@sema-agent/server 7.132.0 → 7.134.0

package/dist/capabilities/scenarios.js

@@ -1,16 +1,23 @@
-import { WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
+import { USER_ATTACHMENT_SEAT, WEB_FETCH_TOOL_NAME, assembleCodeTools, defaultTaskRegistry } from "@sema-agent/core";
 import { HttpError, createCodedHttpError } from "../security.js";
 import { createSubagentExtraTools, extraToolsErrorFields, nowTool } from "./builtin-tools.js";
 import { parseRepo, repoToolsFor } from "./repo-tools.js";
 import { NOW_TOOL_NAME, REPO_PULL_DIFF_TOOL_NAME, REPO_READ_FILE_TOOL_NAME, REPO_TREE_TOOL_NAME } from "./host-tool-names.js";
 import { createWebSearchBackend, judgeRequestWebSearch } from "../plugins/web-search.js";
 import { skillsForScenario } from "./skills.js";
+import { OFFICE_EXCLUDED_TOOL_NAMES, runHasWorkspace } from "./hands-lane.js";
 import { BRAND_IDENTITY_SCENARIOS } from "./brand-identity.js";
 export function buildPromptSeats(scenarioName, prompt, callerSystemPrompt) {
     const parts = [prompt?.roleText, callerSystemPrompt].filter((t) => typeof t === "string" && t.length > 0);
     const systemPrompt = parts.length > 0 ? parts.join("\n\n") : callerSystemPrompt;
     return { promptBinding: scenarioName, ...(prompt?.role !== undefined ? { promptRole: prompt.role } : {}), ...(systemPrompt !== undefined ? { systemPrompt } : {}) };
 }
+export function buildExcludeToolsSeat(scenarioExcludes, callerExcludes) {
+    if (scenarioExcludes === undefined || scenarioExcludes.length === 0)
+        return callerExcludes !== undefined ? { excludeTools: [...callerExcludes] } : {};
+    const own = new Set(scenarioExcludes);
+    return { excludeTools: [...scenarioExcludes, ...(callerExcludes ?? []).filter((n) => !own.has(n))] };
+}
 export { SEMA_IDENTITY } from "./prompts/identity.js";
 function requestWebSearchBackend(verdict, deployment, logger) {
     switch (verdict.kind) {
@@ -31,6 +38,8 @@ export function buildScenarios(deps) {
         const webSearch = requestWebSearchBackend(deps.requirePrincipal !== true
             ? judgeRequestWebSearch(req?.settings?.webSearch)
             : { kind: "absent" }, deps.webSearch, deps.logger);
+        const ensureChildSessionDurable = deps.ensureChildSessionDurable;
+        const delegationRoot = ctx?.delegationRoot;
         return {
             tools: [
                 nowTool(),
@@ -49,7 +58,7 @@ export function buildScenarios(deps) {
                             scope: "default",
                             ...(deps.backgroundAgentStore ? { agentStore: deps.backgroundAgentStore } : {}),
                             ...(deps.checkpointStore ? { checkpointStore: deps.checkpointStore } : {}),
-                            ...(deps.ensureChildSessionDurable ? { ensureChildSessionDurable: deps.ensureChildSessionDurable } : {}),
+                            ...(ensureChildSessionDurable !== undefined ? { ensureChildSessionDurable: (childSessionId) => ensureChildSessionDurable(childSessionId, delegationRoot) } : {}),
                         },
                         ...createSubagentExtraTools(deps.subagentExtraTools),
                         ...(deps.logger
@@ -59,7 +68,7 @@ export function buildScenarios(deps) {
                     ...(webSearch ? { webSearch } : {}),
                 }).filter((t) => t.name !== WEB_FETCH_TOOL_NAME || deps.requirePrincipal !== true),
             ],
-            hands: "full",
+            hands: BUILTIN_SCENARIO_HANDS.default,
             skills: skillsForScenario(deps.skills, "default"),
         };
     };
@@ -67,6 +76,7 @@ export function buildScenarios(deps) {
         default: defaultScenario,
         code: (req, principal, ctx) => ({
             ...defaultScenario(req, principal, ctx),
+            hands: BUILTIN_SCENARIO_HANDS.code,
             prompt: { role: "code" },
         }),
         "code-review": (req) => codeReview(deps, req),
@@ -77,10 +87,17 @@ export function buildScenarios(deps) {
             }
             return {
                 tools: [...repoToolsFor(repoClient, parseRepo(req.repo)), nowTool()],
-                hands: "none",
+                hands: BUILTIN_SCENARIO_HANDS.scan,
                 skills: skillsForScenario(deps.skills, "scan"),
             };
         },
+        cowork: (req, principal, ctx) => ({
