@sema-agent/server 7.135.0 → 7.136.0

package/dist/approval-card.d.ts

@@ -21,7 +21,7 @@
  * 没有方法、没有捕获的行为。
  */
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type ResumeStartupCause, type RuleOffer, type RuleOffersAbsence as CoreRuleOffersAbsence, type SteerReplayFacet } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, READ_ROOT_CANDIDATE_DIR_MAX, type AskClass, type AskEvidenceAbsence, type CheckpointSummary as CoreCheckpointSummary, type PendingAction as CorePendingAction, type ReadRootGrantCandidate, type ResumeStartupCause, type RuleOffer, type RuleOffersAbsence as CoreRuleOffersAbsence, type SteerReplayFacet, type ToolApprovalCard } from "@sema-agent/core";
 import type { AskRow } from "./plugins/approval-ask-store-sql.js";
 import type { SettleCause, SettleOutcome } from "./approval-deny-reasons.js";
 import type { ToolApprovalFrame } from "./tool-approval.js";
@@ -440,7 +440,7 @@ export interface AskClassPair {
  * [ref] ②(core 7.37.0 [ref])第六 / 七位 `askClass` / `classes`:这一问的类对(经 {@link readAskClassPair};两位同在同缺,与活卡帧 / 呈卡帧的卡
  * 同名同义同值)—— durable 审批席按类答的依据。缺席 = 老行(core 7.37.0 之前 park 的,续跑不补)/ 读不出(计 [ref] tag)。
  * [ref](core 7.51.0 [ref])第八位 `boundGrantAbsence`:这张卡为什么没有授予绑定摘要(经 {@link readClosedWordSeat};与活卡帧 / inbox 行同名同义同值)——
- * `not_bindable` = 这一问不绑任何授予(「本会话放行」可按工具记)。缺席 = 技能卡(带摘要;摘要不上队列行,见 ⑧b)/ 7.51.0 之前停驻的行(core inbox 投
+ * `not_bindable` = 这一问不绑任何授予(「本会话放行」可按工具记)。缺席 = 技能卡(带摘要;摘要与清单、成因词三位走另一只投影 {@link skillCardFacts},见其顶注)/ 7.51.0 之前停驻的行(core inbox 投
  * `unreadable`,队列行如实缺席)/ 集外词(计 [ref] tag)。
  */
 export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "ruleOffersAbsence" | "mandated" | "mandate" | "origin" | "askClass" | "classes" | "boundGrantAbsence">;
@@ -471,6 +471,32 @@ export type ParkRowFacts = Pick<ToolApprovalPark, "requiresRealApproval" | "rule
  * 不许拿本函数的产物去推强制 —— 两者共用的是 schema,不是折叠。
  */
 export declare function parkRowFacts(stored: unknown): ParkRowFacts;
+/**
+ * 🔴 **技能卡三位的唯一投影**:授予绑定摘要 `boundGrantDigest`、它哈希的清单 `boundGrants`、分类器没给判词的成因 `classifierNoRuling` ——
+ * 助手收件箱行(`GET /v1/assistant/inbox`)、运维队列行(`GET /v1/approvals` 的 `pending[]`)、`/v1/approvals/stream` 的 `pending` 帧三张停驻读面
+ * **经这一只函数**投它们。同一张停驻的技能卡于是三面同一份字节:运维从队列决这张卡时,看得到批准它还授予了什么。
+ *
+ * **输入恒是 core 的检查点摘要**({@link CoreCheckpointSummary},`summarizeCheckpoint` 的产物)—— 三位的校验点单点在 core:摘要是串才回显;清单**只在哈希等于摘要时**才发布
+ * (「never a list beside a digest that binds another」—— 一份与摘要对不上的清单会让批准人看着一份清单、批的却是另一份绑定);成因词只在闭集成员时回显。
+ * 本仓**不重算哈希**(core 的 `boundInputHashOf` 不在公开导出面上,清单校验读口 `readBoundBinding` 同样不导出),所以**不许**拿寄存行 `pendingAction` 上的原值直接投 ——
+ * 原值上的清单是未经哈希校验的(这正是三位此前不上队列行的原因,见 `trace/core-keyset-guard.ts` ⑧b 记账的旧注)。两只店各自拿到「这一行的摘要」的办法不同
+ * (LOCAL 孪生本来就握着 core 对同一行投的摘要;SQL 孪生对带三位之一的行读一次该行再调 core 的 `summarizeCheckpoint`,见 `plugins/checkpoint-store-sql.ts`),
+ * 但投影只有这一只:OMIT 契约 —— 缺席即缺席,恒不铸 `undefined` 值的键。
+ *
+ * `boundGrants` 是**部署文本**(技能名、清单条目):本函数不脱敏、不转义,与收件箱行逐字同口径 —— 渲染按上下文转义是客户端的事(契约同句)。
+ * 三位都不进 `card_json`(同步路铸点,另一条纪律)。
+ *
+ * 🚧 清单校验读口 `readBoundBinding` 若成为 core 的公开导出,SQL 孪生那一次整行读与 {@link parkRowCarriesSkillCardFacts} 一并退役:`parkRowFacts` 直接读寄存行原值经 core 的读口投三位。
+ */
+export type SkillCardFacts = Pick<CoreCheckpointSummary, "boundGrantDigest" | "boundGrants" | "classifierNoRuling">;
+export declare function skillCardFacts(summary: SkillCardFacts): SkillCardFacts;
+/**
+ * 这一行的寄存行(`pendingAction`,读自持久层 ⇒ `unknown`)**有没有可能**让 core 的摘要投出三位里的任何一位 —— 只回答「值不值得为它取一次摘要」,**不投值**:
+ * `tool_approval` 臂上摘要字段是串(core 只在这时回显摘要与清单),或成因词键在场(是不是闭集成员由 core 的摘要判)。判错的方向只有一个 —— 多取一次摘要(摘要读数为空),
+ * 绝不漏取:摘要字段不是串 ⇒ core 的摘要既无摘要也无清单;成因词键不在 ⇒ 无成因词 —— 两者都不满足的行,摘要里这三位恒空。普通卡(绝大多数行)因此零额外读。
+ * 只读键在不在 / 是不是串,不读值的内容,所以不需要 {@link readClosedWordSeat} 那样的计数。
+ */
+export declare function parkRowCarriesSkillCardFacts(stored: unknown): boolean;
 /** [ref](core 7.4.0 [ref])—— 回落卡的计数与窗。`limit` 是**闭二词**(core d.ts 逐字),两个计数是
  *  非负整数,`autoDenyAfterMs` 是 core 契约里的 `0..2147483647` 非负整数(`0` = 本卡不武装窗:部署把
  *  旋钮关了,或 TOTAL 档的卡按 [ref]① 恒 0 等人)。四成员**全必填**——core 的 `DenialLimitFallback` 上
@@ -524,6 +550,18 @@ export declare const ApprovalCardSchema: z.ZodObject<{
