@sema-agent/server 7.135.0 → 7.137.0

package/dist/session-sync.d.ts

@@ -50,7 +50,7 @@ import type { ServiceFileHistoryStore, ServiceSessionPolicyStore, ResumeAnchorSt
 /**
  * core 7.55.0 [ref] T2([ref]):一只会话的文件历史**读不全**(撕裂 / 读不出的边界、读不出的跟踪集 —— 店的 `exportHistory` 答 `{ ok: false }`,`adopt_failed`
  * 带店判的 `permanence`)。它**不是**「没有历史」:读成 `null` 的同步会把这只会话的全部 rewind 历史丢在路上、还答成功。会话同步的两只拉取口
- * (manifest、history blob)对它答同一句 503 `state.file_history_unreadable`(路由 `sendFileHistoryUnreadable`)。
+ * (manifest、history blob)对它答同一句 503 `state.file_history_unreadable`(路由 `sendPullUnreadable`;连接类故障在拉取口同码同体键答 `permanence: "transient"`,部署错配类故障〔缺表 / 权限拒〕答 `permanence: "terminal"`)。
  */
 export declare class FileHistoryUnreadableError extends Error {
     readonly sessionId: string;
@@ -67,9 +67,21 @@ export declare function exportedFileHistory(store: Pick<ServiceFileHistoryStore,
  *  Returned by {@link exportSessionManifest} (closes over the source store); consumed wherever a caller pulls
  *  content-addressed history bytes lazily (the live PUSH route's `importHistory` replay). */
 export type BlobGetter = (hash: string) => Promise<Uint8Array | undefined>;
-/** 一只文件历史店自己的 blob 取值口({@link BlobGetter}):店带 `getBlob` ⇒ 绑在店上;没有这条面(core 的 local 文件店)⇒ 恒答 `undefined`(「这里取不到」)。
+/** blob 两面(`putBlob` / `getBlob`)齐备的文件历史店(marker 门,不做名字探测:local 的引擎文件店带同名私有助手)。 */
+export type SyncBlobHistoryStore = ServiceFileHistoryStore & {
+    readonly syncBlobFaces: true;
+} & {
+    [P in "putBlob" | "getBlob"]-?: NonNullable<ServiceFileHistoryStore[P]>;
+};
+/**
+ * 「这只文件历史店有没有 blob 两面」的**唯一**读法:marker `syncBlobFaces`(只有 SQL 两只店立它)∧ 两面在场。能力事实 `sessionSyncFileHistory`(capability-facts)
+ * 与取值口 {@link blobGetterOf} 都读它 —— 事实说有,取值口就通到事实店的 `getBlob`;事实说没有,取值口恒空。
+ * 名字探测(`store.getBlob?.…`)不可靠:core 的 local 文件店带与服务面同名的**私有**助手(同形 `putBlob` 已被 marker 挡过一次),名字探会错拿到它。
+ */
+export declare function syncBlobFacesOf(store: ServiceFileHistoryStore): SyncBlobHistoryStore | undefined;
+/** 一只文件历史店自己的 blob 取值口({@link BlobGetter}):从 {@link syncBlobFacesOf} 派生 —— 有 blob 两面 ⇒ 绑在店上的 `getBlob`;没有(core 的 local 文件店)⇒ 恒答 `undefined`(「这里取不到」)。
  *  拉取面(manifest 的 `getBlob`)、identical 自愈臂、提交臂三处读同一只,不各写一份「无面则 undefined」。 */
-export declare function blobGetterOf(store: Pick<ServiceFileHistoryStore, "getBlob">): BlobGetter;
+export declare function blobGetterOf(store: ServiceFileHistoryStore): BlobGetter;
 /** The history-import capability face of a `FileHistoryStore` (`importHistory` is OPTIONAL on the core
  *  contract — a store without it cannot be a 2c history sink). */
 export interface FileHistoryImportFace {

package/dist/session-sync.js

@@ -21,9 +21,12 @@ export async function exportedFileHistory(store, sessionId) {
         throw new FileHistoryUnreadableError(sessionId, exported.error);
     return exported.history;
 }
+export function syncBlobFacesOf(store) {
+    return store.syncBlobFaces === true && typeof store.putBlob === "function" && typeof store.getBlob === "function" ? store : undefined;
+}
 export function blobGetterOf(store) {
-    const get = store.getBlob?.bind(store);
-    return get ? (hash) => get(hash) : async () => undefined;
+    const faces = syncBlobFacesOf(store);
+    return faces ? (hash) => faces.getBlob(hash) : async () => undefined;
 }
 export function fileHistoryImportFace(fs) {
     const candidate = fs?.importHistory;

package/dist/spec-fields.d.ts

@@ -21,6 +21,32 @@ export declare function normalizeSuggestNextPrompts(v: unknown): TaskSpec["sugge
  * undefined (never an empty object — keeps the spec byte-identical for non-users).
