@sema-agent/server 7.144.0 → 7.146.0

package/dist/config-types.d.ts

@@ -1042,6 +1042,10 @@ export interface ServiceConfigFlat {
          *  形会把全员折叠成单键,per-remote 层退化成共享预算而非公平层,`off` + 全局帽 64 是诚实形)。
          *  坏值拒启([ref] A 档),词表与拒因见 config.ts `parseDevicePreAuthPerRemoteEnv`。 */
         maxPreAuthPerRemote?: number | "off";
+        /** `DEVICE_TRUSTED_PROXY_CIDRS`([ref];缺席 = 名单空 = 不读任何代理头,帽键 = socket 对端)= per-remote 帽键的可信代理
+         *  名单(规范 CIDR 文本)。socket 对端落在名单内,汇聚端才读 `X-Forwarded-For`、取自右向左第一个名单外地址作帽键。
+         *  坏项拒启([ref] A 档),拒因见 config.ts `parseDeviceTrustedProxyCidrsEnv`;唯一消费点 = `boot/device-lane.ts` 透传汇聚端。 */
+        trustedProxyCidrs?: readonly string[];
         /** `DEVICE_ENROLL_TOKEN_TTL_SEC`(§4.7 第五个旋钮;默认 900 = §7-T5 ① 的 15min)= enrollment
          *  token 的有效期**时长**(整秒,自 **DB now** 起算 —— 时间权威是库,不是副本墙钟)。唯一消费点 =
          *  签发动词 `POST /v1/devices/enroll-tokens`(`http/routes/devices.ts`);[ref] 之前它刻意未铸
@@ -1299,6 +1303,10 @@ export interface ServiceConfigFlat {
     attachmentMimeAllowlist?: string[];
     /** D-1 未绑定附件 TTL(上传后从未被任何 task 引用的行,过期由 reaper 收割;缺省 24h)。 */
     attachmentUnboundTtlMs: number;
+    /** 收编批量导入 `POST /v1/adoption/:id/sessions`:每请求最多几个会话信封(`ADOPTION_IMPORT_MAX_SESSIONS`;缺省 / 地板见 `adoption/import-limits.ts`)。 */
+    adoptionImportMaxSessions: number;
+    /** 收编批量导入:每个会话信封最多多少字节(信封 JSON 的 UTF-8 字节;`ADOPTION_IMPORT_MAX_SESSION_BYTES`;缺省 / 地板 / 上帽见 `adoption/import-limits.ts`)。 */
+    adoptionImportMaxSessionBytes: number;
     /** Header carrying the authenticated principal (S6). Identity never comes from the body. */
     principalHeader: string;
     /** Require the principal header on task requests (set true in multi-tenant production). */
@@ -1365,6 +1373,15 @@ export interface ServiceConfigFlat {
      *  只在单用户形(`REQUIRE_PRINCIPAL` 未开)且名单为空时成立 —— 否则拒启(`config-invariants.ts` 的 `operator-single-user`:一个事实一个来源)。
      *  env 独有(没有中心写位),起服冻结。读法只有 `explicitOperatorOk` / `operatorRosterPresent` 两只。 */
     operatorSingleUser?: boolean;
+    /**
+     * `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT` —— 「出示这台部署的 service 凭据、不报主体的调用方是谁」的**唯一声明座**。缺省 `true`(不设 = 今天的读法):
+     * 它代部署本人说话(fleet 调用方,运维聚合口的 service 臂);`false` ⇒ 它是**无身份调用方**,各面按既有的「过了凭据门、没有主体」那一臂答
+     * (fleet 读面 401 identity、运维聚合口 401 operator、舰队流多租 401 principal_required / 单用户落 `default`、写档 401 identity、无主 placed 子代 404)。
+     * 只改一处:`http/principal-gate.ts` 的 `actsForDeployment` 多这一个合取项 —— 它的两个读者(fleet 调用方的凭据臂、`/metrics*` 的 service 臂)一次继承,
+     * 零新拒码、零新闸点;自报位 `/health.auth.serviceTokenActsForDeployment` = 配了 service 凭据 ∧ 本位。没配 service 凭据的部署上声明 `false` 是空真(那一臂本来就够不着)。
+     * env 独有(词表布尔,词表外拒启;没有 `config.d` 文件形、没有中心写位),起服读一次、热路径够不着(不是热键)。
+     */
+    serviceTokenActsForDeployment: boolean;
     /**
      * DESIGN-278 §5 S2([ref])—— `GET /v1/config/catalog`(配置目录自描述端点)的显式旋钮。
      * 默认 **ON**(设计稿 §0.5:合规部署可关)。端点本身已是 operator-only(`explicitOperatorOk`,
@@ -1615,7 +1632,7 @@ export interface ServiceConfigFlat {
      *  tools for a declared `plan` itself, and no plan entry clamps the hands (only `AUTONOMY=read-only` does). */
     planModeEnabled: boolean;
     /**
-     * `HOOKS_TIMEOUT_MS` —— 请求 `settings.hooks` 那张 mods 注册(`settings.hooks`)每个 handler 的时间预算(ms;一个事件跑一遍本请求的钩子条目)。
+     * `HOOKS_TIMEOUT_MS` —— 请求 hooks 的每张车道注册(`settings.hooks` / `settings.hooks.managed`,各一份同值)每个 handler 的时间预算(ms;一个事件跑一遍这条车道的钩子条目)。
      * **缺席 = 不铸键**;唯一读法 = `hooks/hook-runner.ts` 的 `settingsHooksBudgetMs`(未设 ⇒ 600000,单条命令超时的上限;这只数是引擎的钟,不是钩子子进程的墙钟)。
      *
      * 🔴 `0` 是有效值(引擎按字面:零预算,下一个定时器拍就到期),不是「未设」;
@@ -1891,7 +1908,7 @@ export interface ServiceConfigFlat {
      *  under the shared-engine shape (several shell sessions on one config, engine rides the FIRST shell's process
      *  group per the T11 anti-orphan call) other live sessions may still be using this engine, so an unconditional
      *  drain kills a peer mid-turn (499) and 503s new submits. Instead SIGHUP arms an idle watch: shut down only
-     *  after `inflight()` (bg/resume legs + live streams) has been 0 for this long, WITHOUT flipping `draining`
+     *  after `inflight()` (bg/resume legs + live streams — the blocking set `http + leader`; session-resident background shells/monitors are in the `/health.inflight` total but do not block) has been 0 for this long, WITHOUT flipping `draining`
      *  (peers stay fully served). A true orphan (last window closed) self-terminates when the window expires —
      *  T11 stands, just bounded instead of immediate. A SECOND SIGHUP (or SIGTERM) escalates to the normal drain
      *  path. Default 120s, floor 5s. Env: SIGHUP_IDLE_GRACE_MS. */
@@ -1940,6 +1957,20 @@ export interface ServiceConfigFlat {