     }, z.core.$strict>;
     governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
     rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
+    approvalCard: z.ZodOptional<z.ZodEnum<{
+        question: "question";
+        plan: "plan";
+        skill: "skill";
+        shell: "shell";
+        workflow: "workflow";
+        "file-edit": "file-edit";
+        "file-write": "file-write";
+        "notebook-edit": "notebook-edit";
+        fetch: "fetch";
+        generic: "generic";
+    }>>;
     inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
     allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
         member: z.ZodEnum<{
@@ -664,6 +702,18 @@ export declare const ApprovalCardEnvelopeSchema: z.ZodObject<{
         }, z.core.$strict>;
         governanceForced: z.ZodOptional<z.ZodLiteral<true>>;
         rememberRefused: z.ZodOptional<z.ZodLiteral<true>>;
+        approvalCard: z.ZodOptional<z.ZodEnum<{
+            question: "question";
+            plan: "plan";
+            skill: "skill";
+            shell: "shell";
+            workflow: "workflow";
+            "file-edit": "file-edit";
+            "file-write": "file-write";
+            "notebook-edit": "notebook-edit";
+            fetch: "fetch";
+            generic: "generic";
+        }>>;
         inputHasBidi: z.ZodOptional<z.ZodLiteral<true>>;
         allowRuleShadowed: z.ZodOptional<z.ZodArray<z.ZodObject<{
             member: z.ZodEnum<{
@@ -806,6 +856,9 @@ export interface ApprovalCardSource {
     governanceForced?: true;
     /** 7.116.0 S4:「本会话放行」不会被记住(帧上同名键,见 `ApprovalCardSchema.rememberRefused`)。 */
     rememberRefused?: true;
+    /** 7.136.0:引擎铸的卡词 —— 与 wire 帧**同一份素材**(发帧点经 `readApprovalCard` 读定的那一格)⇒ 活卡帧 / `approval_request` 的卡 / `card_json` /
+     *  重放帧四面同源(见 `ApprovalCardSchema.approvalCard`)。 */
+    approvalCard?: ToolApprovalCard;
     /** E-14:bidi 在场位 —— 与 wire 帧**同一份素材**(`ToolApprovalFrame` 结构上满足本接口)⇒ live 帧 /
      *  `approval_request` / `card_json` / 重放帧四面同源,不是四处各扫一遍。 */
     inputHasBidi?: true;
@@ -880,7 +933,7 @@ export declare function buildApprovalRequestFrame(input: {
 /**
  * 🔴 **呈卡帧的活面事实座**(呈卡腿上旧族退役之后,开卡帧的全部事实都由本族承载)。
  *
- * 这十个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位:
+ * 这十个座是活卡帧 `tool_approval` 上有、而卡(`ApprovalCardSchema`,`card_json` 的耐久信封)上**没有**的那几位(`approvalCard` 7.136.0 起也在卡上,见本注末段):
  * 卡外的事实此前只骑活卡帧,呈卡腿的消费方靠「两帧按 approvalId 合读」拿到它们。呈卡腿自此只发本族帧 ⇒ 它们挪到**活铸**的
  * 呈卡帧顶层,同名同型同值 —— 值取自同一只帧对象(活卡帧的那一次铸定,`tool-approval.ts` 的 `askBroadcast`),本仓不另算一遍。
  *
@@ -889,6 +942,9 @@ export declare function buildApprovalRequestFrame(input: {
  * (`readRootCandidate` 有不进卡的硬理由:耐久面兑现不了它,见活卡帧该座顶注)。
  *
  * `requiresRealApproval` 不在表里:卡上 `risk.requiresRealApproval` 是同一个事实(铸卡第三参就是它),一个事实一个读法。
+ * ⚠️ **`approvalCard` 是表里唯一一位 7.136.0 起同时在卡上的座**(`ApprovalCardSchema.approvalCard`:断连重放的卡要渲回同一张专卡,卡词必须进卡;
+ * 同一次读定、同值)。按上一句的规矩它该离表(活铸帧顶层这一份退役 —— wire BREAKING,下游 sdk 的孪生表同改),本版按 additive 交付、未退役:
+ * 一个事实两处读,登记为待收的债,收法 = 离表 + 消费方改读 `card.approvalCard`,不是在这里加第三处。
  */
 export declare const APPROVAL_REQUEST_LIVE_FACT_KEYS: readonly ["mandated", "mandate", "origin", "boundGrantDigest", "boundGrants", "classifierNoRuling", "boundGrantAbsence", "approvalCard", "readRootCandidate", "probeReason"];
 /** 呈卡帧活面事实座的类型面 = 活卡帧同名座的 `Pick`(同型由构造保证,不手抄)。 */
@@ -1015,7 +1071,7 @@ export declare function buildRevokeFrame(batchId: string, askIds: readonly strin
  *    过窗未收敛的行(`expiresInMs === 0`)**仍然重放**,不在这里代打 `expireAsk` CAS(那会制造第五个
  *    竞争者;收敛是车2 的窗到期竞争者与车5 恢复扫描的职责)。
  */
-export declare function buildReplayFrame(row: AskRow, nowMs: number): ApprovalRequestFrame | undefined;
+export declare function buildReplayFrame(row: Pick<AskRow, "askId" | "taskId" | "expiresAtMs" | "cardJson">, nowMs: number): ApprovalRequestFrame | undefined;
 /**
  * [ref] —— 持久行上那张卡**要不要人**:卡面 `risk.requiresRealApproval`(铸卡时取自引擎在 `AskRequest` 上盖的同一位,
  * {@link buildApprovalCard} 第三参)。读者 = 耐久 ask 回决口在裁决之前交给引擎判官 `policyCannotAnswer` 的那一问(`host-decision.ts` 的 `heldAskOf`)。

