@sema-agent/server 7.150.0 → 7.152.0

package/dist/capability-facts.js

@@ -1,3 +1,4 @@
+import { assembleFileHistory } from "./file-history-capture.js";
 import { buildOperatorRosterWayOut, operatorRosterPresent } from "./http/principal-gate.js";
 import { mcpInjectionHonored } from "./task-mcp.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "./deployment-shape.js";
@@ -5,8 +6,11 @@ import { presentedApprovalFrameFamily, resolveStreamApprovalGate } from "./tool-
 import { selfOrchestrationDenial } from "./task-workflow.js";
 import { centerEntitlementSourceWired } from "./runtime-caps-resolver.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
-import { blobExchangeOf, overwriteWipeIncapable } from "./session-sync.js";
+import { landingBlobFacesOf } from "./session-sync.js";
+import { overwriteWipeIncapable } from "./plugins/landed-attendants.js";
 import { WORKSPACE_PERSIST_DEFAULT, WORKSPACE_SNAPSHOT_KEEP_DEFAULT, workspaceSnapshotTimeoutOf } from "./workspace-space.js";
+import { sessionKindFaceOf } from "./session-kind.js";
+import { birthFaceOf } from "./plugins/session-birth.js";
 import { headReadPresent } from "./session-incarnation.js";
 import { laneWiresExecutionEnv } from "./execution-lane-caps.js";
 export const CAPABILITY_FACT_WHY = {
@@ -23,7 +27,7 @@ export const CAPABILITY_FACT_WHY = {
     session_fork_face_absent: "the session store has no fork face",
     session_row_faces_absent: "the session store has no session-row faces (headOf / sessionSummaryOf / writeSessionRowCells)",
     session_purge_absent: "no session purge coordinator is wired",
-    session_policy_store_absent: "no session policy store is wired",
+    session_kind_faces_absent: "the session store cannot record a session kind (it needs the birth receipt face that takes a kind, sessionKindOf, listSessions and listIdleOfKind) or no session purge coordinator is wired to age such sessions out",
     store_backend_absent: "no store backend is wired (DB_BACKEND=memory, multi-tenant bare boot, or half-configured SQL)",
     file_history_store_absent: "no file-history store is wired",
     resume_anchor_store_absent: "no rewind anchor map is wired (the handle → session-entry map a rewind target is read through, with the run store an unknown handle is checked against — both come from the store backend)",
@@ -34,7 +38,7 @@ export const CAPABILITY_FACT_WHY = {
     session_export_absent: "the session store has no entry export faces (exportEntries / exportEntriesStream)",
     session_import_staging_absent: "the session store has no staged-import face (beginImportStaging)",
     policy_purge_absent: "the session policy store has no deleteBySession purge verb",
-    blob_exchange_absent: "the file-history store carries no blob exchange (FileHistoryStore.blobExchange — SQL backends only)",
+    blob_exchange_absent: "the file-history store carries no complete blob face (the blob exchange FileHistoryStore.blobExchange together with the per-landing provenance face blobLanding — SQL backends only)",
     device_hub_absent: "the device lane hub is not wired",
     device_store_absent: "the device store is not wired",
     device_enrollment_absent: "device enrollment is not wired",
@@ -45,7 +49,7 @@ export const CAPABILITY_FACT_WHY = {
     shared_memory_store_absent: "no shared memory store provider is wired",
     org_memory_directory_absent: "no org memory directory (membership fold) is wired",
