@sema-agent/server 7.131.0 → 7.133.0

package/dist/text-bidi.d.ts

@@ -1,50 +1,3 @@
-/**
- * `text-bidi.ts` —— 双向控制符(bidi)与 C0 控制符字符类的**单一属主**。
- *
- * ## 为什么有这个文件
- * 同一条字符类此前在本仓有两份逐字手抄(`session-titler.ts` 的 `sanitizeTitle`、
- * `plugins/send-user-file.ts` 的 `sanitizeSendFileName`),第三份还要给审批卡的 bidi **在场检测**用。
- * 这是一条安全语义上的词表(它划定「人眼看到的顺序可能不是字节顺序」那一族码点),三份手抄必然漂移 ——
- * 单一属主的纪律与 `APPROVAL_GATE_KINDS` 同源(CLAUDE.md 硬条款:词表是闭集,不许散落副本)。
- *
- * ## 两条类刻意分开(**别合并**)
- *  · {@link BIDI_CONTROL_CHARS} —— **只有** bidi 一族(LRM/RLM、嵌入与覆写、隔离符)。它是**检测**用的:
- *    问的是「这串文本里有没有能让人眼读到与执行顺序不同的东西」。C0 控制符不属于这一问 —— 一条 Bash
- *    命令里出现换行、一段 diff 里出现制表符都是**正常**的,把它们算进来会让检测位恒为真、从而毫无判别力。
- *  · {@link CONTROL_AND_BIDI_CHARS} —— bidi ∪ C0/DEL,**清洗**用的(标题、文件名这类要落一行的短串)。
- *    清洗面比检测面宽是对的:那两处要的是「只留可打印的一行」。
- *
- * ## 案锚
- * Trojan Source([ref]②;`docs/DISEASE-SHAPES.md` 的不可见字符条):字面控制符让**人审与机器门看到
- * 两份不同的文本**。审批卡是本仓唯一一处「把模型写的命令交给人眼判断」的面,所以它需要的是**披露**
- * (告诉壳「这串里有 bidi」),不是清洗 —— 清洗会改掉即将被执行的那串字节,让卡上显示的与真正跑的不是
- * 同一个东西,那比不披露更坏。
- */
-/**
- * bidi 一族的字符类**内容**(不含方括号,便于拼进更大的类)。
- *
- * 逐字 = Unicode 的 `Bidi_Control=Yes` **全集**(12 个码点),不是「常见的那几个」:
- *  · U+061C = ALM(Arabic Letter Mark);U+200E/200F = LRM/RLM;
- *  · U+202A-202E = 嵌入/覆写族(含 RLO);U+2066-2069 = 隔离符族。
- *
- * 🔴 **U+061C 是 codex 交叉复审 [medium] 验真后补的**:首版漏了它 —— 而漏一个码点在**检测**面上不是
- * 「覆盖率差一点」,是一条完整的跳过路(只用 ALM 构造的输入让在场位缺席,壳于是照常按干净渲染)。
- * 交叉锚:core 自己的 `APPROVER_REFUSED_CHARS_RE`(`dist/core/tool-policy.js`)同样含 `\\u061c`。
- *
- * ⚠️ 与 core 那只**更宽**的集合的差额如实登记(刻意,不是漏):core 还含 C1(`\\u0080-\\u009f`)与
- * U+2028/U+2029(行/段分隔符)。那两族**不是 bidi**(不影响阅读方向),属于「不可打印 / 换行伪装」的
- * 另一问;本类是 bidi 专用,混进来会让 {@link hasBidiControls} 的语义从「方向可能骗你」滑成「有奇怪
- * 字符」。清洗面要不要跟着加宽是另一件(见 {@link CONTROL_AND_BIDI_CHARS} 的注)。
- */
-export declare const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
-/** bidi ∪ C0/DEL —— **清洗**面用(见文件头注:清洗面比检测面宽是刻意的)。
- *  ⚠️ 仍**不含** C1(`€-Ÿ`)与 U+2028/U+2029:加宽是行为变更、要各自的判据支撑,不搭本批的车
- *  (登记在此,别当成漏)。两处存量消费方(标题、文件名)较其手抄前身**多剥一枚 U+061C**
- *  (经 {@link BIDI_CONTROL_CHARS} 内插带入)—— 对本清洗类是有意收紧,merge-rescan 745 验真后
- *  钉在两消费方各自的测试里;除此之外与手抄前身逐字同集。 */
-export declare const CONTROL_AND_BIDI_CHARS = "\\u0000-\\u001f\\u007f\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
-/** 清洗用的全局正则(`String.replace` 会在返回前把 `lastIndex` 归零,故模块级常量可安全复用)。 */
-export declare const CONTROL_AND_BIDI_STRIP_RE: RegExp;
-/** 这串文本里**有没有** bidi 控制符。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
+/** 这串文本里**有没有** bidi 控制符(判官 = core 的 {@link carriesBidiControls})。纯谓词:不改一个字节、不做任何清洗(理由见文件头注)。 */
 export declare function hasBidiControls(text: string): boolean;
 //# sourceMappingURL=text-bidi.d.ts.map

package/dist/text-bidi.js

@@ -1,8 +1,6 @@
-export const BIDI_CONTROL_CHARS = "\\u061c\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069";
-export const CONTROL_AND_BIDI_CHARS = `\\u0000-\\u001f\\u007f${BIDI_CONTROL_CHARS}`;
-export const CONTROL_AND_BIDI_STRIP_RE = new RegExp(`[${CONTROL_AND_BIDI_CHARS}]`, "g");
-const BIDI_DETECT_RE = new RegExp(`[${BIDI_CONTROL_CHARS}]`);
+import { carriesBidiControls } from "@sema-agent/core";
+const WHOLE_TEXT_SCAN = { maxNodes: 1, maxChars: Number.MAX_SAFE_INTEGER };
