@sema-agent/server 7.145.0 → 7.146.0

package/dist/http/routes/session-sync.js

@@ -1,10 +1,9 @@
 import { once } from "node:events";
-import { randomBytes } from "node:crypto";
-import { sessionLogDigest, sessionLogDigestsComparable, StreamingImportValidator, validateFileHistoryExport } from "@sema-agent/core";
+import { sessionLogDigest, sessionLogDigestsComparable, validateFileHistoryExport } from "@sema-agent/core";
 import { StringDecoder } from "node:string_decoder";
 import { FileHistoryUnreadableError, blobGetterOf, exportSessionManifest, exportedFileHistory, fileHistoryImportFace, replayFileHistory, replayPolicyRecords, wipeSessionAttendants } from "../../session-sync.js";
 import * as facts from "../../capability-facts.js";
-import { classifySyncRelationshipByIds, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
+import { classifySyncRelationshipByIds, createStagedLogFeed, MalformedImportEntryError, newStagingToken, readImportAnchors, SyncConflictError } from "../../session-sync-kernel.js";
 import { isUuidShape, legacyUnownedSessionOk, sessionOwnerCellOf } from "../../security.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, logRequestError, msg } from "../send.js";
 import { StampedSessionArchiveError } from "../../session-error-wire.js";
@@ -14,7 +13,6 @@ import { storeFaultClassOf } from "../../plugins/store-fault.js";
 import { fleetViewOf, gatedPrincipal, explicitOperatorOk, sendUnauthorized, sessionCallerOf } from "../principal-gate.js";
 const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
 const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
-const SYNC_IMPORT_BATCH = 500;
 import { SHA256_HEX_RE } from "../../digest-form.js";
 import { assertNever, SESSION_NOT_FOUND_MESSAGE } from "../route-ctx.js";
 import { readSessionRulesRecords, describeSessionRulesRecordProblem } from "../../session-policy-wire.js";
@@ -501,7 +499,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                 }
                 const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
                 const operatorOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config);
-                const token = randomBytes(8).toString("hex");
+                const token = newStagingToken();
                 const handle = sessionStorage.beginImportStaging(sessionId, token);
                 const stagingId = handle.stagingId;
                 importLeases.set(sessionId, { at: Date.now(), stagingId });
@@ -527,13 +525,8 @@ export async function handleSessionSync(req, res, match, ctx) {
                     sendError(res, 404, "not_found.staging", "staging not found");
                     return;
                 }
-                const validator = new StreamingImportValidator();
+                const feed = createStagedLogFeed(pending.handle);
                 let lineBuf = "";
-                let pendingBatch = [];
-                const flush = async () => { if (pendingBatch.length) {
-                    await pending.handle.appendBatch(pendingBatch);
-                    pendingBatch = [];
-                } };
                 class PrecheckError extends Error {
                     status;
                     constructor(status, msg) {
@@ -542,12 +535,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                     }
                 }
                 const streamedIds = new Set();
-                const onEntry = (e) => {
-                    if (!e || typeof e !== "object" || typeof e.id !== "string")
-                        throw new PrecheckError(422, "malformed entry (missing id)");
-                    streamedIds.add(e.id);
-                    validator.step(e);
-                };
+                const onEntry = async (e) => { streamedIds.add(await feed.push(e)); };
                 const utf8 = new StringDecoder("utf8");
                 try {
                     for await (const chunk of req) {
@@ -568,10 +556,7 @@ export async function handleSessionSync(req, res, match, ctx) {
                             catch {
                                 throw new PrecheckError(400, "malformed NDJSON line");
                             }
-                            onEntry(e);
-                            pendingBatch.push(e);
-                            if (pendingBatch.length >= SYNC_IMPORT_BATCH)
-                                await flush();
+                            await onEntry(e);
                         }
                     }
                     lineBuf += utf8.end();
@@ -584,11 +569,9 @@ export async function handleSessionSync(req, res, match, ctx) {
                         catch {
                             throw new PrecheckError(400, "malformed NDJSON line");
                         }
-                        onEntry(e);
-                        pendingBatch.push(e);
+                        await onEntry(e);
                     }
-                    await flush();
-                    validator.finish();
+                    await feed.finish();
                     if (streamedIds.size !== pending.declaredEntryIds.length || !pending.declaredEntryIds.every((id) => streamedIds.has(id))) {
                         throw new PrecheckError(422, "streamed entries do not match the Phase-A declared entryIds");
                     }
@@ -600,6 +583,10 @@ export async function handleSessionSync(req, res, match, ctx) {
                         sendError(res, e.status, "invalid_entries", e.message);
                         return;
                     }
+                    if (e instanceof MalformedImportEntryError) {
+                        sendError(res, 422, "invalid_entries", e.message);
+                        return;
+                    }
                     if (sendSessionError(res, e, "import"))
                         return;
                     throw e;

package/dist/http/routes/sessions-list.d.ts

@@ -2,7 +2,7 @@
  * [ref] A9 域模块 —— 会话列表 / 发件链接列表。
  *
  * 路由:`GET /v1/sessions`(CC /resume picker,keyset 分页)、`GET /v1/sendfile-links`。
- * owner-scope 与 trace 列表同一权威模型(`fleetViewOf` 读档:service 凭据不报主体 / 只读 trace 凭据 / dev-open = fleet-wide;带验过的主体 = 钉住那位主体)。本域零可变状态。
+ * owner-scope 与 trace 列表同一权威模型(`fleetViewOf` 读档:service 凭据不报主体〔部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` 时不算〕/ 只读 trace 凭据 / dev-open = fleet-wide;带验过的主体 = 钉住那位主体)。本域零可变状态。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { type SessionListItem } from "../../security.js";