package/dist/approval-card.js

@@ -1,7 +1,8 @@
 import { z } from "zod";
-import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, BOUND_GRANT_ABSENCES, DENIAL_LIMIT_BOUNDS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, RULE_OFFER_KINDS, STEER_REPLAY_FACETS, isAskClass, readRuleOffers, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
+import { ALLOW_RULE_MEMBERS, ASK_EVIDENCE_ABSENCE_VALUES, TOOL_APPROVAL_CARDS, BOUND_GRANT_ABSENCES, DENIAL_LIMIT_BOUNDS, MAX_RULE_TEXT_CHARS, PERSISTED_RULE_MATCHES, UNCOVERED_SEGMENT_REASONS, READ_ROOT_CANDIDATE_DIR_MAX, RESUME_STARTUP_CAUSES, RULE_OFFERS_ABSENCES, RULE_OFFER_KINDS, STEER_REPLAY_FACETS, isAskClass, readRuleOffers, isAskOrigin, isAutoModeFallbackCause, isMintableProbeReason, isPersistedRuleMandate, screenAskClassMembers } from "@sema-agent/core";
 import { redactSecrets } from "./trace/redact.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { readApprovalCard } from "./approval-content-kind.js";
 import { capText } from "./caller-text-echo.js";
 import { retireParkArmWords, retireStoredCardWords } from "./retired-card-words.js";
 export const MAX_AGENT_NAME = 200;
@@ -345,6 +346,19 @@ export function parkRowFacts(stored) {
         ...(boundGrantAbsence !== undefined ? { boundGrantAbsence } : {}),
     };
 }
+export function skillCardFacts(summary) {
+    return {
+        ...(summary.boundGrantDigest !== undefined ? { boundGrantDigest: summary.boundGrantDigest } : {}),
+        ...(summary.boundGrants !== undefined ? { boundGrants: summary.boundGrants } : {}),
+        ...(summary.classifierNoRuling !== undefined ? { classifierNoRuling: summary.classifierNoRuling } : {}),
+    };
+}
+export function parkRowCarriesSkillCardFacts(stored) {
+    if (typeof stored !== "object" || stored === null || !("kind" in stored) || stored.kind !== "tool_approval")
+        return false;
+    const digest = "boundGrantDigest" in stored ? stored.boundGrantDigest : undefined;
+    return typeof digest === "string" || ("classifierNoRuling" in stored && stored.classifierNoRuling !== undefined);
+}
 export const DenialLimitFallbackSchema = z
     .object({
     consecutive: z.number().int().nonnegative(),
@@ -377,6 +391,7 @@ export const ApprovalCardSchema = z
         .strict(),
     governanceForced: z.literal(true).optional(),
     rememberRefused: z.literal(true).optional(),
+    approvalCard: z.enum(TOOL_APPROVAL_CARDS).optional(),
     inputHasBidi: z.literal(true).optional(),
     allowRuleShadowed: z
         .array(z
@@ -444,6 +459,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
     const sourceTaskId = capText(source.sourceTaskId, MAX_IDENT);
     const sourceAgentName = capText(source.sourceAgentName, MAX_AGENT_NAME);
     const allowRuleShadowed = readAllowRuleShadowed(req);
+    const approvalCard = readApprovalCard(source.approvalCard);
     return {
         toolName: capText(source.toolName, MAX_IDENT) ?? "",
         message: capText(source.message, MAX_MESSAGE) ?? "",
@@ -456,6 +472,7 @@ export function buildApprovalCard(source, req, requiresRealApproval) {
         },
         ...(source.governanceForced === true ? { governanceForced: true } : {}),
         ...(source.rememberRefused === true ? { rememberRefused: true } : {}),
+        ...(approvalCard !== undefined ? { approvalCard } : {}),
         ...(source.inputHasBidi === true ? { inputHasBidi: true } : {}),
         ...(allowRuleShadowed !== undefined ? { allowRuleShadowed } : {}),
         ...(probeCause !== undefined ? { probeCause } : {}),