 export function hasBidiControls(text) {
-    return BIDI_DETECT_RE.test(text);
+    return carriesBidiControls(text, WHOLE_TEXT_SCAN);
 }
 //# sourceMappingURL=text-bidi.js.map

package/dist/tighten-only-seats.d.ts

@@ -0,0 +1,150 @@
+/**
+ * **请求面「只收紧」座位族** —— 团队仓库里只会收紧的四张列表,在 `settings` 面各有一个每请求座位:一张闭集座位表、一组受理判据、一个能力位。
+ *
+ *  | 座位(`settings.…`)                | 去处                                                                                          | 部署侧的表                          |
+ *  |-------------------------------------|-----------------------------------------------------------------------------------------------|-------------------------------------|
+ *  | `readDenyPatterns`                  | core 任务层席 `TaskSpec.readDenyPatterns`(只增不减)                                           | `READ_DENY_PATTERNS`                |
+ *  | `writeProtectedExtra`               | core 任务层席 `TaskSpec.writeProtectedAdditions`(只增不减)                                    | `WRITE_PROTECTED_EXTRA`             |
+ *  | `complianceAdditionalDenies`        | core 任务层席 `TaskSpec.complianceAdditionalDenies`(只增不减)                                 | `COMPLIANCE_ADDITIONAL_DENIES`      |
+ *  | `permissions.neverAuto`             | 本仓审批席的请求叶策略(命中的工具恒问真人;见 `approval.ts` `createRequestNeverAutoPolicy`)    | `APPROVAL_NEVER_AUTO`               |
+ *
+ * ## 律
+ *  · **取并在拥有部署表的那一层做一次**:三座的部署表在 core 的 `RunnerDeps`(`readDenyPatterns` / `writeProtectedPaths` / `compliancePostureResolver`),与任务层列表的并集由 core 在 prepare 取
+ *    (`CLAMP_SET` 的 addOnly 律:`[]` 不抹任何行、任务层只加不减);`neverAuto` 的部署表在本仓审批席,请求叶与基线名单经 `tightenGoverned` 的 deny-wins 折叠取并。
+ *    **本仓不在折叠之外手写第二份并集** —— 那是下游改上游席语义(并集规则一份在 core,哪天 core 改身份函数,本仓的副本会静默分岔)。
+ *  · **空数组 ≡ 缺席**(并集的单位元):读入时不铸键,spec 与不带这个座位的请求字节相同。
+ *  · **请求面没有放宽臂**:列表只能加行;送空、送别的行,部署的表一行不少。
+ *  · **条目律借引擎的判官**(同一批 env 腿读的那几只:`compileReadDeny` / `resolveWriteProtectedTable` / `COMPLIANCE_CAPABILITIES`),宿主不自造第二份校验语义;读拒条目的元素文法 env / 中心 / 请求三腿同读
+ *    `read-deny-entry.ts` 的那一只。受理面在 prepare 之前把坏形响亮拒掉(400),不让它变成 200 之后才失败的一跑。
+ *  · 受理判据一处({@link tightenOnlySeatIssue}):不是数组 / 超帽 / 坏项 ⇒ 400 `request.field_invalid` + 机读位(`field` / `reason` / `count`+`cap` | `index`),与 S-904 三桶同形。
+ *    fresh 受理口、`resolveSpec`(两腿)、存体重放预判三处调这一只。
+ *  · 座位表是闭集:加一座 = 加一行(`TIGHTEN_ONLY_SEAT_NAMES` 与表互为编译期穷举;`wire` 位置必须落在 `task-settings.ts` 的受理列里 —— 下面的编译期门)。
+ *
+ * 谁调:`task-settings.ts`(`parseTaskSettings` 读入 · `applyTaskSettings` 投影 · 键闭集门)· `http/admission.ts` / `boot/resolve-spec.ts` / `http/stored-body-replay.ts`(受理判据)·
+ * `http/routes/capabilities.ts`(能力位 `taskSettings.tightenOnlySeats`)· `request-key-closure.ts`(顶层同名键的拒句指路)。
+ */
+import { type ComplianceCapability, type ReadDenyEntry, type WriteProtectedEntry } from "@sema-agent/core";
+import type { GovernanceOverrides } from "./governance-overrides.js";
+import { type LimitFacts } from "./limit-refusal.js";
+/** 四座(表序;句子说「表序里第一座」)。 */
+export declare const TIGHTEN_ONLY_SEAT_NAMES: readonly ["neverAuto", "readDenyPatterns", "writeProtectedExtra", "complianceAdditionalDenies"];
+export type TightenOnlySeatName = (typeof TIGHTEN_ONLY_SEAT_NAMES)[number];