  */
 export declare function normalizeResilience(v: unknown, operator: boolean): TaskSpec["resilience"];
+/**
+ * 请求体 `attachments` 的子键**只有这一张表**(键 → 受理类别)。三处读它,不再各抄一份键名:
+ *  · 导出类型 `TaskRequestAttachments`(`http/wire-types.ts`)—— 与本表互为差集门(下面两只 `_GuardAttachmentKeys*`:类型加 / 删一个键而本表没跟 ⇒ tsc 红);
+ *  · 受理门(`http/admission.ts`)—— 非对象那一句列的键、布尔类键的逐键 `must be a boolean` 检查都从这里取;
+ *  · 重放翻译口 {@link normalizeAttachments} —— 入参形与逐键赋值的键集都是本表(`parts` 记录对 {@link AttachmentKey} 穷举,少一个键 ⇒ tsc 红)。
+ * 类别只回答受理门一个问题:`boolean` = 值必须是布尔(literal-true 键与布尔透传键的差别在翻译口,不在门);`mode` = `todoReminderMode` 的枚举;
+ * `changedFiles` = 布尔或 `{ maxFiles }`。后两类各有自己的门。键的**顺序**就是受理门那一句里的顺序(句子字面另由错误文案冻结钉守)。
+ */
+export type AttachmentKeyKind = "boolean" | "mode" | "changedFiles";
+export declare const ATTACHMENT_KEY_KINDS: {
+    readonly todoReminder: "boolean";
+    readonly todoReminderMode: "mode";
+    readonly changedFiles: "changedFiles";
+    readonly budgetUsd: "boolean";
+    readonly backgroundTasks: "boolean";
+    readonly toolsDelta: "boolean";
+    readonly agentListing: "boolean";
+    readonly skillsListing: "boolean";
+    readonly mcpInstructions: "boolean";
+    readonly mcpUnavailable: "boolean";
+};
+export type AttachmentKey = keyof typeof ATTACHMENT_KEY_KINDS;
+/** 表的键,原序。 */
+export declare const ATTACHMENT_KEYS: readonly AttachmentKey[];
+/** 受理门要验「值必须是布尔」的键(= 类别 `boolean`),原序。 */
+export declare const ATTACHMENT_BOOLEAN_KEYS: readonly AttachmentKey[];
 /**
  * [ref] (core 1.251) — normalize `body.attachments` → `TaskSpec.attachments`. Core's contract is
  * literal-true unions ("关闭=删 key,勿传 false"): only `true` (or, for changedFiles, an object with a sane
@@ -163,21 +189,25 @@ export declare function toolNameListFromBody(raw: unknown): string[] | undefined
 export declare function allowToolsSpecFragment(raw: unknown): {
     allowTools?: string[];
 };
-/** [ref]/[ref] — body.promptProfile → `TaskSpec.promptProfile`(core 1.328 R2 主件,CC LT(model_id)
- *  同构双形轴)。语义:纯呈现轴不碰策略(simple=CC 212 短形面缺省;classic=长形面,可按任务/模型试分)
- *  ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(引擎缺省 simple,byte-compat)。
+/** core 7.56.0 [ref] — body.promptLean → `TaskSpec.promptLean`(提示词形的唯一任务开关:`true` 加 `lean_prompt` 特征、`false` 去掉它、
+ *  缺省 = 模型声明)。纯呈现轴不碰策略 ⇒ 无租户门(deferTools 同姿势);全委托树继承由 core 管。缺省不挂键(模型目录条目的声明说话)。
  *
- *  ⚠️ **这不是一条 defer 注**([ref] 件⑤ 对表结论,core [ref] 同判):本段说的是 `promptProfile` 这根
- *  **呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提 deferTools 只是在借它
- *  的「无租户门」姿势作类比。「引擎缺省 simple」这句本身在 core 5.40.0 上仍逐字为真
- *  (`core/types.d.ts`:default "simple"),本批亲验未变。
- *  真正的 defer 轴对表(core 5.40.0 起 `deferMode:"auto"` 不再 sweep 内建;7.15.0 起它不再是第二道门,
- *  只是把候选集拓宽后走同一道阈值门)记在
- *  `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
- *  DEFENSIVE(resume 重放不过 HTTP 400 门):非法值 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
-export declare function promptProfileFromBody(raw: unknown): "simple" | "classic" | undefined;
+ *  ⚠️ **这不是一条 defer 注**:本段说的是提示词形这根**呈现**轴,它与 `deferMode` / `deferTools` 的延迟披露轴**无耦合** —— 上一行提
+ *  deferTools 只是在借它的「无租户门」姿势作类比。真正的 defer 轴对表记在 `src/capabilities/tool-defer.ts` 的头注 —— 别把两根轴的结论写到一处。
+ *  DEFENSIVE(resume 重放不过 HTTP 400 门):非布尔 ⇒ undefined;提交面另有 fail-loud 400(邻居姿势)。 */
+export declare function promptLeanFromBody(raw: unknown): boolean | undefined;
+/**
+ * `TaskSpec.promptLean` 的座位片段:体里的 `promptLean`(布尔才算,见 {@link promptLeanFromBody})是唯一读数;缺席 ⇒ 不挂键。两条腿同一读法:
+ * 退役键 `promptProfile` 不读 —— 新提交带它在键闭集门 400;7.136.x 存体里的它由一次性迁移 M30 在起服时改写成 `promptLean`(`stored-request-prompt-profile-m30.ts`),
+ * 改写不到的残留行在续跑判据上拒(`http/stored-body-replay.ts` 第四问),到不了这里。
+ */
+export declare function promptLeanSpecFragment(body: {