package/dist/http/routes/sessions.js

@@ -8,6 +8,7 @@ import { recordFailOpen } from "../../observability/fail-open.js";
 import { MCP_DIAL_DEADLINE_MS, raceDeadline } from "../mcp-dial-deadline.js";
 import { sentMemoryComplianceFailure } from "../memory-compliance-failure-reply.js";
 import { readLayerSeat, sentMemoryLayerRefusal } from "../memory-layer-reply.js";
+import { DEPLOYMENT_SHAPE_PREDICATES } from "../../deployment-shape.js";
 import { MAX_SETTINGS_OUTPUT_STYLE_CHARS, MAX_SETTINGS_ENV_VARS, MAX_SETTINGS_ENV_KEY_CHARS, MAX_SETTINGS_ENV_VALUE_CHARS } from "../../task-settings.js";
 import { readWritableSessionPermissionRules } from "../../session-policy-wire.js";
 import { sendJson, sendError, sendSessionError, sendSessionPolicyError, sseHeaders, httpErrorBody } from "../send.js";
@@ -615,6 +616,7 @@ export async function handleSessions(req, res, match, ctx) {
                         memoryStatusCache.delete(cacheKey); });
                 }
                 const s = await pending;
+                const workerPathsDisclosed = DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(deps.config);
                 sendJson(res, 200, {
                     sessionId,
                     autoConsolidationArmed: deps.memoryAutoConsolidationArmed,
@@ -624,6 +626,8 @@ export async function handleSessions(req, res, match, ctx) {
                     ...(s.foldedCount !== undefined ? { foldedCount: s.foldedCount } : {}),
                     ...(s.optOutSource !== undefined ? { optOutSource: s.optOutSource } : {}),
                     ...(s.lastCaptureAt !== undefined ? { lastCaptureAt: s.lastCaptureAt } : {}),
+                    ...(s.writeHome !== undefined && workerPathsDisclosed ? { writeHome: s.writeHome } : {}),
+                    ...(s.planes !== undefined && workerPathsDisclosed ? { planes: s.planes.map((row) => ({ plane: row.plane, ...(row.status.writeHome !== undefined ? { writeHome: row.status.writeHome } : {}) })) } : {}),
                 });
             }
             catch (err) {

package/dist/http/routes/tasks.js

@@ -76,7 +76,7 @@ const MULTI_ATTEMPT_NO_EVENT_CHANNEL_NOTICE = "verify / cascade ran with their n
 export async function handleTasks(req, res, match, ctx) {
     const { deps } = ctx;
     const { idemCache, inflightRuns, steerableRuns, counters } = ctx.registry;
-    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied } = ctx.helpers;
+    const { readJson, rateLimited, quotaExceeded, leaseDenied, usageWindowDenied, admitRun } = ctx.helpers;
     const { prepareSpec, finalizeTaskResult } = ctx.legs;
     const reqState = ctx.req;
     const source = ctx.req.source;
@@ -144,10 +144,14 @@ export async function handleTasks(req, res, match, ctx) {
         }
         if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)) || (await usageWindowDenied(req, res)))
             return;
+        let runSlot = undefined;
         const prepared = await prepareSpec(req, res, keyedBody, undefined, { liveStream });
         if (!prepared)
             return;
         try {
+            runSlot = admitRun(req, res);
+            if (runSlot === undefined)
+                return;
             const declaredFamilies = declaredApprovalFrameFamilies(prepared.body.settings);
             const approvalLegInput = (streamApprovalOn) => {
                 const legWalltimeMs = typeof prepared.spec.limits?.maxWalltimeMs === "number" ? prepared.spec.limits.maxWalltimeMs : undefined;
@@ -184,7 +188,7 @@ export async function handleTasks(req, res, match, ctx) {
                 sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
                 if (earlyDurableTid)
                     writeMetaFrame(res, earlyDurableTid, prepared.spec.sessionId, prepared.warnings);
-                const ac = createRunAbort();
+                const ac = createRunAbort(prepared.auth?.principal ?? null);
                 let closed = false;
                 let detachLogged = false;
                 let disconnectParkGrace;
@@ -355,6 +359,7 @@ export async function handleTasks(req, res, match, ctx) {
                         }, HEARTBEAT_MS);
                         durableHeartbeat.unref?.();
                         inflightRuns.set(tid, ac);
+                        runSlot?.release();
                         void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !ac.signal.aborted)
                             abortFromVerb(); }).catch(() => undefined);
                     }
@@ -849,7 +854,10 @@ export async function handleTasks(req, res, match, ctx) {
                 };
                 counters.uncountedBillableInflight++;
                 try {
-                    resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runStreamSubmitLeg()));
+                    const settling = idemCache.run(inflightKey, async () => withRunReceipt(await runStreamSubmitLeg()));
+                    if (!ranLive)
+                        runSlot?.release();
+                    resp = await settling;
                 }
                 catch (e) {
                     deps.logger?.error("stream_error", { closed, err: redactHead(e instanceof Error ? e.message : String(e), 2000) });
@@ -904,7 +912,7 @@ export async function handleTasks(req, res, match, ctx) {
                             return ctxRefusal;
                     }
                     commitSessionInheritEnv(deps, prepared.spec.sessionId, prepared.body);
-                    const syncCancelCtrl = createRunAbort();
+                    const syncCancelCtrl = createRunAbort(principal ?? null);
                     markChildrenStoppedByUserOnAbort(syncCancelCtrl.signal, durableTaskId ?? prepared.spec.sessionId, prepared.auth?.principal);
                     if (durableTaskId && deps.runStore) {
                         const rs = deps.runStore;
@@ -920,11 +928,13 @@ export async function handleTasks(req, res, match, ctx) {
                         }, HEARTBEAT_MS);
                         durableHeartbeat.unref?.();
                         inflightRuns.set(tid, syncCancelCtrl);
+                        runSlot?.release();
                         void Promise.resolve(rs.isCancelRequested?.(tid, owner)).then((c) => { if (c && !syncCancelCtrl.signal.aborted)
                             abortFromVerb(); }).catch(() => undefined);
                     }
                     else if (durableTaskId) {
                         inflightRuns.set(durableTaskId, syncCancelCtrl);
+                        runSlot?.release();
                     }
                     const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal, ...(durableTaskId ? { taskId: durableTaskId } : {}) };
                     const observeSyncLegEvent = (ev) => {
@@ -1001,12 +1011,20 @@ export async function handleTasks(req, res, match, ctx) {
                     noteRunOutcome(result);
                     return { status: 200, body: withSyncSubmitKeys(buildSyncSubmitBody(exitResult)) };
                 };
-                const resp = await idemCache.run(inflightKey, async () => withRunReceipt(await runSyncSubmitLeg()));
+                let ranSyncLeg = false;
+                const settling = idemCache.run(inflightKey, async () => {
+                    ranSyncLeg = true;
+                    return withRunReceipt(await runSyncSubmitLeg());
+                });
+                if (!ranSyncLeg)
+                    runSlot?.release();
+                const resp = await settling;
                 sendSubmitResult(res, resp);
             }
             return;
         }
         finally {
+            runSlot?.release();
             prepared.peerLease.release();
         }
     }