+/** 每座一个条目的类型(归一后的值;进 spec / 请求叶的就是它,不另投影)。 */
+interface SeatEntryTypes {
+    readonly neverAuto: string;
+    readonly readDenyPatterns: ReadDenyEntry;
+    readonly writeProtectedExtra: WriteProtectedEntry;
+    readonly complianceAdditionalDenies: ComplianceCapability;
+}
+/** 读入的产物:每座一份归一后的非空列表(缺席的座不在)。 */
+export type TightenOnlySeatValues = {
+    readonly [N in TightenOnlySeatName]?: readonly SeatEntryTypes[N][];
+};
+type SeatValuesDraft = {
+    -readonly [N in TightenOnlySeatName]?: readonly SeatEntryTypes[N][];
+};
+/** 三座落 core 任务层席时进 spec 的片段(键 = core 的 `TaskSpec` 席名)。 */
+export type TightenOnlySpecSeats = Pick<GovernanceOverrides, "readDenyPatterns" | "writeProtectedAdditions" | "complianceAdditionalDenies">;
+/** 座位在 `settings` 里的位置:顶层键,或 `permissions` 下的一个成员。 */
+type SeatWire = readonly [key: string] | readonly [container: "permissions", key: string];
+declare const SEAT_WIRE: {
+    readonly neverAuto: readonly ["permissions", "neverAuto"];
+    readonly readDenyPatterns: readonly ["readDenyPatterns"];
+    readonly writeProtectedExtra: readonly ["writeProtectedExtra"];
+    readonly complianceAdditionalDenies: readonly ["complianceAdditionalDenies"];
+};
+/** 编译期门:每座的 wire 位置都在 `task-settings.ts` 的受理列里(座位表加一行而受理列没跟 ⇒ 这里红 —— 否则键闭集门会把新座 400 掉)。 */
+type SeatTopKeys = Extract<(typeof SEAT_WIRE)[TightenOnlySeatName], readonly [string]>[0];
+type SeatPermissionKeys = Extract<(typeof SEAT_WIRE)[TightenOnlySeatName], readonly ["permissions", string]>[1];
+/** 一个条目的读数:归一值,或接在坐标后面成句的原因(自带连接符)。 */
+type EntryReading<E> = {
+    readonly ok: true;
+    readonly value: E;
+} | {
+    readonly ok: false;
+    readonly after: string;
+};
+/**
+ * 一行座位。方法写成**方法签名**(参数双变):表是异质的,遍历时由 {@link eachSeat} 用同一个 `E` 把一行的读 / 放 / 投影三件事配回去。
+ *  · `grammar` —— 句子里说「这张表该装什么」;
+ *  · `readEntry` —— 一个条目的受理判(借引擎的判官);
+ *  · `get` / `put` —— 归一值在 {@link TightenOnlySeatValues} 里的位置(每行自己拼一次本座的键,类型检查);
+ *  · `sink` —— 去处:core 任务层席(`toSpec` 给出进 spec 的片段)或本仓审批席。
+ */
+interface SeatRow<E> {
+    readonly wire: SeatWire;
+    readonly grammar: string;
+    readEntry(entry: unknown): EntryReading<E>;
+    get(values: TightenOnlySeatValues): readonly E[] | undefined;
+    put(draft: SeatValuesDraft, list: readonly E[]): void;
+    /** 这一座的条数帽(超了响亮拒 `over_cap`,不截;先于逐条读,拒体有界)。 */
+    readonly maxEntries: number;
+    /** 整张列表的**成本预算**(可选;只给「引擎匹配代价随条目内容增长」的座):`measure` 数一张列表占多少预算,超 `cap` ⇒ 响亮拒(`over_cap` + `count` + `cap`),不截。 */
+    readonly budget?: {
+        measure(list: readonly E[]): number;
+        readonly cap: number;
+        readonly unit: string;
+    };
+    readonly sink: {
+        readonly kind: "core_task_seat";
+        toSpec(list: readonly E[]): TightenOnlySpecSeats;
+    } | {
+        readonly kind: "approval_seat";
+    };
+}
+/**
+ * 读拒模式的**成本单位 = 一颗 `*`**:引擎(core `compileSegmentPattern`)把每一颗 `*` 编成一个 `[^/]*`,相邻的星就是相邻的回溯点 ——
+ * 一段里 k 颗 `*` 对长度 n 的路径段是 n 的 k 次方级回溯(实测 16 颗连续的星对 17 字的段 ≈ 4 s,跑在事件循环上、任何计时器打不断)。
+ * 所以界按**调用方写下的每一颗**计,不按「连续的一串」计。整段 `**` / `id_rsa*` / `*.pem` / `*secret*` / `*_*_key` / `a**b` 都在内。
+ */
+export declare const MAX_READ_DENY_STARS_PER_SEGMENT = 2;