+    readonly promptLean?: unknown;
+}): {
+    promptLean?: boolean;
+};
 /** [ref]②(core 5.14.0 `TaskSpec.toolMaterializeStrategy`):deferred 工具激活后的 schema 供给策略。
- *  与 {@link promptProfileFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
+ *  与 {@link promptLeanFromBody} 同姿势的**防御性归一**——提交面的 fail-loud 400 在 HTTP 门,这里
  *  只负责 resume 重放存量 body 时把不认识的值静默 DROP(回落 core 的 env/缺省链),而不是把它带上 spec。 */
 export declare function toolMaterializeStrategyFromBody(raw: unknown): "static" | "swap" | undefined;
 /** [ref]④ — 每键的运营方上限旋钮(env,缺省不设=不封顶)。 */

package/dist/spec-fields.js

@@ -25,6 +25,20 @@ export function normalizeResilience(v, operator) {
     };
     return Object.keys(out).length > 0 ? out : undefined;
 }
+export const ATTACHMENT_KEY_KINDS = {
+    todoReminder: "boolean",
+    todoReminderMode: "mode",
+    changedFiles: "changedFiles",
+    budgetUsd: "boolean",
+    backgroundTasks: "boolean",
+    toolsDelta: "boolean",
+    agentListing: "boolean",
+    skillsListing: "boolean",
+    mcpInstructions: "boolean",
+    mcpUnavailable: "boolean",
+};
+export const ATTACHMENT_KEYS = Object.keys(ATTACHMENT_KEY_KINDS);
+export const ATTACHMENT_BOOLEAN_KEYS = ATTACHMENT_KEYS.filter((k) => ATTACHMENT_KEY_KINDS[k] === "boolean");
 export function normalizeAttachments(v) {
     if (v == null || typeof v !== "object" || Array.isArray(v))
         return undefined;
@@ -37,17 +51,19 @@ export function normalizeAttachments(v) {
         changedFiles =
             typeof mf === "number" && Number.isFinite(mf) && mf >= 1 ? { maxFiles: Math.min(100, Math.floor(mf)) } : true;
     }
-    const out = {
-        ...(o.todoReminder === true ? { todoReminder: true } : {}),
-        ...(changedFiles !== undefined ? { changedFiles } : {}),
-        ...(typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {}),
-        ...(o.toolsDelta === true ? { toolsDelta: true } : {}),
-        ...(o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {}),
-        ...(o.budgetUsd === true ? { budgetUsd: true } : {}),
-        ...(o.mcpInstructions === true ? { mcpInstructions: true } : {}),
-        ...(typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {}),
-        ...(typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {}),
+    const parts = {
+        todoReminder: o.todoReminder === true ? { todoReminder: true } : {},
+        todoReminderMode: o.todoReminderMode === "baseline" || o.todoReminderMode === "off" ? { todoReminderMode: o.todoReminderMode } : {},
+        changedFiles: changedFiles !== undefined ? { changedFiles } : {},
+        budgetUsd: o.budgetUsd === true ? { budgetUsd: true } : {},
+        backgroundTasks: typeof o.backgroundTasks === "boolean" ? { backgroundTasks: o.backgroundTasks } : {},
+        toolsDelta: o.toolsDelta === true ? { toolsDelta: true } : {},
+        agentListing: typeof o.agentListing === "boolean" ? { agentListing: o.agentListing } : {},
+        skillsListing: typeof o.skillsListing === "boolean" ? { skillsListing: o.skillsListing } : {},
+        mcpInstructions: o.mcpInstructions === true ? { mcpInstructions: true } : {},
+        mcpUnavailable: typeof o.mcpUnavailable === "boolean" ? { mcpUnavailable: o.mcpUnavailable } : {},
     };
+    const out = Object.assign({}, ...ATTACHMENT_KEYS.map((k) => parts[k]));
     return Object.keys(out).length > 0 ? out : undefined;
 }
 export function normalizeResumeAtMode(v, resumeAtResolved) {
@@ -90,6 +106,7 @@ const SKILL_FIELD_SHAPES = {
     disallowedTools: { required: false, ok: skillToolListOk },
     files: { required: false, ok: skillFilesOk },
     baseDir: { required: false, ok: isAbsoluteHostPath },
+    mods: { required: false, ok: () => false },