      *  `SEMA_PARENT_PID` 在不在场(operator-knob 铁律)。 Env: `ENGINE_ORPHAN_LINGER_MS`(默认 2000,闭区间
      *  [1000, 86400000])。 */
     engineOrphanLingerMs: number;
+    /** [ref]:**首次附着前**的宽限窗 —— 引擎起服以来还没有过任何非探针 HTTP 请求(态「候首触」)时,三合取要**持续**成立多久才自退;
+     *  生效窗 = `max(`{@link engineLingerMs}`, 本值)`(宽限只拉长不缩短;`ENGINE_AUTO_EXIT` 关着 ⇒ owned 窗 = ∞ ⇒ 它也是 ∞)。首个非探针请求
+     *  到达之后回到 {@link engineLingerMs}、单向;父死之后一律 {@link engineOrphanLingerMs}(孤儿压过候首触)。默认 **180000**:防的是一次性
+     *  `-p` 壳在 spawn 与首次接触之间被饿住(高载宿主 / CI)超过 owned 窗 —— 从没被碰过的引擎此前按 owned 窗自退,壳醒来起步失败。
+     *  `0` = 不给额外宽限(逐字回到本键之前的行为);小于 owned 窗的值同样落成 owned 窗。与两只静默窗**同一只校验器、同一对上下界**,
+     *  多放行字面 `0`(别的零形照常拒);`1..999`(秒当毫秒)与其余坏值**拒启**;解析**无条件**(operator-knob 铁律)。 Env: `ENGINE_FIRST_ATTACH_MS`(默认 180000,
+     *  取值 `0` 或闭区间 [1000, 86400000])。 */
+    engineFirstAttachMs: number;
+    /** [ref]([ref] v3):**交接车道**的静默窗 —— 壳经 `POST /v1/engine/handover` 把引擎交给后台、自己退出之后,三合取(无附着 ∧ 无在飞 ∧
+     *  无运行中、引擎一退就会被收掉的后台 shell)要**持续**成立多久才自退。下一只壳 `POST /v1/engine/attach` 即离开本车道。默认 **1800000**(30 min):
+     *  防的是「用户忘了后台引擎」,不是上限 —— 后台 shell 在跑时本窗不起算(那正是选「后台继续」的意思)。与其余三只窗**同一只校验器**,下界单独是
+     *  60000(交接后的窗比壳重启窗还短没有意义);坏值**拒启**;解析**无条件**(operator-knob 铁律,不看 `ENGINE_AUTO_EXIT` / `SEMA_PARENT_PID`)。
+     *  Env: `ENGINE_HANDOVER_LINGER_MS`(默认 1800000,闭区间 [60000, 86400000])。 */
+    engineHandoverLingerMs: number;
     /** E23 (shell-host contract): inbound MCP elicitation HITL. When enabled, the service mounts `RunnerDeps.onElicit` + the
      *  `POST /v1/elicitations/:id/respond` route so an opted-in MCP server (`McpServerSpec.elicitation`, itself default
      *  OFF) can ask the END USER for input mid-tool-call. LIVE-ONLY (no durable suspend; lost on crash/replica-change).
@@ -2170,6 +2201,14 @@ export interface ServiceConfigFlat {
     logLevel: "debug" | "info" | "warn" | "error";
     /** Per-principal request cap per minute on task/run endpoints. 0 disables. */
     rateLimitPerMin: number;
+    /** `RUN_MAX_CONCURRENT`:本副本**在飞 run 的全局上限**(整数,0 / 缺省 = 不设)。一条新提交要起 run 时,在飞数已到帽 ⇒ 429 `limit.rate_exceeded`
+     *  + 机读 `reason: "run_concurrency_cap"` + `retryAfterSec: 5`(同值 `Retry-After` 头)。数的是 `inflightRuns ∪ steerableRuns`(与 `drainState.inflight` 同源);
+     *  判点在三个提交门(`POST /v1/runs` 与 A2A `message/send`、`POST /v1/tasks`、`POST /v1/tasks/stream`)的幂等重放之后;续跑 / 唤醒 / 审批作答不判。
+     *  属主 `http/run-concurrency-cap.ts`。 */
+    runMaxConcurrent: number;
+    /** `RUN_MAX_CONCURRENT_PER_PRINCIPAL`:同一**已验提交主体**(`gatedPrincipal`,与成本配额门同键)在本副本的在飞 run 上限(整数,0 / 缺省 = 不设)。
+     *  无主体请求(无头 service 凭据)不判这一帽,只受 {@link ServiceConfigFlat.runMaxConcurrent}。 */
+    runMaxConcurrentPerPrincipal: number;
     /** Operator CEILING on per-task cost (USD) / tokens (1.37 budget gate). A request may ask for a
      *  LOWER limit but is capped to this; 0/unset = no ceiling. The review gateway sets these to stop a
      *  single task from burning the shared cloud key. Enforced by core (failed + errorCode budget.*). */
@@ -2337,11 +2376,11 @@ export type ServiceMemoryConfig = Pick<ServiceConfigFlat, "memoryEngineEnabled"
  *  三者都是 operator 在配置面写下的**治理声明**(与 autonomy/commandPolicy 同族),不是存储旋钮
  *  ——`retentionPolicy` 尤其容易被误归 store 组:它的消费点是 core 的启动期能力校验与将来的调度面,
  *  config 这一层它只是一句声明。 */
-export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
+export type ServiceAuthConfig = Pick<ServiceConfigFlat, "authToken" | "authTokens" | "allowUnauthedWrites" | "corsOrigins" | "principalHeader" | "requirePrincipal" | "autonomy" | "commandPolicy" | "compliancePosture" | "lockedConfigKeys" | "configCatalogEnabled" | "retentionPolicy" | "retentionSweep" | "operatorPrincipals" | "operatorSingleUser" | "serviceTokenActsForDeployment" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "authBridgeIssuer" | "principalJwtMaxTtlSec" | "bindHost" | "bindHostSource">;
 /** 组:orchestration(编排 + 执行车道 + 沙箱面 + workflow/后台 agent 存留)。 */
 export type ServiceOrchestrationConfig = Pick<ServiceConfigFlat, "sandboxGit" | "remoteExec" | "remoteExecHomeDir" | "requireExecutionLane" | "worktreeIsolation" | "leaderEnabled" | "leaderFanoutEnabled" | "routerEnabled" | "selfOrchestrationEnabled" | "selfOrchestrationModels" | "selfOrchestrationWorkerIsolation" | "forkEnabled" | "experimentalObserverAgents" | "schedulerEnabled" | "schedulerSessionWakeup" | "schedulerSessionLifetime" | "schedulerStorePath" | "planModeEnabled" | "hooksTimeoutMs" | "workflowRunStoreBackend" | "workflowOrphanGraceMs" | "workflowJournalRetentionMs" | "workflowRunRetentionMs" | "usageWindows" | "workflowAgentsReadOnly" | "workflowSizeGuideline" | "backgroundAgentRetentionMs" | "backgroundAgentStaleRunningMs" | "backgroundAgentParkClaimStaleMs" | "delegationEntryCaps" | "rosterRetentionMs" | "leaderRunStaleMs" | "scratchpadSweepTtlMs" | "sandboxPkgSource" | "sandboxPkgSourceCustom" | "sessionAutoTitle" | "sessionAutoTitleSource" | "selectEnvironmentTool" | "envFactsEnabled" | "toolDeferLongtail" | "lspEnabled" | "lspHostEnabled" | "lspEnvAllow" | "imageBakes" | "readFace" | "readFaceSource" | "taskWriteFaceEscalation" | "readDenyPatterns" | "readDenyBuiltinTiers" | "readDenyBuiltinExclude" | "readDenyFloorRequired" | "sandboxReadFloor" | "agentConfigDir" | "configLkgPath" | "configLkgEnabled">;
