@sema-agent/server 7.149.0 → 7.151.0

package/dist/runs.d.ts

@@ -17,6 +17,9 @@ import type { RunAcceptance } from "./run-acceptance.js";
 import type { SessionWorkspaceRecorder } from "./session-workspace.js";
 import type { VerifyRoundsSpec } from "./http/verify-rounds.js";
 import { type ParkLedgerEventType } from "./trace/ledger-events.js";
+import type { LandedAttendantSeat } from "./plugins/landed-attendants.js";
+import type { DelegationRootWitness } from "./delegated-session-owner.js";
+import type { SessionFace } from "./session-incarnation.js";
 import type { UserInputLedger } from "./user-input-ledger.js";
 /**
  * stoppedBy (core 1.252): a service cancel is a USER stop — mark the run's still-running background
@@ -27,8 +30,8 @@ import type { UserInputLedger } from "./user-input-ledger.js";
  * cross-replica flag poll). Advisory only — the cancel itself must never fail on attribution.
  *
  * Access = TASK-scoped children ONLY: owner = the parent taskId (on a RESUME leg: the sessionId — core's
- * canonical taskId there), scope = `principal ?? "default"` (core registers children under
- * `spec.principal ?? "default"`, so an anonymous run's children live in scope "default" and an access
+ * canonical taskId there), scope = the engine-identity cell `engineScopeOfOwner(subject)` (core registers
+ * children under its task scope, so an anonymous run's children live in scope "default" and an access
  * WITHOUT scope matched nothing). Session-scoped children are DELIBERATELY not marked: a cancelled parent
  * does NOT take them down (CC Backgrounded semantics — core's teardown reaps with skipSessionScoped), so
  * pre-marking them "user" would misattribute a stop that isn't happening.
@@ -201,10 +204,36 @@ export type ResumeAnchorLeg = "stream" | "sync" | "bg" | "resume";
  * 到期只放手不取消:那次写照常在飞,迟到落定的锚照样可用(迟到的失败被吞,不重复计数)。
  * 用户面的读数仍只有一处:会话视图用户消息行的 `taskId?`(present-iff 锚在)与 `resumeAt` 的 404 `resume_at.unknown_event`。
  */
-export declare function settleResumeAnchor(write: () => Promise<void>, where: {
+export declare function settleResumeAnchor(write: (held: () => boolean) => Promise<void>, where: {
     readonly leg: ResumeAnchorLeg;
     readonly kind: "prompt" | "turn";
 }): Promise<void>;
+/** 一条运行腿的两只回退锚写口(缺席 = 这条腿没有那一种锚:没有落定席位 / 没有提示手柄 / 没有叶子读)。 */
+export interface RunAnchorWriter {
+    /** 用户提示锚:键 = 这条 run 的 id(客户端手里的回退手柄),值 = 那条用户提交的条目 id。 */
+    readonly prompt?: (entryId: string, held: () => boolean) => Promise<void>;
+    /** 助手文本锚:键 = 这一轮第一个 text 帧的 eventId,值 = 此刻会话的叶子。 */
+    readonly turn?: (eventId: string, held: () => boolean) => Promise<void>;
+}
+/**
+ * **运行腿回退锚的唯一写法**(后台腿 / 同步腿 / 流式腿 / 续跑腿同一只):锚只经落定席位的 `putAnchors` 落(`plugins/landed-attendants.ts`:段首锁会话根行判住客),
+ * 住客 = **这条 run 自己的那一位** —— 受理时见证到的(`LegFacts.sessionWitness`,带化身);见证里还没有化身(这条腿新建了会话)⇒ 第一笔锚之前读一次头钉住。
+ * 钉住发生在腿还在等这一笔的期限之内(`held()`:腿被这一笔挡着 ⇒ run 在跑、认领在手 ⇒ 会话删不掉),到期之后才完成的钉住不发写;已发出的写到期只放手不取消
+ * (`settleResumeAnchor`),但它绑着钉住的那一位 —— run 收场、会话被删、同 id 被别人重建之后才落的那一笔落不进新住客,也落不进空闲 id(段判「不是那一位」⇒ 零写,
+ * 记一次同一只 fail-open,`reason=error`)。没有席位 ⇒ 两只都缺席(这台部署不存锚)。
+ */
+export declare function createRunAnchorWriter(args: {
+    readonly seat: Pick<LandedAttendantSeat, "putAnchors"> | undefined;
+    readonly sessionId: string;
+    readonly owner: string | null;
+    /** 用户提示锚的键(这条 run 的 id);缺 ⇒ 不写提示锚(没有手柄 / 续跑腿接着别的腿的 run)。 */
+    readonly promptKey: string | undefined;
+    readonly witness: DelegationRootWitness | undefined;
+    /** 头读投成的住客(属主存取器的 `sessionOccupantReadOf`);缺 ⇒ 见证里没有化身时钉不住 ⇒ 不写。 */
+    readonly occupantOf: ((sessionId: string) => Promise<SessionFace | undefined>) | undefined;
+    /** 会话此刻的叶子(属主存取器的 `sessionFactsReadOf` 投影);缺 ⇒ 不写助手文本锚。 */
+    readonly leafOf: ((sessionId: string) => Promise<string | null | undefined>) | undefined;
+}): RunAnchorWriter;
 export declare class TurnAnchorCapture {
     private readonly capture;
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
@@ -227,7 +256,7 @@ export declare class TurnAnchorCapture {
     private turnHadTool;
     /** 用户提交是不是开场提示的唯一读法({@link createPromptCommitReader};开场窗 + 闩 —— 开场提示之后打断标记 / steer 不改锚;附件帧不是提问)。 */
     private readonly promptCommit;
-    constructor(capture: ((eventId: string) => Promise<void>) | undefined, 
+    constructor(capture: ((eventId: string, held: () => boolean) => Promise<void>) | undefined, 
     /** 这只捕获器在哪条腿上(写失败的 fail-open 探针行带它)。 */
     leg: Exclude<ResumeAnchorLeg, "stream">, 
     /** R8 (CC-parity rewind): capture a USER-message anchor straight from the
@@ -242,7 +271,7 @@ export declare class TurnAnchorCapture {
      *  user-role commit in the same run — the interruption marker, a steer — never moves it. The capture instance is per
      *  run: a leg that CONTINUES an existing run (same taskId) wires no `captureUser` (its opening prompt was anchored
      *  by the first leg). */
-    captureUser?: ((entryId: string) => Promise<void>) | undefined);
+    captureUser?: ((entryId: string, held: () => boolean) => Promise<void>) | undefined);
     /** A `human_input` arrived — the objective's declared attachments open the frame window of {@link createPromptCommitReader} (another applied input inside the window voids it). */
     onHumanInput(ev: {
         readonly type: string;
@@ -359,7 +388,7 @@ cascade?: CascadeConfig, instrumentDegenerate?: (result: TaskResult) => void, pl
 elicitOwner?: string | null, 
 /** E18 resume-at: capture the turn's (firstTextEventId → leaf entryId) anchor at each turn_end. Built by the caller
  *  closing over {sessionId, owner, the session store's head read (`headOf(id)?.leafId`), resumeAnchorStore}; undefined ⇒ no anchor store wired. */