+/** 整张 `readDenyPatterns` 列表的 `*` 总预算:引擎每次判路径对每条模式、每个路径段各跑一遍,一段 2 颗星是段长的平方 —— 总量只界住「乘几遍」(128 颗时 64 条的表对万字段 ≈ 3.9 s)。
+ *  不是上界:16 颗的整表(8 条各 2 颗)对对手形的 4000 字段本机实测约 1 s、万字段约 5–6 s;段长的那一维只能在引擎里收(线性时间匹配或路径段长度上限,已向引擎请托)。 */
+export declare const MAX_READ_DENY_STARS_TOTAL = 16;
+/** 每座条数的缺省上限 —— 与 `settings.permissions` 三桶同一只帽(编译口的整表帽;超了响亮拒,不截)。读拒模式另有更紧的一只({@link MAX_READ_DENY_ENTRIES}),每座的帽写在座位表那一行。 */
+export declare const MAX_TIGHTEN_ONLY_SEAT_ENTRIES = 1000;
+/** 整张 `readDenyPatterns` 列表的条数帽:不带星的条目也是每段一遍匹配,条数本身就是成本(其余三座的帽是 {@link MAX_TIGHTEN_ONLY_SEAT_ENTRIES})。 */
+export declare const MAX_READ_DENY_ENTRIES = 32;
+/** 座位表(闭集;`{ [N in 座名]: SeatRow }` 双向穷举:少一座 / 多一座都是编译红)。 */
+export declare const TIGHTEN_ONLY_SEATS: {
+    readonly [N in TightenOnlySeatName]: SeatRow<SeatEntryTypes[N]>;
+};
+/** 一座在体内的坐标的**字面类型**(`settings.readDenyPatterns` | … | `settings.permissions.neverAuto`),从 {@link SEAT_WIRE} 派生,不手抄。 */
+export type TightenOnlySeatField = `settings.${SeatTopKeys}` | `settings.permissions.${SeatPermissionKeys}`;
+/** 一座在体内的坐标(`settings.readDenyPatterns` / `settings.permissions.neverAuto`)。 */
+export declare function tightenOnlySeatField(name: TightenOnlySeatName): TightenOnlySeatField;
+/** 拒体的机读位:撞帽 = {@link LimitFacts}(`over_cap` + `count` + `cap`),坏项 = `bad_entry`(+ 首个坏项的下标;整座不是数组时无下标)。 */
+export type TightenOnlySeatIssueFields = LimitFacts | {
+    readonly field: string;
+    readonly reason: "bad_entry";
+    readonly index?: number;
+};
+/** 一次裁决:是哪一座、wire 文案、机读位。 */
+export interface TightenOnlySeatIssue {
+    readonly seat: TightenOnlySeatName;
+    readonly message: string;
+    readonly fields: TightenOnlySeatIssueFields;
+}
+/**
+ * 四座的**唯一**受理判据(纯函数)。逐座按表序(整表判只有 {@link readSeat} 一只,本函数与 {@link readTightenOnlySeats} 共用):缺席 / `null` ⇒ 不判;不是数组 ⇒ `bad_entry`(无下标);
+ * 超帽 ⇒ `over_cap`(先于逐条读,拒体有界);首个坏条目 ⇒ `bad_entry` + 它的下标;成本预算超了 ⇒ `over_cap`(`count` = 占用,`cap` = 预算)。全合法 ⇒ `null`。空数组合法(单位元)。
+ * 句子出口剥控制与双向字符(引擎的原因句可能转载调用方的条目文字)。
+ */
+export declare function tightenOnlySeatIssue(settings: unknown): TightenOnlySeatIssue | null;
+/** 读入的结果:归一后的非空列表(空数组 ≡ 缺席,不铸键);判据说不合法的座**整座丢弃**并报名(`rejected`)—— 只有绕过两道入口的读者走得到,留痕由调用方记。 */
+export interface ReadTightenOnlySeats {
+    readonly values: TightenOnlySeatValues;
+    readonly rejected: readonly TightenOnlySeatName[];
+}
+/**
+ * 把一份**未验过**的 `settings` 读成四座的归一值(`parseTaskSettings` 的读入腿 —— RESUME 重放也走这里,所以宽容:不抛、坏座整座丢弃并报名)。
+ * 与 {@link tightenOnlySeatIssue} 共用 {@link readSeat}(同一只整表判):fresh 提交与续跑在更早处已被它响亮拒过,这里是宽容层。
+ */
+export declare function readTightenOnlySeats(settings: unknown): ReadTightenOnlySeats;
+/**
+ * 三座落 core 任务层席的 spec 片段(进 `tightenGoverned` 的 `TaskSpec` 席名 —— 与部署表取并由 core 的 addOnly 律在 prepare 做一次)。没有这三座的值 ⇒ `{}`。
+ * `neverAuto` 不在这里(它的去处是审批席的请求叶策略,见 `approval.ts` 的 `createRequestNeverAutoPolicy`)。
+ */
+export declare function tightenOnlySpecSeats(values: TightenOnlySeatValues): TightenOnlySpecSeats;
+export {};
+//# sourceMappingURL=tighten-only-seats.d.ts.map

package/dist/tighten-only-seats.js

@@ -0,0 +1,196 @@
+import { COMPLIANCE_CAPABILITIES, compileReadDeny, resolveWriteProtectedTable } from "@sema-agent/core";
+import { echoCallerText } from "./caller-text-echo.js";