 /** 组:limitsHttp(HTTP 面 + 各类上限/配额/回收窗)。 */
-export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "rateLimitPerMin" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
+export type ServiceLimitsHttpConfig = Pick<ServiceConfigFlat, "port" | "attachmentOrphanGraceMs" | "workspaceFileMaxBytes" | "attachmentMaxBytes" | "attachmentMimeAllowlist" | "attachmentUnboundTtlMs" | "adoptionImportMaxSessions" | "adoptionImportMaxSessionBytes" | "infraCostRates" | "drainGraceMs" | "drainSecondSignalMinGapMs" | "sighupIdleGraceMs" | "parentPid" | "engineAutoExit" | "engineLingerMs" | "engineOrphanLingerMs" | "engineFirstAttachMs" | "engineHandoverLingerMs" | "rateLimitPerMin" | "runMaxConcurrent" | "runMaxConcurrentPerPrincipal" | "maxTaskCostUsd" | "maxTaskTokens" | "maxPrincipalCostUsd" | "costQuotaWindowSec" | "reapIntervalSec" | "runStaleSec" | "toolResultTtlSec">;
 /** 组:observability(可观测)。 */
 export type ServiceObservabilityConfig = Pick<ServiceConfigFlat, "metricsToken" | "traceToken" | "toolTrace" | "traceThinking" | "logLevel" | "otel">;
 /** 组:integrations(外部集成)。`mcpServers` / `a2aPeers` 由 web-admin 适配器填(无 env 腿),归本组。 */

package/dist/config.d.ts

@@ -502,11 +502,16 @@ export declare function parseCapEnv(name: string, raw: string | undefined): {
  * 这里**不改解析**(让配置根跟着 `LOCAL_DATA_ROOT` 走,会让现有部署的 config.d 当场失踪 —— 代价比
  * 分家本身大得多)。只回一个「分家了,两个根分别是什么」的事实,由 boot 期打告警,合一旋钮 = `CONFIG_LOCAL_DIR`。
  *
- * @returns 分家时回两个根;一致(或已被 CONFIG_LOCAL_DIR/AGENT_DATA_DIR 统一)时回 undefined。
+ * 判的是「**一声不响**的分家」,不是「两个根不同」:合一旋钮一旦给出就是运维表过的态 —— `CONFIG_LOCAL_DIR`
+ * 等于数据根 = 合一,不等 = 有意分家,两者都不报。只有配置根是**推导**来的(`AGENT_DATA_DIR` / 家目录缺省)
+ * 且 ≠ 数据根,才可能是没人表过态的分家 ⇒ 报。
+ *
+ * @returns 一声不响的分家时回两个根;一致、或 `CONFIG_LOCAL_DIR` 显式在场(等 = 合一,不等 = 有意分家)时回 undefined。
  */
 export declare function splitLocalRoots(a: {
     /** optional:类型上可缺席(config-types 里是 `localDataRoot?`)——缺席时无从比较,判为不分家。 */
     localDataRoot: string | undefined;
+    /** `CONFIG_LOCAL_DIR`(`loadConfig` 已把空串归为缺席):在场 ⇒ 运维用合一旋钮表过态,本函数不再判。 */
     configLocalDir: string | undefined;
     agentDataDir: string | undefined;
     home: string;

package/dist/config.js

@@ -3,7 +3,7 @@ import { DEFAULT_AT_MENTION, DEFAULT_MODEL_REF, mintCapabilityKeys } from "./mod
 import { homedir } from "node:os";
 import { isAbsolute, join, posix as posixPath } from "node:path";
 import { fileURLToPath } from "node:url";
-import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential } from "@sema-agent/core";
+import { compileAllowList, inheritEnvPolicyProblem, BUILTIN_COMPLIANCE_DENIES, COMPLIANCE_CAPABILITIES, CROSS_SESSION_INBOUND_SETTINGS, CROSS_SESSION_DIALOG_EXPIRY_VALUES, compileReadDeny, resolveReadDenyBuiltins, isModelPriced, PROTOCOL_TABLE, RECOMMENDED_SENSITIVE_PATTERNS, judgeRuleToolName, resolveFileHistoryRetention, resolveLockedKeys, validatePermissionRules, WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, principalInboxConsumerOf, carriesCredential, isReplicableScope } from "@sema-agent/core";
 import { ROSTER_PRIMARY_ROLES, ROSTER_CHEAP_ROLES, WEB_ADMIN_ENV, retiredEnvRefusal, stripControlAndBidi } from "@sema-agent/settings-schema";
 import { parseApprovalHmacKeys, parsePrincipalJwks } from "./auth-keys.js";
 import { DEFAULT_ELICITATION_THROTTLE } from "./elicitation.js";
@@ -16,6 +16,7 @@ import { projectLayerOwnerOf } from "./project-layer-key.js";
 import { DEFAULT_QUESTION_THROTTLE } from "./question.js";
 import { GIT_API_KINDS, isGitApiKind } from "./git-api-kind.js";
 import { CONFIG_PROVIDER_WORDS, RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC, RESILIENCE_DEFAULTS, TASK_WRITE_FACE_ESCALATIONS, MAX_TIMER_DELAY_MS, AUTO_MODE_CLASSIFIER_TIMEOUT_BOUNDS, DRAIN_GRACE_FLOOR_MS, DRAIN_SECOND_SIGNAL_MIN_GAP_BOUNDS, DRAIN_SECOND_SIGNAL_MIN_GAP_DEFAULT_MS, FIRST_BYTE_TIMEOUT_BOUNDS, FLEET_LEASE_OUTAGE_MAX_DEFAULT_MS, fleetScopeOf, DEVICE_DELIVERY_TIMEOUT_BOUNDS, DEVICE_EXEC_TIMEOUT_BOUNDS, inWholeNumberBounds, wholeNumberBoundsRule } from "./config-types.js";
+import { parseTrustedProxyCidr } from "./net-address.js";
 import { DEVICE_HELLO_ACK_BOUNDS } from "./device-ws-protocol.js";
 import { FLEET_ADVERTISE_ADDRESS_ENV, FLEET_GENERATION_ENV, FLEET_SCOPE_ENV, SERVING_LEASE_TTL_FLOOR_MS, isCanonicalGeneration } from "@sema-agent/settings-schema/fleet";