-captureTurnAnchor?: (eventId: string) => Promise<void>, 
+captureTurnAnchor?: (eventId: string, held: () => boolean) => Promise<void>, 
 /** MF-Fleet (shell-host contract): the run-scoped fleet-row publisher. `onStart` adds the live row; `onEvent` accrues
  *  tokens (turn_end) + subagent child rows (task_progress); `onTerminal` flips/removes it. Fired for ALL legs
  *  (verify/cascade/plain-stream) so a background run TRANSITIONS its `GET /v1/fleet/stream` row exactly like the
@@ -367,7 +396,7 @@ captureTurnAnchor?: (eventId: string) => Promise<void>,
 fleetPublisher?: FleetRunPublisher, 
 /** R8 (CC-parity rewind): capture a USER-message anchor (keyed by this run's taskId) from `message_committed{role:"user"}`
  *  — the CC "rewind to the prompt" target. undefined ⇒ no anchor store wired. */
-captureUserMessageAnchor?: (entryId: string) => Promise<void>, 
+captureUserMessageAnchor?: (entryId: string, held: () => boolean) => Promise<void>, 
 /** §4④ : AskUserQuestion LIVE coordinator — establishes a per-run onQuestion ALS context (like `elicitation`)
  *  so an AskUserQuestion tool call routes to this run's stream + owner-gated respond. undefined ⇒ headless default. */
 question?: QuestionCoordinator, 
@@ -457,7 +486,7 @@ workspaceRecorder?: SessionWorkspaceRecorder,
  */
 runSkills?: readonly RunSkillEntry[], 
 /**
- * 这次提交登记的工作目录(部署事实 `LegFacts.registeredCwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
+ * 这条腿跑在的工作目录(部署事实 `LegFacts.sessionBindings.cwd`)。只在两条组合腿(verify / cascade)上经 `compositionLegRoot` 交给引擎 ——
  * 梯子的级 / 验证器腿跑在引擎现铸的会话里,工厂按会话读不到它;普通流形跑在根会话上,工厂自己读得到。缺席 = 没登记 ⇒ 每一条腿照旧落临时目录。
  */
 registeredCwd?: string): Promise<void>;

package/dist/runs.js

@@ -9,9 +9,8 @@ import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js"
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withSubject } from "./observability/principal-context.js";
-import { partsOf } from "./owner-brands.js";
 import { recoveredSubject } from "./owner-faces.js";
-import { taskSpecIdentityOf } from "./engine-identity.js";
+import { engineScopeOfOwner } from "./engine-identity.js";
 import { withModelReachScope } from "./model-reach-scope.js";
 import { createInstructionSelectionLeg } from "./instruction-selection.js";
 import { redactSecrets } from "./trace/redact.js";
@@ -62,11 +61,10 @@ export async function taskHandleStop(registry, handle, access, agentStore) {
     return registry.stopTask(handle, access);
 }
 export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
-    const recovered = recoveredSubject(subject);
-    const principal = taskSpecIdentityOf(recovered === undefined ? undefined : partsOf(recovered)).principal;
+    const scope = engineScopeOfOwner(subject);
     const mark = () => {
         try {
-            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope: principal ?? "default" }, "user", { skipSessionScoped: true });
+            defaultTaskRegistry.markStopSourceForOwner({ owner: taskId, scope }, "user", { skipSessionScoped: true });
         }
         catch {
         }
@@ -79,6 +77,10 @@ export function markChildrenStoppedByUserOnAbort(signal, taskId, subject) {
 }
 const EXECUTION_ENV_REFUSAL_HTTP_STATUS = {
     "env.home_unconfirmed": 409,
+    "env.snapshot_bucket_missing": 409,
+    "env.occupant_missing": 409,
+    "env.sandbox_refused": 409,
+    "env.host_key_rejected": 409,
 };
 const PREPARE_REFUSAL_HTTP_STATUS = {
     "resume.session_not_found": 404,
@@ -234,13 +236,52 @@ export function createPromptCommitReader() {
     };
 }
 export async function settleResumeAnchor(write, where) {
+    let open = true;
     try {
-        await withinIoDeadline(write);
+        await withinIoDeadline(() => write(() => open));
     }
     catch (err) {
         const why = err instanceof IoDeadlineExceeded ? `reason=timeout boundMs=${BASELINE_IO_DEADLINE_MS}` : `reason=error error=${err instanceof Error ? err.message : String(err)}`;
         recordFailOpen("server.resume-anchor.capture-failed", `leg=${where.leg} kind=${where.kind} ${why}`);
     }
+    finally {
+        open = false;
+    }
+}
+export function createRunAnchorWriter(args) {
+    const { seat, sessionId, owner, promptKey, witness, occupantOf, leafOf } = args;
+    if (seat === undefined)
+        return {};
+    let pinned = witness !== undefined && witness.incarnation !== null ? { owner: witness.owner, incarnation: witness.incarnation } : undefined;
+    const pin = async () => (pinned ??= await occupantOf?.(sessionId));
+    const put = async (landed, eventId, entryId) => {
+        const out = await seat.putAnchors(sessionId, landed, [{ eventId, entryId }], owner);
+        if (!out.landed)
+            throw new Error("the session's occupant is no longer this run's — the anchor was not written");
+    };
+    return {
+        ...(promptKey !== undefined
+            ? {
+                prompt: async (entryId, held) => {
+                    const landed = await pin();
+                    if (landed !== undefined && held())
+                        await put(landed, promptKey, entryId);
+                },
+            }
+            : {}),
+        ...(leafOf !== undefined
+            ? {
+                turn: async (eventId, held) => {
+                    const landed = await pin();
+                    if (landed === undefined || !held())
+                        return;
+                    const leaf = await leafOf(sessionId);
+                    if (leaf)
+                        await put(landed, eventId, leaf);
+                },
+            }
+            : {}),
+    };
 }
 export class TurnAnchorCapture {
