,响亮不静默。
+ * 迁移**(启动期把存量字节原地改名;窗关后已删码)。S-1542(core 7.51.0 #1731)起这只筛是 core `screenGateOutcome(g)` 缺省的**档案读法**
+ * (每个闭集 = 今日成员 ∪ core `RETIRED_MEMBERS`),读腿与写腿同走它:残留旧拼法的字节(local 车道引擎 File 店里不可改写的已决行)
+ * **整条读回、原词上帧、计数 0**(档案词是当年合法铸下的事实,不是缺陷,不改写成今天的词);整条 withhold + 计数的只有真缺陷
+ * (集外且不在退役表的词、破不变量、形坏)。读法只有一种。
  *
  * ## 与写腿脱敏汇点的关系(别再走回头路)
  * 写腿的对偶是 `redactLedgerEventData`(三孪生 store 的 `appendEvent` 落库前),它管的是脱敏、不是判形;

package/dist/trace/project.js

@@ -1,5 +1,5 @@
 import { admitProviderEcho, redactErrorMessage, redactModelText } from "../observability/run-terminal.js";
-import { isAskClass, isAskOrigin, isModeReleaseReason, isPermissionMode, isPersistedRuleMandate, isSettlementParty, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
+import { MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, screenGateOutcome, TEAM_ROLES, ToolRoster, ToolRosterDelta, WRITE_PROTECTION_TARGET_VIEWS } from "@sema-agent/core";
 import { Value } from "typebox/value";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { redactSecrets, redactDeep } from "./redact.js";
@@ -111,77 +111,16 @@ export function screenedGate(v) {
         return undefined;
     }
 }
-function modeLedgerDefect(d) {
-    const classesOk = (v) => Array.isArray(v) && v.every((c) => isAskClass(c));
-    if (d.kind === "denied") {
-        if (d.mode !== undefined && !isPermissionMode(d.mode))
-            return "disposition.mode is outside the closed set";
-        if (d.askClass !== undefined && !isAskClass(d.askClass))
-            return "disposition.askClass is outside the closed set";
-        if (d.classes !== undefined && !classesOk(d.classes))
-            return "disposition.classes is not a list of ask classes";
-        return false;
-    }
-    if (d.released === undefined)
-        return false;
-    const r = d.released;
-    if (r === null || typeof r !== "object")
-        return "disposition.released is not an object";
-    const o = r;
-    if (!isPermissionMode(o.mode) || !isAskClass(o.askClass) || !classesOk(o.classes))
-        return "disposition.released.mode / askClass / classes is outside its closed set";
-    if (o.origin !== undefined && !isAskOrigin(o.origin))
-        return "disposition.released.origin is outside the closed set";
-    if (o.mandate !== undefined && !isPersistedRuleMandate(o.mandate))
-        return "disposition.released.mandate is outside the closed set";
-    return false;
-}
-function withReleaseReasonTheEngineReads(g) {
-    const d = g.disposition;
-    if (d.kind !== "allowed" || d.released === undefined)
-        return g;
-    const r = d.released;
-    if (r === null || typeof r !== "object")
-        return g;
-    const reason = d.released.reason;
-    if (typeof reason !== "string" || isModeReleaseReason(reason))
-        return g;
-    const { reason: _unread, ...kept } = d.released;
-    return { ...g, disposition: { ...d, released: kept } };
-}
 function screenedGateOrThrow(v) {
-    if (v === null || typeof v !== "object") {
-        if (v !== undefined)
-            recordFailOpen("server.trace.gate-outcome-defective", "gate is not an object");
-        return undefined;
-    }
-    const stored = v;
-    if (stored.disposition === null || typeof stored.disposition !== "object" || (stored.disposition.kind !== "allowed" && stored.disposition.kind !== "denied")) {
-        recordFailOpen("server.trace.gate-outcome-defective", "disposition is not one of the two arms");
-        return undefined;
-    }
-    const g = withReleaseReasonTheEngineReads(stored);
-    const d = g.disposition;
-    const classifierFallbackRaw = d.classifier !== null && typeof d.classifier === "object" ? d.classifier.fallback : undefined;
-    const shapeDefect = (d.kind === "denied" && typeof d.deniedBy !== "string" && "disposition.deniedBy is not a string") ||
-        (d.kind === "denied" && d.cause !== undefined && typeof d.cause !== "string" && "disposition.cause is not a string") ||
-        (d.classifier !== undefined && (d.classifier === null || typeof d.classifier !== "object") && "disposition.classifier is not an object") ||
-        (classifierFallbackRaw !== undefined && (classifierFallbackRaw === null || typeof classifierFallbackRaw !== "object") && "disposition.classifier.fallback is not an object") ||
-        (classifierFallbackRaw !== undefined && classifierFallbackRaw !== null && typeof classifierFallbackRaw === "object" && typeof classifierFallbackRaw.cause !== "string" && "disposition.classifier.fallback.cause is not a string") ||
-        modeLedgerDefect(d) ||
-        (g.settlement !== undefined && (g.settlement === null || typeof g.settlement !== "object") && "settlement is not an object") ||
-        (g.settlement !== undefined && g.settlement !== null && typeof g.settlement.kind !== "string" && "settlement.kind is not a string") ||
-        (g.origin !== undefined && typeof g.origin !== "string" && "origin is not a string") ||
-        undefined;
-    if (shapeDefect !== undefined) {
-        recordFailOpen("server.trace.gate-outcome-defective", shapeDefect);
+    if (v === undefined)
         return undefined;
-    }
-    const defects = screenGateOutcome(g);
+    const defects = screenGateOutcome(v);
     if (defects.length > 0) {
         recordFailOpen("server.trace.gate-outcome-defective", defects.join("; "));
         return undefined;
     }
+    const g = v;
+    const d = g.disposition;
     const attribution = d.classifier;
     const classifier = attribution === undefined
         ? undefined
@@ -193,10 +132,6 @@ function screenedGateOrThrow(v) {
                 : { fallback: { from: attribution.fallback.from, to: attribution.fallback.to, cause: attribution.fallback.cause } }),
         };
     const settlement = g.settlement === undefined ? undefined : projectSettlement(g.settlement);
-    if (g.settlement !== undefined && settlement === undefined) {
-        recordFailOpen("server.trace.gate-outcome-defective", "settlement.who is not an object with a party in the closed set");
-        return undefined;
-    }
     const rel = d.kind === "allowed" ? d.released : undefined;
     const released = rel === undefined
         ? undefined
@@ -242,11 +177,7 @@ export function screenedStoredEventData(type, data) {
     return { ...d, gate };
 }
 function projectSettlement(st) {
-    const whoV = st.who;
-    const partyV = whoV === null || typeof whoV !== "object" ? undefined : whoV.party;
-    if (!isSettlementParty(partyV))
-        return undefined;
-    const who = whoV;
+    const who = st.who;
     return {
         kind: st.kind,
         when: st.when,