package/dist/approval-content-kind.d.ts

@@ -48,6 +48,7 @@ export declare function parkedFacetOf(gate: ParkedGateFace | undefined): "A" | "
  * 审批门型 = core `PAUSE_REGISTRY` 里寄存臂是 `tool_approval` 的登记门 —— 与 core `parkedApprovalCardOf` 判「是不是审批门」同一条判据(只在这些门上读卡)。
  * **派生,不手写**(core 7.55.0 [ref] P1 阶段二):此前本仓手写一份二员词表([ref] 时 core 没有导出词表),一次性迁移 M21 又自派生一份;
  * core 加一行审批味的门,这里跟着变,零处要改。读者:决断口与拒扫腿按门型绑定取行(`gateKinds`)、`/decide` 的门型守卫、M21 / M29 的候选扫描。
+ * 包根同出(`index.ts`):嵌入方 / sdk 读这一只,不手抄。
  * 到期分法**不**读这张表 —— SQL 里是由 core 两张表生成的 facet 谓词(`plugins/checkpoint-index-columns.ts`),JS 里是 {@link denySweepOwns}。
  */
 export type ApprovalGateKind = {

package/dist/approval-content-kind.js

@@ -33,7 +33,7 @@ export function parkedApprovalCard(gate) {
 export function parkedFacetOf(gate) {
     return gate !== undefined && isGateKind(gate.kind) ? facetOf({ kind: gate.kind, approvalCard: gate.approvalCard }) : undefined;
 }
-export const APPROVAL_GATE_KINDS = Object.keys(PAUSE_REGISTRY).filter((k) => PAUSE_REGISTRY[k].pending === "tool_approval");
+export const APPROVAL_GATE_KINDS = Object.freeze(Object.keys(PAUSE_REGISTRY).filter((k) => PAUSE_REGISTRY[k].pending === "tool_approval"));
 export function isApprovalGateKind(k) {
     return k !== undefined && APPROVAL_GATE_KINDS.includes(k);
 }

package/dist/auth-bridge.d.ts

@@ -1,7 +1,7 @@
 import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
+import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
-export type { VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
 /**
  * [ref] ② —— 鉴权桥 issuer 的**唯一**取值(装配 `boot/stage-09-leader.ts` 与 caps `centerWiring.issuer` 同读,不各写一份回退):
  * 显式 `AUTH_BRIDGE_ISSUER`(`config.authBridgeIssuer`)恒赢 ⇒ `source:"explicit"`;缺席则回退中心基址 `webAdmin.baseUrl`
@@ -34,13 +34,41 @@ export interface WebAdminJwtVerifierOptions {
     fetchImpl?: typeof fetch;
     nowMs?: () => number;
 }
+/** 验证腿的拒因(闭集)= 契约 R9 的五个码 ∪ `readTokenScope` 的拒词;两边都是契约的闭集,加词 ⇒ 这里随之变宽(穷举分支的读者编译红)。 */
+type AuthBridgeRefusal = AuthBridgeErrorCode | TokenScopeRefusal;
+/** 本服务受理的桥身份:契约 `VerifiedIdentity`(验证器「令牌带了什么」的报告形)之上,scope 经 `readTokenScope` 读定后**必带**。 */
+type BridgeIdentity = Omit<VerifiedIdentity, "scope"> & {
+    scope: string;
+};
 export type VerifyOutcome = {
     ok: true;
-    identity: VerifiedIdentity;
+    identity: BridgeIdentity;
+} | {
+    ok: false;
+    error: AuthBridgeRefusal;
+};
+/** 拒因记账的去处(验证器选项与 HTTP 装配各自持有同一对 logger / metrics)。 */
+type BridgeSinks = {
+    readonly logger?: Logger | undefined;
+    readonly metrics?: Pick<Metrics, "inc"> | undefined;
+};
+/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 是 `unknown` —— 这一位正是边界要判的形,它不信型面
+ *  (席是嵌入方可换的:`""` 过得了 `scope: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
+type ReportedOutcome = {
+    ok: true;
+    identity: Omit<BridgeIdentity, "scope"> & {
+        scope?: unknown;
+    };
 } | {
     ok: false;
-    error: AuthBridgeErrorCode;
+    error: AuthBridgeRefusal;
 };
+/**
+ * 注入边界:任何验证器(内建 {@link createWebAdminJwtVerifier},或嵌入方注入的 `ServiceDeps.webAdminJwtVerifier`)交来的结局,在这里定「装不装身份」。
+ * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次(入参型见 {@link ReportedOutcome})。
+ * 读不出 ⇒ 同一只记账口、不交身份(调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
+ */
+export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
 /** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */
 export interface WebAdminJwtVerifier {
     verify: (bearer: string) => Promise<VerifyOutcome>;
@@ -50,8 +78,9 @@ export declare const DEFAULT_JWKS_TTL_SEC: number;
 /** 一次 JWKS 拉取的时限(毫秒):kid 未知、超离线宽限、后台刷新三条路用同一只拉取,同一个时限。 */
 export declare const JWKS_FETCH_TIMEOUT_MS = 10000;
 /**
- * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为
- * AUTH_BRIDGE_ERROR_CODES(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。
+ * registry-JWT verifier(单例,进程级 JWKS 缓存)。`verify(bearer)` 全程不 throw——一切异常折为拒因闭集
+ * {@link AuthBridgeRefusal}(HTTP 面由调用方恒答 generic 401,码只进日志/metrics,R9)。
  */
 export declare function createWebAdminJwtVerifier(opts: WebAdminJwtVerifierOptions): WebAdminJwtVerifier;
+export {};
 //# sourceMappingURL=auth-bridge.d.ts.map