 };
 const skillOk = (s) => {
     if (!plainObject(s))
@@ -301,8 +318,12 @@ export function toolNameListFromBody(raw) {
 export function allowToolsSpecFragment(raw) {
     return raw === undefined ? {} : { allowTools: raw };
 }
-export function promptProfileFromBody(raw) {
-    return raw === "simple" || raw === "classic" ? raw : undefined;
+export function promptLeanFromBody(raw) {
+    return typeof raw === "boolean" ? raw : undefined;
+}
+export function promptLeanSpecFragment(body) {
+    const lean = promptLeanFromBody(body.promptLean);
+    return lean !== undefined ? { promptLean: lean } : {};
 }
 export function toolMaterializeStrategyFromBody(raw) {
     return raw === "static" || raw === "swap" ? raw : undefined;

package/dist/stored-request-prompt-profile-m30.d.ts

@@ -0,0 +1,49 @@
+/**
+ * 一次性迁移 M30 —— 升级之前停驻的行(`checkpoint_ctx`)里请求体的退役键 `promptProfile`,起服**原地改写**成 `promptLean`。
+ * 🔴 M30 · 窗口见 `plugins/one-time-migrations.ts` 的 ONE_TIME_MIGRATIONS 登记表(窗、删法、删后由谁接住只写在那一行)。
+ *
+ * ## 为什么要它(持久数据面)
+ * 引擎 7.56.0 把提示词形收成一个布尔(`TaskSpec.promptLean`),双形词 `promptProfile`(`"simple" | "classic"`)整键退役;新提交带它在键闭集门 400。
+ * 7.136.x 及以前停驻的任务,`checkpoint_ctx` 存着的请求体带的是旧键 —— 续跑腿重放它,没有读者 ⇒ `"classic"`(要长形)静默回到模型声明的短形。
+ * 持久数据面 = 一次性迁移把旧表示消灭(不是续跑时按日历再读一遍:那样存体从不改,窗内续跑过一次、再停驻、窗关后再续跑,意图照样静默丢)。
+ *
+ * ## 法(一条映射,与 MIGRATION 写给调用方的同一张)
+ * 窗内每次起服扫一遍 `checkpoint_ctx`(两孪生共有的 ctx 行改写店腿 `rewriteCtxRows`,与 M28 同一只;SQL 按原文 CAS、`updated_at_ms` 不动;local 信封的 `updatedAt` 不动),
+ * 体里带自有键 `promptProfile` 的行:删掉它;`"classic"` 且体里没有布尔 `promptLean` ⇒ 写 `promptLean: false`(长形的意图);`"simple"`(当年的缺省形)/ 词表外的值 ⇒
+ * 只删键;体里已有布尔 `promptLean`(它说了算)⇒ 只删键。体的其余键、行上的读法记号与凭据位原样随行(行改写 = `http/checkpoint-ctx.ts` `rewriteStoredBodyKeys`)。
+ * 已改写 / 不带旧键的行零写;读不出的行计数、不动(留给读口的响亮臂)。读数一行 info `checkpoint_ctx_prompt_profile_rewritten`(行数,不带值),不进
+ * `OneTimeMigrationReport`(登记行 `reportKeys` 空,与 M28 同形)。窗外不扫。
+ *
+ * ## 改写不到的行(响亮拒,不是第二种读法)
+ * 续跑腿不读旧键(`resolveSpec` 只读布尔 `promptLean`)。存体里仍带 `promptProfile` 的行 —— 窗内从没起过本版的部署,或滚动升级里旧副本在本版起服扫描之后才写下的行 ——
+ * 在五个续跑问点的同一只判据上拒(`http/stored-body-replay.ts` 第四问,409 `checkpoint.unsupported_version`);窗内再起一次本版即改写它。
+ *
+ * ## 为什么不在 `one-time-migrations.ts` 的迁移段里
+ * 那一段跑在店层(起服第 3 段),checkpoint 店还没建;本条与 M28 同在起服第 6 段 checkpoint 店建成之后、任何路由装配之前调一次。
+ */
+import { type SealedCheckpointCtx } from "./http/checkpoint-ctx.js";
+import { type OneTimeMigrationWindow } from "./plugins/one-time-migrations.js";
+import type { CheckpointCtxRowsRewriter } from "./plugins/checkpoint-store-sql.js";
+/** M30 一次起服的读数(起服 info 行逐键打出;测试按它断言)。`window: "closed"` ⇒ 一行都没读(其余全 0)。`rowsLongFormKept` = 改写成 `promptLean: false` 的行。 */
+export interface PromptProfileRetireM30Report {
+    readonly window: "open" | "closed";
+    readonly rowsScanned: number;
+    readonly rowsRewritten: number;
+    readonly rowsLongFormKept: number;
+    readonly rowsUnreadable: number;
+    readonly rowsTooLarge: number;
+}
+/**
+ * 一行存量 ctx 的 M30 改写(纯函数;店腿逐行调):体里没有自有键 `promptProfile`(或体不是对象)⇒ `undefined`(不写);否则交回改写后的落盘形与改动数
+ * (写了 `promptLean: false` 记 1,只删键记 0)。导出给两孪生的真库钉(`checkpoint-ctx-credential-seal-db-integration.test.ts`)直接喂店腿。
+ */
+export declare function retirePromptProfileRowM30(stored: object): {
+    readonly ctx: SealedCheckpointCtx;
+    readonly values: number;
+} | undefined;
+/** 跑一次 M30(`today` = UTC 日历日 YYYY-MM-DD;`window` 缺省 = 登记表 M30 那一行 —— 只有测试递别的窗)。窗关 ⇒ 不扫。 */
+export declare function retirePromptProfileM30(store: CheckpointCtxRowsRewriter, opts: {
+    readonly today: string;
+    readonly window?: Pick<OneTimeMigrationWindow, "removableAfter">;
+}): Promise<PromptProfileRetireM30Report>;
+//# sourceMappingURL=stored-request-prompt-profile-m30.d.ts.map