package/dist/trace/tool-output-media.d.ts

@@ -17,7 +17,8 @@ export declare function projectToolStructured(structured: unknown, redact: (valu
  * `tool_end` 载荷的媒体降级(持久面恒用;活面只在连接积压时用),**一次调用降两个座位**:
  *  · `output`:带 `data` 的媒体块换成描述符,有任何一块被换 ⇒ 帧级 `truncated: true` 且帧级 `totalChars` 在场 —— core 不变量
  *    「Present iff truncated」:被界之前那个值的真实大小。帧上已有 `totalChars`(core 已截断:文本被切而媒体留着)⇒ **原样保留**
- *    (它说的是更早的原值,本仓手里的已是切过的值,重算只会低报);没有 ⇒ 按 {@link trueSizeOf} 逐块求和(core 没截,`output` 就是原值 ——
+ *    (它说的是更早的原值,本仓手里的已是切过的值,重算只会低报);没有 ⇒ 按引擎的逐块计数器 `toolOutputBlockChars` 求和(core 7.51.1 导出,`tool_end.totalChars` 加总的就是它;本仓 7.128.x 及以前的拷贝
+ *    `trueSizeOf` 随之删除)(core 没截,`output` 就是原值 ——
  *    文本块是本服务脱敏后的字节,即本服务交付的内容)。已是描述符的块(无 `data`)原样 ⇒ 幂等。
  *  · `structured`:媒体卡去掉 `file.base64`(core 卡形自己的「不带字节」形),其余成员逐字。帧级 `truncated` / `totalChars` 只说 `output`,
  *    单独剥卡**不动**它们(`output` 已是 core 描述符而卡仍带 ≤48K 字节的帧,和卡超 48K 时 core 自己略去 `base64` 的帧,在这两个键上读数一致)。