     capture;
@@ -262,7 +303,7 @@ export class TurnAnchorCapture {
         const prompt = this.promptCommit(committed);
         const captureUser = this.captureUser;
         if (prompt !== undefined && captureUser)
-            await settleResumeAnchor(() => captureUser(prompt), { leg: this.leg, kind: "prompt" });
+            await settleResumeAnchor((held) => captureUser(prompt, held), { leg: this.leg, kind: "prompt" });
     }
     onText(eventId) {
         if (this.firstTextEventId === undefined) {
@@ -278,7 +319,7 @@ export class TurnAnchorCapture {
         const capture = this.capture;
         const handle = this.firstTextEventId;
         if (handle && !this.turnHadTool && capture)
-            await settleResumeAnchor(() => capture(handle), { leg: this.leg, kind: "turn" });
+            await settleResumeAnchor((held) => capture(handle, held), { leg: this.leg, kind: "turn" });
         this.firstTextEventId = undefined;
         this.turnHadTool = false;
     }
@@ -388,6 +429,7 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         await sink.appendParked(word, grafted);
         const sealed = sealResultForExit(grafted);
         reached = { kind: word, result: sealed };
+        await acceptance?.settle(sealed);
         const committed = await commitParkRow({
             runStore, taskId, word, result: sealed, card: { token, sessionId: spec.sessionId }, cards: checkpointCards, leg: "bg",
             legId: parkCommit.legId, staleWindowMs: parkCommit.runStaleSec === undefined ? undefined : parkCommit.runStaleSec * 1000,
@@ -396,7 +438,6 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             reached = undefined;
             settledAsCancel = committed.row?.errorCode === CANCELLED_CODE;
         }
-        acceptance?.settle(sealed);
     };
     const settleLegResult = async (engineResult) => {
         const result = atHostBoundary(engineResult);
@@ -410,10 +451,10 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
         const safe = await withModelUsage(sealResultForExit(settled));
         await sink.appendDone(safe);
         reached = { kind: "done", result: safe };
+        await acceptance?.settle(safe);
         const plane = outwardPlane(safe.terminal);
         await runStore.setTerminal(taskId, plane.status, safe, plane.errorMessage ?? null);
         await releaseKeyIfZeroWorkRefusal(runStore, taskId, safe);
-        acceptance?.settle(safe);
     };
     const instructionLeg = createInstructionSelectionLeg();
     const sink = createLedgerSink({ appendEvent: (seq, type, data) => runStore.appendEvent(taskId, seq, type, data), persistThinking, notifiedKeys, onActivity: (kind, statusData) => recordTurnActivity(taskId, kind, statusData), legSections: () => ({ instructions: instructionLeg.segment(), skills: runSkills }), usage: { modelUsage, taskId } });
@@ -609,12 +650,12 @@ export async function runInBackground(runner, spec, runStore, taskId, parkCommit
             if (reached?.kind === "done") {
                 const plane = outwardPlane(reached.result.terminal);
                 settledAsCancel = failureCodeOf(reached.result.terminal) === CANCELLED_CODE;
+                await acceptance?.settle(reached.result);
                 await runStore.setTerminal(taskId, plane.status, reached.result, plane.errorMessage ?? null);
                 await releaseKeyIfZeroWorkRefusal(runStore, taskId, reached.result);
-                acceptance?.settle(reached.result);
             }
             else if (reached !== undefined) {
-                acceptance?.settle(reached.result);
+                await acceptance?.settle(reached.result);
             }
             else if (thrownCancelCause === undefined && observedDone !== undefined && heldParkOf(atHostBoundary(observedDone)) !== undefined) {
                 recordFailOpen("server.runs.terminal-ledger-write-failed", `arm=park-held ${message}`);

package/dist/runtime-governance.d.ts

@@ -92,8 +92,9 @@ export declare function compileCommandPolicyLayers(rules: CommandRule[] | undefi
  * `plan` 是有出口的**生命周期词**(`plan_review` 把计划带出 plan),不是围栏:它是**提交入口的模式词地板**({@link autonomyModeFloor}),
  * 盖在每一个 spec 出生点一次(词 = {@link entryPermissionMode} 的 `effective`):受理门盖进存储的提交体(`task-settings.ts` `stampEntryPermissionMode`)、run-local 盖在它自建的 spec 上、
  * leader run 盖在它出生时的入口体上(`leader/run-entry.ts`;入口词是 `plan` 的 leader run 进不了那条车道 —— worker 会话没有计划审阅通道 ⇒ 受理口响亮拒)。此后一条 run 的模式词
- * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)与 `plan_review` 写回。按段折一个模式词 = 第二个源:被批准的计划会在下一次挂起→续跑
- * 被拉回 plan。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
+ * 只有存储体一个源,写者是每一个出生点(新的持久化写都经 `http/checkpoint-ctx.ts` `buildCheckpointCtx`)、`plan_review` 写回与续跑口(停驻 run 的存储体被重放之前过一次**现**地板、
+ * 钳过的随 CAS 赢点写回;`permission-mode-admission.ts` `stampReplayEntryMode`,地板的出口词 —— `plan_review` 批准写下的词 —— 原样读)。按段折一个模式词 = 第二个源:
+ * 被批准的计划会在下一次挂起→续跑被拉回 plan;续跑口不是按段折 —— 它与提交口同一只入口一步,写的是同一个源,且不碰出口词。收紧入参的型上因此没有 `permissionMode`(`governance-overrides.ts`)。(上一个发布版本里本档不碰模式词,按段折的是只读手 +
  * 写面 `roots`、与 `read-only` 同形 —— 运维 plan 那时根本不进 plan 模式,见下一段。)
  *
  * 🔴 **为什么 `plan` 不再与 `read-only` 同形**:修前两档同映「只读手 + roots」,外加 `resolve-spec.ts` 见只读手就剥委派工具 —— 于是 `plan` 有三套
@@ -145,8 +146,8 @@ export interface EntryPermissionMode<W extends PermissionMode | undefined = Perm
  *    无人值守腿(`unattended-permission-mode.ts` `withUnattendedLeg`:`default` 钳在 spec 的词之下);
  *  · 「这个词会变成什么」的读者 —— 能力面写面开不开({@link autonomyKeepsOpenWriteFace}:bypass 声明过地板)、能力面 auto 读面
  *    (`auto-mode-face.ts` `judgeAutoModeArming`:意图过地板;`clamped` 且不是 auto ⇒ 未武装原因 `operator_floor`)、
- *    存量停驻体能否按此刻的地板重放(`http/stored-body-replay.ts`:体的词经钳会变 ⇒ 拒)。
- * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,上面八处各调本函数一次。
+ *    受理判官的入口一步(`permission-mode-admission.ts` `entryStep`:提交口盖章、在飞切档口、续跑口 —— 停驻 run 的存储体被重放之前过**现**地板 —— 三口同经这一处)。
+ * `test/entry-permission-mode.test.ts` 按语法树钉:core 钳在 `src/` 只此一处调用,本函数七处调用点各一次。
  */
 export declare function entryPermissionMode<W extends PermissionMode | undefined>(word: W, floor: PermissionMode | undefined): EntryPermissionMode<W>;
 /**

package/dist/security.d.ts

@@ -1,4 +1,5 @@
 import type { IncomingMessage } from "node:http";
+import type { EntriesStreamOptions } from "./session-sync-kernel.js";
 import { type SessionHead, type SessionPlacementRecord, type SessionStore, type SessionTreeEntry } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import type { Logger } from "./observability/logger.js";
@@ -9,6 +10,8 @@ import type { TaskRequestBody } from "./http/wire-types.js";
 import type { StagingHandle } from "./session-sync-kernel.js";
 import type { SessionDeletionFace } from "./session-deletion.js";
 import { type SessionBirth } from "./session-incarnation.js";
+import { type IdleSession, type IdleSessionCursor, type SessionKind, type SessionKindReading } from "./session-kind.js";
+import type { SessionListQuery } from "./plugins/store-contracts.js";
 import type { ClientSessionRowWrite, ReplaySessionRowWrite, ReplaySessionRowWriteOutcome, SessionRowAnswer, SessionRowPatch, SessionRowWriteOutcome } from "./session-row.js";
 import type { ExecutionPlacementSeat } from "./execution-placement.js";
 import type { SessionUnreadable } from "./session-error-wire.js";
@@ -56,6 +59,10 @@ export interface SessionListItem {
      *  by a fork after lineage was recorded (an older fork is not backfilled: its source is unknown). OMIT-when-absent, never `null`. Additive key, passed
      *  through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.forkedFrom` in `plugins/store-contracts.ts`. */
     forkedFrom?: string;
+    /** The session's kind (`session-kind.ts`): present-iff the session was created by a submission that declared `sessionKind`; a top-level session
+     *  never carries it (OMIT-when-absent, never `null`). The default list view lists only top-level sessions; `?sessionKind=<word>` lists that kind.
+     *  Additive key, passed through unprojected (`sessions-list.ts`). Same name and meaning as `SessionSummary.sessionKind` in `plugins/store-contracts.ts`. */
+    sessionKind?: SessionKind;
 }
 /**
  * 会话店的行格写原语(规则与判序:`session-row.ts` 头注「写原语」)—— 按入口分两只重载:客户端写(PATCH)的结局闭集四员;行重放(2c 导入落定后的那一笔)
@@ -74,7 +81,7 @@ export interface SessionRowCellsWriter {
  * 🔴 2026-08-01 复审逮到:守卫原本是**逐条路由白名单**(`PUT …/policy`、`POST …/sync/import`),
  * 而 `DELETE /v1/sessions/:id`(删整条会话)不在其中 —— 同一风险形、爆炸半径**更大**,却没门。
  *
- * 风险形逐字同源(守卫自己的注释):「无 service token + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
+ * 风险形逐字同源(守卫自己的注释):「请求没带凭据门认的凭据 + 未开 `ALLOW_UNAUTHED_WRITES`」这一形下
  * fleet 写档(面表 fleet 列的 `dev_open` 格,`owner-faces.ts` 的 `listFilterOf`)判 fleet-wide ⇒ 集群内**任意**不报主体的调用方可对**任意** session 动手(报了主体的调用方只动得到那位主体的,`principal-gate.ts` 的 `actsForDeployment`)。
  * policy 腿担心的是「forged principal 能 tighten/DoS 一个会话的工具」;DELETE 直接把会话删掉。
  *
@@ -104,6 +111,10 @@ export type SessionOwnerCell = {
 export declare function claimCallerOf(subject: Subject | undefined, config: DeploymentShapeInput<"principal">): Caller;
 /** 提交挂接「没有这只会话」那一答的句子(requireExisting 缺行与认领面看不见同一句;投影 `attach_absent`)。 */
 export declare const ATTACH_ABSENT_MESSAGE = "requireExistingSession: session does not exist (resume.session_not_found)";
+/** 带种类的提交撞上一只种类不同的既有会话的 409(律 `session-kind.ts`):体上机读位 `sessionKind` = 行上的词(顶层行缺席)。句子不回显请求的词以外的任何行事实。 */
+export declare const SESSION_KIND_MISMATCH_MESSAGE = "this session already exists with a different session kind \u2014 a session's kind is written once, when the session is created, and never changes; send the same sessionKind the session was created with, omit sessionKind to run the session as it is, or start a new session";
+/** 部署记不了种类(会话店没有出生回执面 / 种类读)⇒ 400 `request.precondition_unmet`(受理门读同一只能力事实 `capability-facts.ts` 的 `sessionKinds`,先拒在那里;这里是纵深)。 */
+export declare const SESSION_KIND_UNRECORDABLE_MESSAGE = "sessionKind requires a session store that records a session's kind and ages such sessions out (DB_BACKEND=mysql|pg|local) \u2014 this deployment cannot, so the session would be created as a top-level conversation; capabilities.sessionKinds lists the kinds a deployment accepts";
 /** 读一只会话行的 {@link SessionOwnerCell}:有主行 = 属主那一格(`owner-faces.ts` 的 `ownerCellOf`,属主列读数的唯一铸法);无主时问一次店的 `placementOf`
  *  (既有读口;店不交它 = 不实现 placement = 没有 placed 行)。`owner` = 调用点那一读。 */
 export declare function sessionOwnerCellOf(store: Pick<OwnerAwareSessionStore, "placementOf"> | undefined, sessionId: string, owner: string | null): Promise<SessionOwnerCell>;
@@ -135,35 +146,25 @@ export type OwnerAwareSessionStore = SessionStore & {
     register?: (sessionId: string, owner: string | null) => Promise<void>;
     /** [ref] placed 分区的元组读口(店的既有读口,一行 PK 读;`undefined` = 普通会话或无此行)。店不交它 = 不实现 placement = 没有 placed 行(无 repo 的内存店)。两个读者:
      *  ① 会话面的属主门只在属主为 NULL 时读它一次(无主的 placed 行不是公共行,`http/principal-gate.ts` 的 `sessionOwnerCellOf`);
-     *  ② `agent` 的唯一读口 `session-agent.ts` 的 `readSessionAgent`(会话视图体顶层、运维审批队列的停驻行同读):店没有这一面 ⇒ 键缺席,读面不凭别处另铸子代身份。 */
+     *  ② `agent` 的唯一读口 `http/owner-access.ts` 的 `readSessionAgent`(会话视图体顶层、运维审批队列的停驻行同读):店没有这一面 ⇒ 键缺席,读面不凭别处另铸子代身份。 */
     placementOf?: (sessionId: string) => Promise<SessionPlacementRecord | undefined>;
     /** E16 — enumerate the caller's sessions (owner-filtered on the session store's OWN owner column).