package/dist/stored-request-prompt-profile-m30.js

@@ -0,0 +1,25 @@
+import { rewriteStoredBodyKeys } from "./http/checkpoint-ctx.js";
+import { ONE_TIME_MIGRATIONS, migrationWindowOpen } from "./plugins/one-time-migrations.js";
+const RETIRED_KEY = "promptProfile";
+export function retirePromptProfileRowM30(stored) {
+    const body = stored.body;
+    if (body === null || typeof body !== "object" || Array.isArray(body) || !Object.hasOwn(body, RETIRED_KEY))
+        return undefined;
+    const fields = body;
+    const keepsLongForm = fields[RETIRED_KEY] === "classic" && typeof fields["promptLean"] !== "boolean";
+    return { ctx: rewriteStoredBodyKeys(stored, { drop: [RETIRED_KEY], ...(keepsLongForm ? { set: { promptLean: false } } : {}) }), values: keepsLongForm ? 1 : 0 };
+}
+function m30Window() {
+    const row = ONE_TIME_MIGRATIONS.find((w) => w.id === "M30");
+    if (row === undefined)
+        throw new Error("stored-request-prompt-profile-m30: the one-time migration registry has no M30 row — this migration outlived its registry row; delete it with that row");
+    return row;
+}
+export async function retirePromptProfileM30(store, opts) {
+    if (!migrationWindowOpen(opts.window ?? m30Window(), opts.today)) {
+        return { window: "closed", rowsScanned: 0, rowsRewritten: 0, rowsLongFormKept: 0, rowsUnreadable: 0, rowsTooLarge: 0 };
+    }
+    const r = await store.rewriteCtxRows((_sessionId, ctx) => retirePromptProfileRowM30(ctx));
+    return { window: "open", rowsScanned: r.scanned, rowsRewritten: r.rewritten, rowsLongFormKept: r.valuesRewritten, rowsUnreadable: r.unreadable, rowsTooLarge: r.tooLarge };
+}
+//# sourceMappingURL=stored-request-prompt-profile-m30.js.map

package/dist/task-a2a.d.ts

@@ -1,102 +1,73 @@
-/**
- * [DESIGN-269 车1 §2.2/§2.3 — A2A client seam] — project a caller's per-request A2A peers
- * (`TaskRequest.a2aPeers`) into the engine, so a `sema` run can talk to the agents the USER declares,
- * not only the ones the deployment's web-admin declares. Point-for-point mirror of `task-mcp.ts`
- * (the MCP seam), because the trust question is the same question — and deliberately NOT a copy where
- * the two protocols differ (see 「A2A 比 MCP 窄」 below).
- *
- * 🔒 SECURITY — an A2A peer is a remote **AGENT**, not a data source: it acts on its own side. core ruled
- * (2026-08-03, `A2aServerSpec` doc) that every skill such a peer advertises mounts with `egress: true` +
- * `effect: "write"`, i.e.接入即引入对外写通道 — it registers the approval gate, is never auto-allowed on a
- * no-policy deployment, and its replies reach the model inside an untrusted-data fence. The trust boundary
- * is therefore the SAME one the MCP seam draws, for the same reason:
- *   - SINGLE-USER deployment (`requirePrincipal !== false`… i.e. `!== true`): the requester IS the
- *     super-admin of their own worker, so the peers they name are their own choice (CC-parity), on EVERY
- *     execution lane — an A2A call is a plain outbound HTTPS request made by the worker, so the lane where
- *     the agent's TOOL CALLS run is irrelevant (exactly the fact that decoupled the MCP gate from the lane).
- *   - MULTI-TENANT deployment (`requirePrincipal === true`): a tenant must NOT make the SHARED worker POST
- *     to a body-chosen URL (SSRF) carrying body-chosen headers, nor mount write-capable tools from an agent
- *     the operator never vetted. Gate CLOSED → body peers ignored; the fleet gets peers only through center
- *     config (`config.a2aPeers`).
- * When the gate is closed a sent `a2aPeers` is IGNORED — and SAID (`a2a_injection_ignored` + the
- * `capabilities.a2aInjection` advertisement), never silently swallowed.