     org_delivery_gate_absent: "no organization delivery gate is mounted (PRINCIPAL_INBOX_ASSISTANT is unset: the deployment declares no principal-inbox consumer)",
-    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut()}`,
+    operator_principals_empty: `no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can ever be an operator; ${buildOperatorRosterWayOut("operate")}`,
     adoption_store_absent: "no adoption log store is wired (SQL backends only)",
     memory_bundle_faces_absent: "the memory engine's governance bundle faces are not wired",
     memory_compliance_faces_absent: "the memory engine's provenance/erasure faces are not wired",
@@ -63,8 +67,7 @@ export const CAPABILITY_FACT_WHY = {
     a2a_serve_off: "A2A_SERVE_ENABLED is off",
     elicitation_disabled: "inbound MCP elicitation is off (MCP_ELICITATION_ENABLED)",
     ask_question_disabled: "AskUserQuestion live HITL is off (ASK_QUESTION_ENABLED)",
-    tool_approval_disabled: "live tool approval is off (TOOL_APPROVAL_ENABLED)",
-    stream_approval_disabled: "the stream approval protocol is off (STREAM_APPROVAL_ENABLED)",
+    tool_approval_disabled: "this worker presents no approval cards (needs TOOL_APPROVAL_ENABLED, a store backend (DB_BACKEND) and DURABLE_APPROVAL)",
     read_root_grant_posture_refused: "this is not a single-user host-lane deployment (REMOTE_EXEC=host without REQUIRE_PRINCIPAL), the only posture that honors a read-directory grant",
     background_agent_store_absent: "no background-agent store is wired",
     sendfile_ledger_absent: "no SendUserFile ledger is wired",
@@ -156,6 +159,12 @@ export function sessionList(d) {
     const lister = d.sessionStorage?.listSessions?.bind(d.sessionStorage);
     return lister !== undefined ? yes({ lister }) : no("session_lister_absent");
 }
+export function sessionKinds(d) {
+    const s = d.sessionStorage;
+    return birthFaceOf(s) !== undefined && sessionKindFaceOf(s) !== undefined && typeof s?.listSessions === "function" && typeof s.listIdleOfKind === "function" && d.purgeSession !== undefined
+        ? YES
+        : no("session_kind_faces_absent");
+}
 export function sessionFork(d) {
     const s = d.sessionStorage;
     if (s?.fork === undefined)
@@ -180,21 +189,18 @@ export function sessionDelete(d) {
     return yes({ purge, sessionStorage: owned.sessionStorage });
 }
 export function sessionPolicy(d) {
-    const policyStore = d.sessionPolicyStore;
-    if (policyStore === undefined)
-        return no("session_policy_store_absent");
+    const backend = d.backend;
+    if (backend === undefined)
+        return no("store_backend_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
-    return yes({ policyStore, sessionStorage: owned.sessionStorage });
+    return yes({ sessionStorage: owned.sessionStorage, backend });
 }
 export function sessionSync(d) {
-    const { fileHistoryStore: historyStore, sessionPolicyStore } = d;
     const backend = d.backend;
     if (backend === undefined)
         return no("store_backend_absent");
-    if (historyStore === undefined)
-        return no("file_history_store_absent");
     const s = d.sessionStorage;
     if (s?.exportEntries === undefined || s.exportEntriesStream === undefined)
         return no("session_export_absent");
@@ -202,34 +208,34 @@ export function sessionSync(d) {
         return no("session_import_staging_absent");