+            ...defaultScenario(req, principal, ctx),
+            hands: BUILTIN_SCENARIO_HANDS.cowork,
+            skills: skillsForScenario(deps.skills, "cowork"),
+            excludeTools: OFFICE_EXCLUDED_TOOL_NAMES,
+            prompt: { role: "cowork" },
+        }),
     };
 }
 export function selectScenario(scenarios, name) {
@@ -91,11 +108,22 @@ export function selectScenario(scenarios, name) {
         throw new Error(`scenario "${name}" is not registered — resolve a request's scenario through gateScenarioRequest, which only returns registered names`);
     return picked;
 }
+export function attachmentSuppliesFor(hands, handsLane) {
+    const workspace = runHasWorkspace(hands, handsLane);
+    return USER_ATTACHMENT_SEAT.supplies.filter((supply) => workspace || supply !== "path");
+}
 function availabilityFields(deps, toolset) {
     const verdict = scenarioAvailability(deps, toolset);
     return verdict.available ? { available: true } : { available: false, unavailableReason: verdict.reason };
 }
-export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan"];
+export const BUILTIN_SCENARIO_NAMES = ["code", "default", "code-review", "scan", "cowork"];
+export const BUILTIN_SCENARIO_HANDS = {
+    code: "full",
+    default: "full",
+    "code-review": "none",
+    scan: "none",
+    cowork: "full",
+};
 export function builtinScenarioDetails(scenarios, deps, branded) {
     const probe = (name, req, principal, fallback) => {
         try {
@@ -109,6 +137,7 @@ export function builtinScenarioDetails(scenarios, deps, branded) {
     const mk = (name, summary, toolset, tools, promptSummary) => ({
         name, source: "builtin", builtin: true, summary, toolset, tools, promptSummary, enabled: true,
         ...availabilityFields(deps, toolset),
+        attachmentSupplies: attachmentSuppliesFor(BUILTIN_SCENARIO_HANDS[name], deps.handsLane === true),
     });
     const brandedScenario = (name) => branded && BRAND_IDENTITY_SCENARIOS.includes(name);
     const details = {
@@ -116,6 +145,7 @@ export function builtinScenarioDetails(scenarios, deps, branded) {
         default: mk("default", "通用/助理场景(域中性 persona,CC agent loop 全量工具面;[891] 起非出厂缺省,显式可选)", "full-body", probe("default", {}, undefined, [NOW_TOOL_NAME]), brandedScenario("default") ? "Sema 产品身份 + core 默认宪法(结构层由引擎合成)" : "core 默认宪法(中性,无场景附加 persona)"),
         "code-review": mk("code-review", "代码评审(clone-free 只读仓库工具)", "repo-readonly", probe("code-review", { repo: "probe/probe" }, undefined, REPO_TOOLS), "评审员提示词(产出契约)"),
         scan: mk("scan", "中性只读仓库扫描(输出契约由 objective+skills 决定)", "repo-readonly", probe("scan", { repo: "probe/probe" }, undefined, REPO_TOOLS), "无场景附加提示词(objective+center skills 拥有输出契约)"),
+        cowork: mk("cowork", "办公向场景(default 的工具面去编码类工具:文件读 / 浏览 / 连接器挂载;Cowork 角色基底)", "office", probe("cowork", {}, undefined, [NOW_TOOL_NAME]), "core Cowork 角色基底(promptRole: cowork;办公向,不带编码 persona)"),
     };
     return details;
 }
@@ -126,7 +156,8 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             continue;
         if (typeof spec.name !== "string" || !SCENARIO_NAME_RE.test(spec.name))
             continue;
-        if (!Object.hasOwn(TOOLSETS, spec.toolset) || !TOOLSETS[spec.toolset])
+        const toolset = Object.hasOwn(TOOLSETS, spec.toolset) ? TOOLSETS[spec.toolset] : undefined;
+        if (!toolset)
             continue;
         out[spec.name] = {
             name: spec.name,
@@ -138,6 +169,7 @@ export function centerScenarioDetails(specs, builtinNames, deps) {
             promptSummary: "",
             enabled: true,
             ...availabilityFields(deps, spec.toolset),
+            attachmentSupplies: attachmentSuppliesFor(toolset.hands, deps.handsLane === true),
         };
     }
     return out;
@@ -213,7 +245,7 @@ function codeReview(deps, req) {
     const coords = parseRepo(req.repo);
     const repoTools = repoToolsFor(repoClient, coords);
     const skills = skillsForScenario(deps.skills, "code-review");
-    const hands = "none";
+    const hands = BUILTIN_SCENARIO_HANDS["code-review"];
     return { tools: [...repoTools, nowTool()], hands, skills, prompt: { roleText: REVIEWER_ROLE_TEXT } };
 }
 const REVIEWER_ROLE_TEXT = "You are a senior code reviewer. Call repo_tree to map the repository, then repo_read_file to read " +