package/dist/auth-bridge.js

@@ -1,5 +1,6 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
 import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
+import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 export function authBridgeIssuerOf(config) {
     if (config.authBridgeIssuer !== undefined)
@@ -8,6 +9,20 @@ export function authBridgeIssuerOf(config) {
         return { issuer: config.webAdmin.baseUrl, source: "fallback" };
     return undefined;
 }
+function recordBridgeRefusal(sinks, error, at = {}) {
+    sinks.metrics?.inc("auth_bridge_verify_total", { outcome: error });
+    sinks.logger?.warn?.("auth_bridge_rejected", { error, ...(at.kid ? { kid: at.kid.slice(0, 128) } : {}), ...(at.iss !== undefined ? { iss: at.iss } : {}) });
+}
+export function admitBridgeIdentity(outcome, sinks) {
+    if (!outcome.ok)
+        return undefined;
+    const scoped = readTokenScope({ scope: outcome.identity.scope });
+    if ("refused" in scoped) {
+        recordBridgeRefusal(sinks, scoped.refused);
+        return undefined;
+    }
+    return { ...outcome.identity, scope: scoped.scope };
+}
 export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 export const JWKS_FETCH_TIMEOUT_MS = 10_000;
 const MAX_JWKS_BYTES = 256 * 1024;
@@ -42,8 +57,7 @@ export function createWebAdminJwtVerifier(opts) {
     let inflight;
     const withinGrace = () => lastFetchSuccessMs !== undefined && jwksWithinOfflineGrace({ lastFetchSuccessMs, nowMs: now() }, { offlineGraceSec });
     const fail = (error, kid) => {
-        opts.metrics?.inc("auth_bridge_verify_total", { outcome: error });
-        opts.logger?.warn?.("auth_bridge_rejected", { error, ...(kid ? { kid: kid.slice(0, 128) } : {}), iss: displayIssuer });
+        recordBridgeRefusal(opts, error, { kid, iss: displayIssuer });
         return { ok: false, error };
     };
     async function refreshJwks() {
@@ -144,8 +158,11 @@ export function createWebAdminJwtVerifier(opts) {
         const mapped = toVerifiedIdentity(payload, opts.audience ? { audience: opts.audience } : undefined);
         if (!mapped.ok)
             return fail(mapped.error, kid);
+        const scoped = readTokenScope(payload);
+        if ("refused" in scoped)
+            return fail(scoped.refused, kid);
         opts.metrics?.inc("auth_bridge_verify_total", { outcome: "ok" });
-        return { ok: true, identity: mapped.identity };
+        return { ok: true, identity: { ...mapped.identity, scope: scoped.scope } };
     }
     return { verify };
 }

package/dist/boot/budget-tracing.d.ts

@@ -1,6 +1,5 @@
 import { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
 import type { ServiceConfig } from "../config.js";
-import { FleetUsageAccumulator } from "../fleet-client.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import type { Logger } from "../observability/logger.js";
 import type { Metrics } from "../observability/metrics.js";
@@ -26,7 +25,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     costQuota: CostQuota | import("../plugins/pg-cost-quota.js").PgCostQuota | import("../plugins/tidb-cost-quota.js").TiDBCostQuota;
     modelUsageTracker: ModelUsageTracker;
     promptManifestTracker: PromptManifestTracker;
-    fleetUsage: FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     sideQueryAccounting: (principal: string | undefined, r: {