+import { limitRefusal } from "./limit-refusal.js";
+import { MAX_PERMISSION_RULES_PER_LIST } from "./permission-rule-list.js";
+import { readReadDenyEntry } from "./read-deny-entry.js";
+import { stripControlAndBidi } from "@sema-agent/settings-schema";
+export const TIGHTEN_ONLY_SEAT_NAMES = ["neverAuto", "readDenyPatterns", "writeProtectedExtra", "complianceAdditionalDenies"];
+const SEAT_WIRE = {
+    neverAuto: ["permissions", "neverAuto"],
+    readDenyPatterns: ["readDenyPatterns"],
+    writeProtectedExtra: ["writeProtectedExtra"],
+    complianceAdditionalDenies: ["complianceAdditionalDenies"],
+};
+const CORE_REASON_ECHO_CHARS = 400;
+function coreReason(e) {
+    const text = e instanceof Error ? e.message : String(e);
+    return echoCallerText(text.replace(/^(?:readDenyPatterns \(additions\)|writeProtectedPaths): /, ""), { maxChars: CORE_REASON_ECHO_CHARS });
+}
+export const MAX_READ_DENY_STARS_PER_SEGMENT = 2;
+export const MAX_READ_DENY_STARS_TOTAL = 16;
+export const MAX_TIGHTEN_ONLY_SEAT_ENTRIES = MAX_PERMISSION_RULES_PER_LIST;
+export const MAX_READ_DENY_ENTRIES = 32;
+const starsIn = (text) => (text.match(/\*/g) ?? []).length;
+function maxStarsPerSegment(pattern) {
+    return pattern.split("/").reduce((max, segment) => Math.max(max, starsIn(segment)), 0);
+}
+function isComplianceCapability(entry) {
+    return COMPLIANCE_CAPABILITIES.includes(entry);
+}
+export const TIGHTEN_ONLY_SEATS = {
+    neverAuto: {
+        wire: SEAT_WIRE.neverAuto,
+        grammar: "non-empty tool-name strings",
+        readEntry: (entry) => (typeof entry === "string" && entry.length > 0 ? { ok: true, value: entry } : { ok: false, after: " is not a non-empty tool name string" }),
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.neverAuto,
+        put: (draft, list) => {
+            draft.neverAuto = list;
+        },
+        sink: { kind: "approval_seat" },
+    },
+    readDenyPatterns: {
+        wire: SEAT_WIRE.readDenyPatterns,
+        grammar: "read-deny patterns (a string, or an object { pattern, caseSensitive? })",
+        readEntry: (entry) => {
+            const read = readReadDenyEntry(entry);
+            if (!read.ok)
+                return { ok: false, after: read.after };
+            try {
+                compileReadDeny([read.entry]);
+            }
+            catch (e) {
+                return { ok: false, after: ` is refused by the engine: ${coreReason(e)}` };
+            }
+            const stars = maxStarsPerSegment(read.entry.pattern);
+            if (stars > MAX_READ_DENY_STARS_PER_SEGMENT) {
+                return { ok: false, after: ` has a path segment with ${stars} "*" wildcards — at most ${MAX_READ_DENY_STARS_PER_SEGMENT} per segment are accepted in a request, each "*" counted (the engine matches a segment by backtracking and the cost grows with each extra wildcard); merge them, or ask the operator to put the row in READ_DENY_PATTERNS` };
+            }
+            return { ok: true, value: read.entry };
+        },
+        maxEntries: MAX_READ_DENY_ENTRIES,
+        get: (values) => values.readDenyPatterns,
+        put: (draft, list) => {
