@sema-agent/server 7.148.0 → 7.150.0

package/dist/capability-facts.js

@@ -7,8 +7,8 @@ import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
-import { deletionHeadReadOf, headReadOf } from "./session-incarnation.js";
-import { executionLaneCaps, laneWiresExecutionEnv } from "./execution-lane-caps.js";
+import { headReadPresent } from "./session-incarnation.js";
+import { laneWiresExecutionEnv } from "./execution-lane-caps.js";
 export const CAPABILITY_FACT_WHY = {
     run_store_absent: "no durable run store is wired (DB_BACKEND=mysql|pg|local)",
     subagent_registry_absent: "the sub-agent steer registry is not wired",
@@ -95,25 +95,28 @@ export function subagentSteer(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.subagentSteerRegistry !== undefined ? yes({ runStore: runs.runStore, registry: d.subagentSteerRegistry }) : no("subagent_registry_absent");
+    const registry = d.subagentSteerRegistry;
+    return registry !== undefined ? yes({ runStore: runs.runStore, registry }) : no("subagent_registry_absent");
 }
 export function subagentOutput(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.subagentTaskOutput !== undefined ? yes({ runStore: runs.runStore, output: d.subagentTaskOutput }) : no("subagent_output_face_absent");
+    const output = d.subagentTaskOutput;
+    return output !== undefined ? yes({ runStore: runs.runStore, output }) : no("subagent_output_face_absent");
 }
 export function taskHandles(d) {
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return d.taskHandleOutput !== undefined && d.taskHandleStop !== undefined
-        ? yes({ runStore: runs.runStore, output: d.taskHandleOutput, stop: d.taskHandleStop })
+    const { taskHandleOutput: output, taskHandleStop: stop } = d;
+    return output !== undefined && stop !== undefined
+        ? yes({ runStore: runs.runStore, output, stop })
         : no("task_handle_faces_absent");
 }
 export function sessionOwnership(d) {
     const s = d.sessionStorage;
-    return headReadOf(s) !== undefined ? yes({ sessionStorage: s }) : no("session_head_face_absent");
+    return headReadPresent(s) ? yes({ sessionStorage: s }) : no("session_head_face_absent");
 }
 export function executionPlacementRead(d) {
     const seat = d.sessionStorage?.executionPlacement;
@@ -141,12 +144,13 @@ export function sessionAuditView(d) {
     return d.sessionAudit !== undefined ? yes({ sessionAudit: d.sessionAudit }) : no("session_audit_absent");
 }
 export function sessionEventStream(d) {
-    if (d.sessionWatch === undefined)
+    const watch = d.sessionWatch;
+    if (watch === undefined)
         return no("session_watch_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ watch: d.sessionWatch, sessionStorage: owned.sessionStorage });
+    return yes({ watch, sessionStorage: owned.sessionStorage });
 }
 export function sessionList(d) {
     const lister = d.sessionStorage?.listSessions?.bind(d.sessionStorage);
@@ -156,52 +160,51 @@ export function sessionFork(d) {
     const s = d.sessionStorage;
     if (s?.fork === undefined)
         return no("session_fork_face_absent");
-    if (headReadOf(s) === undefined)
+    if (!headReadPresent(s))
         return no("session_head_face_absent");
     return yes({ sessionStorage: s });
 }
 export function sessionPatch(d) {
     const s = d.sessionStorage;
-    if (headReadOf(s) === undefined || s?.writeSessionRowCells === undefined)
+    if (!headReadPresent(s) || s?.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
     return yes({ sessionStorage: s });
 }
 export function sessionDelete(d) {
-    if (d.purgeSession === undefined)
+    const purge = d.purgeSession;
+    if (purge === undefined)
         return no("session_purge_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    const store = owned.sessionStorage;
-    const headOf = deletionHeadReadOf(store);
-    if (headOf === undefined)
-        return no("session_head_face_absent");
-    const placementOf = store.placementOf?.bind(store);
-    return yes({ purge: d.purgeSession, gateStore: { headOf, ...(placementOf !== undefined ? { placementOf } : {}) } });
+    return yes({ purge, sessionStorage: owned.sessionStorage });
 }
 export function sessionPolicy(d) {
-    if (d.sessionPolicyStore === undefined)
+    const policyStore = d.sessionPolicyStore;
+    if (policyStore === undefined)
         return no("session_policy_store_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ policyStore: d.sessionPolicyStore, sessionStorage: owned.sessionStorage });
+    return yes({ policyStore, sessionStorage: owned.sessionStorage });
 }
 export function sessionSync(d) {
-    if (d.backend === undefined)
+    const { fileHistoryStore: historyStore, sessionPolicyStore } = d;
+    const backend = d.backend;
+    if (backend === undefined)
         return no("store_backend_absent");
-    if (d.fileHistoryStore === undefined)
+    if (historyStore === undefined)
         return no("file_history_store_absent");
     const s = d.sessionStorage;
     if (s?.exportEntries === undefined || s.exportEntriesStream === undefined)