package/dist/boot/budget-tracing.js

@@ -1,6 +1,6 @@
 import { createBrainAssembly } from "../brain.js";
 import { ModelUsageTracker, PromptManifestTracker, buildPricing, createSideQueryAccountant, createTracer } from "../budget.js";
-import { FleetUsageAccumulator } from "../fleet-client.js";
+import { createFleetUsageBins } from "../fleet-client.js";
 import { createFleetLeaseFromEnv } from "../fleet-lease.js";
 import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { CostQuota } from "../observability/cost-quota.js";
@@ -25,7 +25,7 @@ export function createBudgetAndTracing(ctx) {
         : new CostQuota(bounds.limitMicroUsd, bounds.windowMs);
     const modelUsageTracker = new ModelUsageTracker();
     const promptManifestTracker = new PromptManifestTracker();
-    const fleetUsage = centerLaneConfigured(config) ? new FleetUsageAccumulator() : undefined;
+    const fleetUsage = centerLaneConfigured(config) ? createFleetUsageBins(config.webAdmin.credential) : undefined;
     const fleetLease = createFleetLeaseFromEnv(config, { logger, metrics });
     const tracer = createTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
     const sideQueryAccounting = createSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);

package/dist/boot/org-memory.js

@@ -31,7 +31,7 @@ export function createOrgMemoryAdmissionWiring(opts) {
                 fetchSection: (principal) => fetchPrincipalOrgMemory({ baseUrl: centerLeg.baseUrl, credential }, principal, fetch, centerLeg.worker),
                 grantTtlMs: config.memoryOrgGrantTtlMs,
                 unavailableBackoffMs: config.memoryOrgUnavailableBackoffMs,
-            }));
+            })).now;
             return { lookup: (principal) => directoryNow().lookup(principal) };
         })()
         : staticJson !== undefined

package/dist/boot/resolve-spec.js

@@ -36,7 +36,8 @@ import { normalizeAttachments, normalizeResilience, normalizeResumeAtMode, norma
 import { isAbsoluteHostPath } from "@sema-agent/settings-schema";
 import { effectiveHostWorkspace, parseAdditionalDirectories, satisfiedByProcessCwd, shellEnvMismatchCount } from "../task-cwd.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { assertRequestA2aPeerUrls, assertRequestA2aUnlocked, resolveRequestA2a } from "../task-a2a.js";
+import { assertRequestA2aEntries, resolveRequestA2a, snapshotRequestA2a } from "../task-a2a.js";
+import { assertRequestImageUrls } from "../request-image-urls.js";
 import { assertRequestMcpEntries, assertRequestMcpUnlocked, resolveRequestMcp } from "../task-mcp.js";
 import { storedToolAxesRereadM19 } from "../stored-request-tool-axes-m19.js";
 import { storedHooksRereadM20 } from "../stored-request-hooks-m20.js";
@@ -139,9 +140,12 @@ export function createResolveSpec(ctx) {
                 }
             }
         }
-        assertRequestA2aUnlocked(body.a2aPeers, lockedKeys);
+        const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
+        const a2aPeers = snapshotRequestA2a(body.a2aPeers, { reread: storedToolAxes !== undefined });
+        if (opts?.leg === "fresh")
+            assertRequestA2aEntries(a2aPeers);
         if (opts?.leg === "fresh")
-            assertRequestA2aPeerUrls(body.a2aPeers);
+            assertRequestImageUrls(body.images);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
         if (effMode !== undefined && modePolicyOf(effMode).writeFace === "open") {
@@ -152,7 +156,7 @@ export function createResolveSpec(ctx) {
         const lane = bindSettingsCwdEnvAndModel(body, auth, gated, opts);
         const anchors = await resolveHistoryAnchors(body, auth);
         const projectKey = memoryEngine ? await memoryProjectLayers.prepare(config, auth?.memoryScope, realTaskRootOf(auth)) : undefined;
-        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey }, effMode);
+        const spec = assembleSpecLiteral(body, auth, req, opts, { ...gated, ...lane, ...anchors, projectKey, a2aPeers, storedToolAxes }, effMode);
         const folded = await foldGovernanceAndSettings(body, auth, spec, gated);
         const final = await applyImageFactsAndRouting(body, auth, folded.governed, {
             scenarioName: gated.scenarioName,
@@ -355,8 +359,7 @@ export function createResolveSpec(ctx) {
         return deriveAskEffective(askForm.form, "unresolved") === "human_reachable";
     };
     const assembleSpecLiteral = (body, auth, req, opts, parts, effMode) => {
-        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, } = parts;
-        const storedToolAxes = opts?.leg === "fresh" ? undefined : storedToolAxesRereadM19(new Date().toISOString().slice(0, 10));
+        const { scenarioName, cap, hands, acceptedAppend, parsedSettings, attachmentNotice, taskHooks, additionalDirectories, additionalReadDirectories, wireCatalog, picked, resumeAtEntryId, rewindFilesToEntryId, s4DefaultScopes, projectKey, a2aPeers, storedToolAxes, } = parts;
         const spec = {
             objective: attachmentNotice ? `${picked.cleanedObjective}\n\n${attachmentNotice}` : picked.cleanedObjective,
             ...buildPromptSeats(scenarioName, cap.prompt, typeof body.systemPrompt === "string" ? body.systemPrompt : undefined),
@@ -490,7 +493,7 @@ export function createResolveSpec(ctx) {
             ...(parsedSettings.settings?.skillListingBudgetFraction !== undefined ? { skillListingBudgetFraction: parsedSettings.settings.skillListingBudgetFraction } : {}),
             ...(parsedSettings.settings?.skillListingMaxDescChars !== undefined ? { skillListingMaxDescChars: parsedSettings.settings.skillListingMaxDescChars } : {}),
             mcp: resolveRequestMcp(mcpForScenario(config.mcpServers, scenarioName), body.mcpServers, config, logger, opts?.onNotice !== undefined ? { sessionId: auth?.sessionId, emit: opts.onNotice } : undefined, storedToolAxes),
-            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), body.a2aPeers, config, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
+            a2a: resolveRequestA2a(a2aForScenario(config.a2aPeers, scenarioName), a2aPeers, config, logger, opts?.leg === "fresh" ? "fresh" : "resume", storedToolAxes),
             toolPolicy: toolPolicyForHands(hands, durableEnabled
                 ? createApprovalBaselinePolicy(config, {
                     kind: "durable",