package/dist/http/routes/trace-usage.js

@@ -102,7 +102,7 @@ export async function handleTraceUsage(req, res, match, ctx) {
             };
             const now = Date.now();
             const from = parseT(q.get("from"), now - 7 * 86_400_000);
-            const to = parseT(q.get("to"), now);
+            const to = parseT(q.get("to"), now + 1);
             if (Number.isNaN(from) || Number.isNaN(to) || from >= to) {
                 sendError(res, 400, "request.query_invalid", "invalid from/to (ISO-8601 or epoch-ms; from < to)");
                 return;

package/dist/http/run-concurrency-cap.d.ts

@@ -0,0 +1,86 @@
+/**
+ * 在飞 run 并发帽 —— `RUN_MAX_CONCURRENT`(本副本全局)/ `RUN_MAX_CONCURRENT_PER_PRINCIPAL`(同一已验提交主体),缺省 0 = 关。
+ *
+ * ## 为什么有这一只
+ * 共享一台 GPU / 一只小模型网关的部署,调用方自己限并发不可靠(多个调用方、重试风暴、脚本一把梭)。`RATE_LIMIT_RPM` 是速率桶(每分钟几条),
+ * 不是「此刻有几条在跑」;一条 run 可以跑几十分钟,速率桶放行的新提交会在同一台机器上叠起来。本帽数的就是后一个量。
+ *
+ * ## 数什么
+ * **同一份**在飞集:`inflightRuns ∪ steerableRuns`({@link liveRunIdsOf} —— `drainState.inflight` 读的也是它;`isRunLiveOnThisReplica`(`http/server.ts`)是同一并集的逐 id 判,
+ * 另写成两只 `has` 的析取,不经本函数;计数只有这一处写法,不另造第二份)。按主体数时读 `inflightRuns` 值上的 `owner`({@link RunAbort.owner} —— 句柄与腿同寿,不另起旁表);
+ * 只在 `steerableRuns` 里的键没有属主可读,只计入全局(今天每条可 steer 的腿都同时登记在 `inflightRuns`,这是形式上的保守)。
+ * 数的是**本副本**:副本之间不共享,多副本部署的整体并发 = 各副本的帽之和。
+ *
+ * ## 判点(哪几扇门判、哪几扇不判)
+ * 判 = **新提交要起一条 run** 的三个提交门(`routes/runs.ts` 的 `createDurableRun` —— `POST /v1/runs` 与 A2A `message/send` 共用的建行腿、
+ * `routes/tasks.ts` 的 `POST /v1/tasks` 与 `POST /v1/tasks/stream`),且排在**幂等重放之后**(同键 / 自带 taskId 的重试拿回自己的回执,不吃新 429)。
+ * 不判 = 已有 run 的延续与作答:续跑、唤醒、审批 / 问答作答、`/decide` —— 它们不是新提交,在飞时照样占一格(被数;没有 run 行的老形续跑不登记进在飞集,不被数),
+ * 但拒它们会把一张已经在等人的卡卡死。所以帽闸的是**新提交**,不是在飞总数的硬上限:一条停驻的 run 续跑回来时,在飞数可以越过帽。
+ * leader 口的后台 run 不在 `inflightRuns` 里(drain 靠 `uncountedBillableInflight` 看见它),本帽不数它也不判它。
+ * 位置的两个如实:三个口的帽都排在受理漏斗(`prepareSpec`,可能为新会话做登记)**之后**、建行与 SSE 头之前 —— `POST /v1/runs` 与 A2A 口因自带 `taskId` 的重放在漏斗之后才答、帽必须排在它后面
+ * (与 lease / 治理窗的 429 同位),`POST /v1/tasks` 两口与它们同位;拒时漏斗已做的会话登记不撤。同键的并发重复提交若赶在首发还在受理(尚未落行、尚未进在飞合流)的窗里到达,按新提交判,
+ * 帽满时与其它准入门(速率 / 配额)同形可能拿到一次 429 + `Retry-After`,按它重投即拿回首发的回执。
+ *
+ * ## 席位(为什么放行不是「读一下数就完了」)
+ * 判完帽到这条 run 登记进 `inflightRuns` 之间隔着若干次 await(建行、执行放置、续跑输入落库 …)。并发一阵提交若都只「读数」,会全部在登记之前读到同一个数、
+ * 一起放行 —— 越帽。所以放行即**占一枚席位**({@link RunSlot}),在飞数 = 在飞集 + 未放的席位。席位在这条 run 登记进在飞集的那一拍放掉:
+ * 三个提交门同形:建行腿 `mintAndDriveDurableRun` 在 `runInBackground`(返回前同步登记)返回后就地放(`runSlot` 入参),`POST /v1/tasks` / `/v1/tasks/stream` 两腿在各自的
+ * `inflightRuns.set` 之后就地放;提交门的 `finally` 总再放一次兜底(早退、被别的门拒、抛 —— `release` 幂等)。登记到放席位之间没有 await,别的提交读不到
+ * 「既在集里又占着席位」的中间态,所以不重复计。
+ * 两个尾巴:合流进别人在飞建行的重复提交(同键赛过 `peek`)自己不建行 —— `POST /v1/tasks` 一族席位当场放回;`POST /v1/runs`(与 A2A 提交)的席位到这一次提交的整段结清(`.finally`)才放,
+ *   合流的那一次要等共享铸件结清,帽边上可多答一次 429;没有 run store 的部署上同步 / 流式腿根本不登记进在飞集