 import { ScopeId } from "@sema-agent/settings-schema/api/scopes";
@@ -59,6 +60,7 @@ import { allowlistedEnv } from "./server-secret-env.js";
 import { ENV_NAME_ALLOWLIST_KNOBS, ENV_NAME_ALLOWLIST_KNOB_NAMES, describeAllowlistPostures } from "./env-name-allowlist-knobs.js";
 import { APPROVAL_ASK_RETENTION_DEFAULT_MS, APPROVAL_ASK_RETENTION_FLOOR_MS } from "./approval-ask-retention.js";
 import { parseModsDeclaration } from "./mods-declaration.js";
+import { ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT, ADOPTION_IMPORT_MAX_SESSIONS_FLOOR, ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING, ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT, ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR } from "./adoption/import-limits.js";
 import { buildDeclaredEngineWithoutCoordinatesRefusal, missingSqlCoordinateKeys } from "./sql-engine-coordinates.js";
 export { RETENTION_MODES, MEMORY_CONSOLIDATION_MIN_INTERVAL_SEC } from "./config-types.js";
 function csv(name) {
@@ -274,6 +276,11 @@ function clampEnvWithWarn(name, fallback, min, max = Number.POSITIVE_INFINITY) {
         CONFIG_WARNINGS.push({ env: name, raw: env(name, fallback), used: String(used), kind: "clamped" });
     return used;
 }
+function countEnvClamped(name, fallback, min, max = Number.POSITIVE_INFINITY) {
+    if (!Number.isInteger(numEnv(name, String(fallback))))
+        throw new Error(`env ${name}=${env(name, String(fallback))} must be a whole number (it is a count)`);
+    return clampEnvWithWarn(name, String(fallback), min, max);
+}
 function numEnvOr(name, fallback) {
     const raw = process.env[name];
     if (raw === undefined || raw === "")
@@ -439,6 +446,19 @@ function parseDevicePreAuthPerRemoteEnv() {
     }
     return n;
 }
+function parseDeviceTrustedProxyCidrsEnv(raw) {
+    if (raw === undefined || raw === "")
+        return undefined;
+    const items = raw.split(",").map((item) => item.replace(/^[ \t]+|[ \t]+$/g, ""));
+    return items.map((item, i) => {
+        const r = parseTrustedProxyCidr(item);
+        if (r.ok)
+            return r.text;
+        throw new Error(`env DEVICE_TRUSTED_PROXY_CIDRS item ${i + 1} of ${items.length} (${JSON.stringify(item)}) ${r.flaw}. ` +
+            `This list names the reverse proxies whose X-Forwarded-For the device pre-auth cap trusts — list only your own proxies, comma-separated ` +
+            `(e.g. 10.0.0.0/8,fd00::/8); unset it to read no proxy header at all (the cap is then keyed on the socket peer).`);
+    });
+}
 function parseFileHistoryRetention() {
     const raw = process.env.FILE_HISTORY_RETENTION_KEEP;
     if (raw === undefined || raw === "")
@@ -1590,19 +1610,30 @@ function parentPidEnv() {
     return { parentPid: n };
 }
 const ENGINE_LINGER_FLOOR_MS = 1_000;
+const ENGINE_HANDOVER_LINGER_FLOOR_MS = 60_000;
 const ENGINE_LINGER_CEIL_MS = 24 * 60 * 60 * 1_000;
-function lingerMsEnv(name, raw, defaultMs, disableHint) {
+function engineWindowZeroSentence(zero) {
+    switch (zero.kind) {
+        case "refused":
+            return `There is no "disable" value here — ${zero.disableHint}`;
+        case "noGrace":
+            return `the literal "0" is the one value below the floor accepted here — ${zero.offHint}`;
+    }
+}
+function lingerMsEnv(name, raw, defaultMs, floorMs, zero) {
     if (raw === undefined || raw.trim() === "")
         return defaultMs;
+    if (zero.kind === "noGrace" && raw.trim() === "0")
+        return 0;
     const n = parseNumOrFail(name, raw);
-    if (!Number.isSafeInteger(n) || n < ENGINE_LINGER_FLOOR_MS || n > ENGINE_LINGER_CEIL_MS) {
+    if (!Number.isSafeInteger(n) || n < floorMs || n > ENGINE_LINGER_CEIL_MS) {
         throw new Error(`env ${name}="${raw}" must be an INTEGER number of MILLISECONDS in ` +
-            `[${ENGINE_LINGER_FLOOR_MS}, ${ENGINE_LINGER_CEIL_MS}] (1s … 24h) — it is how long ` +
+            `[${floorMs}, ${ENGINE_LINGER_CEIL_MS}] (${floorMs / 1_000}s … 24h) — it is how long ` +
             `"nobody attached, no run in flight, no HTTP touch" must hold CONTINUOUSLY before the engine self-exits. ` +
             `A value like "60" is the seconds-for-milliseconds slip: a 60ms window kills the engine inside a shell's own ` +
             `restart gap. A value like "1e100" passes a naive "is it a positive integer" check but the elapsed clock can ` +
             `NEVER reach it, which silently turns self-exit off while looking configured. ` +
-            `There is no "disable" value here — ${disableHint}`);
+            engineWindowZeroSentence(zero));
     }
     return n;
 }
@@ -1757,6 +1788,10 @@ function parseMemoryDomain(ctx) {
         if (scope === undefined) {