+            draft.readDenyPatterns = list;
+        },
+        budget: { measure: (list) => list.reduce((sum, entry) => sum + starsIn(typeof entry === "string" ? entry : entry.pattern), 0), cap: MAX_READ_DENY_STARS_TOTAL, unit: `"*" wildcards` },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ readDenyPatterns: [...list] }) },
+    },
+    writeProtectedExtra: {
+        wire: SEAT_WIRE.writeProtectedExtra,
+        grammar: "write-protection names (a literal name string, or an object { name, kind })",
+        readEntry: (entry) => {
+            try {
+                const rows = resolveWriteProtectedTable([entry]);
+                const row = rows[0];
+                if (rows.length !== 1 || row === undefined)
+                    return { ok: false, after: " does not read as exactly one write-protection row" };
+                return { ok: true, value: row };
+            }
+            catch (e) {
+                return { ok: false, after: ` is refused by the engine: ${coreReason(e)}` };
+            }
+        },
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.writeProtectedExtra,
+        put: (draft, list) => {
+            draft.writeProtectedExtra = list;
+        },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ writeProtectedAdditions: [...list] }) },
+    },
+    complianceAdditionalDenies: {
+        wire: SEAT_WIRE.complianceAdditionalDenies,
+        grammar: `capability names (${COMPLIANCE_CAPABILITIES.join("|")})`,
+        readEntry: (entry) => isComplianceCapability(entry)
+            ? { ok: true, value: entry }
+            : { ok: false, after: ` is not one of ${COMPLIANCE_CAPABILITIES.join("|")}` },
+        maxEntries: MAX_TIGHTEN_ONLY_SEAT_ENTRIES,
+        get: (values) => values.complianceAdditionalDenies,
+        put: (draft, list) => {
+            draft.complianceAdditionalDenies = list;
+        },
+        sink: { kind: "core_task_seat", toSpec: (list) => ({ complianceAdditionalDenies: [...list] }) },
+    },
+};
+function eachSeat(visit) {
+    return TIGHTEN_ONLY_SEAT_NAMES.map((name) => visit(name, TIGHTEN_ONLY_SEATS[name]));
+}
+export function tightenOnlySeatField(name) {
+    const wire = SEAT_WIRE[name];
+    return wire.length === 1 ? `settings.${wire[0]}` : `settings.${wire[0]}.${wire[1]}`;
+}
+function rawListOf(settings, wire) {
+    if (settings === null || typeof settings !== "object" || Array.isArray(settings))
+        return undefined;
+    const top = settings[wire[0]];
+    if (wire.length === 1)
+        return top;
+    if (top === null || typeof top !== "object" || Array.isArray(top))
+        return undefined;
+    return top[wire[1]];
+}
+function readSeat(name, row, settings) {
+    const raw = rawListOf(settings, row.wire);
+    if (raw === undefined || raw === null)
+        return { kind: "absent" };
+    const field = tightenOnlySeatField(name);
+    const refuse = (message, fields) => ({ kind: "refused", seat: name, message: sanitized(message), fields });
+    if (!Array.isArray(raw)) {
+        return refuse(`${field} must be an array of ${row.grammar} — refused rather than ignored, because an ignored list reads as "in effect" to the caller`, { field, reason: "bad_entry" });