+ * (drain 靠 `uncountedBillableInflight` 数它们),它们的席位就活到请求结束 —— 帽照样数得到它们。
+ *
+ * ## 拒的形
+ * 429 `limit.rate_exceeded`(沿用现有限流码,不新铸一枚:消费端的分支同「稍后再来」)+ 体里机读 `reason`(闭集 {@link RATE_EXCEEDED_REASONS},今天一词)
+ * + `retryAfterSec`(固定 {@link RUN_CONCURRENCY_RETRY_AFTER_SEC});头 `Retry-After` 与体里同值,同其它限流 / 配额门的发送形(`res.setHeader("retry-after")` + `sendError`)。
+ * 拒在建行、认领会话与 SSE 头之前(受理漏斗已做的会话登记见上面「位置的两个如实」)。
+ *
+ * ## 谁需要 / 谁受伤 / 补偿
+ * 需要:共享一台 GPU 或一只小模型网关的家用 / 小团队部署。受伤:超帽者拿 429(新行为,缺省关)。补偿:缺省 0 = 关(升级零变化)+ `Retry-After` 给退避。
+ * 无主体请求(无头 service 凭据、`REQUIRE_PRINCIPAL=false` 的单用户部署)只受全局帽 —— 按主体帽对它不判(没有主体可分账)。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { RunAbort } from "../run-cancel-context.js";
+import { type RefusalBody } from "./refusal-body.js";
+import type { FlatServiceDeps } from "./server.js";
+/**
+ * 本副本在飞 run 的 id 集 —— `inflightRuns`(durable 腿)∪ `steerableRuns`(活流)的**唯一**并集写法:
+ * `drainState.inflight`(排空等多久)、`isRunLiveOnThisReplica`(这条 run 是不是在本副本跑)与并发帽读的是同一份。
+ * 参数取 `ReadonlyMap`:读法不改登记簿。
+ */
+export declare function liveRunIdsOf(inflightRuns: ReadonlyMap<string, unknown>, steerableRuns: ReadonlyMap<string, unknown>): Set<string>;
+/** 并发帽拒的机读 `reason` 词。 */
+export declare const RUN_CONCURRENCY_CAP_REASON: "run_concurrency_cap";
+/**
+ * 429 `limit.rate_exceeded` 体上机读 `reason` 的**闭集**(穷举读它;加一种拒因 ⇒ 这里加一词,`switch` 的消费端编译红)。
+ * 其余 `limit.rate_exceeded` 的产地(速率桶、赎回准入、MCP 探活、烘焙提交)不带 `reason` —— 读法是「有 `reason` 才分」。
+ */
+export declare const RATE_EXCEEDED_REASONS: readonly ["run_concurrency_cap"];
+export type RateExceededReason = (typeof RATE_EXCEEDED_REASONS)[number];
+/** 退避提示:固定 5 秒(是提示不是承诺 —— 在飞的 run 可能再跑很久;帽满只说「稍后再来」)。 */
+export declare const RUN_CONCURRENCY_RETRY_AFTER_SEC = 5;
+/** 一枚席位:放行与登记进在飞集之间占着的那一格。`release` 幂等(登记点放一次,提交门的 `finally` 再放一次兜底)。 */
+export interface RunSlot {
+    release(): void;
+}
+/** 并发帽拒的 `{status, body, retryAfterSec}`(体经全仓唯一组句器;状态与退避供发送口用)。 */
+export declare function runConcurrencyRefusalOf(): {
+    readonly status: 429;
+    readonly body: RefusalBody;
+    readonly retryAfterSec: number;
+};
+export interface RunConcurrencyGate {
+    /**
+     * 提交门的并发帽准入:放行 ⇒ 交回席位(调用点登记那一拍 / `finally` 放);超帽 ⇒ 已应答 429(+ `Retry-After`),交回 `undefined`,调用点 `return`。
+     * 位序:在幂等重放、`rateLimited` / `quotaExceeded` / `leaseDenied` / `usageWindowDenied` 之后,任何建行 / 认领 / SSE 头之前。
+     */
+    admitRun(req: IncomingMessage, res: ServerResponse): RunSlot | undefined;
+}
+/** 装配口:`deps` 只读 `config`(两旋钮,每次判时现读)与 `logger`;在飞集由 server 装配层交来(两张登记簿本身,不拷)。 */
+export declare function createRunConcurrencyGate(ctx: {
+    deps: Pick<FlatServiceDeps, "config" | "logger">;
+    inflightRuns: ReadonlyMap<string, RunAbort>;
+    steerableRuns: ReadonlyMap<string, unknown>;
+}): RunConcurrencyGate;
+//# sourceMappingURL=run-concurrency-cap.d.ts.map