package/dist/capability-facts.d.ts

@@ -22,7 +22,7 @@ import type { FlatServiceDeps } from "./http/server.js";
 import type { ServiceConfig } from "./config.js";
 import type { OwnerAwareSessionStore } from "./security.js";
 import type { ServiceFileHistoryStore } from "./plugins/store-backend.js";
-import { resolveStreamApprovalGate } from "./tool-approval.js";
+import { resolveStreamApprovalGate, type ApprovalFrameFamily } from "./tool-approval.js";
 import { type WorkspaceSyncCapability } from "./workspace-space.js";
 import type { WorkspaceCacheCapability } from "./workspace-cache.js";
 /** why 闭集:词 → 给运维看的一句义(诊断 / 测试读它;wire 上的拒句由各门自写)。 */
@@ -56,7 +56,8 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly image_index_absent: "no image index is wired (SQL backends only)";
     readonly shared_memory_store_absent: "no shared memory store provider is wired";
     readonly org_memory_directory_absent: "no org memory directory (membership fold) is wired";
-    readonly operator_principals_empty: "OPERATOR_PRINCIPALS is empty, so no caller can ever be an operator";
+    readonly org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)";
+    readonly operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${string}`;
     readonly adoption_store_absent: "no adoption log store is wired (SQL backends only)";
     readonly memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired";
     readonly memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired";
@@ -73,6 +74,7 @@ export declare const CAPABILITY_FACT_WHY: {
     readonly ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)";
     readonly tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)";
     readonly stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)";
+    readonly read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant";
     readonly background_agent_store_absent: "no background-agent store is wired";
     readonly sendfile_ledger_absent: "no SendUserFile ledger is wired";
     readonly workflow_engine_absent: "the workflow engine is not available on this worker";
@@ -199,6 +201,29 @@ type ActiveStreamApproval = Extract<ReturnType<typeof resolveStreamApprovalGate>
 export declare function streamApproval(d: Pick<Deps, "toolApproval" | "config" | "backend" | "checkpointStore">): Fact<StreamApprovalWhy, {
     askStore: ActiveStreamApproval["askStore"];
 }>;
+/**
+ * 读根授权(「Yes, and add directory」)这台部署**受理不受理** —— `GET /v1/capabilities` 的 `approvalReadRootGrant` 位,与
+ * `POST /v1/tool-approvals/:id/respond` 对应答体 `readRootGrant` 的受理门**读同一只**(位说不受理而口照收,就是「位说 X、行为不是 X」)。
+ *
+ * 判据 = 单用户 host 车道姿态 {@link cwdHonored}(与调用方 `cwd` / 附加目录同一条信任边界):授权把一个**宿主目录**加进本 run 的读目录,
+ * 只有「这台机器一个可信主人」的姿态才有这个授权的语义;多租户与云上 / 容器车道的读面另有归宿(沙箱内的读面档位见 `READ_FACE`)。
+ * 消费方的选项可见条件是**合取**:卡上有 `readRootCandidate`(逐卡位,引擎铸)∧ 本位为真。位缺席 = 老 server(不受理)。
+ * 没有别的端点按本位判可用与否 —— 它只管应答体里的这一键。
+ */
+export declare function readRootGrant(d: Pick<Deps, "config">): Fact<"read_root_grant_posture_refused">;
+/**
+ * 审批开卡帧的族 —— `GET /v1/capabilities` 的 `approvalFrameFamilies` 位。**值族投影**(出形是闭集词数组,不是 `{ available }`;同
+ * `engineCapabilityBits` 一类),入参是 {@link streamApproval} **已求出的那一份事实**而不是 deps:一次请求里 `streamApproval` 位与本位读同一次判据求值
+ * (判据读活配置与 backend,两次求值在开关热改的窗口里会撕出 `streamApproval:true` 配旧族的应答;也多取一次 ask 店)。
+ *  · 流内审批在场(呈卡协议上场)⇒ `["approval_request"]`;
+ *  · 活卡协调器在、协议没上场(开关关 / 无 store backend / 无 park 设施)⇒ `["tool_approval"]`;
+ *  · 活卡协调器缺席 ⇒ `[]`(没有审批卡可呈)。
+ * 对 why 闭集穷举:`streamApproval` 的拒因多一个 ⇒ 这里编译红,逼着给新拒因定族。三条执行腿选族读的是同一只判据的 `active`,
+ * 与本映射的「在场 ⇒ 呈卡族」是同一条规则(真腿对拍钉在 `test/stream-approval-on-e2e.test.ts`)。没有端点按它拒:它是消费方分派帧族的读点,`streamApproval` 的词义不变。
+ * S-1914:它也是壳**声明**的依据 —— 一条 run 只在 `settings.approvalFrameFamilies` 含本位那一个族时有活审批通道(三条腿判的是同一只映射
+ * `presentedApprovalFrameFamily`);不含 ⇒ 这条腿不呈卡,问当场交无人值守政策口。本位的值不因声明而变。
+ */
+export declare function approvalFrameFamilies(stream: ReturnType<typeof streamApproval>): readonly ApprovalFrameFamily[];
 export declare function deviceLane(d: Pick<Deps, "deviceHub">): Fact<"device_hub_absent", {
     hub: Store<"deviceHub">;
 }>;
@@ -232,12 +257,19 @@ export declare function sharedMemoryRead(d: Pick<Deps, "sharedMemoryStore" | "or
     provider: Store<"sharedMemoryStore">;
     directory: Store<"orgMemoryDirectory">;
 }>;
-/** operator 名单非空。空名单下 `explicitOperatorOk` 对任何身份恒假 ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
+/** 跨主体投递门在座(`POST /v1/principal-inbox/messages` 的可用性门与能力位 `principalInboxDelivery` 同读这一只)。门的装配本身是
+ *  一道合取(收件箱消费方声明 ∧ 耐久 mailbox ∧ org 成员目录 ∧ 配额店,缺一拒启 —— `boot/stage-06-runners.ts`),
+ *  所以这里只判「门在不在」:在 ⟺ 那四件都在。 */
+export declare function principalInboxDelivery(d: Pick<Deps, "orgDeliveryGate">): Fact<"org_delivery_gate_absent", {
+    gate: Store<"orgDeliveryGate">;
+}>;
+/** 这台部署有运维名册(名单非空 ∨ 单用户声明 `OPERATOR_SINGLE_USER`;唯一读法 `operatorRosterPresent`)。没有时 `explicitOperatorOk` 对任何身份恒假
+ *  ⇒ 这一族的口对谁都打不通 = 部署不可用(不是鉴权拒)。
  *
  * operator 族的复合事实**先判名单、再判设施**:门序是「身份 → 名单空(501)→ 授权(403)→ 设施缺席(501)」——
  * 名单空时没有人过得了授权,不先判它,这一形就永远答成 403;设施缺席则留在授权之后答(不对非 operator 透露部署形态)。 */
 export declare function operatorLane(d: {
-    readonly config: Pick<ServiceConfig, "operatorPrincipals">;
+    readonly config: Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
 }): Fact<"operator_principals_empty">;
 type AdoptionCapableBackend = Store<"backend"> & {
     adoptionLog(): ReturnType<NonNullable<Store<"backend">["adoptionLog"]>>;