     if (!headReadPresent(s) || s.sessionSummaryOf === undefined || s.writeSessionRowCells === undefined)
         return no("session_row_faces_absent");
-    if (overwriteWipeIncapable(sessionPolicyStore))
+    if (overwriteWipeIncapable(backend.sessionPolicy()))
         return no("policy_purge_absent");
-    return yes({ backend, sessionStorage: s, historyStore });
+    return yes({ backend, sessionStorage: s, historyStore: assembleFileHistory(backend).store });
 }
 export function sessionSyncFileHistory(d) {
     const sync = sessionSync(d);
     if (!sync.available)
         return sync;
-    const blobExchange = blobExchangeOf(sync.historyStore);
-    return blobExchange !== undefined ? yes({ historyStore: sync.historyStore, blobExchange }) : no("blob_exchange_absent");
+    const blobs = landingBlobFacesOf(sync.historyStore);
+    return blobs !== undefined ? yes({ historyStore: sync.historyStore, blobs }) : no("blob_exchange_absent");
 }
 export function sessionRewindFiles(d) {
-    const { fileHistoryStore: historyStore, resumeAnchorStore: anchors, config, backend } = d;
-    if (historyStore === undefined)
+    const { config, backend } = d;
+    if (backend === undefined)
         return no("file_history_store_absent");
     const owned = sessionOwnership(d);
     if (!owned.available)
         return owned;
     const runs = durableRuns(d);
-    if (anchors === undefined || !runs.available)
+    if (!runs.available)
         return no("resume_anchor_store_absent");
     if (!laneWiresExecutionEnv(config.remoteExec.provider))
         return no("execution_lane_handless");
     if (!DEPLOYMENT_SHAPE_PREDICATES.rewindableWorkspace.holds(config))
         return no("workspace_rebuilt_per_task");
-    if (backend?.kind !== "local")
+    if (backend.kind !== "local")
         return no("session_store_shared");
-    return yes({ historyStore, anchors: { anchors, runs: runs.runStore }, sessionStorage: owned.sessionStorage });
+    return yes({ historyStore: assembleFileHistory(backend).store, anchors: { anchors: backend.resumeAnchor(), runs: runs.runStore }, sessionStorage: owned.sessionStorage });
 }
 export function sessionRewindFilesPreview(d) {
     const rewind = sessionRewindFiles(d);
@@ -250,19 +256,19 @@ export function toolApproval(d) {
     return d.toolApproval !== undefined ? yes({ coordinator: d.toolApproval }) : no("tool_approval_disabled");
 }
 export function streamApproval(d) {
+    if (d.toolApproval === undefined)
+        return no("tool_approval_disabled");
+    const coordinator = d.toolApproval;
     const gate = resolveStreamApprovalGate({
-        toolApprovalEnabled: d.toolApproval !== undefined,
-        streamApprovalEnabled: d.config.streamApproval?.enabled === true,
+        toolApprovalEnabled: true,
         backend: d.backend,
         checkpointStore: d.checkpointStore,
     });
     if (gate.active)
-        return yes({ askStore: gate.askStore });
+        return yes({ askStore: gate.askStore, coordinator });
     switch (gate.reason) {
         case "no_tool_approval":
             return no("tool_approval_disabled");
-        case "protocol_disabled":
-            return no("stream_approval_disabled");
         case "no_backend":
             return no("store_backend_absent");
         case "no_park_facility":
@@ -277,20 +283,8 @@ export function readRootGrant(d) {
     return DEPLOYMENT_SHAPE_PREDICATES.callerOwnsWorkerDisk.holds(d.config) ? YES : no("read_root_grant_posture_refused");