package/dist/trace/tool-output-media.js

@@ -1,12 +1,6 @@
+import { isMediaBlock, mediaBlockDescriptor, toolOutputBlockChars } from "@sema-agent/core";
 import { redactDeep } from "./redact.js";
 import { recordFailOpen } from "../observability/fail-open.js";
-function isMediaBlock(b) {
-    if (b === null || typeof b !== "object" || Array.isArray(b))
-        return false;
-    const block = b;
-    return (block.type === "image" || block.type === "document") && typeof block.data === "string";
-}
-const MIME_ECHO_MAX = 255;
 export function projectToolOutput(output) {
     if (!Array.isArray(output))
         return redactDeep(output);
@@ -27,15 +21,6 @@ export function projectToolStructured(structured, redact) {
     const file = Object.fromEntries(Object.entries(structured.file).map(([k, v]) => [k, k === "base64" ? v : redact(v)]));
     return Object.fromEntries(Object.entries(structured).map(([k, v]) => [k, k === "file" ? file : redact(v)]));
 }
-function trueSizeOf(b) {
-    if (isMediaBlock(b))
-        return b.data.length;
-    if (b !== null && typeof b === "object" && !Array.isArray(b) && b.type === "text" && typeof b.text === "string") {
-        const { type: _type, text, ...rest } = b;
-        return text.length + Math.max(0, (JSON.stringify(rest)?.length ?? 2) - 2);
-    }
-    return JSON.stringify(b)?.length ?? 0;
-}
 export function toolEndMediaAsDescriptors(data) {
     const output = data.output;
     const outputHasMedia = Array.isArray(output) && output.some(isMediaBlock);
@@ -45,15 +30,8 @@ export function toolEndMediaAsDescriptors(data) {
     const next = { ...data };
     if (outputHasMedia) {
         const blocks = output;
-        const totalChars = typeof data.totalChars === "number" && Number.isFinite(data.totalChars) ? data.totalChars : blocks.reduce((n, b) => n + trueSizeOf(b), 0);
-        next.output = blocks.map((b) => isMediaBlock(b)
-            ? {
-                type: b.type,
-                ...(typeof b.mimeType === "string" && b.mimeType.length <= MIME_ECHO_MAX ? { mimeType: b.mimeType } : {}),
-                bytes: Math.floor((b.data.length * 3) / 4),
-                truncated: true,
-            }
-            : b);
+        const totalChars = typeof data.totalChars === "number" && Number.isFinite(data.totalChars) ? data.totalChars : blocks.reduce((n, b) => n + toolOutputBlockChars(b), 0);
+        next.output = blocks.map((b) => (isMediaBlock(b) ? mediaBlockDescriptor(b) : b));
         next.truncated = true;
         next.totalChars = totalChars;
     }