package/dist/capability-facts.js

@@ -1,5 +1,7 @@
+import { buildOperatorRosterWayOut, operatorRosterPresent } from "./http/principal-gate.js";
 import { mcpInjectionHonored } from "./task-mcp.js";
-import { resolveStreamApprovalGate } from "./tool-approval.js";
+import { cwdHonored } from "./task-cwd.js";
+import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-approval.js";
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
 import { overwriteWipeIncapable } from "./session-sync.js";
@@ -34,7 +36,8 @@ export const CAPABILITY_FACT_WHY = {
     image_index_absent: "no image index is wired (SQL backends only)",
     shared_memory_store_absent: "no shared memory store provider is wired",
     org_memory_directory_absent: "no org memory directory (membership fold) is wired",
-    operator_principals_empty: "OPERATOR_PRINCIPALS is empty, so no caller can ever be an operator",
+    org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)",
+    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut()}`,
     adoption_store_absent: "no adoption log store is wired (SQL backends only)",
     memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired",
     memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired",
@@ -51,6 +54,7 @@ export const CAPABILITY_FACT_WHY = {
     ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)",
     tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)",
     stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)",
+    read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
     workflow_engine_absent: "the workflow engine is not available on this worker",
@@ -192,7 +196,7 @@ export function streamApproval(d) {
         toolApprovalEnabled: d.toolApproval !== undefined,
         streamApprovalEnabled: d.config.streamApproval?.enabled === true,
         backend: d.backend,
-        parkFacility: d.checkpointStore !== undefined,
+        checkpointStore: d.checkpointStore,
     });
     if (gate.active)
         return yes({ askStore: gate.askStore });
@@ -211,6 +215,25 @@ export function streamApproval(d) {
         }
     }
 }
+export function readRootGrant(d) {
+    return cwdHonored(d.config) ? YES : no("read_root_grant_posture_refused");
+}
+export function approvalFrameFamilies(stream) {
+    if (stream.available)
+        return [presentedApprovalFrameFamily(true)];
+    switch (stream.why) {
+        case "tool_approval_disabled":
+            return [];
+        case "stream_approval_disabled":
+        case "store_backend_absent":
+        case "checkpoint_store_absent":
+            return [presentedApprovalFrameFamily(false)];
+        default: {
+            const unhandled = stream.why;
+            throw new Error(`unhandled stream-approval why: ${JSON.stringify(unhandled)}`);
+        }
+    }
+}
 export function deviceLane(d) {
     return d.deviceHub !== undefined ? yes({ hub: d.deviceHub }) : no("device_hub_absent");
 }
@@ -252,8 +275,11 @@ export function sharedMemoryRead(d) {
         return no("org_memory_directory_absent");
     return yes({ provider: d.sharedMemoryStore, directory: d.orgMemoryDirectory });
 }
+export function principalInboxDelivery(d) {
+    return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");
+}
 export function operatorLane(d) {
-    return d.config.operatorPrincipals.length > 0 ? YES : no("operator_principals_empty");
+    return operatorRosterPresent(d.config) ? YES : no("operator_principals_empty");
 }
 export function adoption(d) {
     const lane = operatorLane(d);