 }
 export function approvalFrameFamilies(stream) {
-    if (stream.available)
-        return [presentedApprovalFrameFamily(true)];
-    switch (stream.why) {
-        case "tool_approval_disabled":
-            return [];
-        case "stream_approval_disabled":
-        case "store_backend_absent":
-        case "checkpoint_store_absent":
-            return [presentedApprovalFrameFamily(false)];
-        default: {
-            const unhandled = stream.why;
-            throw new Error(`unhandled stream-approval why: ${JSON.stringify(unhandled)}`);
-        }
-    }
+    const family = presentedApprovalFrameFamily(stream.available);
+    return family === undefined ? [] : [family];
 }
 export function deviceLane(d) {
     return d.deviceHub !== undefined ? yes({ hub: d.deviceHub }) : no("device_hub_absent");
@@ -367,15 +361,15 @@ export function engineHandover(d) {
         return no("engine_handover_lane_absent");
     return door.observing ? yes({ door }) : no("engine_lease_stopped");
 }
-export function operatorLane(d) {
-    return operatorRosterPresent(d.config) ? YES : no("operator_principals_empty");
+export function operatorLane(d, power) {
+    return operatorRosterPresent(d.config, power) ? YES : no("operator_principals_empty");
 }
 function adoptionLogStore(d) {
     const b = d.backend;
     return b !== undefined && typeof b.adoptionLog === "function" ? yes({ backend: b }) : no("adoption_store_absent");
 }
 export function adoption(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return adoptionLogStore(d);
@@ -390,7 +384,7 @@ export function adoptionSessionImport(d) {
     return yes({ backend: log.backend, sessionStorage: s });
 }
 export function memoryBundle(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryBundleExport !== undefined && d.memoryBundleImport !== undefined
@@ -398,13 +392,13 @@ export function memoryBundle(d) {
         : no("memory_bundle_faces_absent");
 }
 export function memoryCompliance(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryCompliance !== undefined ? yes({ faces: d.memoryCompliance }) : no("memory_compliance_faces_absent");
 }
 export function memoryOrigin(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryOriginFace !== undefined ? yes({ faces: d.memoryOriginFace }) : no("memory_origin_faces_absent");
@@ -412,17 +406,17 @@ export function memoryOrigin(d) {
 export function memoryConsolidation(d) {
     if (d.memoryConsolidation === undefined)
         return no("consolidation_valve_closed");
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     return lane.available ? yes({ valve: d.memoryConsolidation }) : lane;
 }
 export function memoryOptOutGrant(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     return d.memoryOptOutGrant !== undefined ? yes({ store: d.memoryOptOutGrant }) : no("memory_optout_grant_absent");
 }
 export function outcomeLedger(d) {
-    const lane = operatorLane(d);
+    const lane = operatorLane(d, "operate");
     if (!lane.available)
         return lane;
     const sink = d.outcomeSink;
@@ -431,7 +425,7 @@ export function outcomeLedger(d) {
 export function configCatalog(d) {
     if (d.config.configCatalogEnabled !== true)
         return no("config_catalog_disabled");
-    return operatorLane(d);
+    return operatorLane(d, "operate");
 }
 export function ruleLane(d) {
     return d.ruleConsent !== undefined ? yes({ lane: d.ruleConsent }) : no("rule_store_absent");