             throw new Error("MEMORY_SYNC_URL is set but no sync scope is derivable (memory engine off or multi-tenant without an explicit scope) — set MEMORY_SYNC_SCOPE, or run the single-user file memory engine with a typed MEMORY_SCOPE (e.g. user:<tenant>) so it provides one");
         }
+        if (!isReplicableScope(scope)) {
+            throw new Error(`${memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE"} names a userlocal: memory layer as the sync layer — that layer family never leaves the store it is written in ` +
+                "(the engine refuses to sync it before any read or request), so this sync leg would fail every round. Set MEMORY_SYNC_SCOPE to a layer that may be replicated, or unset MEMORY_SYNC_URL.");
+        }
         if (carriesCredential(scope)) {
             throw new Error(`${memorySyncScopeRaw !== undefined ? "MEMORY_SYNC_SCOPE" : "MEMORY_SCOPE"} (the memory sync layer's name) holds a credential-shaped part — the layer name travels verbatim in every sync request path and report, so it is refused, never cleaned: rename the layer`);
         }
@@ -1915,6 +1950,7 @@ function parseAuthDomain(ctx) {
         ...parseGovernanceDeclarations(),
         operatorPrincipals: csv("OPERATOR_PRINCIPALS"),
         operatorSingleUser: boolEnv("OPERATOR_SINGLE_USER", false),
+        serviceTokenActsForDeployment: boolEnv("SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT", true),
         configCatalogEnabled: boolEnv("CONFIG_CATALOG_ENABLED", true),
         principalJwtPubkeys,
         principalJwtIss,
@@ -2062,6 +2098,7 @@ function parseOrchestrationDomain(ctx) {
                                                                 ...((n) => (n !== undefined ? { maxInflightPerDevice: n } : {}))(parseDeviceBoundedIntEnv("DEVICE_MAX_INFLIGHT_PER_DEVICE", process.env.DEVICE_MAX_INFLIGHT_PER_DEVICE, DEVICE_HELLO_ACK_BOUNDS.maxInflight)),
                                                                 ...((n) => (n !== undefined ? { maxPreAuthPerRemote: n } : {}))(parseDevicePreAuthPerRemoteEnv()),
                                                                 ...((n) => (n !== undefined ? { enrollTokenTtlSec: n } : {}))(parseDeviceEnrollTokenTtlEnv()),
+                                                                ...((n) => (n !== undefined ? { trustedProxyCidrs: n } : {}))(parseDeviceTrustedProxyCidrsEnv(process.env.DEVICE_TRUSTED_PROXY_CIDRS)),
                                                                 relay: parseDeviceRelayUrlEnv(process.env.DEVICE_RELAY_URL),
                                                                 ...(process.env.DEVICE_SUPERSEDE ? { supersede: enumEnv("DEVICE_SUPERSEDE", "stale_only", ["stale_only", "deny"]) } : {}),
                                                             }
@@ -2158,6 +2195,8 @@ function parseLimitsHttpDomain() {
             ? { attachmentMimeAllowlist: csv("ATTACHMENT_MIME_ALLOWLIST").map((s) => s.toLowerCase()) }
             : {}),
         attachmentUnboundTtlMs: clampEnvWithWarn("ATTACHMENT_UNBOUND_TTL_MS", String(24 * 3600 * 1000), LIMITS_HTTP_FLOORS.attachmentUnboundTtlMs),
+        adoptionImportMaxSessions: countEnvClamped("ADOPTION_IMPORT_MAX_SESSIONS", ADOPTION_IMPORT_MAX_SESSIONS_DEFAULT, ADOPTION_IMPORT_MAX_SESSIONS_FLOOR),
+        adoptionImportMaxSessionBytes: countEnvClamped("ADOPTION_IMPORT_MAX_SESSION_BYTES", ADOPTION_IMPORT_MAX_SESSION_BYTES_DEFAULT, ADOPTION_IMPORT_MAX_SESSION_BYTES_FLOOR, ADOPTION_IMPORT_MAX_SESSION_BYTES_CEILING),
         infraCostRates: {
             toolCallMicroUsd: clampEnvWithWarn("INFRA_COST_TOOL_CALL", "0", 0),
             sandboxSecMicroUsd: clampEnvWithWarn("INFRA_COST_SANDBOX_SEC", "0", 0),
@@ -2173,9 +2212,23 @@ function parseLimitsHttpDomain() {
         sighupIdleGraceMs: clampEnvWithWarn("SIGHUP_IDLE_GRACE_MS", String(120_000), 5_000),
         ...parentPidEnv(),
         engineAutoExit: boolEnv("ENGINE_AUTO_EXIT", false),
-        engineLingerMs: lingerMsEnv("ENGINE_LINGER_MS", process.env.ENGINE_LINGER_MS, 60_000, "set ENGINE_AUTO_EXIT=false to turn self-exit off entirely."),
-        engineOrphanLingerMs: lingerMsEnv("ENGINE_ORPHAN_LINGER_MS", process.env.ENGINE_ORPHAN_LINGER_MS, 2_000, "this window only applies once the SEMA_PARENT_PID process is gone — unset SEMA_PARENT_PID to stop watching the parent at all."),
+        engineLingerMs: lingerMsEnv("ENGINE_LINGER_MS", process.env.ENGINE_LINGER_MS, 60_000, ENGINE_LINGER_FLOOR_MS, { kind: "refused", disableHint: "set ENGINE_AUTO_EXIT=false to turn self-exit off entirely." }),
+        engineOrphanLingerMs: lingerMsEnv("ENGINE_ORPHAN_LINGER_MS", process.env.ENGINE_ORPHAN_LINGER_MS, 2_000, ENGINE_LINGER_FLOOR_MS, {