      *  `includeUnowned` = [ref] 窄互认第二臂的**第三条件**(`owner IS NULL`)的 SQL 承载位:置真时
      *  谓词放宽为 `owner = ? OR owner IS NULL`。只在 `owner` 在场时有意义(路由已判①③);`owner` 缺席
      *  (fleet-wide)时本位无效——那一面本来就不钉 owner。 */
-    listSessions?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<SessionListItem[]>;
+    listSessions?: (opts: SessionListQuery) => Promise<SessionListItem[]>;
     /** The SAME list face as {@link listSessions} (same SELECT, same mapper, same predicate and keyset) with each row's occupant — the row's owner and
      *  incarnation as read in that one read. The incarnation never enters the row (it is not a wire fact: `session-incarnation.ts`); this pair is for the
      *  in-process reader that must address a row by occupant — the peer directory's `PeerSessionRecord.occupant`. `listSessions` is this face's rows. */
-    listSessionRows?: (opts: {
-        owner?: string;
-        includeUnowned?: boolean;
-        cursor?: {
-            lastActivityAt: string;
-            sessionId: string;
-        };
-        limit: number;
-        q?: string;
-    }) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    listSessionRows?: (opts: SessionListQuery) => Promise<Array<SessionRowAnswer<SessionListItem>>>;
+    /** 按 id 的种类读(律 `session-kind.ts`;授权口的种类判与会话视图的 `sessionKind` 读它):读到它时行上的住客 + 种类。三只持久店都交,包装原样转发。 */
+    sessionKindOf?: (sessionId: string) => Promise<SessionKindReading | undefined>;
+    /** 老化候选面(律 `session-kind.ts`;唯一读者 = 维护拍的老化腿 `boot/session-age-out.ts`):种类为 `kind`、最后活动早于 `idleBefore`、当下无活引用的会话(在删的照交),
+     *  最老先出、`(lastActivityAt, sessionId)` 升序 keyset 续页(`after` = 上一页最后一条)。与 `listPlaced`、删除面 `pending()` 同族的用途专一枚举 —— 不出列表投影。 */
+    listIdleOfKind?: (kind: SessionKind, idleBefore: Date, page: {
+        readonly after?: IdleSessionCursor;
+        readonly limit: number;
+    }) => Promise<IdleSession[]>;
     /** ONE session's list row — the SAME projection {@link listSessions} emits for it (same columns, same mapper). `undefined` = not a
      *  row of the list face (no such session, or a placed / delegation-transcript session, which never lists). Reader: the 2c
      *  manifest (`title` / `pinned`). */
@@ -215,10 +216,7 @@ export type OwnerAwareSessionStore = SessionStore & {
      *  `opts.batchSize` is the page size (default 500). Resolves to `null` (NOT an empty iterable) when the session does
      *  not exist (the existence probe is async — `session_meta` first, like {@link exportEntries} — so the method returns
      *  a Promise of the iterable-or-null; the iterable itself then pages lazily). The read half of exportEntries, paged. */
-    exportEntriesStream?: (sessionId: string, opts?: {
-        afterSeq?: number;
-        batchSize?: number;
-    }) => Promise<AsyncIterable<SessionTreeEntry> | null>;
+    exportEntriesStream?: (sessionId: string, opts: EntriesStreamOptions) => Promise<AsyncIterable<SessionTreeEntry> | null>;
     /** 2c session-sync — IMPORT a verbatim entry log into `sessionId`, re-stamping `owner` to the
      *  authenticated importing principal (never the bundle's). The log is passed through core's
      *  `validateEntriesForImport` (the single fail-closed invariant gate) before any write. */
@@ -303,7 +301,7 @@ export interface AuthContext {
      *  `PROJECT_ID_REGEX` 门后折小写回传;[ref]/[ref] 宽读严写 —— 词法带 /i 收下大写形,但派生 scope 键
      *  与 config.projects 查表都只认这一个归一形,否则同一个项目会按大小写分成两只记忆盘)。
      *  身份半场(scope 的 tenant 段)永远来自 verified principal — projectId 只选「哪个项目盘/哪条登记」
-     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。main.ts 拿它查 defaultScopes。 */
+     *  (config.projects 查表键 + proj: 键的 projectId 段),不是 capability。装配器拿它判 defaultScopes 种子项目(对提交者可见才算,`project-registry.ts`)。 */
     resolvedProjectId?: string;
 }
 /** 授权口的入参:请求、体,与提交出口收候选的口(`submission-exit.ts`;只有登记了新行才调,传了也可能一次不调)。 */
@@ -385,9 +383,9 @@ export declare const CHECKPOINT_PUBLIC_SCOPE: "_";
  *
  * 写侧不是本仓能单方面改的:core 的 `treeScope = reviveClaim?.row.scope ?? ctx.principal ??