package/dist/center-config-tier.d.ts

@@ -0,0 +1,69 @@
+/**
+ * S-667 —— **中心配置档位的唯一属主**:「在用的中心配置是谁的」+「换人之后降到了无中心配置档没有」+ 两态通告。
+ *
+ * ## 律
+ * 凭证身份(凭据文件里的主体,`center-credential.ts` 的 `identity`)变化的那一刻,server 自己:
+ *  1. 把在用的中心配置降到「无中心配置」档 —— 每个中心下发的热面回 env 底、中心提示词层撤下、Runner 的模型表换回 env 表;
+ *  2. 当场发起一次拉取(不等下一个 60s 拍);
+ *  3. 通告 {@link CenterIdentityNoticeCode} `center_identity_demoted`;新身份的候选落地 ⇒ 通告 `center_identity_landed`。
+ * 拉取成功之前**不回退**到上一个人的任何东西(盘上 LKG 是按身份分箱的,新身份的箱里没有上一个人的;内存里的在用候选在降档时已清)。
+ * 不采「壳重启引擎」:读凭据文件的那一刻引擎自己就判得出,壳只能猜;本机引擎多会话共享,重启会打断别的会话正在跑的 run。
+ *
+ * ## 本模块只管状态与词,不管动作
+ * 降档的动作(换活配置、换 Runner 席、撤提示词层、拉取)在 `boot/web-admin.ts`,那里是活配置与单飞拍的属主;本模块是纯状态机:
+ *  · `committed(identity)` —— 一份中心候选(或「无中心配置」候选自己,身份缺席)提交了:记下在用配置的身份;降档态下第一份带身份的提交 = 换上了;
+ *  · `drifted(identity)` —— 此刻凭证的身份与参照身份(在用配置的,或已降档时在等的)不一致吗(只有存在参照且「凭证身份读得出」才可能为真);
+ *  · `demote(awaiting)` / `retarget(awaiting)` —— 记下降档、改在等的身份;
+ *  · `notice()` —— 最近一条通告(`/health.centerIdentityNotice` 的取值口读它)。
+ *
+ * ## 通告的面
+ * 通告是**最近一条**,不是事件日志:`/health.centerIdentityNotice = { code, message, at, retained? }`(无鉴权面 —— 只有闭集码、冻结句、时刻,
+ * 不带身份、不带令牌、不带路径);从未换过人 ⇒ 键缺席。消费端按 `at` 判断「这一条我转述过没有」。日志轴另有同名事件
+ * (`center_identity_demoted` warn / `center_identity_landed` info)。
+ * 这两只码**不在** core 的 `EngineNotice` 码册里(那是 core 的闭集,受众与归属键由 core 定;进该册要 core 加行)—— 它们是本服务自铸的 `/health` 值,
+ * 登记在 `trace/self-minted-wire.ts` 的 `centerIdentityNotice`,契约 §0.4 成文。
+ */
+import type { ConfigApplyGroup } from "./web-admin-client/apply-ledger.js";
+/** 两态通告码(闭集)。新增一个 = `CENTER_IDENTITY_NOTICE_MESSAGE` 与 `SELF_MINTED_WIRE.centerIdentityNotice` 当场编译红。 */
+export declare const CENTER_IDENTITY_NOTICE_CODES: readonly ["center_identity_demoted", "center_identity_landed"];
+export type CenterIdentityNoticeCode = (typeof CENTER_IDENTITY_NOTICE_CODES)[number];
+/**
+ * 每个码的**冻结句**(wire 可见 —— `test/api-notice-text-freeze.test.ts` §8 逐字冻;改一个字节要同步契约与消费端)。
+ * 句子是定句:不带身份、不带版本号、不带路径,免鉴权面上读到它不泄露任何东西。映射型逐码穷举。
+ */
+export declare const CENTER_IDENTITY_NOTICE_MESSAGE: {
+    readonly center_identity_demoted: "The center credential now belongs to another account: this engine dropped the previous account's center configuration and runs on its base configuration (no center layer) until the new account's configuration is pulled.";
+    readonly center_identity_landed: "The new account's center configuration was pulled and is now in force.";
+};
+/** 一条通告(wire 形:`/health.centerIdentityNotice` 就是这个对象)。 */
+export interface CenterIdentityNotice {
+    readonly code: CenterIdentityNoticeCode;
+    readonly message: string;
+    /** 铸这条通告的时刻(ms epoch)。 */
+    readonly at: number;
+    /**
+     * 只在 `center_identity_demoted` 上、且非空时在场:降档**没能降到底**的组 —— 该组被整拒(例:env 的审批名单在这台部署上无处可服务),活值仍是上一个人下发的。
+     * 冻结句说「回了基础配置」,这一键让它对这几组如实:成员是世代账的组闭集(`ConfigApplyGroup`)。缺席 = 每个热面都已回 env 底。
+     */
+    readonly retained?: readonly ConfigApplyGroup[];
+}
+export interface CenterConfigTier {
+    /** 一份候选提交了(含部分应用)。`identity` = 拉到它的凭证身份;缺席 = 本地腿候选 / 「无中心配置」候选自己(没有中心配置在服务)。
+     *  降档态下第一份带身份的提交 ⇒ 铸并返回 `center_identity_landed`;其余返回 undefined。 */
+    committed(identity: string | undefined): CenterIdentityNotice | undefined;
+    /**
+     * 此刻凭证的身份与「参照身份」不一致吗 —— 参照 = 在用中心配置的身份;已降档则是降档在等的那个身份。没有参照(没有中心配置在服务、也没降过档)/
+     * 凭证身份读不出(`undefined`)⇒ 恒假:降无可降,读不出不是换了人。
+     */
+    drifted(identity: string | undefined): boolean;
+    /** 记下降档(此后没有中心配置在服务,在等 `awaiting` 这个身份的候选)并铸 `center_identity_demoted`;`retained` = 没能降到底的组(空 / 缺席 = 全降到底)。 */
+    demote(awaiting: string, retained?: readonly ConfigApplyGroup[]): CenterIdentityNotice;
+    /** 已降档态下凭证又换了人:只改「在等谁」,不再铸通告(还是同一次降档 —— 新身份的候选没落地)。 */
+    retarget(awaiting: string): void;
+    /** 最近一条通告;从未铸过 ⇒ undefined。 */
+    notice(): CenterIdentityNotice | undefined;
+    /** 是否在降档态(降过、新身份的候选还没落地)。 */
+    isDemoted(): boolean;
+}
+export declare function createCenterConfigTier(now?: () => number): CenterConfigTier;
+//# sourceMappingURL=center-config-tier.d.ts.map