package/dist/http/run-concurrency-cap.js

@@ -0,0 +1,54 @@
+import { gatedPrincipal } from "./principal-gate.js";
+import { refusalBody } from "./refusal-body.js";
+import { sendError } from "./send.js";
+export function liveRunIdsOf(inflightRuns, steerableRuns) {
+    return new Set([...inflightRuns.keys(), ...steerableRuns.keys()]);
+}
+export const RUN_CONCURRENCY_CAP_REASON = "run_concurrency_cap";
+export const RATE_EXCEEDED_REASONS = [RUN_CONCURRENCY_CAP_REASON];
+export const RUN_CONCURRENCY_RETRY_AFTER_SEC = 5;
+const UNTRACKED_SLOT = { release: () => undefined };
+export function runConcurrencyRefusalOf() {
+    return {
+        status: 429,
+        body: refusalBody({
+            errorCode: "limit.rate_exceeded",
+            message: "too many runs are in flight on this server right now — nothing was started; retry after the Retry-After interval",
+            facts: { reason: RUN_CONCURRENCY_CAP_REASON, retryAfterSec: RUN_CONCURRENCY_RETRY_AFTER_SEC },
+        }),
+        retryAfterSec: RUN_CONCURRENCY_RETRY_AFTER_SEC,
+    };
+}
+export function createRunConcurrencyGate(ctx) {
+    const { deps, inflightRuns, steerableRuns } = ctx;
+    const seats = new Set();
+    function admitRun(req, res) {
+        const { runMaxConcurrent: globalCap, runMaxConcurrentPerPrincipal: ownCap } = deps.config;
+        if (globalCap === 0 && ownCap === 0)
+            return UNTRACKED_SLOT;
+        const owner = gatedPrincipal(req, deps.config);
+        const live = liveRunIdsOf(inflightRuns, steerableRuns);
+        const inFlight = live.size + seats.size;
+        let scope;
+        if (globalCap > 0 && inFlight >= globalCap)
+            scope = "global";
+        else if (ownCap > 0 && owner !== undefined) {
+            const holders = [...[...live].map((id) => inflightRuns.get(id)?.owner), ...[...seats].map((seat) => seat.owner)];
+            if (holders.filter((o) => o === owner).length >= ownCap)
+                scope = "principal";
+        }
+        if (scope !== undefined) {
+            deps.logger?.info?.("run_concurrency_cap_refused", { scope, inFlight, cap: scope === "global" ? globalCap : ownCap, hasPrincipal: owner !== undefined });
+            const refusal = runConcurrencyRefusalOf();
+            const { error, errorCode, ...extra } = refusal.body;
+            res.setHeader("retry-after", String(refusal.retryAfterSec));
+            sendError(res, refusal.status, errorCode, error, extra);
+            return undefined;
+        }
+        const seat = { owner };
+        seats.add(seat);
+        return { release: () => void seats.delete(seat) };
+    }
+    return { admitRun };
+}
+//# sourceMappingURL=run-concurrency-cap.js.map

package/dist/http/server.d.ts

@@ -2,7 +2,7 @@ import http from "node:http";
 import type { MemoryComplianceFaces, MemoryOriginFaces, SessionMemoryStatusFace } from "../memory-operator-faces.js";
 import type { SideQueryAccounting } from "../budget.js";
 import type { IncomingMessage } from "node:http";
-import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type ConsolidationRunReceipt, type ConsolidationDriverRunRow, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
+import { type Runner, type RunnerDeps, type TaskSpec, type TaskResult, type WorkflowRunStore, type MemoryEntry, type MemoryExportBundle, type MemoryImportReport, type SideQuerySpec, type SideQueryResult, type Brain, type EngineNotice } from "@sema-agent/core";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ServiceConfig } from "../config-types.js";
 import { type SessionMirrorRuling } from "../web-admin-client/facade.js";
@@ -31,7 +31,7 @@ import type { Metrics } from "../observability/metrics.js";
 import { type RateGate } from "../observability/rate-limit.js";
 import type { QuotaTracker } from "../observability/cost-quota.js";
 import type { ModelUsageTracker, PromptManifestTracker } from "../budget.js";
-import type { ConsolidationSeatLabel, ConsolidationValve } from "../boot/memory-consolidation.js";
+import type { ConsolidationValve, MemoryConsolidationFaces } from "../boot/memory-consolidation.js";
 import { streamApprovals, checkQuestionAnswer } from "./routes/approvals-assistant.js";
 export { streamApprovals, checkQuestionAnswer };
 import { cascadeConfig } from "./run-meta.js";
@@ -581,15 +581,9 @@ export interface ServiceSeamDeps {
      *  **启动期**就被拒了(`boot/memory-consolidation.ts`),那些机器根本起不来。⇒ 缺席形是 **404 族**
      *  (整域不挂),刻意**不是** 501:501 说「换部署形态」,这里的动作是「把旋钮打开」。全文见
      *  `routes/memory-consolidation.ts` 头注。
-     *  🔴 `seat` 的词表单一真源 = `boot/memory-consolidation.ts` 的 {@link ConsolidationSeatLabel}
-     *  (type-only import,tsc 擦除、非装载边)——在这里再写一遍字面量联合就是第二份会漂的词表。 */
-    memoryConsolidation?: {
-        readonly seat: ConsolidationSeatLabel;
-        readonly model: string;
-        readonly scopes: readonly string[];
-        run(scope: string): Promise<ConsolidationRunReceipt>;
-        lastRun(scope: string): ConsolidationDriverRunRow | undefined;
-    };
+     *  🔴 形的单一真源 = `boot/memory-consolidation.ts` 的 {@link MemoryConsolidationFaces}(type-only import,tsc 擦除、非装载边)——
+     *  在这里再写一遍成员表就是第二份会漂的形(core 7.63.0 把 `lastRun` 改成异步时这里的手抄形正好漂了一次)。 */
+    memoryConsolidation?: MemoryConsolidationFaces;
     /** [ref] §3.1 / [ref] §1.3([ref] S-2):per-principal memory-capture opt-out 授权表的管理面
      *  (`/v1/admin/memory-optout` 四口,operator-only)—— `backend.memoryOptOutGrant()` 的同一只(与
      *  `RuntimeCaps.allowMemoryOptOut` 的 resolver 腿读同一张表,零缓存直读 ⇒ 写后下一次 prepare 即生效)。
@@ -729,7 +723,10 @@ export interface ServiceDeploymentDeps {
      *    orchestrator/shell retries against the replacement instance; read paths + in-flight verbs (steer/cancel/
      *    respond/subagent) stay open so the runs we are waiting on can still finish/interact.
      *  • `inflight` is ASSIGNED BY createServer (a live union of this replica's in-flight legs: durable bg/resume
-     *    `inflightRuns` + live sync/resume streams `steerableRuns`) — main.ts polls it to know when drain is done.
+     *    `inflightRuns` + live sync/resume streams `steerableRuns`, the leader leg, and the session-resident background
+     *    shells/monitors — `inflightBreakdown` is the same read split into its three terms) — an observable fact (`/health.inflight`).
+     *    `blockingInflight` (also ASSIGNED BY createServer) is the same breakdown minus the session-resident term: "is there still work that
+     *    must be waited out" — the drain wait main.ts polls after SIGTERM, the orphan/lease windows and the SIGHUP idle window read THAT.
      *  • /health carries `draining:true` + `version` (build self-description); draining is a readiness reason
      *    (`http/readiness.ts`) ⇒ `/readyz` 503 + `/health` `ready:false` (the k8s readiness 摘流信号).
      *  • [ref]:`attachedStreams` 同样 ASSIGNED BY createServer —— 本副本当前打开着的 SSE 流条数
@@ -740,6 +737,12 @@ export interface ServiceDeploymentDeps {
      *    硬停起点各调一次。
      */
     drainState?: import("../fleet/drain-entry.js").DrainState;
+    /**
+     * 在飞数第四类的读口:本进程**会话驻留的后台 shell / monitor** 行数(`session-resident-background.ts` 的 `countSessionResidentBackground` 在 composition root 绑上围栏表;
+     * 法与边界见该文件头)。`createHttpServer` 把它作为 `inflightBreakdown.sessionResident` 并进总数 `drainState.inflight` 的**同一次读**;它**不**进阻断集
+     * `drainState.blockingInflight`(排空 / 孤儿窗与附着租约自退 / SIGHUP 空闲窗判停读阻断集)。缺席(嵌入方 / 夹具)= 这一项恒 0,`inflight` 逐字同改前。
+     */
+    sessionResidentBackground?: () => number;
     /** 编排器片 2 件 3:服务租约此刻的读数(`fleet/serving-lease.ts` 的客户端交出;引擎信号铸点与计费准入判同读)。缺席 = 没装租约客户端
      *  (非 fleet 成员 / 没接中心 / 测试夹具)⇒ `none`(与没有租约的引擎逐字同)。 */
     servingLease?: () => import("../fleet/engine-signal.js").ServingLeaseView;