  * opts.background?.scope` 同时喂**进程内** `defaultTaskRegistry` 与 **durable** 行,而本仓/`core` 全域的
- * 读侧是一整族 `principal ?? "default"`(`runs.ts` markStopSourceForOwner、会话的引擎租户分区 `session-children-retire.ts`
- * `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent output/stream 三口、`agents-roster.ts`、
- * `fleet.ts`)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
+ * 读侧经唯一换算 `engine-identity.ts` 的 `engineScopeOf` / `engineScopeOfOwner`(匿名 ⇒ `"default"`;读者:`runs.ts` markStopSourceForOwner、
+ * 会话的引擎租户分区 `session-children-retire.ts` `sessionTenantScope`(删除协调器的子代 / 信箱 / 后台 shell 三腿)、`http/routes/runs.ts` 的 subagent
+ * output/stream 与句柄三口、`agents-roster.ts`、`fleet.ts` 的工作流行)。⇒ **把铸点改成 `"_"` 会把这一整族读者一起打瞎**(本车实测:`subagent-tail-content-supply`
  * 的 tail 建连当场 404)。所以归一只能发生在**读侧**:checkpoint 侧拿着 `"_"` 去查 bg 分区时,
  * 显式把这两个键当同一格。
  */
@@ -396,9 +394,9 @@ export declare const BACKGROUND_REGISTRY_ANON_SCOPE: "default";
  * checkpoint 的 scope → 该在哪些 **bg 注册簿分区**里找它的 parked 子代([ref])。
  *
  * 匿名(`"_"`)⇒ 两个都查:`"_"`(将来若统一了写侧)与 `"default"`(今天 core 真写下去的那个)。
- * 其余 ⇒ 原样单查:有 principal 时两套约定折出**同一个**串(`encodeCheckpointScope` 只在 null/undefined
- * 时才替换,core 那侧也只在 `ctx.principal` 缺席时才落兜底),不存在第二个候选;而多租户部署里一个
- * **真名叫 `default`** 的租户必须只匹配自己那格 —— 所以别把别名做成双向。
+ * 其余 ⇒ 引擎那一格单查:停驻行的 scope 列是**主体**,bg 行是引擎按它的任务 scope 写的(落点今天只写人)⇒ 经唯一换算
+ * `engine-identity.ts` 的 `engineScopeOfOwner`:没带场景的主体逐字节同(两套约定折出同一个串),带场景的主体 ⇒ 那个人;
+ * 不存在第二个候选。多租户部署里一个**真名叫 `default`** 的租户只匹配自己那格 —— 所以别把别名做成双向。
  */
 export declare function backgroundScopesForCheckpointScope(scope: string): readonly string[];
 /** Encode a subject (the partition key — `owner-brands.ts`; or none) as the checkpoint `scope` column value. A row owner read back from a store is the

package/dist/security.js

@@ -3,8 +3,10 @@ import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
 import { FACES, OWNERLESS_ORDINARY_CELL, ownerCellOf, ownerlessCellWithoutRead, qualsOf, recoveredSubject, visibleOn } from "./owner-faces.js";
 import { mintDurableOwnerKey, mintPerson, partsOf, personOf, scenarioNamed, subjectOf } from "./owner-brands.js";
 import { deletionHeadReadOf } from "./session-incarnation.js";
+import { isSessionKind, sessionKindFaceOf } from "./session-kind.js";
 import { memoryScopeFor } from "./memory-scope.js";
 import { verifyPrincipalJwt } from "./principal-jwt.js";
+import { engineScopeOfOwner } from "./engine-identity.js";
 import { fieldConflictFacts } from "./field-conflict.js";
 import { refusalReservedKeyMessage, refusalReservedKeyOf } from "./http/refusal-body.js";
 import { PRINCIPAL_MAX_BYTES, principalShapeProblem } from "./principal-shape.js";
@@ -33,6 +35,14 @@ export const ATTACH_ABSENT_MESSAGE = "requireExistingSession: session does not e
 function attachAbsentError() {
     return createCodedHttpError(404, "resume.session_not_found", ATTACH_ABSENT_MESSAGE);
 }
+export const SESSION_KIND_MISMATCH_MESSAGE = "this session already exists with a different session kind — a session's kind is written once, when the session is created, and never changes; send the same sessionKind the session was created with, omit sessionKind to run the session as it is, or start a new session";
+function sessionKindMismatch(rowKind) {
+    return createCodedHttpError(409, "conflict.session_kind_mismatch", SESSION_KIND_MISMATCH_MESSAGE, rowKind === undefined ? undefined : { sessionKind: rowKind });
+}
+export const SESSION_KIND_UNRECORDABLE_MESSAGE = "sessionKind requires a session store that records a session's kind and ages such sessions out (DB_BACKEND=mysql|pg|local) — this deployment cannot, so the session would be created as a top-level conversation; capabilities.sessionKinds lists the kinds a deployment accepts";
+function sessionKindUnrecordable() {
+    return createCodedHttpError(400, "request.precondition_unmet", SESSION_KIND_UNRECORDABLE_MESSAGE);
+}
 export async function sessionOwnerCellOf(store, sessionId, owner) {
     if (owner !== null)
         return ownerCellOf(owner);
@@ -122,13 +132,25 @@ export function createAuthorizer(config, sessionStore, logger) {
     };
     const birthFace = birthFaceOf(sessionStore);
     const withdrawFace = withdrawFaceOf(sessionStore);
-    const registerNew = async (id, owner, register, onBirth) => {
-        if (birthFace === undefined || withdrawFace === undefined)
+    const kindFace = sessionKindFaceOf(sessionStore);
+    const registerNew = async (id, owner, kind, register, onBirth) => {
+        if (kind !== undefined && birthFace === undefined)
+            throw sessionKindUnrecordable();
+        if (birthFace === undefined || (withdrawFace === undefined && kind === undefined))
             return register(id, owner);