package/dist/boot/runner-deps.js

@@ -20,6 +20,8 @@ import { storeFormRefusalInIncident } from "../memory-store-refusal.js";
 import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
+import { errorKindOf } from "../observability/err-text.js";
+import { buildShownUrlsInText } from "../url-refusal.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -263,12 +265,12 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "mcp") {
-                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
                 metrics.inc("mcp_server_unavailable_total");
                 return;
             }
             if (ctx.phase === "a2a") {
-                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
                 metrics.inc("a2a_peer_unavailable_total");
                 return;
             }

package/dist/boot/stage-04-stores.d.ts

@@ -15,7 +15,7 @@ export declare function runStage04(ctx: Awaited<ReturnType<typeof runStage03>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-05-execution-env.d.ts

@@ -30,7 +30,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-06-runners.d.ts

@@ -93,7 +93,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-07-capability-layer.d.ts

@@ -108,7 +108,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-08-reapers.d.ts

@@ -121,7 +121,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-09-leader.d.ts

@@ -145,7 +145,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -144,7 +144,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
-    fleetUsage: import("../fleet-client.js").FleetUsageAccumulator | undefined;
+    fleetUsage: import("../fleet-client.js").FleetUsageBins | undefined;
     memoryBundleFaces: import("../memory-bundle-engine.js").MemoryBundleFaces | undefined;
     memoryComplianceFaces: import("../memory-operator-faces.js").MemoryComplianceFaces | undefined;
     memoryOriginFaces: import("../memory-operator-faces.js").MemoryOriginFaces | undefined;

package/dist/boot/stores.js

@@ -9,7 +9,7 @@ import { TiDBMemoryEngineBackend, ensureTiDBMemoryEngineSchema } from "../plugin
 import { PgMemoryHistoryStore, PgMemorySyncStore, ensurePgMemoryHistorySchema, ensurePgMemorySyncSchema } from "../plugins/memory-sync-store-pg.js";
 import { TiDBMemoryHistoryStore, TiDBMemorySyncStore, ensureTiDBMemoryHistorySchema, ensureTiDBMemorySyncSchema } from "../plugins/memory-sync-store-tidb.js";
 import { MinioBlobBackend } from "../plugins/blob-backend.js";
-import { ensureSnapshotBucket } from "../plugins/snapshot-bucket-presence.js";
+import { ensureSnapshotBuckets } from "../plugins/snapshot-bucket-presence.js";
 import { PgBackgroundAgentStore, TiDBBackgroundAgentStore, ensurePgBackgroundAgentSchema, ensureTiDBBackgroundAgentSchema } from "../plugins/background-agent-store-sql.js";
 import { PgMailboxStore, TiDBMailboxStore, ensurePgMailboxSchema, ensureTiDBMailboxSchema } from "../plugins/mailbox-store-sql.js";
 import { createDropOnlyRecipientLifecycle } from "../plugins/mailbox-recipient-lifecycle.js";
@@ -58,8 +58,7 @@ export async function openStores(ctx) {
     let backend;
     let storeDegradedReason;
     const dsnConfigured = !!(config.tidb || config.pg);
-    if (config.snapshotBlobStore)
-        await ensureSnapshotBucket(config.snapshotBlobStore, config.storeLockWaitMs, logger);
+    await ensureSnapshotBuckets(config, logger);
     const wantDb = config.sessionBackend === "tidb" ||
         config.dbBackend === "local" ||
         (config.sessionBackend === "auto" && dsnConfigured);