         return no("session_export_absent");
     if (s.beginImportStaging === undefined)
         return no("session_import_staging_absent");
-    if (headReadOf(s) === undefined || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
+    if (!headReadPresent(s) || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
-    if (overwriteWipeIncapable(d.sessionPolicyStore))
+    if (overwriteWipeIncapable(sessionPolicyStore))
         return no("policy_purge_absent");
-    return yes({ backend: d.backend, sessionStorage: s, historyStore: d.fileHistoryStore });
+    return yes({ backend, sessionStorage: s, historyStore });
 }
 export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
@@ -211,20 +214,22 @@ export function sessionSyncFileHistory(d) {
     return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
 }
 export function sessionRewindFiles(d) {
-    if (d.fileHistoryStore === undefined)
+    const { fileHistoryStore: historyStore, resumeAnchorStore: anchors, config, backend } = d;
+    if (historyStore === undefined)
         return no("file_history_store_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    if (d.resumeAnchorStore === undefined || d.runStore === undefined)
+    const runs = durableRuns(d);
+    if (anchors === undefined || !runs.available)
         return no("resume_anchor_store_absent");
-    if (!laneWiresExecutionEnv(d.config.remoteExec.provider))
+    if (!laneWiresExecutionEnv(config.remoteExec.provider))
         return no("execution_lane_handless");
-    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(d.config))
+    if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(config))
         return no("workspace_rebuilt_per_task");
-    if (d.backend?.kind !== "local")
+    if (backend?.kind !== "local")
         return no("session_store_shared");
-    return yes({ historyStore: d.fileHistoryStore, anchors: { anchors: d.resumeAnchorStore, runs: d.runStore }, sessionStorage: owned.sessionStorage });
+    return yes({ historyStore, anchors: { anchors, runs: runs.runStore }, sessionStorage: owned.sessionStorage });
 }
 export function sessionRewindFilesPreview(d) {
     const rewind = sessionRewindFiles(d);
@@ -294,14 +299,15 @@ export function deviceManagement(d) {
     const lane = deviceLane(d);
     if (!lane.available)
         return lane;
-    if (d.deviceStore === undefined)
+    const { deviceStore: store, deviceEnrollment: enrollment } = d;
+    if (store === undefined)
         return no("device_store_absent");
-    if (d.deviceEnrollment === undefined)
+    if (enrollment === undefined)
         return no("device_enrollment_absent");
     const runs = durableRuns(d);
     if (!runs.available)
         return runs;
-    return yes({ hub: lane.hub, store: d.deviceStore, enrollment: d.deviceEnrollment, runStore: runs.runStore });
+    return yes({ hub: lane.hub, store, enrollment, runStore: runs.runStore });
 }
 export function fleetStream(d) {
     return d.fleetBus !== undefined ? yes({ fleetBus: d.fleetBus }) : no("fleet_bus_absent");
@@ -341,7 +347,8 @@ export function memorySyncServe(d) {
     return identity !== undefined ? yes({ perform: d.memorySync, identity }) : no("memory_sync_identity_undeclared");
 }
 export function sessionMemorySync(d) {
-    if (d.memorySyncLeg === undefined)
+    const leg = d.memorySyncLeg;
+    if (leg === undefined)
         return no("memory_sync_leg_absent");
     const runs = durableRuns(d);
     if (!runs.available)
@@ -349,7 +356,7 @@ export function sessionMemorySync(d) {
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ leg: d.memorySyncLeg, runStore: runs.runStore, sessionStorage: owned.sessionStorage });
+    return yes({ leg, runStore: runs.runStore, sessionStorage: owned.sessionStorage });
 }
 export function principalInboxDelivery(d) {
     return d.orgDeliveryGate !== undefined ? yes({ gate: d.orgDeliveryGate }) : no("org_delivery_gate_absent");
@@ -503,19 +510,8 @@ export function hostScheduler(c) {
 export function autoBackgroundOnTimeout(c, hostBackgroundShellOn) {
     if (c.autoBackgroundOnTimeout !== true)
         return no("auto_background_off");
-    const cap = executionLaneCaps(c.remoteExec.provider).backgroundShell;
-    switch (cap) {
-        case "unsupported":
-            return no("lane_cannot_adopt_running_command");
-        case "supported":
-            return YES;
-        case "single-user-only":
-            return c.requirePrincipal !== true && hostBackgroundShellOn ? YES : no("lane_cannot_adopt_running_command");
-        default: {
-            const unknownCap = cap;
-            throw new Error(`auto-background fact: unknown lane capability ${String(unknownCap)}`);
-        }
-    }
+    const laneCanAdopt = DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(c) && (c.remoteExec.provider !== "host" || hostBackgroundShellOn);
+    return laneCanAdopt ? YES : no("lane_cannot_adopt_running_command");
 }
 export const AUTO_BACKGROUND_ON_TIMEOUT_WORDS = ["armed", "off", "unsupported"];
 export function autoBackgroundOnTimeoutWord(f) {