-        const receipt = await birthFace.registerWithReceipt(id, owner);
-        if (receipt.minted !== undefined)
+        const receipt = await birthFace.registerWithReceipt(id, owner, kind);
+        if (receipt.minted !== undefined && withdrawFace !== undefined)
             onBirth?.(receipt.minted, withdrawFace);
     };
+    const judgeKind = async (id, wanted, judged, subject) => {
+        if (kindFace === undefined)
+            throw sessionKindUnrecordable();
+        const reading = await kindFace.sessionKindOf(id);
+        if (reading === undefined || judged === undefined || reading.incarnation !== judged.incarnation)
+            throw attachRefused("not_visible", subject);
+        if (reading.kind !== wanted)
+            throw sessionKindMismatch(reading.kind);
+    };
     return async ({ req, body, onBirth }) => {
         const subject = verifiedSubject(req, config);
         if (config.requirePrincipal && !subject) {
@@ -142,6 +164,7 @@ export function createAuthorizer(config, sessionStore, logger) {
             projectId = body.projectId.toLowerCase();
         }
         const requireExisting = body.requireExistingSession === true;
+        const kind = isSessionKind(body.sessionKind) ? body.sessionKind : undefined;
         const headOf = deletionHeadReadOf(sessionStore);
         let head;
         const readOwner = headOf === undefined ? undefined : async (id) => {
@@ -159,7 +182,7 @@ export function createAuthorizer(config, sessionStore, logger) {
                         throw attachRefused("missing", subject);
                     }
                     if (register) {
-                        await registerNew(requested, subject ?? null, register, onBirth);
+                        await registerNew(requested, subject ?? null, kind, register, onBirth);
                         owner = await readOwner(requested);
                     }
                     else if (config.requirePrincipal) {
@@ -170,11 +193,18 @@ export function createAuthorizer(config, sessionStore, logger) {
                     const claimCaller = claimCallerOf(subject, config);
                     if (!visibleOn("session.attach", qualsOf(claimCaller, await sessionCellFor("session.attach", claimCaller, sessionStore, requested, owner))))
                         throw attachRefused("not_visible", subject);
+                    if (kind !== undefined)
+                        await judgeKind(requested, kind, head, subject);
+                }
+                else if (kind !== undefined) {
+                    throw register ? attachRefused("missing", subject) : sessionKindUnrecordable();
                 }
             }
             else if (config.requirePrincipal) {
                 throw new HttpError(403, "session reuse needs an owner-aware session store on a multi-tenant deployment: this worker's session store cannot attest who owns a session, so a sessionId cannot be authorized — including one this worker itself minted a moment ago (without a register seam it was never recorded as yours). Configure a durable session backend (SESSION_BACKEND), or omit sessionId on every turn to start fresh.");
             }
+            if (!readOwner && kind !== undefined)
+                throw sessionKindUnrecordable();
             sessionId = requested;
         }
         else {
@@ -183,9 +213,13 @@ export function createAuthorizer(config, sessionStore, logger) {
             }
             sessionId = uuidv7();
             if (register)
-                await registerNew(sessionId, subject ?? null, register, onBirth);
+                await registerNew(sessionId, subject ?? null, kind, register, onBirth);
+            else if (kind !== undefined)
+                throw sessionKindUnrecordable();
             if (readOwner)
                 await readOwner(sessionId);
+            if (kind !== undefined)
+                await judgeKind(sessionId, kind, head, subject);
         }
         return { subject, sessionId, memoryScope: memoryScopeFor(config, subject === undefined ? undefined : personOf(subject), projectId), resolvedProjectId: projectId, ...(head === undefined ? {} : { head }) };
     };
@@ -223,7 +257,7 @@ export function subjectWidthExceeded(subject) {
 export const CHECKPOINT_PUBLIC_SCOPE = "_";
 export const BACKGROUND_REGISTRY_ANON_SCOPE = "default";
 export function backgroundScopesForCheckpointScope(scope) {
-    return scope === CHECKPOINT_PUBLIC_SCOPE ? [CHECKPOINT_PUBLIC_SCOPE, BACKGROUND_REGISTRY_ANON_SCOPE] : [scope];
+    return scope === CHECKPOINT_PUBLIC_SCOPE ? [CHECKPOINT_PUBLIC_SCOPE, BACKGROUND_REGISTRY_ANON_SCOPE] : [engineScopeOfOwner(scope)];
 }