- *
- * ⚠️ **A2A 的轴比 MCP 窄,这不是简化而是协议事实**:A2A has no per-skill annotation vocabulary, so there is
- * no server-hint leg to fold — `toolAxes` (the CALLER's own judgement) is the ONLY thing that can move an axis
- * off the fail-closed default. core says as much on `A2aToolAxis`: `irreversibility:"never"` / `egress:false`
- * 「appears ONLY via an explicit caller override」, enforcement ignores the loosening (tighten-only) and the
- * ask's risk-axes REPORT face consumes it. So this module carries the caller's overrides through verbatim —
- * they are a judgement, not silence — while knowing that core will not let them widen enforcement.
- *
- * ⚠️ **两票判据的词表在 core 5.36 尚未到货**(分单件 C-1/C-2,core 已认领排 5.37 后首个 A2A 窗):
- * `LockedKey` 是 `"mcp"|"toolPolicy"|"compliancePosture"|"retentionPolicy"`,`ComplianceCapability` 是
- * `"mcp_servers"|"workflows"|"web_fetch"|"org_memory_mount"` —— 两张表里都还没有 A2A 的位。本模块因此按
- * **字符串**判(server config 的 `lockedConfigKeys` 本就是 server 自己的声明面,不经 core 闭集型),
- * 判据一到货就换 core 真源、钉子逐字不用改。
- * 🔴 **今天这两票在 env 通道上还打不响**,而这是刻意如实记下的、不是被忽略的缺口:`LOCKED_CONFIG_KEYS`
- * 经 core 的 `resolveLockedKeys` 校验(未知键拒启)、`COMPLIANCE_ADDITIONAL_DENIES` 经 `COMPLIANCE_CAPABILITIES`
- * 校验(同拒),所以运维今天**写不进** `a2a` / `a2a_peers`。而且合规那一票还有第二层:即便有人跳过 boot 期
- * 校验把 `a2a_peers` 塞进档位,`resolveComplianceDenies` 对闭集外的词是**抛**(亲测 core 5.36),于是这条
- * 请求腿的失败方向是**响亮**(500)而不是安静放行 —— 方向正确,故本模块不加任何兜底。两票的代码先在场是
- * 纵深:core 词表到货那一拍这条腿自己就活了,不需要有人记得回来补;反过来(等词表到了再写判据)才是
- * 「广告了却拦不住」的那一类缺口。钉在 `test/task-a2a.test.ts`(含到货后该怎么改那一格的原地说明)。
- */
-import { type A2aServerSpec, type CompliancePosture } from "@sema-agent/core";
+import type { A2aServerSpec } from "@sema-agent/core";
+import { type DeclarationRefusal } from "./request-declaration-refusal.js";
 import type { StoredToolAxesRereadM19 } from "./stored-request-tool-axes-m19.js";
+import { type PrincipalAxisInput } from "./deployment-shape.js";
 /** Bound on caller-supplied peers (anti-DoS; a real declaration names a handful of agents). */
 export declare const MAX_REQUEST_A2A_PEERS = 32;
-/** The deployment-facing shape this module reads. `lockedConfigKeys` is deliberately `readonly string[]`
- *  and not core's `LockedKey[]`: the `a2a` member does not exist in core's union yet (see module header),
- *  and a predicate that cannot even NAME the key it guards is a predicate that silently guards nothing. */
-export interface A2aGateConfig {
-    requirePrincipal?: boolean;
-    lockedConfigKeys?: readonly string[];
-    compliancePosture?: CompliancePosture;
+/**
+ * 一条**没有被挂上**的请求腿对端的事实 —— 运维 warn `a2a_injection_dropped` 的 `dropped` 条目(`validateRequestA2a` 的 `dropped` 同形)。与 MCP 面 {@link McpInjectionDrop}(`mcp_injection_dropped`)
+ * **同形同键名**:`reason` · `field`,只有名字键各座自己的(MCP `server` ↔ A2A `peer`;键集两向钉在下面的 `_GuardDropKeys*` 上,任一边改名 ⇒ 编译红)。
+ *  · `peer`:申报名(调用方文本,限长 128,读不出 ⇒ `<malformed>`;撞帽的尾项是一条合并标签 `(+N over cap of 32)`);
+ *  · `reason`:**判官表**({@link A2A_PEER_KEY_JUDGES})对这一键的原因句 —— 与同一份体上新提交门 400 拒句里的那一句逐字同一句(同一只组句器 `declarationIssueFacts`,不回显值),**只有一臂例外**:
+ *    一次性迁移 M19 的重读入参克隆不了(访问器成员 / BigInt / Proxy / 环 / 非纯数据)⇒ 句子带前缀 `declaration not cloneable (<because>) — the one-time migration re-reads the stored declaration as plain JSON data and this one is not; `,**其后**才是判官对原声明的那一句(新提交门不铸这一臂,所以 400 拒句里没有这个前缀);
+ *    条目不是对象 = 列表级骨架的头一句(`declarationEntryNotObject`);撞帽 = 撞帽铸点的头一句(`declarationOverCapFacts`,受理口撞帽拒句以同一句开头)。**`reason` 只有一种内容 = 句子**,本座不自铸原因词,
+ *    机读词(`over_cap`)留在 400 拒体的 `facts`、不进日志的 `reason`;