package/dist/http/server.js

@@ -9,6 +9,7 @@ import {} from "../memory-sync.js";
 import {} from "../orchestration/workflow-agent-steer.js";
 import {} from "../orchestration/workflow-completion-inbox.js";
 import {} from "../fleet/fleet-bus.js";
+import { blockingInflightOf, inflightTotal } from "../fleet/drain-entry.js";
 import {} from "../tool-approval.js";
 import {} from "../observability/rate-limit.js";
 import { IdempotencyCache } from "./idempotency.js";
@@ -20,6 +21,7 @@ import { coarseStatusForState, errorCodeForExit } from "./routes/images.js";
 export { coarseStatusForState, errorCodeForExit };
 import { sendError, sendHttpError, sendOpenFaceFault, logRequestError } from "./send.js";
 import { createRequestGuards } from "./request-guards.js";
+import { createRunConcurrencyGate, liveRunIdsOf } from "./run-concurrency-cap.js";
 import { sqlEngineSeatIssue } from "../sql-engine-posture.js";
 import { parkDecisionStoreRefusal } from "../orchestration/workflow-park-decision.js";
 import { CHECKPOINT_CTX_SEALING_REQUIRED } from "./checkpoint-ctx.js";
@@ -104,16 +106,28 @@ export function createHttpServer(rawDeps) {
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
     const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
-    if (deps.drainState)
-        deps.drainState.inflight = () => new Set([...inflightRuns.keys(), ...steerableRuns.keys()]).size + counters.uncountedBillableInflight + counters.admittedInflight + (deps.leaderEndpoint?.inflight?.() ?? 0);
+    const blockingParts = () => ({
+        http: liveRunIdsOf(inflightRuns, steerableRuns).size + counters.uncountedBillableInflight + counters.admittedInflight,
+        leader: deps.leaderEndpoint?.inflight?.() ?? 0,
+    });
+    const inflightBreakdown = () => ({ ...blockingParts(), sessionResident: deps.sessionResidentBackground?.() ?? 0 });
+    if (deps.drainState) {
+        deps.drainState.inflightBreakdown = inflightBreakdown;
+        deps.drainState.inflight = () => inflightTotal(inflightBreakdown());
+        deps.drainState.blockingInflight = () => blockingInflightOf(blockingParts());
+    }
     let lastBillableActivityAt = performance.now();
+    let firstBillableActivityAt = null;
     const noteActivity = (url) => {
         if (isProbePath(url))
             return;
         lastBillableActivityAt = performance.now();
+        firstBillableActivityAt ??= lastBillableActivityAt;
     };
     if (deps.drainState)
         deps.drainState.lastActivityAt = () => lastBillableActivityAt;
+    if (deps.drainState)
+        deps.drainState.firstActivityAt = () => firstBillableActivityAt;
     if (deps.drainState)
         deps.drainState.yieldInflight = () => preemptableRuns.yieldAll();
     if (deps.hookWakeBus) {
@@ -155,7 +169,8 @@ export function createHttpServer(rawDeps) {
     }
     const { quotaExceeded, ownerCostQuotaDenied, ownerFleetLeaseDenied, ownerLeaseDenied, ownerQuotaDenied, leaseDenied, usageWindowDenialFor, usageWindowDenied, rateLimited, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, readJson, readRawBody } = createRequestGuards({ deps });
     const { prepareSpec } = createAdmission({ deps, readJson, runnerFor });
-    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
+    const { admitRun } = createRunConcurrencyGate({ deps, inflightRuns, steerableRuns });
+    const { routeCtxBase, resumeCheckpoint, driveResumeIntoRunLog, driveResumeLeg, mayDiscloseRowError, resumePreempted, startFreshHostTurn, resumeWake, sessionNotifyDoor } = createResumeLegs({ deps, runnerFor, idemCache, inflightRuns, preemptableRuns, steerableRuns, wakeParkMints, counters, readJson, readRawBody, rateLimited, quotaExceeded, ownerQuotaDenied, leaseDenied, ownerLeaseDenied, usageWindowDenied, admitRun, safeDecode, runOwnerOk, sessionOwnerOk, runSessionAcceptOk, prepareSpec, finalizeTaskResult, ownerCostQuotaDenied, ownerFleetLeaseDenied, usageWindowDenialFor });
     const { denyExpiredApprovals, redeemParkedAsk } = createApprovalSweeps({ deps, resumeCheckpoint, mayDiscloseRowError });
     const { handle } = createDispatch({ deps, noteActivity, routeCtxBase, counters });
     const server = http.createServer((req, res) => {