package/dist/card-rule-offers.d.ts

@@ -0,0 +1,32 @@
+/**
+ * **一张审批卡的规则候选:唯一读者**(活卡铸点、两只 checkpoint 店的铸行与回读投影、停驻行的规则记录读者同调这一只)。
+ *
+ * 规则一句:每一张面上投出的候选,都是同一份记录过**这一只**读者得到的投影 —— 同一个下标空间。读法 = core `readRuleOffers` 的闭集词
+ * (经 `approval-card.ts` 的 `readRuleOfferList`)→ 基数前缀帽 {@link MAX_RULE_OFFERS}(扣在读之前:exact single 恒 0、batch 恒末,前缀截不动选择键)→
+ * 兑付座超尺整条撤回 → 派生事实一致性(自称的 kind / match / command / directory 座与共享校验器从 `rule` 文本派生的三元组逐字一致,且是这张卡的工具与卡形)。
+ * 此前店侧另有一只读者(超尺截长、不判派生事实):一只展示成目录授权、规则文本却是 Bash 放行的 offer 能在队列行上出现,同一张停驻卡的重放帧与队列行
+ * 下标对不上。展示变换(逐条脱敏 + 截长,1:1 保位、只改字)归各展示腿,不是读法(`checkpoint-store-face.ts` 的 `displayRuleOffers`)。
+ */
+import { type RuleOffer } from "@sema-agent/core";
+/**
+ * 读一张卡的候选(唯一读者;头注)。`undefined` = 没有素材可投 / 可兑:原值不是非空列表(引擎没铸),或有兑付座超了不可截的尺(整条车道撤回)。
+ * `[]` = 原值有、全被丢光(闭集词不认 / 派生事实不一致):活卡铸点据它把绑定值回落到调用自己的命令(编辑臂兑的就是它),展示腿读作无供给。
+ */
+export declare function readCardRuleOffers(raw: unknown, cardTool: string): readonly RuleOffer[] | undefined;
+/**
+ * **已落盘投影的解码**(SQL 腿的 `checkpoint.rule_suggestions` 列:铸行那一刻 {@link readCardRuleOffers} 读出、经展示变换落下的那一份)。读者在铸行时已经跑过;
+ * 这里只认闭集词形 + 同一组界(扫描窗 / 成员前缀 / 基数),**不再判**派生事实与兑付座尺 —— 展示形是脱敏、截长过的字(截长之后的规则文本不再是一条可解析的规则),
+ * 再过一遍读者会把铸行时留下的候选丢掉,同一份素材两个后端两种卡面。手改过的列由这只解码落成丢弃(响亮,同一只 offer-dropped 计数)。
+ */
+export declare function decodeRuleOfferProjection(raw: unknown): readonly RuleOffer[];
+/**
+ * 这张卡的**绑定值**(`prepareCardApproval` 的 `command`,也是耐久行的 `rule_command`)= **卡形的绑定值**(core `prepareCardApproval` 对 `command` 入参的逐形定义):
+ *  · 值形(整工具 / 名字 / 主机:core 对这三形只铸**一只** single,它的 `command` 座就是那个值 —— 整工具 `""`、名字工具是调用带的名字、主机工具是调用到达的主机)
+ *    ⇒ 那一只候选自己的 `command`;
+ *  · 其余(命令形候选 / 批,或读者把候选丢光了)⇒ 被裁决的命令原字节 `args.command`(非空串;读不出 ⇒ 没有素材)。空候选表不说任何值形:
+ *    绑定值回到调用自己的命令(编辑面兑的就是它)。
+ * 候选走到这里之前已过 {@link singleOfferBelongsOnCard}:每只 single 都是这张卡的工具、这只工具的卡形 ⇒ 值形与命令形不会同卡。值形候选不止一只 = 不是 core 铸得出的卡
+ * ⇒ 没有素材(整条车道撤回,与本文件其余撤回臂同形)。`req.args` 窄读,禁裸 as-cast。
+ */
+export declare function cardBindingOf(args: unknown, offers: readonly RuleOffer[]): string | undefined;
+//# sourceMappingURL=card-rule-offers.d.ts.map

package/dist/card-rule-offers.js

@@ -0,0 +1,130 @@
+import { MAX_RULE_TEXT_CHARS, parseRuleText } from "@sema-agent/core";
+import { MAX_RULE_OFFERS, MAX_RULE_OFFER_BATCH_MEMBERS, readRuleOfferList } from "./approval-card.js";
+import { CARD_RULE_FORM_OF_MATCH, cardRuleFormOf } from "./permission-rule-vocab.js";
+import { createLogger } from "./observability/logger.js";
+const defaultLogger = createLogger();
+export function readCardRuleOffers(raw, cardTool) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw)) {
+        readRuleOfferList(raw);
+        return undefined;
+    }
+    if (raw.length === 0)
+        return undefined;
+    return boundRuleOfferTexts(raw.slice(0, MAX_RULE_OFFER_SCAN).map(preboundBatchMembers), cardTool);
+}
+export function decodeRuleOfferProjection(raw) {
+    return readRuleOfferList(Array.isArray(raw) ? raw.slice(0, MAX_RULE_OFFER_SCAN).map(preboundBatchMembers) : raw)
+        .map(({ offer }) => offer)
+        .slice(0, MAX_RULE_OFFERS);
+}
+const MAX_RULE_OFFER_SCAN = 32;
+function preboundBatchMembers(item) {
+    if (typeof item !== "object" || item === null)
+        return item;
+    const candidate = item;
+    if (candidate.kind !== "batch" || !Array.isArray(candidate.rules) || candidate.rules.length <= MAX_RULE_OFFER_BATCH_MEMBERS)
+        return item;