package/dist/card-settle-stored-scope.d.ts

@@ -0,0 +1,56 @@
+/**
+ * **按令牌把一张 pending 卡 CAS expire —— 全仓唯一的读法**(状态读 `get` 交出的行状态,属主格读店的列,CAS 吃那一格)。六个读者同读这一只,没有第二份:
+ *  · `POST /v1/runs/:id/cancel` 的停驻取消腿(`routes/runs.ts` 的 `cancelSuspended`);
+ *  · 一条续跑腿被取消之后结算它续的那张卡(`resume-legs.ts` 的 `settleCardForCancel`);
+ *  · 审批 SLA 拒扫腿对「准入策略挡住」的续跑当场过期该卡(`http/approval-sweeps.ts` 的 `expirePolicyBlockedCard`);
+ *  · 会话删除 / 显式结清口带走停驻子代时作废它的卡(`session-children-retire.ts` 的 `expireParkedCard`);
+ *  · 停驻写没落定就以失败收场时作废手里那张卡(`card-void.ts` 的 `voidPendingCard`);
+ *  · 复活不了的停驻子代被 deny 时作废它的卡(`parked-decide.ts` 的 `voidUnrevivableCard`)。
+ *
+ * ## 规则一条:顺序恒为「先读状态、(要求归属就)再核归属、最后按存储列 expire」,不读行体里的属主格
+ * 一张停驻卡的事实在店里有两份:列(令牌、归属 run 的会话、门型、属主格 `scope` —— 引擎停驻时盖下,身份迁移时与行体里那一份一起迁)与行体(`checkpoint` 里的 JSON 快照)。
+ * `expire` 的 CAS 谓词吃的是列;拿行体里自带的那一份去配,行体与列不一致(手改 / 外来写者 / 迁移两腿之间)时只会把「列好体坏」说成「被并发决议了」,行体读不成检查点时更是读行体就抛。
+ *  1. **状态**:卡已不在待决面(已结 / 已不在)⇒ 不写 —— 已结的卡上 CAS 恒输,写一次只是多一次店写(店写口故障时那一次还会抛,把「本来什么都不用做」的收场变成失败)。
+ *     状态读 `get` 交出的行状态(状态列权威,不是行体快照里那一份);**读不成检查点的行体**({@link UnreadableCheckpointRowError})读不出状态 ⇒ 不替 CAS 判(「不知道」不当作「已结」),
+ *     下一步吃列的 CAS 自己判;其余读故障(连库 / 超时 / 程序错)原样上抛,店的故障不是答案。
+ *  2. **归属**(调用方要求时):卡的归属会话(`hostSessionOfCard`,列)必须就是调用方说的那只 —— 只作废**这一张**;读不出 / 对不上 ⇒ `host_mismatch`,不写。状态在归属之前:已结的卡不因归属对不上而报警。
+ *  3. **属主格**:`peekScopeByToken`(SQL = `scope` 列,local = 账本行),`null` 是店契约里的匿名值,按契约换成公共哨兵(两只真店的属主列非空,到不了这一臂)。
+ * 找「取消动词会结算哪一张卡」是取消口自己的事(`run-cancel-card.ts`);本模块只管拿到令牌之后怎么结算。
+ */
+import type { CheckpointToken } from "@sema-agent/core";
+import type { CheckpointStoreFull } from "./plugins/store-backend.js";
+/** 「这张卡此刻的状态」那一问要的店口(只读 `get` 交出的行状态;结构型 —— 真店的 `get` 直接对上)。 */
+export interface CardStatusPort {
+    get(token: CheckpointToken): Promise<{
+        readonly status?: string;
+    } | null>;
+}
+/** 结算一张卡要的店口:状态 + 属主格(店的列)+ CAS expire。六个读者的依赖型都从这一份取,不各自另写一份 `Pick`。 */
+export type CardSettlePort = CardStatusPort & Pick<CheckpointStoreFull, "peekScopeByToken" | "expire">;
+/** 要求归属时多要的一口:卡归在哪只会话上(归属列)。 */
+export type CardHostPort = Pick<CheckpointStoreFull, "hostSessionOfCard">;
+/**
+ * 结算的结局(店的事实,不嗅文案):
+ *  · `expired` —— 本调用亲手把一张 pending 的卡 expire 了;
+ *  · `not_pending` —— 卡已不在待决面(已结 / 已不在),没写;
+ *  · `lost` —— 读状态时还 pending、CAS 输给了并发的结算(决定 / 收割 / 别的作废者);
+ *  · `host_mismatch` —— 调用方要求的归属对不上(或说不出),没写。
+ */