+ *  · `field`:体内坐标 `a2aPeers[i].<键路径>`(条目不是对象 ⇒ `a2aPeers[i]`;撞帽 ⇒ `a2aPeers`),与受理口拒体 `field` 同一个坐标系。
+ * 与 MCP 面的差只有两处,都是各自协议的事实:MCP 的 `reason` 是引擎词表的闭集词(`malformed_entry` …),A2A 引擎没有这张词表,`reason` 恒是句子(判官的答案 / 撞帽句);MCP 的 `field` 是条目内键路径,
+ * A2A 的是体内绝对坐标(它的拒体 `field` 本就如此)。
+ */
+export interface A2aInjectionDrop {
+    readonly peer: string;
+    readonly reason: string;
+    readonly field: string;
 }
+/** The deployment-facing shape this module reads: the principal axis only (the single-user gate). */
+export type A2aGateConfig = PrincipalAxisInput;
 /**
- * Does THIS deployment honor caller-supplied per-request A2A peers? Three vetoes, ALL of them here (this
- * predicate is the single owner — the capability bit and the request leg both read it, so there is exactly
- * one place where the answer can be wrong):
- *   ① the deployment locks the `a2a` key — a locked deployment that advertised `a2aInjection:true` would
- *      hand every consumer an affordance whose every use 400s (`config.locked_key`); "says yes ⟺ route
- *      works" breaks on the spot. Same conjunction, same reason, as `mcpInjectionHonored`'s lock veto;
- *   ② the compliance posture denies `a2a_peers` — advertised-but-refused again;
- *   ③ multi-tenant (deployment-shape row `multiTenant`) — a tenant cannot point the shared worker at an agent.
- *
- * ⚠️ **`resolveComplianceDenies` is deliberately NOT wrapped in try/catch** (same ruling as the MCP twin):
- * it is fail-loud on a posture outside the closed set, and the posture has already been validated twice
- * before reaching here (config parse + boot assembly). If it ever throws here, someone bypassed both doors
- * and the LOUD direction (route 500) is the correct one — swallowing it into a boolean would let a
- * deployment with a broken posture keep advertising the capability (仓规:安全轴禁静默兜底).
+ * Does THIS deployment honor caller-supplied per-request A2A peers? One veto — multi-tenant (deployment-shape row `multiTenant`): a tenant cannot
+ * point the shared worker at an agent. The capability bit and the request leg both read this predicate, so there is exactly one place where the answer can be wrong.
  */
 export declare function a2aInjectionHonored(config: A2aGateConfig): boolean;
+/**
+ * 请求体 `a2aPeers[i]` 的**键闭集**(判序 = 本数组序:名 → 对端地址 → 它的 agent card 地址 → 凭据头 → 身份头 → 技能收窄 → 轴覆写)。两向钉在 core 的 `A2aServerSpec` 上:
+ * 型上多一个键而表没跟 ⇒ 编译红(新键会被词表外的键门 400 掉 —— wire 上的静默回归);表里写一个型上没有的词 ⇒ 也红。于是这张表是从 core 的型**派生**出来的数据,而不是谁记得去同步的清单。
+ */
+export declare const A2A_PEER_ENTRY_KEYS: readonly ["name", "url", "cardUrl", "headers", "principalHeader", "allowSkills", "toolAxes"];
+/**
+ * **请求入口的一次读**(`boot/resolve-spec.ts` 在腿首铸一份,受理门与读器——续跑重放腿只有读器——都吃这一份):`body.a2aPeers` 若是数组,返回同形数组
+ * (每个对象条目换成它的 {@link PeerSnapshot};非对象条目原样;长度保真 —— 界外的条数仍是受理门撞帽拒与读器丢弃留声的依据,只快照界内的条目);不是数组(缺席 / `null` / 别的形)原样返回。
+ * 为什么在入口铸而不是各调用点各铸:快照按调用点铸,受理口一份、读器一份,嵌入方递来的 getter 对象在两次读之间变形(第一次给干净 URL、第二次给带凭据 URL;`headers` 成员第一次
+ * `Bearer accepted`、第二次 `Bearer changed`)就让门判第一份、读器挂第二份 —— 门独有的凭据一问被绕过、鉴权头被换掉。入口铸一次、往下传,「门判的就是读器挂的」才字面成立;
+ * 快照是纯数据到叶子(见 {@link PeerSnapshot}),后续任何读者都不再触碰源对象。
+ */
+export declare function snapshotRequestA2a(raw: unknown, options: {
+    readonly reread: boolean;
+}): unknown;
 /** 读这条对端的是哪条腿:`fresh` = 新提交;`resume` = 续跑重放升级前存下的请求体(`boot/resolve-spec.ts` 的 `opts.leg` 分流,同一个读法)。 */
 type A2aRequestLeg = "fresh" | "resume";
 /**
  * Shape-check the raw `body.a2aPeers`. `null` → a non-array (caller error; the route may 400). Otherwise the
- * valid subset + the names of dropped (malformed/over-cap) entries.