+    return { ...candidate, rules: candidate.rules.slice(0, MAX_RULE_OFFER_BATCH_MEMBERS) };
+}
+function ruleOfferTextsOverSize(offer) {
+    const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+    if (offer.kind === "single")
+        return over(offer.rule) || over(offer.command);
+    return offer.rules.some((r) => {
+        switch (r.kind) {
+            case "command":
+                return over(r.rule) || over(r.command);
+            case "directoryRead":
+                return over(r.rule) || over(r.directory);
+            default:
+                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+        }
+    });
+}
+function ruleOfferDerivedFactsAgree(offer, cardTool) {
+    const derive = (rule) => {
+        const p = parseRuleText(rule, "allow");
+        return "rule" in p ? p.rule : undefined;
+    };
+    if (offer.kind === "single") {
+        const d = derive(offer.rule);
+        return d !== undefined && d.rule === offer.rule && d.match === offer.match && d.command === offer.command && singleOfferBelongsOnCard(d.match, d.tool, cardTool);
+    }
+    return offer.rules.every((m) => {
+        const d = derive(m.rule);
+        if (d === undefined || d.rule !== m.rule)
+            return false;
+        switch (m.kind) {
+            case "command":
+                return d.tool === "Bash" && d.match === m.match && d.command === m.command;
+            case "directoryRead":
+                return d.tool === "Read" && d.match === "subpath" && d.command === m.directory;
+            default:
+                throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(m)}`);
+        }
+    });
+}
+function singleOfferBelongsOnCard(match, ruleTool, cardTool) {
+    const form = CARD_RULE_FORM_OF_MATCH[match];
+    return ruleTool === cardTool && form !== undefined && form === cardRuleFormOf(cardTool);
+}
+function boundRuleOfferTexts(offers, cardTool) {
+    const over = (s) => s.length > MAX_RULE_TEXT_CHARS;
+    const clipSegment = (s) => (over(s) ? s.slice(0, MAX_RULE_TEXT_CHARS) : s);
+    const out = [];
+    for (const { offer } of readRuleOfferList(offers)) {
+        if (out.length >= MAX_RULE_OFFERS)
+            break;
+        if (ruleOfferTextsOverSize(offer))
+            return undefined;
+        if (!ruleOfferDerivedFactsAgree(offer, cardTool)) {
+            defaultLogger.warn("rule_offer_dropped_derived_facts_disagree", {
+                kind: offer.kind,
+                note: "an offer's kind/match/command/directory seats do not agree with what the shared validator derives from its rule text, or it is not this card's tool / card form — dropped whole so the card never shows one grant while redeeming another (core/dist skew or forged material?)",
+            });
+            continue;
+        }
+        switch (offer.kind) {
+            case "single":
+                out.push({ kind: "single", rule: offer.rule, match: offer.match, command: offer.command });
+                break;
+            case "batch": {
+                const rules = [];
+                for (const r of offer.rules) {
+                    switch (r.kind) {
+                        case "command":
+                            rules.push({ kind: "command", rule: r.rule, match: r.match, command: r.command, segment: clipSegment(r.segment) });
+                            break;
+                        case "directoryRead":