 export const encodeCheckpointScope = (subject) => subject ?? CHECKPOINT_PUBLIC_SCOPE;
 export const decodeCheckpointScope = (scope) => (scope === CHECKPOINT_PUBLIC_SCOPE ? undefined : mintDurableOwnerKey(scope));

package/dist/server-secret-env.d.ts

@@ -18,7 +18,8 @@
  * `ADB_VENDOR_KEYS` / `AWS_SECRET_ACCESS_KEY` 一类,实测)。三个继承词只在引擎一处判:
  *  · `"all"` = 整份环境 **减** 本进程声明的自有凭据名;`"scrub"`(缺省)= 形状剥 ∪ 该名单;`[names]` = 严格白名单,点到名单中的名 ⇒ 引擎响亮拒
  *    (`inheritEnvPolicyProblem`:构造时与 spawn 时两格都拒,拒句带名;本仓不自判 withheld、不留第二读法)。
- *  · 名单 = 配置目录(`config-catalog.ts`)全部 `type:"secret"` 名 ∪ 名单型旋钮名(`env-name-allowlist-knobs.ts`,其原文可能夹着被错展开的令牌)∪ **生效配置
+ *  · 名单 = 本包凭据类变量名({@link CREDENTIAL_ENV_NAMES}:配置目录(`config-catalog.ts`)全部 `type:"secret"` 名 ∪ bake-runner 进程自己的凭据名 `BAKE_RUNNER_CREDENTIAL_ENV`
+ *    —— 目录只装服务进程读的 env,runner 的 bearer 不是目录行)∪ 名单型旋钮名(`env-name-allowlist-knobs.ts`,其原文可能夹着被错展开的令牌)∪ **生效配置
  *    模型条目的 `apiKeyEnv`**(key-resolver 取凭据的那张表 `config.modelApiKeyEnv` 的值 —— 本进程消费的凭据变量名,条目由中心热应用新增 / 改名),
  *    **机器派生**、不手抄、不按「归谁消费」切({@link serverWithheldEnvNames} 一处)。声明两个时机、同一只 {@link declareServerWithheldEnv}:起服第一步(三个进程入口:
  *    `boot/stage-01-config.ts` / `run-local.ts` / `bake-runner/main.ts`,在任何执行环境构造与 spawn 之前 —— 声明先于构造才有构造时拒;此时没有生效配置 = 空表),
@@ -29,9 +30,10 @@
  *    `loadConfig()` 的**声明前提**({@link ownCredentialDeclarationRefusal}:起服表的名没全扣 ⇒ `loadConfig` 抛,拒句点名 {@link declareServerWithheldEnv} —— 「先声明」不再只是入口里的位置契约,
  *    不经入口直接调 `loadConfig` 的进程〔包根嵌入方 / bench / 探针脚本〕得先声明,声明对它们才不是空的)与能力词 `inherit_env.own_credentials_withheld` 在本进程的事实
  *    {@link ownCredentialsWithheld}(当前生效配置应声明的名全被扣;活配置经 {@link bindOwnCredentialsConfig} 在 `loadConfig()` 之后绑一次;未绑 / 没扣 ⇒ false)。
- *  · **值臂**(core 7.52.0 [ref]):声明是一张表 `{ names, values }`。`values` = 本进程持有凭据的变量(目录 secret 名 ∪ 模型条目 `apiKeyEnv`,{@link serverCredentialValueSources})
- *    此刻装着的**每一枚**本服务凭据 —— 颗粒按本服务读这只变量的那一只解析器定(目录行的 `credentialForm`:整值总在内,`SERVICE_AUTH_TOKENS` 另加每一枚令牌、
- *    `APPROVAL_HMAC_KEYS` 另加每一把钥;{@link credentialsHeldBy})—— 引擎按整串比,所以一枚令牌换了个变量名放着与原变量同扣,部分重叠 / 前后缀不同的值不扣。
+ *  · **值臂**(core 7.52.0 [ref]):声明是一张表 `{ names, values }`。`values` = 本包凭据类变量(本包凭据类变量名 ∪ 模型条目 `apiKeyEnv`,{@link serverCredentialValueSources})
+ *    此刻装着的**每一枚**本服务凭据 —— 颗粒按本服务读这只变量的那一只解析器定(行的 `credentialForm`:装着凭据值的颗粒整值总在内,`SERVICE_AUTH_TOKENS` 另加每一枚令牌、
+ *    `APPROVAL_HMAC_KEYS` 另加每一把钥;名单型旋钮的颗粒 `name-list` 是零枚 —— 原文是变量名单,不是凭据;一只变量有几个读者就取几个读法的并集 —— 模型条目的 `apiKeyEnv` 指着它 ⇒
+ *    key-resolver 把它整值读成一枚,哪怕它是一行名单型旋钮;{@link credentialsHeldBy})—— 引擎按整串比,所以一枚令牌换了个变量名放着与原变量同扣,部分重叠 / 前后缀不同的值不扣。
  *    逐枚交给引擎的同一只判;引擎判「不是凭据值」的那一枚不扣、名照扣、不拒启、点名那个变量一次。能力词 `inherit_env.own_credential_values_withheld` 的事实 = {@link ownCredentialValuesWithheld}(位真 ⇔ 值臂每一枚都真扣)。
  *    「这个变量是不是本服务的凭据」(名是,或值是)只有一只读法 {@link ownCredentialVariable}(判官 = 引擎此刻的声明):名单型旋钮的解析器与声明增长时的重判都问它。
  *  · 调用方显式传入的 env(`cfg.env` / 单次命令的 `env` / 沙箱的点名放回)不是继承,照旧原样叠在组合结果之上 —— 那是适配器自己的凭据通道。
@@ -54,19 +56,19 @@
 import { type InheritEnvPolicy, type SecretEnvFinding } from "@sema-agent/core";
 import type { ServiceConfig } from "./config-types.js";
 import { type SecretEnvScrubSite } from "./observability/secret-env-scrub.js";
-/** 配置目录里 `type:"secret"` 的 env 名(按目录原文 —— 引擎按平台比名:POSIX 逐字、Windows 不分大小写,本仓不再另折叠)。 */
-export declare const CATALOG_SECRET_ENV_NAMES: ReadonlySet<string>;
+/** 本包凭据类变量名({@link CREDENTIAL_FORM_OF} 的键;排序只为读数稳定)。 */
+export declare const CREDENTIAL_ENV_NAMES: ReadonlySet<string>;
 /** 生效配置模型条目 name → `apiKeyEnv`(变量**名**,值从本进程 env 取)—— `ServiceConfig.modelApiKeyEnv` 的形,key-resolver 读凭据的那张表。 */
 export type ModelApiKeyEnvTable = Readonly<Record<string, string>>;
 /**
- * 本进程的自有凭据名(机器派生,三臂一处:目录 secret 名 ∪ 名单型旋钮名 ∪ `modelApiKeyEnv` 表的值;排序只为读数稳定)。纯函数:给哪张表就答哪张表的应声明
+ * 本进程的自有凭据名(机器派生,三臂一处:本包凭据类变量名 ∪ 名单型旋钮名 ∪ `modelApiKeyEnv` 表的值;排序只为读数稳定)。纯函数:给哪张表就答哪张表的应声明
  * 集合 —— 声明时给候选表、能力位给活表,同一只派生。名字按原文交引擎(目录臂同形),不在本仓折叠大小写。
  */
 export declare function serverWithheldEnvNames(modelApiKeyEnv?: ModelApiKeyEnvTable): readonly string[];
 /**
- * 本进程**持有凭据值**的变量名(值臂的来源;core 7.52.0 [ref]):目录 secret 名 ∪ 模型条目 `apiKeyEnv` 的值 —— 名单与值臂两臂同一张表派生,只少不在目录里的名单型旋钮名
- * (今天 = bake-runner 进程的 `BAKE_ENV_ALLOW`);目录里的名单型旋钮行是 secret 行,原文按凭据类整值对待(行上 `credentialForm: "whole"`)。每个来源装着几枚凭据
- * 由目录行的颗粒定({@link credentialsHeldBy})。纯函数,排序只为读数稳定。
+ * 本进程的**凭据类变量**名:本包凭据类变量名 ∪ 模型条目 `apiKeyEnv` 的值 —— 名单与值臂两臂同一张表派生,只少不在那张表里的名单型旋钮名(今天 = bake-runner 进程的
+ * `BAKE_ENV_ALLOW`)。两个读者问同一张:值臂按每只的颗粒读出它此刻装着的凭据值({@link credentialsHeldBy};名单型旋钮的颗粒 `name-list` ⇒ 零枚,名照扣),
+ * 请求 `settings.env` 的凭据判据按名拒(`task-settings.ts` `settingsEnvCredentialIssue`)。纯函数,排序只为读数稳定。
  */
 export declare function serverCredentialValueSources(modelApiKeyEnv?: ModelApiKeyEnvTable): readonly string[];
 /**