+ * valid subset + the dropped (malformed/over-cap) entries as {@link A2aInjectionDrop} facts (peer name · reason · body coordinate).
  */
 export declare function validateRequestA2a(raw: unknown): {
     ok: A2aServerSpec[];
-    dropped: string[];
+    dropped: A2aInjectionDrop[];
 } | null;
-/** fresh 提交腿的 `a2aPeers` URL 门:{@link requestA2aPeerUrlRefusal} 有答案 ⇒ 同步 400(码 / 句 / 机读位原样)。 */
-export declare function assertRequestA2aPeerUrls(bodyA2a: unknown): void;
 /**
- * DESIGN-269 §2.4 —— **同步**拒面:部署锁了 `a2a` 而请求仍带 `a2aPeers` ⇒ 400 `config.locked_key`
- * (逐字沿用 `assertRequestMcpUnlocked` 的裁定,连错误码都同一个 —— 消费端判的是「某个键被行政锁住了」,
- * 不是「哪个键」;码分裂只会让 SDK 多写一条等价分支)。
- *
- * 判据是「请求**占位**」而不是「请求的值合不合法」:锁是两态的,占了就整拒,不静默丢(静默丢正是把
- * 判决变成探针的那一形)。键缺席 / 显式 `null` 都不是占位;**空数组是占位**(调用方确实写了这个键)。
- *
- * ⚠️ **不看车道**:多租户腿本来就会忽略 body peers(`a2aInjectionHonored` 关),但锁在场时「忽略」是
- * 错的失败方向 —— operator 声明了「本部署不收任务自带 A2A peer」,那就该说出来。
+ * 请求体 `a2aPeers`「这份声明能不能原样用」的回答者(与 MCP 的 `requestMcpDeclarationRefusal` 同一副骨架、同一个拒形):
+ *  ① **列表**:在场却不是数组 / 超过 {@link MAX_REQUEST_A2A_PEERS} 条(撞帽机读位一组键)/ 某一条不是对象 ⇒ `400 request.field_invalid`;
+ *  ② **键名**:条目上词表外的键 ⇒ `400 request.body_shape` + `unknownKeys`;
+ *  ③ **键值**:逐键问判官表 {@link A2A_PEER_KEY_JUDGES} ⇒ `400 request.field_invalid`,拒句点名 `a2aPeers[i].<键路径>`、peer 名与该键判官的原因句;`url` / `cardUrl` 带凭据时拒体另带机读 `field` / `reason`。
+ * 整份拒而不是挂前 32 条 / 丢掉读不出的那条 / 整只忽略:一份被悄悄截短、少了几条或整只没生效的声明,在发送方那里读起来是「生效了」(修前:这些形全部 200 + 运维 warn;其中 `allowSkills`
+ * 写成 `allowSkill` 的对端照样挂上远端卡声明的全部技能 —— 收窄意图坏形时退化成放行)。同时这份体整份落盘,界内每一条的 `url` / `cardUrl` 都被判官看过 —— 超过界的列表整份拒,所以扫描有界。
  *
- * ⚠️ 参数类型是 `ReadonlySet<string>`:core 的 `LockedKey` 尚无 `a2a` 成员(见模块头),而
- * `ReadonlySet<LockedKey>` 结构上可当 `ReadonlySet<string>` 传入,所以调用点无需任何转换。
+ * 纯值域、与租户车道无关(多租户腿整只 `a2aPeers` 本会被忽略,告诉调用方「这样写不行」只多不少)。
+ * 只在 fresh 门上判(`boot/resolve-spec.ts` 在 MCP 条目门旁):重放存量 body 的腿不问它 —— 拒会砖死升级前停驻的任务(本仓 `opts.leg` 先例),走宽容读器({@link resolveRequestA2a}:坏条目不挂 +
+ * `a2a_injection_dropped` 留声)。A2A serve 腿(`routes/a2a-serve.ts`)铸的体只有 `objective` / `taskId` / `sessionId` / `scenario` 四键,到不了这一座。
  */
-export declare function assertRequestA2aUnlocked(bodyA2a: unknown, lockedKeys: ReadonlySet<string>): void;
+export declare function requestA2aDeclarationRefusal(list: unknown): DeclarationRefusal | undefined;
+/** fresh 提交腿的 `a2aPeers` 门:{@link requestA2aDeclarationRefusal} 有答案 ⇒ 同步 400(码 / 句 / `unknownKeys` / 机读位原样)。 */
+export declare function assertRequestA2aEntries(bodyA2a: unknown): void;
 /**
  * Merge GATED per-request peers OVER the deployment baseline (center/config). The baseline WINS on a name
  * clash — a caller can ADD a peer but can never SHADOW a configured one. This is load-bearing on THIS lane