package/dist/web-admin-client/apply-effective.js

@@ -15,6 +15,7 @@ import { judgeModelRouteEndpoint } from "../model-route-endpoint.js";
 import { gateIntentUnserviceableReason } from "../approval.js";
 import { refusedGroups } from "./apply-ledger.js";
 import { judgeConfigCandidate } from "./candidate-gate.js";
+import { declareServerWithheldEnv, withdrawServerWithheldEnv } from "../server-secret-env.js";
 const charsPerTokenOf = (v) => (typeof v === "number" && Number.isFinite(v) && v > 0 ? v : undefined);
 function envDerivedModel(config) {
     const m = config.envModel;
@@ -97,17 +98,21 @@ export function applyEffective(config, eff, logger, opts) {
         return false;
     }
     const mp = staged.modelPlaneGroup.stages.models;
-    if (mp !== undefined && opts.swapPlane !== undefined) {
-        try {
-            opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
-        }
-        catch (err) {
-            logger?.warn("web_admin_model_plane_swap_refused", {
-                version: staged.version,
-                error: err instanceof Error ? err.message : String(err),
-                note: "the Runner refused the candidate model plane (swapDeps screens the whole candidate atomically — the current generation stays in force untouched); candidate refused whole, re-judged next poll (/health shows target≠applied while it persists)",
-            });
-            return false;
+    if (mp !== undefined) {
+        declareCandidateWithheldEnv(mp.modelApiKeyEnv, staged.version);
+        if (opts.swapPlane !== undefined) {
+            try {
+                opts.swapPlane({ models: mp.models, tiers: mp.activeTiers });
+            }
+            catch (err) {
+                withdrawServerWithheldEnv();
+                logger?.warn("web_admin_model_plane_swap_refused", {
+                    version: staged.version,
+                    error: err instanceof Error ? err.message : String(err),
+                    note: "the Runner refused the candidate model plane (swapDeps screens the whole candidate atomically — the current generation stays in force untouched); candidate refused whole, re-judged next poll (/health shows target≠applied while it persists)",
+                });
+                return false;
+            }
         }
     }
     commitStaged(config, staged);
@@ -141,6 +146,18 @@ export function applyEffective(config, eff, logger, opts) {
         logger?.info("web_admin_projects", { projects: Object.keys(staged.projects) });
     return true;
 }
+function declareCandidateWithheldEnv(modelApiKeyEnv, version) {
+    try {
+        declareServerWithheldEnv(modelApiKeyEnv);
+    }
+    catch (err) {
+        const entries = Object.entries(modelApiKeyEnv)
+            .map(([model, envName]) => `${model}→${envName}`)
+            .join(", ");
+        throw new Error(`model catalog (effective v${version}): a model entry's apiKeyEnv names a variable the engine cannot withhold from model-driven shells — ` +
+            `the candidate is refused whole and the current generation keeps serving; fix that entry's apiKeyEnv (entries: ${entries}). Engine: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 function commitStaged(config, staged) {
     const mp = staged.modelPlaneGroup.stages.models;
     if (mp) {

package/dist/web-admin-client/facade.d.ts

@@ -51,6 +51,6 @@ export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHt
 export { mutateInPlace, applyEffective, type ApplyReport, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, type ModelPlaneDomain, type ModelPlaneOf, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, type RestartSlice, type RestartSliceCtx, type EngineRestartSignal, } from "./restart-signal.js";
 export { applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
-export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline } from "./read-face.js";
+export { applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, CENTER_READ_FACE_LIVE_KEYS, type CenterReadFaceApply, type CenterReadFaceReport, type ReadFaceBaseline, type ReadFaceSeat } from "./read-face.js";
 export type { CenterSkillManifest, CenterMcpServer, CenterA2aPeer, CenterModel, CenterReadFace, EffectiveConfig, ExecutionRuling, SessionMirrorRuling, } from "./types.js";
 //# sourceMappingURL=facade.d.ts.map

package/dist/web-admin-client/facade.js

@@ -2,5 +2,5 @@ export { fetchEffective, fetchPrincipalCaps, fetchPrincipalOrgMemory, WebAdminHt
 export { mutateInPlace, applyEffective, applyRuntimeGates, applyRuntimeHot, logEffectiveDiff, MODEL_PLANE_DOMAINS, withModelPlaneOf, fullyLandedForLkg, } from "./apply-effective.js";
 export { restartReasons, modelPlaneChanged, } from "./restart-signal.js";
 export { applySkillsManifest, resolveMcpServers, mcpForScenario, resolveA2aPeers, a2aForScenario } from "./skills-mcp.js";
-export { applyCenterReadFace, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
+export { applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, CENTER_READ_FACE_LIVE_KEYS } from "./read-face.js";
 //# sourceMappingURL=facade.js.map