package/dist/boot/web-admin.js

@@ -12,7 +12,7 @@ import { applyCenterArtifact, centerSourceOnError, withPromptArtifactBackfill }
 import { centerScenarios, centerScenarioDetails } from "../capabilities/scenarios.js";
 import { isRosterGateArmed } from "../config.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg, legacyV1LkgPath, migrateV1Lkg } from "../config-lkg.js";
+import { defaultLkgPath, defaultSkillCacheDir, saveLkg, loadLkg } from "../config-lkg.js";
 import { answerStillCurrent, centerStateBin, credentialIdentityNow, judgeCenterCredentialAtBoot } from "../center-credential.js";
 import { createCenterConfigTier } from "../center-config-tier.js";
 import { buildCenterCredentialHealthView, createCenterCredentialRenewer } from "../center-credential-renewer.js";
@@ -21,6 +21,7 @@ import { createConfigProvider, raceBootFetch, serviceConfigSourceKind, BOOT_FETC
 import { ConfigDirUntrustedError } from "../config-dir-trust.js";
 import { createKeyResolver } from "../key-resolver.js";
 import { buildSealedKeyPublicFace, ensureCheckpointCtxSealing, ensureSealedKeyStore, reportExecutionPublicKey } from "../sealed-key.js";
+import { anthropicLaneCredentialOf } from "../model-route-gap.js";
 import { applyEffective, applyCenterReadFace, buildReadFaceBaseline, buildReadFaceSwapCandidate, restoreReadFaceBaseline, mutateInPlace, logEffectiveDiff, applySkillsManifest, skillManifestEntriesNotInstalled, resolveMcpServers, resolveA2aPeers, restartReasons, modelPlaneChanged, withModelPlaneOf, fullyLandedForLkg, NO_CENTER_EFFECTIVE, isNoCenterEffective, fetchPromptArtifact } from "../web-admin-client/facade.js";
 import { buildConfigHandoff, buildRestartSignal, configHandoffMissing } from "../fleet/engine-signal.js";
 import { createMcpRevocationLedger, enabledMcpEntries } from "../web-admin-client/mcp-revocation.js";
@@ -133,7 +134,7 @@ export async function createWebAdminRuntime(ctx) {
         }
         return r;
     };
-    const sealedKeyDir = join(config.localDataRoot ?? localRoot, "sealed-key");
+    const sealedKeyDir = config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
     let sealedKeys;
     try {
         sealedKeys = await ensureSealedKeyStore(sealedKeyDir, logger);
@@ -146,6 +147,11 @@ export async function createWebAdminRuntime(ctx) {
         });
     }
     catch (err) {
+        if (config.sealedKeyDir !== undefined) {
+            throw new Error(`SEALED_KEY_DIR=${config.sealedKeyDir}: the declared model-key custody directory cannot hold a sealed-key store (${String(err)}) — ` +
+                `refusing to start rather than run with every sealed model unusable (no_key_store). Make that directory creatable, owned by ` +
+                `the service user and chmod-able to 0700 on a writable filesystem, or unset SEALED_KEY_DIR to use <data root>/sealed-key.`);
+        }
         logger.warn("sealed_key_store_unavailable", { err: String(err), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
     }
     let checkpointCtxSealing;
@@ -153,7 +159,7 @@ export async function createWebAdminRuntime(ctx) {
         checkpointCtxSealing = await ensureCheckpointCtxSealing(sealedKeyDir, logger);
     }
     catch (err) {
-        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make <data root>/sealed-key/checkpoint-ctx-keys/ creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
+        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), dir: join(sealedKeyDir, "checkpoint-ctx-keys"), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make that directory (under the sealed-key custody directory: SEALED_KEY_DIR, default <data root>/sealed-key) creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
     }
     const configProvider = serviceConfigSourceKind(config) !== undefined
         ? createConfigProvider({
@@ -458,19 +464,6 @@ export async function createWebAdminRuntime(ctx) {
                 return null;
             }
             const lkgPath = lkgPathFor(identity);
-            const legacy = await migrateV1Lkg({ legacyPath: config.configLkgPath ?? legacyV1LkgPath(config, cc?.worker), binPath: lkgPath, worker: cc?.worker, identity });
-            switch (legacy.outcome) {
-                case "none":
-                    break;
-                case "migrated":
-                    logger.info("config_lkg_migrated", { from: legacy.from, retiredTo: legacy.retiredTo, to: lkgPath, note: "formatVersion 1 LKG (pull-token identity = this worker) migrated once into this credential identity's bin; the old file was renamed, not deleted" });
-                    if (legacy.retireError !== undefined)
-                        logger.warn("config_lkg_legacy_not_retired", { path: legacy.from, reason: legacy.retireError, note: "the bin was written and is used; only the old file's rename / copy failed" });
-                    break;
-                case "not-migrated":
-                    logger.warn("config_lkg_unusable", { path: legacy.path, reason: legacy.reason, note: "env fallback serves; the cache rewrites on the next clean candidate" });
-                    return null;
-            }
             const read = await loadLkg(lkgPath, cc?.worker, identity);
             if (!read.lkg) {
                 if (read.reason !== "absent")
@@ -800,7 +793,7 @@ export async function createWebAdminRuntime(ctx) {
         },
         initKeyResolver() {
             keyResolver = createKeyResolver(config.modelApiKeyEnv, process.env, config.modelApiKeys);
-            if (process.env.ANTHROPIC_AUTH_TOKEN && !process.env.ANTHROPIC_API_KEY && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
+            if (anthropicLaneCredentialOf(config.anthropic ?? {})?.kind === "bearer" && (Object.keys(config.modelApiKeys).length > 0 || Object.keys(config.modelApiKeyEnv).length > 0)) {
                 logger.warn("per_model_key_bearer_gateway_combo", {
                     perModelKeys: Object.keys(config.modelApiKeys).length + Object.keys(config.modelApiKeyEnv).length,
                     note: "ANTHROPIC_AUTH_TOKEN (Bearer) deployment with per-model keys: core's per-call auth REPLACES the Authorization header with x-api-key for those models — a Bearer-only gateway will 401 them. Remove the per-model key for such models, or use a gateway accepting x-api-key.",