+export declare const CARD_EXPIRE_OUTCOME: {
+    readonly expired: "expired";
+    readonly notPending: "not_pending";
+    readonly lost: "lost";
+    readonly hostMismatch: "host_mismatch";
+};
+export type CardExpireOutcome = (typeof CARD_EXPIRE_OUTCOME)[keyof typeof CARD_EXPIRE_OUTCOME];
+/** 调用方要求:这张卡必须归在 `hostSession` 这只会话上(`undefined` = 调用方说不出自己的会话 ⇒ 恒对不上)。 */
+export interface CardHostGuard {
+    readonly hostSession: string | undefined;
+}
+/**
+ * 按店里的属主格把 `token` 那张卡 CAS expire(≈ deny 的 reaper 终局;不是 resolve —— 取消意味着 run 死掉,deny-RESUME 会把拒绝喂回模型烧 token),次序见模块头注。
+ * 要求归属就给 `guard`(店口多带 {@link CardHostPort});不给 ⇒ 不核归属(令牌是调用方按列找来的,如取消口的 `runCancelCardOf`)。
+ */
+export declare function expireCardUnderStoredScope(cs: CardSettlePort, token: CheckpointToken): Promise<CardExpireOutcome>;
+export declare function expireCardUnderStoredScope(cs: CardSettlePort & CardHostPort, token: CheckpointToken, guard: CardHostGuard): Promise<CardExpireOutcome>;
+//# sourceMappingURL=card-settle-stored-scope.d.ts.map

package/dist/card-settle-stored-scope.js

@@ -0,0 +1,27 @@
+import { UnreadableCheckpointRowError } from "./plugins/checkpoint-store-face.js";
+import { CHECKPOINT_PUBLIC_SCOPE } from "./security.js";
+export const CARD_EXPIRE_OUTCOME = { expired: "expired", notPending: "not_pending", lost: "lost", hostMismatch: "host_mismatch" };
+async function cardLeftPending(cs, token) {
+    try {
+        const live = await cs.get(token);
+        return live === null || live.status !== "pending";
+    }
+    catch (e) {
+        if (e instanceof UnreadableCheckpointRowError)
+            return false;
+        throw e;
+    }
+}
+export async function expireCardUnderStoredScope(cs, token, guard) {
+    if (await cardLeftPending(cs, token))
+        return CARD_EXPIRE_OUTCOME.notPending;
+    if (guard !== undefined) {
+        if (guard.hostSession === undefined || cs.hostSessionOfCard === undefined || (await cs.hostSessionOfCard(token)) !== guard.hostSession)
+            return CARD_EXPIRE_OUTCOME.hostMismatch;
+    }
+    const scope = await cs.peekScopeByToken(token);
+    if (scope === undefined)
+        return CARD_EXPIRE_OUTCOME.notPending;
+    return (await cs.expire(token, scope ?? CHECKPOINT_PUBLIC_SCOPE)) ? CARD_EXPIRE_OUTCOME.expired : CARD_EXPIRE_OUTCOME.lost;
+}
+//# sourceMappingURL=card-settle-stored-scope.js.map