package/dist/http/stored-body-replay.d.ts

@@ -1,19 +1,20 @@
 /**
- * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
+ * 「这条停驻行的持久化体在本版上能否重放」—— **唯一**判据(四问一只,外加 `settings.env` 凭据一臂;五个问点同调:续跑驱动段 `resume-legs.ts` `resolveResumeSpecOrBlocked`、
  * plan_review 的 prepare 段、SLA 拒扫腿的跳过臂 `approval-sweeps.ts`、终态 run 的 steer 铸唤醒卡之前 `routes/runs.ts`;`resolveSpec` 本身留作提交腿的拒点)。
  * 四问的规则、记号、拒句与删除条件的属主 = `http/checkpoint-ctx.ts` 顶注;答复 = 那里的 `storedBodyReplayAnswer`。
  *
- * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:第三问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
+ * 为什么判据住在这里而不是 `checkpoint-ctx.ts`:模式词问要读体的**生效模式词**(`task-settings.ts` `storedBodyPermissionMode`,请求设置的解析层)与本部署此刻的
  * **入口地板**(`runtime-governance.ts` `autonomyModeFloor`)—— 这两只属主带着配置层的包外依赖;`checkpoint-ctx.ts` 被随包的本地排空脚本经编译产物 import,
- * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,前两问的谓词照旧住在各自属主里。
+ * 它的闭包只许 node 内建 / 引擎包根(`test/drain-check-local.test.ts` 的闭包门)。判据只有这一只,allow 读法问、工具名清单问与退役请求键问的谓词照旧住在各自属主里。
  */
 import type { PermissionMode } from "@sema-agent/core";
 import { type Autonomy } from "../runtime-governance.js";
 import { type ExecutionConfigRootDeployment } from "../execution-config-root.js";
+import { type ModelApiKeyEnvTable } from "../server-secret-env.js";
 import { type StoredBodyReplayRefusal } from "./checkpoint-ctx.js";
 import type { CheckpointCtx } from "./route-ctx.js";
 /**
- * 第三问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
+ * 模式词问:本行体里的模式词能否按当前读法重放。不能 ⇔ 本部署此刻有入口地板 ∧ 行上没有当前的模式词读法记号 ∧ 体的生效词进这块地板会变
  * (`runtime-governance.ts` `entryPermissionMode`,与提交入口的盖章同一只函数;判的是「词变不变」而不是 `clamped` —— 体无词的旧行进地板取地板本身,
  * 那也是变)⇒ 返回拒因的两个事实(体的词、地板);能 ⇒ `undefined`。
  */
@@ -22,13 +23,15 @@ export declare function permissionModeReadingUnstated(ctx: CheckpointCtx, floor:
     floor: PermissionMode;
 } | undefined;
 /**
- * 预判读的部署配置:`autonomy`(第三问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)与配置根的几位(user 设置层 `/` 规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
+ * 预判读的部署配置:`autonomy`(模式词问的模式词地板)、执行车道的 home 两位(`~/` 形规则那一问)与配置根的几位(user 设置层 `/` 规则那一问)。`ServiceConfig` 结构上满足,四个问点传 `deps.config` 整份。
  */
 export type StoredReplayDeployment = ExecutionConfigRootDeployment & {
     readonly autonomy?: Autonomy | undefined;
+    /** 生效配置模型条目 name → `apiKeyEnv`(`settings.env` 凭据判据的名单一臂;缺席 = 没有模型条目,与 `serverCredentialValueSources` 的缺省同读)。 */
+    readonly modelApiKeyEnv?: ModelApiKeyEnvTable | undefined;
 };
 /**
- * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法记号 → 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
+ * 四问一只判据:不能重放 ⇒ 返回拒的那条规则;能 ⇒ `undefined`。顺序:allow 读法(体里带非空 `allow` 而写者版本证不出 ≥ 7.117.0;常设,按写者版本)→ 请求设置里的条目表(**与拒点同序**:桶门〔形 / 空串 / 超帽〕→ 工具名清单读成空〔**只问限制方向**:放行方向的存量条目读成空,续跑照旧、只留一行运维 warn〕→ deny / ask 的名字层 + 规则文法)→ 模式词读法记号 → 体里的退役请求键(几问同中时答先中的那一问 ——
  * 任一问中都不重放,句子只需一句)。`deployment` = 本部署**此刻**的 `config`(活 config:热改即生效):`autonomy` 的地板由它的唯一属主算,`~/` 形规则的 home 由 `executionLaneHomeDir` 算,问点都不自己算。
  */
 export declare function storedBodyReplayRefusal(ctx: CheckpointCtx, deployment: StoredReplayDeployment): StoredBodyReplayRefusal | undefined;