package/dist/center-config-tier.js

@@ -0,0 +1,42 @@
+export const CENTER_IDENTITY_NOTICE_CODES = ["center_identity_demoted", "center_identity_landed"];
+export const CENTER_IDENTITY_NOTICE_MESSAGE = {
+    center_identity_demoted: "The center credential now belongs to another account: this engine dropped the previous account's center configuration and runs on its base configuration (no center layer) until the new account's configuration is pulled.",
+    center_identity_landed: "The new account's center configuration was pulled and is now in force.",
+};
+export function createCenterConfigTier(now = Date.now) {
+    let inForce;
+    let awaiting;
+    let demoted = false;
+    let last;
+    const mint = (code, retained = []) => {
+        last = { code, message: CENTER_IDENTITY_NOTICE_MESSAGE[code], at: now(), ...(retained.length > 0 ? { retained: [...retained] } : {}) };
+        return last;
+    };
+    return {
+        committed(identity) {
+            inForce = identity;
+            if (!demoted || identity === undefined)
+                return undefined;
+            demoted = false;
+            awaiting = undefined;
+            return mint("center_identity_landed");
+        },
+        drifted(identity) {
+            const reference = demoted ? awaiting : inForce;
+            return reference !== undefined && identity !== undefined && identity !== reference;
+        },
+        demote(next, retained) {
+            inForce = undefined;
+            awaiting = next;
+            demoted = true;
+            return mint("center_identity_demoted", retained);
+        },
+        retarget(next) {
+            if (demoted)
+                awaiting = next;
+        },
+        notice: () => last,
+        isDemoted: () => demoted,
+    };
+}
+//# sourceMappingURL=center-config-tier.js.map