package/dist/card-void.d.ts

@@ -1,6 +1,7 @@
 /**
- * **结算时作废一张归本 run 会话的、本服务兑现不了的卡** —— 读卡 → 卡仍 pending ∧ 卡归调用方说的那只会话(归属列,`hostSessionOf`)⇒
- * 按卡**自己的** scope 走 checkpoint 店的 `expire`(与引擎的本进程仲裁器、续跑的 resolve 同一只 CAS,恰一个赢家)。不新增任何持久态。
+ * **结算时作废一张归本 run 会话的、本服务兑现不了的卡** —— 卡仍 pending ∧ 卡归调用方说的那只会话(归属列,`hostSessionOfCard`)⇒
+ * 按店里该卡的属主格走 checkpoint 店的 `expire`(全仓唯一的读法 {@link expireCardUnderStoredScope}:先读状态、再核归属、最后按属主列 CAS;与引擎的本进程仲裁器、续跑的 resolve 同一只 CAS,恰一个赢家)。
+ * 不新增任何持久态。
  *
  * 规则只有一条:**本服务兑现不了的卡不留在待决面上**。产地 = 停驻没落定就以失败收场的腿(`runs.ts` 的 `voidHeldParkCard`:后台腿与
  * 续跑腿):卡在本 run 的会话上,但兑现它的那条 run 已经 `failed`、认领已放 —— 卡的命运先于认领释放(调用方先调本动词、再放认领)。
@@ -8,20 +9,14 @@
  * `verifier-pause-card.ts`);那只动词只收验证器的卡,本 run 自己会话上的卡按引擎的读法仍走店级 `expire`。
  *
  * 不抛:作废没做成(店读 / 作废抛错、卡的会话对不上、没接店)⇒ 卡回到「留在待决面上、由审批兜底收割收走」的形,按产地登记的 tag
- * 响亮留痕(计数 + 探针行 + 一次 warn),结算照常往下走。卡已不 pending / 已不在 ⇒ 什么都不做(CAS 输给了别的结算者,结局相同)。
+ * 响亮留痕(计数 + 探针行 + 一次 warn),结算照常往下走。卡已不 pending / 已不在 ⇒ 什么都不做(别的结算者先收走了,结局相同;先于归属判,已结的卡不因归属对不上而报警)。
  * 店级 `expire` 只作废卡,不动引擎在停驻时给这只会话打的钉(钉在续跑终局 / 续跑失败臂放)。
  */
 import type { CheckpointToken } from "@sema-agent/core";
 import { type FailOpenTag } from "./observability/fail-open.js";
-/** 结算点手里那只 checkpoint 店的三个动词:读卡(取它自己的 scope / 状态)、读它归在哪只会话上 → 按卡自己的 scope CAS 作废。 */
-export interface CardVoidPort {
-    get(token: CheckpointToken): Promise<{
-        readonly scope?: string;
-        readonly status?: string;
-    } | null>;
-    hostSessionOfCard(token: CheckpointToken): Promise<string | null | undefined>;
-    expire(token: CheckpointToken, scope: string): Promise<boolean>;
-}
+import { type CardHostPort, type CardSettlePort } from "./card-settle-stored-scope.js";
+/** 结算点手里那只 checkpoint 店的动词:读卡的状态、读它归在哪只会话上(归属列)、读它的属主格(属主列)→ 按那一格 CAS 作废。 */
+export type CardVoidPort = CardSettlePort & CardHostPort;
 /** 要作废的那一张:停驻带回的凭据 + 它应归的会话(本 run 的会话;对不上就不动它 —— 只作废**这一张**)。 */
 export interface CardRef {
     readonly token: CheckpointToken;