+    }
+    if (raw.length > row.maxEntries) {
+        const refusal = limitRefusal(field, "entries", raw.length, row.maxEntries, {
+            tail: "Refused rather than truncated: a truncated list silently drops the entries past the cap, and a dropped tightening is one that never happened. Merge entries into broader patterns or trim the list",
+        });
+        return refuse(refusal.message, refusal.facts);
+    }
+    const list = [];
+    for (let index = 0; index < raw.length; index++) {
+        const read = row.readEntry(raw[index]);
+        if (!read.ok) {
+            const after = read.after.replace(/\.$/, "");
+            return refuse(`${field}[${index}]${after} — every entry must be ${row.grammar}. Refused rather than dropped, because a dropped entry reads as "in effect" to the caller`, { field, reason: "bad_entry", index });
+        }
+        list.push(read.value);
+    }
+    const budget = row.budget;
+    if (budget !== undefined) {
+        const count = budget.measure(list);
+        if (count > budget.cap) {
+            return refuse(`${field} has ${count} ${budget.unit} in total — at most ${budget.cap} are accepted. Refused rather than truncated: a truncated list silently drops the entries past the budget, and a dropped tightening is one that never happened. Merge entries into broader patterns or trim the list`, { field, reason: "over_cap", count, cap: budget.cap });
+        }
+    }
+    return { kind: "list", list };
+}
+export function tightenOnlySeatIssue(settings) {
+    for (const reading of eachSeat((name, row) => readSeat(name, row, settings))) {
+        if (reading.kind === "refused")
+            return { seat: reading.seat, message: reading.message, fields: reading.fields };
+    }
+    return null;
+}
+function sanitized(message) {
+    return stripControlAndBidi(message);
+}
+export function readTightenOnlySeats(settings) {
+    const draft = {};
+    const rejected = [];
+    eachSeat((name, row) => {
+        const reading = readSeat(name, row, settings);
+        if (reading.kind === "refused")
+            rejected.push(name);
+        else if (reading.kind === "list" && reading.list.length > 0)
+            row.put(draft, reading.list);
+    });
+    return { values: draft, rejected };
+}
+export function tightenOnlySpecSeats(values) {
+    const fragments = eachSeat((_name, row) => {
+        const list = row.get(values);
+        if (list === undefined || list.length === 0)
+            return undefined;
+        const sink = row.sink;
+        switch (sink.kind) {
+            case "core_task_seat":
+                return sink.toSpec(list);
+            case "approval_seat":
+                return undefined;
+            default: {
+                const unhandled = sink;
+                throw new Error(`tighten-only seat sink ${JSON.stringify(unhandled)} has no projection arm`);
+            }
+        }
+    });
+    return fragments.reduce((acc, fragment) => (fragment === undefined ? acc : { ...acc, ...fragment }), {});
+}
+//# sourceMappingURL=tighten-only-seats.js.map