package/dist/checkpoint-ctx-seal-m28.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 一次性迁移 M28 —— 升级之前写下的停驻行(`checkpoint_ctx`)里,请求面凭据位上的明文起服**原地封好**。
+ * 🔴 M28 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 7.134.0 起凭据位上的值在 ctx 里只以封签存在(规则属主 `http/checkpoint-ctx.ts` 末段「凭据位密封」),续跑上下文读口对凭据位上的明文答
+ * 409 `conflict.checkpoint_ctx_unsealable`(`reason:"plaintext"`)。升级前停驻的行是明文 —— 持久数据面不能「翻红」,所以起服扫一遍、用**同一只**封口
+ * (`sealStoredCheckpointCtxM28`,与写侧 `sealCheckpointCtx` 同一只走法)封好、原地回写;不删行、不动续跑时钟、已封的与不带凭据的行零写。
+ *
+ * ## 为什么不在 `one-time-migrations.ts` 的迁移段里
+ * 封要保管店派生的封签器,而那一段跑在店层(起服第 3 段,`openStores`),比建店的 web-admin 运行时能把封签器交下去的地方早、也不该反向依赖它;
+ * 本条在起服第 6 段 checkpoint 店建成、封签器的装配判(`CHECKPOINT_CTX_SEALING_REQUIRED`)过了之后调一次,早于任何路由装配(与 M10 / M19 / M25
+ * 同为在迁移段之外跑的条目)。读数一行 info `checkpoint_ctx_credentials_sealed`,不进 `OneTimeMigrationReport`(登记行 `reportKeys` 空)。
+ */
+import { type CheckpointCtxSealer, type SealedCheckpointCtx } from "./http/checkpoint-ctx.js";
+import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
+import type { CtxRowsRewriteM28 } from "./plugins/checkpoint-store-sql.js";
+/** 两孪生的店腿(`SqlCheckpointStore` / `LocalCheckpointStore` 的 `rewriteCtxRowsM28`)。 */
+export interface CheckpointCtxRowsRewriterM28 {
+    rewriteCtxRowsM28(rewrite: (sessionId: string, ctx: object) => {
+        readonly ctx: SealedCheckpointCtx;
+        readonly values: number;
+    } | undefined): Promise<CtxRowsRewriteM28>;
+}
+/** M28 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。 */
+export interface CheckpointCtxSealM28Report {
+    readonly window: "open" | "closed";
+    readonly rowsScanned: number;
+    readonly rowsSealed: number;
+    readonly valuesSealed: number;
+    readonly rowsUnreadable: number;
+    readonly rowsTooLarge: number;
+}
+/**
+ * 跑一次 M28(`today` = UTC 日历日 YYYY-MM-DD;`window` 缺省 = 登记表 M28 那一行 —— 只有测试递别的窗)。窗关 ⇒ 不扫。
+ * 店腿的每一行:`sealStoredCheckpointCtxM28` 交回新体(凭据位上的明文封好)⇒ 回写;交回 `undefined`(没有明文)⇒ 不写。
+ */
+export declare function sealCheckpointCtxCredentialsM28(store: CheckpointCtxRowsRewriterM28, sealer: CheckpointCtxSealer, opts: {
+    readonly today: string;
+    readonly window?: Pick<OneTimeMigrationWindow, "removableAfter">;
+}): Promise<CheckpointCtxSealM28Report>;
+//# sourceMappingURL=checkpoint-ctx-seal-m28.d.ts.map

package/dist/checkpoint-ctx-seal-m28.js

@@ -0,0 +1,19 @@
+import { sealStoredCheckpointCtxM28 } from "./http/checkpoint-ctx.js";
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+function m28Window() {
+    const row = ONE_TIME_MIGRATIONS.find((w) => w.id === "M28");
+    if (row === undefined)
+        throw new Error("checkpoint-ctx-seal-m28: the one-time migration registry has no M28 row — this migration outlived its registry row; delete it with that row");
+    return row;
+}
+export async function sealCheckpointCtxCredentialsM28(store, sealer, opts) {
+    if (!migrationWindowOpen(opts.window ?? m28Window(), opts.today)) {
+        return { window: "closed", rowsScanned: 0, rowsSealed: 0, valuesSealed: 0, rowsUnreadable: 0, rowsTooLarge: 0 };
+    }
+    const r = await store.rewriteCtxRowsM28((sessionId, ctx) => {
+        const out = sealStoredCheckpointCtxM28(ctx, sealer, sessionId);
+        return out === undefined ? undefined : { ctx: out.ctx, values: out.valuesSealed };
+    });
+    return { window: "open", rowsScanned: r.scanned, rowsSealed: r.rewritten, valuesSealed: r.valuesRewritten, rowsUnreadable: r.unreadable, rowsTooLarge: r.tooLarge };
+}
+//# sourceMappingURL=checkpoint-ctx-seal-m28.js.map

package/dist/checkpoint-identity.d.ts

@@ -0,0 +1,16 @@
+/** `checkpointId` 的长度上界(见本文件头注第 2 条)。 */
+export declare const MAX_CHECKPOINT_ID_CHARS = 128;
+/** 持久层读出的 `checkpointId` 过信任边界:是串、非空、不超长、不含 token(大小写不敏感)⇒ 原值;否则 `undefined`。判据全文见本文件头注。 */
+export declare function trustedCheckpointId(raw: unknown, token: unknown): string | undefined;
+/** 带 `checkpointId` 当 join 键的两类 durable 读面(计数 detail 的 `face`)。 */
+export type DurableCheckpointFace = "approvals-queue" | "assistant-inbox";
+/**
+ * durable 读面的一行 → 它的身份片段,**由调用方原样展开进行投影**(`...durableRowIdentity(face, raw, token)`):读得出可信值 ⇒ `{ checkpointId }`;
+ * 读不出 ⇒ `{}`(这一行**照列**,键缺席)+ 计一次(见本文件头注「durable 面的 join 键」)。
+ * `raw === undefined` = 行上没有这一格(`why=absent`,老行);在场却没过信任边界(非串 / 空串 / 超长 / 含 token / 读不出)= `why=untrusted`。
+ * 三处读面(两只店的 `listPending` + 收件 handler)只经这一只 —— 读法、计数、缺席形各只有一份。
+ */
+export declare function durableRowIdentity(face: DurableCheckpointFace, raw: unknown, token: unknown): {
+    readonly checkpointId?: string;
+};
+//# sourceMappingURL=checkpoint-identity.d.ts.map