+                            rules.push({ kind: "directoryRead", rule: r.rule, directory: r.directory, segment: clipSegment(r.segment) });
+                            break;
+                        default:
+                            throw new Error(`unknown rule-offer batch member kind: ${JSON.stringify(r)}`);
+                    }
+                }
+                out.push({
+                    kind: "batch",
+                    rules,
+                    uncoveredSegments: offer.uncoveredSegments,
+                    ...(offer.uncoveredDetail !== undefined ? { uncoveredDetail: offer.uncoveredDetail.map((d) => ({ segment: clipSegment(d.segment), reason: d.reason })) } : {}),
+                });
+                break;
+            }
+            default:
+                throw new Error(`unknown rule-offer kind: ${JSON.stringify(offer)}`);
+        }
+    }
+    return out;
+}
+export function cardBindingOf(args, offers) {
+    const valueOffers = offers.filter((o) => o.kind === "single" && CARD_RULE_FORM_OF_MATCH[o.match] !== "command");
+    if (valueOffers.length > 0)
+        return valueOffers.length === 1 && offers.length === 1 ? valueOffers[0].command : undefined;
+    if (args === null || typeof args !== "object" || Array.isArray(args))
+        return undefined;
+    const command = args.command;
+    return typeof command === "string" && command !== "" ? command : undefined;
+}
+//# sourceMappingURL=card-rule-offers.js.map

package/dist/center-credential.d.ts

@@ -1,9 +1,9 @@
-import { type WebAdminCredentialDeclaration } from "@sema-agent/settings-schema";
+import { type WebAdminCredential, type WebAdminCredentialDeclaration } from "@sema-agent/settings-schema";
 /** 凭证种类闭集。新增一个种类 = 本文件与 `web-admin-client/center-request.ts` 的穷举 switch 当场编译红。 */
 export type CenterCredentialKind = "pull-token" | "user-jwt" | "user-session" | "none";
 /** 一次取值失败的成因闭集(见模块头注「四个成因」;boot 判决 {@link judgeCenterCredentialAtBoot} 对它穷举)。 */
 export type CenterCredentialFailure = "missing" | "malformed" | "multi_tenant_session" | "expired";
-/** 声明形的**非秘密**投影(进日志 / 拒因 / 未来的 caps 读面):env 形不带值。 */
+/** 声明形的**非秘密**投影(进日志 / 拒因 / 自报位):env 形不带值。唯一铸点 {@link credentialOriginOf}。 */
 export type CenterCredentialOrigin = {
     readonly from: "env";
 } | {
@@ -12,6 +12,10 @@ export type CenterCredentialOrigin = {
 } | {
     readonly from: "absent";
 };
+/** 声明**在**的那两形(配置里 `webAdmin.assertionToken` 的型:没声明 ⇒ 那一格缺席,缺席只有一种读法)。 */
+export type DeclaredCredentialOrigin = Exclude<CenterCredentialOrigin, {
+    readonly from: "absent";
+}>;
 /**
  * 一次取值的结果。`ok:false` 只有文件形会出现(env / absent 形的取值恒成功)。
  * `identity` 是「此刻的凭证是谁」—— 成功恒在;失败时只有 `expired` 知道(信封还读得出 `sub`,只是令牌不许再出站),
@@ -92,11 +96,26 @@ export type CenterCredentialSourceSpec = Exclude<WebAdminCredentialDeclaration,
     readonly multiTenant: boolean;
 };
 /**
- * 读两个声明键 —— 判定全交 settings-schema 的判官 `judgeWebAdminCredentialDeclaration`([ref]:二选一规则的**唯一**实现;空串 = 未设、
- * 不 trim;两个都设 ⇒ throw,boot 拒启,拒句点名两个键、不回显值)。本仓只多读方自己的那一步:文件路径按本进程 cwd 解析成绝对
- * 路径(之后 cwd 变了也读同一个文件 —— 纯契约不碰 `node:path`,这一步归读方)。
+ * 读一份 web-admin 凭证(`credential` ∈ 契约闭集 `WEB_ADMIN_CREDENTIALS`)的那一对声明键 —— 两份凭证的**唯一**读口。判定全交 settings-schema 的判官
+ * `judgeWebAdminCredentialDeclaration`([ref]:二选一规则的**唯一**实现;空串 = 未设、不 trim;两个都设 ⇒ throw,boot 拒启,拒句点名那一对键、不回显值;
+ * 判哪一份由调用方说,判官没有缺省)。本仓只多读方自己的那一步:文件路径按本进程 cwd 解析成绝对路径(之后 cwd 变了也读同一个文件 —— 纯契约不碰
+ * `node:path`,这一步归读方)。
+ */