+            kind: "refused",
+            disableHint: "this window only applies once the SEMA_PARENT_PID process is gone — unset SEMA_PARENT_PID to stop watching the parent at all.",
+        }),
+        engineFirstAttachMs: lingerMsEnv("ENGINE_FIRST_ATTACH_MS", process.env.ENGINE_FIRST_ATTACH_MS, 180_000, ENGINE_LINGER_FLOOR_MS, {
+            kind: "noGrace",
+            offHint: "it means no extra grace before the first non-probe request (the window is then ENGINE_LINGER_MS, as before this knob existed); " +
+                "set ENGINE_AUTO_EXIT=false to turn self-exit off entirely.",
+        }),
+        engineHandoverLingerMs: lingerMsEnv("ENGINE_HANDOVER_LINGER_MS", process.env.ENGINE_HANDOVER_LINGER_MS, 1_800_000, ENGINE_HANDOVER_LINGER_FLOOR_MS, {
+            kind: "refused",
+            disableHint: "this window only applies after a shell hands the engine over (POST /v1/engine/handover) — a shell that never does so never uses it; set ENGINE_AUTO_EXIT=false and unset SEMA_PARENT_PID to turn self-exit off entirely.",
+        }),
         rateLimitPerMin: numEnv("RATE_LIMIT_RPM", "0"),
+        runMaxConcurrent: nonNegativeIntEnv("RUN_MAX_CONCURRENT", "在飞 run 全局并发帽"),
+        runMaxConcurrentPerPrincipal: nonNegativeIntEnv("RUN_MAX_CONCURRENT_PER_PRINCIPAL", "按主体在飞 run 并发帽"),
         maxTaskCostUsd: numEnv("MAX_TASK_COST_USD", "0"),
         maxTaskTokens: numEnv("MAX_TASK_TOKENS", "0"),
         maxPrincipalCostUsd: numEnv("MAX_PRINCIPAL_COST_USD", "0"),
@@ -2484,7 +2537,7 @@ const MEMORY_GROUP_KEYS = [
 const AUTH_GROUP_KEYS = [
     "authToken", "authTokens", "allowUnauthedWrites", "corsOrigins", "principalHeader", "requirePrincipal", "autonomy",
     "commandPolicy", "compliancePosture", "lockedConfigKeys", "retentionPolicy", "retentionSweep",
-    "operatorPrincipals", "operatorSingleUser", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
+    "operatorPrincipals", "operatorSingleUser", "serviceTokenActsForDeployment", "configCatalogEnabled", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud",
     "principalJwtMaxTtlSec", "authBridgeIssuer", "bindHost", "bindHostSource",
 ];
 const ORCHESTRATION_GROUP_KEYS = [
@@ -2501,8 +2554,9 @@ const ORCHESTRATION_GROUP_KEYS = [
 const LIMITS_HTTP_GROUP_KEYS = [
     "port", "attachmentOrphanGraceMs", "workspaceFileMaxBytes", "attachmentMaxBytes", "attachmentMimeAllowlist",
     "attachmentUnboundTtlMs", "infraCostRates", "drainGraceMs", "drainSecondSignalMinGapMs", "sighupIdleGraceMs", "parentPid",
-    "engineAutoExit", "engineLingerMs", "engineOrphanLingerMs",
-    "rateLimitPerMin", "maxTaskCostUsd",
+    "engineAutoExit", "engineLingerMs", "engineOrphanLingerMs", "engineFirstAttachMs", "engineHandoverLingerMs",
+    "rateLimitPerMin", "runMaxConcurrent", "runMaxConcurrentPerPrincipal", "maxTaskCostUsd",
+    "adoptionImportMaxSessions", "adoptionImportMaxSessionBytes",
     "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec", "reapIntervalSec", "runStaleSec", "toolResultTtlSec",
 ];
 const OBSERVABILITY_GROUP_KEYS = ["metricsToken", "traceToken", "toolTrace", "traceThinking", "logLevel", "otel"];
@@ -2729,7 +2783,9 @@ export function parseCapEnv(name, raw) {
     return { value: n };
 }
 export function splitLocalRoots(a) {
-    const configRoot = a.configLocalDir ?? a.agentDataDir ?? join(a.home, ".ai-agent");
+    if (a.configLocalDir !== undefined)
+        return undefined;
+    const configRoot = a.agentDataDir ?? join(a.home, ".ai-agent");
     if (!a.localDataRoot || a.localDataRoot === configRoot)
         return undefined;
     return { dataRoot: a.localDataRoot, configRoot };

package/dist/deleted-session-ids.d.ts

@@ -0,0 +1,19 @@
+import type { DeploymentShapeInput } from "./deployment-shape.js";
+/** 表的条数上限(一条约百字节量级)。引擎的会话暂存自己按会话数有上限(超了整会话驱逐最旧);本表的上限比它宽得多。 */
+export declare const DELETED_SESSION_ID_CAP = 50000;
+/**
+ * **铸点**(唯一):本进程的在线删除协调器在删除会话本体之前记一笔 —— 围栏先立,id 才空出来。删除随后失败也无害:
+ * 这一笔只拒「别的属主」,而会话还在时别的属主本来就用不了它。
+ * 同一只 id 再删一次:这一次的删前属主对已记的每一位都等价(同一只等价律判)⇒ 收进集合(前几位一位不丢 —— 等价律有方向、不传递,只记最新一位会让
+ * 「哨兵删 → 无主重登再删 → `default` 用」绕过「哨兵 ≢ `default`」);对某一位不等价 ⇒ 记成「谁都不是」。后一次删除从不覆盖前一位(前一位的暂存仍可能在本进程)。
+ * `deployment` = 部署形(等价律的窄互认臂读它;调用方递 `ServiceConfig` 整份)。
+ */
+export declare function retireSessionId(sessionId: string, owner: string | null, deployment: DeploymentShapeInput<"principal">): void;
+/**
+ * **读点**(唯一;执行上下文解析器 `http/execution-context.ts` 步 ① 调):这只 id 在本进程被删过、而删前的属主不是 `owner` ⇒ `true`(解析器拒)。
+ * `owner` = 这条执行要服务的属主(根会话行上那一读的住客);`undefined` = 判不出 ⇒ 删过就为真(fail-closed)。
+ * 同一位 = 对**每一位**删前属主,会话属主等价律 `sameSessionOwner(deployment, 删前属主, owner)` 都成立(删前属主是行上记下的那一格,本次住客是这一次的调用方);
+ * 被互不等价的属主各删过一次的 id 对谁都为真。
+ */