package/dist/checkpoint-identity.js

@@ -0,0 +1,19 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+export const MAX_CHECKPOINT_ID_CHARS = 128;
+export function trustedCheckpointId(raw, token) {
+    if (typeof raw !== "string" || raw === "" || raw.length > MAX_CHECKPOINT_ID_CHARS)
+        return undefined;
+    const secret = token === undefined || token === null ? "" : String(token).toLowerCase();
+    if (secret !== "" && raw.toLowerCase().includes(secret))
+        return undefined;
+    return raw;
+}
+export function durableRowIdentity(face, raw, token) {
+    const id = trustedCheckpointId(raw, token);
+    if (id === undefined) {
+        recordFailOpen("server.approvals.durable-row-checkpoint-id-missing", `face=${face} why=${raw === undefined ? "absent" : "untrusted"}`);
+        return {};
+    }
+    return { checkpointId: id };
+}
+//# sourceMappingURL=checkpoint-identity.js.map

package/dist/config-catalog.d.ts

@@ -93,7 +93,23 @@ export interface ConfigCatalogRowCenter {
     /** center 写**现在真的在生效**(在管 ∧ 未被 env 占位压住;env-wins 族 env 占位 ⇒ false = ⚪ 成因 a)。 */
     readonly effectiveNow: boolean;
 }
-export interface ConfigCatalogRow {
+/**
+ * 行上**对 `effectiveValue` 的判词位**(闭集;S-527 收成一族)—— 每一位**只在为真时铸 `true`、恒不铸 `false`**,缺席 = 这一格没有这件事
+ * (不是「不知道」)。净化器({@link sanitizeValue})一次读出值与判词,行投影原样铺平 —— 判词位只有这一种形,第三个判词位加进本闭集即受同一条约束。
+ *  · `effectiveValueInvalid`(S-100,additive)—— 本行的实算值**落在它自己宣告的回显闭集之外**(`echoWords ?? enumValues`,S-201①),
+ *    或它的实算腿回了一个本行没有声明映射的布尔。在场时 `effectiveValue` 恒 `null`:回显一个集外值等于目录在教消费方写一个写回去就非法的词,
+ *    而**静默丢**会让「配错了」与「真的没设」在 wire 上同形([ref] 响亮臂)。只服务闭集族(`type:"enum"`)。
+ *  · `effectiveValueWithheld`(S-527,additive)—— `type:"url"` 行:展示铸点对这一格(单值)或其中任一项(列表)判了扣下(`failedClosed`:
+ *    位置律本会显示的一段 —— 整段 query / 一个路径段 —— 因为里面有一条凭据形而不出门)。判决的属主是铸点,目录不另判;
+ *    标准位置律(userinfo 落地、query 每个值成记号)对每一行同样成立,不是扣下;值整只成占位 = 这一行的展示律显示不了这个值
+ *    (通用 url 行:不是层级式 URL;两只出网代理行的展示律更窄 —— 只显示 `scheme://host[:port]`,形不干净整只占位,`outbound-dispatcher.ts` `displayProxyUrl`),也不是本位。
+ */
+export type CatalogValueVerdict = "effectiveValueInvalid" | "effectiveValueWithheld";
+/** 判词位的行内形({@link CatalogValueVerdict} 每一员都是只取 `true` 的可选键)。 */
+export type CatalogValueVerdicts = {
+    readonly [K in CatalogValueVerdict]?: true;
+};
+export interface ConfigCatalogRow extends CatalogValueVerdicts {
     readonly name: string;
     readonly domain: CatalogDomain;
     readonly type: CatalogValueType;
@@ -105,15 +121,6 @@ export interface ConfigCatalogRow {
     readonly staticDefault?: string;
     readonly derivedDefaultNote?: string;
     readonly effectiveValue: CatalogValue;
-    /**
-     * S-100(additive;**只在真非法时铸,恒不铸 `false`**)—— 本行的实算值**落在它自己宣告的
-     * 回显闭集之外**(`echoWords ?? enumValues`,S-201①),或它的实算腿回了一个本行没有声明映射的布尔。
-     *
-     * 在场时 `effectiveValue` 恒 `null`:回显一个集外值等于目录在教消费方写一个写回去就非法的词,
-     * 而**静默丢**会让「配错了」与「真的没设」在 wire 上同形([ref] 响亮臂)。
-     * 缺席 = 这一格没问题(不是「不知道」)。
-     */
-    readonly effectiveValueInvalid?: true;
     readonly valueClass: "plain" | "secret" | "opaque";
     readonly danger: readonly CatalogDangerAxis[];
     readonly center?: ConfigCatalogRowCenter;