package/dist/http/stored-body-replay.js

@@ -1,4 +1,4 @@
-import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, rulePolicyBucketsRefusal, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
+import { REQUEST_SETTINGS_REFUSAL_PREFIX, SETTINGS_PERMISSION_BUCKETS, SETTINGS_RULE_REFUSAL_CODE, neverAutoNamesRefusal, readSettingsEnv, rulePolicyBucketsRefusal, settingsEnvCredentialIssue, settingsPermissionBucketIssue, storedBodyPermissionMode } from "../task-settings.js";
 import { readTightenOnlySeats, tightenOnlySeatField, tightenOnlySeatIssue } from "../tighten-only-seats.js";
 import { entryProblemsFacts } from "../entry-problems.js";
 import { autonomyModeFloor, entryPermissionMode } from "../runtime-governance.js";
@@ -6,7 +6,9 @@ import { inertToolListEntryOf, replayInertEntry } from "../rule-entry-list.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { migrationWindowEnd } from "../plugins/one-time-migrations.js";
-import { allowListReadingEraOf, allowListReadingUnstated, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
+import { storedEnvCredentialsDropM38 } from "../stored-request-env-credentials-m38.js";
+import { serverCredentialValueSources } from "../server-secret-env.js";
+import { allowListWriterUnproven, permissionModeReadingStated, retiredRequestKeyOf } from "./checkpoint-ctx.js";
 export function permissionModeReadingUnstated(ctx, floor) {
     if (floor === undefined || permissionModeReadingStated(ctx))
         return undefined;
@@ -57,11 +59,23 @@ function storedRulePolicyRefusal(body, deployment) {
     const neverAutoRefused = neverAutoNamesRefusal(neverAuto);
     return neverAutoRefused === undefined ? undefined : replayInertEntry(tightenOnlySeatField("neverAuto"), "deny", SETTINGS_RULE_REFUSAL_CODE, `${REQUEST_SETTINGS_REFUSAL_PREFIX}${neverAutoRefused.message}`, { ...entryProblemsFacts(neverAutoRefused.problems) });
 }
+function storedEnvCredentialRefusal(body, deployment) {
+    const issue = settingsEnvCredentialIssue(readSettingsEnv(body?.settings).reaching, serverCredentialValueSources(deployment.modelApiKeyEnv));
+    if (issue === null || storedEnvCredentialsDropM38(new Date().toISOString().slice(0, 10)))
+        return undefined;
+    return { errorCode: "request.env_credential_refused", message: issue.message, facts: { ...issue.fields } };
+}
 export function storedBodyReplayRefusal(ctx, deployment) {
     const writer = ctx.writerVersion !== undefined ? { writerVersion: ctx.writerVersion } : {};
-    if (allowListReadingUnstated(ctx))
-        return { kind: "allow_list_reading", era: allowListReadingEraOf(ctx), ...writer };
-    const entry = storedPermissionBucketRefusal(ctx.body) ?? storedTightenOnlySeatRefusal(ctx.body) ?? inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
+    if (allowListWriterUnproven(ctx))
+        return { kind: "allow_list_reading", ...writer };
+    const early = storedPermissionBucketRefusal(ctx.body) ?? storedTightenOnlySeatRefusal(ctx.body);
+    if (early !== undefined)
+        return { kind: "inert_tool_list", entry: early };
+    const envCredential = storedEnvCredentialRefusal(ctx.body, deployment);
+    if (envCredential !== undefined)
+        return { kind: "settings_env_credential", refusal: envCredential };
+    const entry = inertToolListEntryOf(ctx.body, ["deny"]) ?? storedRulePolicyRefusal(ctx.body, deployment);
     if (entry !== undefined)
         return { kind: "inert_tool_list", entry };
     const mode = permissionModeReadingUnstated(ctx, autonomyModeFloor(deployment.autonomy));

package/dist/http/wire-types.d.ts

@@ -172,9 +172,14 @@ export interface TaskRequestBody {
      *  `outputSchema` (core ignores it there). */
     outputRetries?: number;
     /** Within-task compaction tuning (core [ref] `TaskSpec.compaction`). ⚠️ ONLY `clampTolerance` is a caller
-     *  knob — the rest of core's compaction object is an OPERATOR axis and is deliberately not on the wire, so this
-     *  type is narrower than core's field on purpose. `boot/resolve-spec.ts` accepts a finite number in [0,1] and
-     *  omits the whole `compaction` key otherwise. Pairs with `compactionModel` (which gear compacts). */
+     *  knob HERE — the rest of core's compaction object is an OPERATOR axis and is deliberately not on the wire, so this
+     *  type is narrower than core's field on purpose. `spec-fields.ts` `compactionSpecFragment` accepts a finite number
+     *  in [0,1] and omits the whole `compaction` key otherwise. Pairs with `compactionModel` (which gear compacts).
+     *  The other caller-owned member of core's `compaction`, the automatic-compaction seat `autoCompact`, rides the CC
+     *  settings key `settings.autoCompactEnabled` (boolean; 7.146.0, capability bit `taskSettings.autoCompactEnabled`) —
+     *  ONE seat per fact: it is deliberately NOT repeated here (`compaction.autoCompact` in the body is not read). Both
+     *  members are minted into the one `TaskSpec.compaction` object by the same mapper. The manual seat `manualCompact`
+     *  (the pass `POST /v1/runs/:id/compact` asks for) is not caller-writable: it takes the deployment's / engine's default. */
     compaction?: {
         clampTolerance?: number;
     };

package/dist/json-body-limit.d.ts

@@ -0,0 +1,8 @@
+/**
+ * 一切 JSON 请求体的字节上限 —— `readJson` 边读边计,越过即 413 `request.payload_too_large`(一条一直都在的门,`http/request-guards.ts`)。
+ *
+ * 住叶子(零依赖)而不是守门族里:依它定帽的面要读同一个数 —— 收编批量导入的「每个会话信封最多多少字节」只有落在它之下才可达
+ * (一个越过它的信封根本进不了门,把旋钮设到那里就是一只永远够不着的帽),配置的上帽从这里算(`adoption/import-limits.ts`)。
+ */
+export declare const MAX_JSON_BODY_BYTES: number;
+//# sourceMappingURL=json-body-limit.d.ts.map