+export declare function sessionIdRetiredFor(sessionId: string, owner: string | null | undefined, deployment: DeploymentShapeInput<"principal">): boolean;
+//# sourceMappingURL=deleted-session-ids.d.ts.map

package/dist/deleted-session-ids.js

@@ -0,0 +1,26 @@
+import { recordFailOpen } from "./observability/fail-open.js";
+import { sameSessionOwner } from "./security.js";
+export const DELETED_SESSION_ID_CAP = 50_000;
+const DELETED_UNDER_SEVERAL = Symbol("deleted under several owners");
+const formerOwners = new Map();
+export function retireSessionId(sessionId, owner, deployment) {
+    const prior = formerOwners.get(sessionId);
+    const recorded = prior === undefined ? [owner] : sessionIdRetiredFor(sessionId, owner, deployment) ? DELETED_UNDER_SEVERAL : prior === DELETED_UNDER_SEVERAL || prior.includes(owner) ? prior : [...prior, owner];
+    formerOwners.delete(sessionId);
+    formerOwners.set(sessionId, recorded);
+    if (formerOwners.size <= DELETED_SESSION_ID_CAP)
+        return;
+    const oldest = formerOwners.keys().next().value;
+    if (oldest !== undefined)
+        formerOwners.delete(oldest);
+    recordFailOpen("server.session-id-tombstone.evicted", `cap=${DELETED_SESSION_ID_CAP}`);
+}
+export function sessionIdRetiredFor(sessionId, owner, deployment) {
+    const former = formerOwners.get(sessionId);
+    if (former === undefined)
+        return false;
+    if (owner === undefined || former === DELETED_UNDER_SEVERAL)
+        return true;
+    return !former.every((f) => sameSessionOwner(deployment, f, owner));
+}
+//# sourceMappingURL=deleted-session-ids.js.map

package/dist/deploy-facts.d.ts

@@ -0,0 +1,155 @@
+/**
+ * 随包的引擎部署事实(npm 包内 `deploy/facts/`)—— 成员集、Schema 方言、形变登记表的**唯一定义处**,以及其中两份成员(车道 / 钥匙保管目录)的投影与 Schema。
+ *
+ * ## 成员律
+ * `deploy/facts/` 只装**引擎自己的部署要求**:引擎发出的 API 调用、引擎按名读的键与目录、引擎要求先存在的条件。每一份都有引擎属主,都是生成物
+ * (唯一生成器 `scripts/gen-deploy-lanes.ts`,`--check` 与 `test/deploy-lane-projections.test.ts` 钉「入库 ≡ 生成物」),从不手写。
+ * 部署方拥有的策略实例(引擎读来诊断、不据以发调用的东西,例如沙箱出网的 NetworkPolicy)不是成员。
+ * 每个成员 `<m>` = 数据 `<m>.json` + 一份机器可读 Schema `<m>.schema.json`;另有一份形变登记 `CHANGES.json`。三类文件都是 npm 子路径
+ * `@sema-agent/server/deploy/facts/<文件>`(子路径 = 包内文件路径)。
+ *  · `lanes`:每条执行车道的租户档、隔离位、必需键 —— 投影自 settings-schema 车道表与执行环境能力块({@link LANE_FACTS_SCHEMA};行由生成器从同一个车道模型渲出,
+ *    安装器那张旧车道表的 `users` / `isolation` 两列也从这些行派生,同源零双写);
+ *  · `sandbox-rbac`:k8s 沙箱服务账号的 RBAC 规则表 —— 表与 Schema 都在 `src/sandbox-rbac-rules.ts`(和表放一起);
+ *  · `sealed-key`:钥匙保管目录的安装契约 —— 投影自 `src/sealed-key-layout.ts` 的布局常量与配置读法「`SEALED_KEY_DIR` 须是绝对路径」({@link SEALED_KEY_FACTS})。
+ *
+ * ## 契约:「未登记的加性形变,或未抬版的破坏性形变 ⇒ 红」
+ * 发车链对**上一个已发 tag** 里的同名 Schema 求差(`scripts/deploy-facts-gate.ts`;CI 浅克隆读不到 tag,这道判据在发车链跑),
+ * 差异逐条分成加性 / 破坏性,与 {@link FACTS_SCHEMA_CHANGES} 里本版新登记的条目对账。**加性只有一种:新增一个可选属性**;其余任何形变
+ * (删属性、改类型、可选 ⇄ 必有、新增必有属性、`items` 形变、闭集增 / 删词、`const` 变、`minItems` / `uniqueItems` / `x-uniqueKey` 变)都是破坏性。
+ * 值的含义变了而 Schema 不变(例如重新定义某个闭集词)门判不出 —— 改动者登记一条 `breaking` 并写明 `why`,复审按这一条问。
+ *
+ * ## 版本
+ * 每个成员的 `schemaVersion` **从登记表派生**({@link factsSchemaVersion}):首发那一版 = 1,此后每个登记了 `breaking` 的版本 +1。不另写常量 ——
+ * 登记一条破坏性形变就抬了版,「改了形忘了抬版」只剩「改了形没登记」一种,门对着已发 tag 抓它。
+ * 读方义务:用**同一个包里**那份 Schema 校验;不认识的 `schemaVersion` 整份拒读;同一版本内的未知键忽略。
+ */
+import { TENANT_SEPARATION_WORDS } from "@sema-agent/settings-schema/execution-lanes";
+/** 包内目录(npm 子路径前缀 `@sema-agent/server/deploy/facts/`)。 */
+export declare const DEPLOY_FACTS_DIR = "deploy/facts";
+/** 成员闭集。加一个成员 = 这里加一个词 + 生成器给它数据与 Schema + 登记表一条 `introduced`(缺任一处 ⇒ 编译错或生成抛)。 */
+export declare const DEPLOY_FACTS_MEMBERS: readonly ["lanes", "sandbox-rbac", "sealed-key"];
+export type DeployFactsMember = (typeof DEPLOY_FACTS_MEMBERS)[number];
+/** 形变登记表的文件名(与成员同目录;不是成员,没有自己的 Schema)。 */
+export declare const DEPLOY_FACTS_CHANGES_FILE = "CHANGES.json";
+/** 方言 = JSON Schema 2020-12 的一个闭子集;根上的 `$schema` 恒为它。 */
+export declare const FACTS_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
+/**
+ * 方言的节点形(类型就是方言:多写一个关键字 = 编译错;`scripts/deploy-facts-gate.ts` 在 JSON 面再判一次,拿到的是入库文件与已发 tag 上的文件)。
+ *  · 标量:`string`(可带 `enum` 闭集或 `const`)/ `integer`(可带 `const`)/ `boolean`;
+ *  · 对象:`properties` + `required`(⊆ properties)+ `additionalProperties: false`(恒关:未登记的键不许出现);
+ *  · 数组:`items`(必有)+ 可选 `minItems`;标量元素可声明 `uniqueItems: true`,对象元素可声明 `x-uniqueKey`(这几个属性的值组合在数组里唯一;
+ *    成员必须是元素的必有属性、且是标量或标量数组 —— 对象成员里加可选属性按上面的判法是加性,却会让旧读方算出的唯一性失真;
+ *    标准校验器把它当注解忽略,本仓的校验器执行它)。
+ *  · JSON 键一律只认自有的(`toString` / `constructor` / `__proto__` 这类原型链上的名字不算「在」)。
+ *  · `description` 任何节点都可带,差异判法不看它(值含义的变化走人工登记)。
+ */
+export type FactsScalarSchema = {
+    readonly type: "string";
+    readonly enum?: readonly string[];
+    readonly const?: string;
+    readonly description?: string;