package/dist/card-void.js

@@ -1,5 +1,6 @@
 import { errorText } from "./observability/err-text.js";
 import { recordFailOpen } from "./observability/fail-open.js";
+import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "./card-settle-stored-scope.js";
 export async function voidPendingCard(card, cards, tag, at) {
     const miss = (reason, err) => recordFailOpen(tag, `reason=${reason}${at === undefined ? "" : ` ${at}`}${err === undefined ? "" : ` err=${err}`}`);
     if (cards === undefined) {
@@ -7,14 +8,8 @@ export async function voidPendingCard(card, cards, tag, at) {
         return;
     }
     try {
-        const live = await cards.get(card.token);
-        if (live === null || live.status !== "pending")
-            return;
-        if (card.sessionId === undefined || (await cards.hostSessionOfCard(card.token)) !== card.sessionId || typeof live.scope !== "string") {
+        if ((await expireCardUnderStoredScope(cards, card.token, { hostSession: card.sessionId })) === CARD_EXPIRE_OUTCOME.hostMismatch)
             miss("card_mismatch");
-            return;
-        }
-        await cards.expire(card.token, live.scope);
     }
     catch (e) {
         miss("store_error", errorText(e));

package/dist/config-catalog.d.ts

@@ -18,6 +18,16 @@ export type CatalogDangerAxis = (typeof CATALOG_DANGER_AXES)[number];
  */
 export declare const URL_CREDENTIAL_POLICIES: readonly ["refuse", "mask"];
 export type UrlCredentialPolicy = (typeof URL_CREDENTIAL_POLICIES)[number];
+/**
+ * secret 行的值**装着几枚凭据、按什么读出来**(闭集;只在 `type: "secret"` 的行上,其余行恒缺席)—— 本服务凭据的颗粒按本服务读这只变量的那一只解析器定:
+ *  · `whole`       —— 整值是一枚(令牌 / 口令 / 私钥 / 一只模型密钥;名单型旋钮的原文也按凭据类整值对待);
+ *  · `token-table` —— `tok=system` 逗号表,每个 `tok` 是一枚(`SERVICE_AUTH_TOKENS`;读法 = `auth-keys.ts` `parseServiceAuthTokens`,`loadConfig` 同读);
+ *  · `key-set`     —— `{kid,key,status}` JSON 数组,每个 `key` 是一枚(`APPROVAL_HMAC_KEYS`;读法 = `auth-keys.ts` `parseApprovalHmacKeys`,`loadConfig` 同读)。
+ * 读者只有一个:自有凭据声明的值臂(`server-secret-env.ts`)—— 整值总在内,列表形另把每一枚交给引擎 ⇒ 一枚令牌换了个变量名放着,与原变量同扣。
+ * 词加一个而读者不补 ⇒ 编译红(读者是穷举 switch);secret 行不写 ⇒ 编译红(`r()` 的 secret 重载要它)。不上 wire。
+ */
+export declare const SECRET_CREDENTIAL_FORMS: readonly ["whole", "token-table", "key-set"];
+export type SecretCredentialForm = (typeof SECRET_CREDENTIAL_FORMS)[number];
 /** 域 = 配置九组(类型锁步:组集变了这里跟着红)。 */
 export type CatalogDomain = keyof ServiceConfigGroups;
 export declare const CATALOG_RESTART_SLICES: readonly RestartSlice[];
@@ -93,6 +103,8 @@ export interface ConfigCatalogSpec {
     readonly scope?: "bootstrap-only";
     /** url 行的凭据处置披露({@link UrlCredentialPolicy});url 行必填(`r()` 的 url 重载要它,缺 ⇒ 编译红),其余行写不进来。 */
     readonly credentialPolicy?: UrlCredentialPolicy;
+    /** secret 行的凭据颗粒({@link SecretCredentialForm});secret 行必填(`r()` 的 secret 重载要它,缺 ⇒ 编译红),其余行写不进来。 */
+    readonly credentialForm?: SecretCredentialForm;
 }
 export interface ConfigCatalogRowCenter {
     readonly domain: string;