+} | {
+    readonly type: "integer";
+    readonly const?: number;
+    readonly description?: string;
+} | {
+    readonly type: "boolean";
+    readonly description?: string;
+};
+export interface FactsObjectSchema {
+    readonly type: "object";
+    readonly properties: {
+        readonly [key: string]: FactsNodeSchema;
+    };
+    readonly required: readonly string[];
+    readonly additionalProperties: false;
+    readonly description?: string;
+}
+export interface FactsArraySchema {
+    readonly type: "array";
+    readonly items: FactsNodeSchema;
+    readonly minItems?: number;
+    readonly uniqueItems?: true;
+    readonly "x-uniqueKey"?: readonly string[];
+    readonly description?: string;
+}
+export type FactsNodeSchema = FactsScalarSchema | FactsObjectSchema | FactsArraySchema;
+/**
+ * 每种节点允许的关键字(运行期闭集;`scripts/deploy-facts-gate.ts` 的方言判读它,对入库文件与已发 tag 上的文件都判)。
+ * `satisfies` 让这张表只列类型里有的键;类型里多出来而表里没列的键,生成器在渲 Schema 时当场抛「方言外的关键字」。根节点另多一个 `$schema`。
+ */
+export declare const FACTS_SCHEMA_KEYWORDS: {
+    readonly string: readonly ["type", "enum", "const", "description"];
+    readonly integer: readonly ["type", "const", "description"];
+    readonly boolean: readonly ["type", "description"];
+    readonly object: readonly ["type", "properties", "required", "additionalProperties", "description"];
+    readonly array: readonly ["type", "items", "minItems", "uniqueItems", "x-uniqueKey", "description"];
+};
+/** 根:一个对象节点 + `$schema`;`schemaVersion` 必有且形恒为 `{ type: "integer", const: <版本> }`(门把这一处当版本通道,不当形变)。 */
+export interface FactsRootSchema extends FactsObjectSchema {
+    readonly $schema: typeof FACTS_SCHEMA_DIALECT;
+    readonly properties: {
+        readonly schemaVersion: {
+            readonly type: "integer";
+            readonly const: number;
+            readonly description?: string;
+        };
+        readonly [key: string]: FactsNodeSchema;
+    };
+}
+export declare const FACTS_SCHEMA_CHANGE_KINDS: readonly ["introduced", "additive", "breaking"];
+export type FactsSchemaChangeKind = (typeof FACTS_SCHEMA_CHANGE_KINDS)[number];
+/**
+ * 一条形变登记。`pointer` = 实例路径:`""` 是整份,`/lanes/[]/isolation` 是 `lanes` 数组每一行的 `isolation`(`[]` = 数组元素)。
+ * `version` = 这条形变随哪个 server 版本发出;已发版本的条目只读(门:基线 tag 上的每一条在本树里原样还在)。
+ */
+export interface FactsSchemaChange {
+    readonly version: string;
+    readonly file: DeployFactsMember;
+    readonly kind: FactsSchemaChangeKind;
+    readonly pointer: string;
+    readonly why: string;
+}
+/**
+ * 形变登记表(只追加;生成器把它写成随包 `CHANGES.json` 与 README 的变更节)。
+ * 新条目的 `version` 写下一个要发的 server 版本;发车链在版本号抬起后核「本版新登记的条目都是这个版本」。
+ */
+export declare const FACTS_SCHEMA_CHANGES: readonly FactsSchemaChange[];
+/**
+ * 成员当前的 `schemaVersion`:登记表里恰一条 `introduced`(那一版 = 1),此后每个登记了 `breaking` 的**不同**版本 +1
+ * (同一版本里登记几条破坏性形变都只抬一次;首发那一版里的 `breaking` 不算 —— 那时还没有发出去的形)。
+ * 登记表不合这个形(零条 / 多条 `introduced`)⇒ 抛:版本号无从派生,不猜。
+ */
+export declare function factsSchemaVersion(member: DeployFactsMember, changes?: readonly FactsSchemaChange[]): number;
+/** 隔离位闭集:手跑在不在 OS 级隔离边界里(执行环境能力块的 `isolation` 位;安装器旧车道表的 `isolation` 列也读这两个词)。 */
+export declare const LANE_ISOLATION_WORDS: readonly ["supported", "unsupported"];
+export type LaneIsolationWord = (typeof LANE_ISOLATION_WORDS)[number];
+/** `lanes.json` 的一行(行序 = settings-schema 车道词序)。 */
+export interface LaneFactsRow {
+    readonly lane: string;
+    readonly tenantSeparation: (typeof TENANT_SEPARATION_WORDS)[number];
+    readonly isolation: LaneIsolationWord;
+    readonly requiredEnv: readonly string[];
+    readonly requiredSecretEnv: readonly string[];
+}
+export declare const LANE_FACTS_SCHEMA: FactsRootSchema;
+/** 钥匙保管目录对安装器的要求(闭集;每个词的意思写在 Schema 的 `description` 里)。 */
+export declare const SEALED_KEY_REQUIREMENTS: readonly ["persist-across-restart", "shared-by-all-replicas", "writable", "whole-directory"];
+export type SealedKeyRequirement = (typeof SEALED_KEY_REQUIREMENTS)[number];
+/** 保管目录路径形的闭集:只收绝对路径(相对路径起服拒)。 */
+export declare const SEALED_KEY_DIR_PATH_FORMS: readonly ["absolute"];
+/**
+ * `sealed-key.json` 的内容:安装契约要求**显式设一个绝对路径的 `SEALED_KEY_DIR`**,安装器据此挂卷。
+ * 没设它时引擎回落到数据根下的 `sealed-key/`(数据根自身还有一条回落链)—— 那是引擎内部行为,安装器不依赖它,所以不在这份事实里。
+ */
+export declare const SEALED_KEY_FACTS: {
+    readonly schemaVersion: number;
+    readonly dirEnv: "SEALED_KEY_DIR";
+    readonly dirPath: "absolute";
+    readonly subdirs: readonly ["checkpoint-ctx-keys"];
+    readonly dirMode: string;
+    readonly fileMode: string;
+    readonly requirements: readonly ["persist-across-restart", "shared-by-all-replicas", "writable", "whole-directory"];
+};
+export declare const SEALED_KEY_FACTS_SCHEMA: FactsRootSchema;
+//# sourceMappingURL=deploy-facts.d.ts.map