+export declare function readWebAdminCredentialDeclaration(credential: WebAdminCredential, env?: Readonly<Record<string, string | undefined>>): WebAdminCredentialDeclaration;
+/** 声明 → 非秘密投影的**唯一**铸点(env 形丢掉值)。凭证来源的 `origin` 与断言令牌的配置读数都经它。 */
+export declare function credentialOriginOf(declared: Readonly<{
+    from: "env";
+} | {
+    from: "file";
+    path: string;
+} | {
+    from: "absent";
+}>): CenterCredentialOrigin;
+/**
+ * [ref] —— 起服日志 `center_assertion_token` 的字段(`build*`:纯数据;`boot/web-admin.ts` 接了中心时打一次,info 级)。声明在 ⇒ 来源形(文件形另带
+ * 绝对路径;值形不带值);没声明 ⇒ 只有 `declared:false`。`effect` 如实说这一份凭证此刻的用途:只被读出声明,没有任何请求出示它。
  */
-export declare function readCenterCredentialDeclaration(env?: Readonly<Record<string, string | undefined>>): WebAdminCredentialDeclaration;
+export declare function buildAssertionTokenBootFields(declared: DeclaredCredentialOrigin | undefined): Readonly<Record<string, string | boolean>>;
 /**
  * 凭证来源工厂(活对象:文件形每次取值读盘并记健康态)。`worker` = `SEMA_WEB_ADMIN_WORKER`(拉取令牌形的身份)。
  * `readFile` / `now` 只为测试注入。

package/dist/center-credential.js

@@ -12,10 +12,30 @@ export class CenterCredentialUnavailableError extends Error {
         this.name = "CenterCredentialUnavailableError";
     }
 }
-export function readCenterCredentialDeclaration(env = process.env) {
-    const declared = judgeWebAdminCredentialDeclaration(env, "access");
+export function readWebAdminCredentialDeclaration(credential, env = process.env) {
+    const declared = judgeWebAdminCredentialDeclaration(env, credential);
     return declared.from === "file" ? { from: "file", path: resolvePath(declared.path) } : declared;
 }
+export function credentialOriginOf(declared) {
+    switch (declared.from) {
+        case "env":
+            return { from: "env" };
+        case "file":
+            return { from: "file", path: declared.path };
+        case "absent":
+            return { from: "absent" };
+    }
+}
+export function buildAssertionTokenBootFields(declared) {
+    if (declared === undefined)
+        return { declared: false };
+    return {
+        declared: true,
+        from: declared.from,
+        ...(declared.from === "file" ? { path: declared.path } : {}),
+        effect: "the declaration is read and reported only (GET /health center.assertionToken); no request from this engine presents the assertion token to the center",
+    };
+}
 const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
 function jwtSubject(bearer) {
     let parsed;
@@ -90,10 +110,10 @@ export function createCenterCredentialSource(spec, worker, deps = {}) {
     };
     switch (spec.from) {
         case "absent":
-            return { origin: spec, declared: false, read: () => observed(NONE), health: () => ({ state: "ok" }), onRead };
+            return { origin: credentialOriginOf(spec), declared: false, read: () => observed(NONE), health: () => ({ state: "ok" }), onRead };
         case "env": {
             const fixed = classify(spec.token, worker);
-            return { origin: { from: "env" }, declared: true, read: () => observed(fixed), health: () => ({ state: "ok" }), onRead };
+            return { origin: credentialOriginOf(spec), declared: true, read: () => observed(fixed), health: () => ({ state: "ok" }), onRead };
         }
         case "file": {
             const readFile = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
@@ -111,7 +131,7 @@ export function createCenterCredentialSource(spec, worker, deps = {}) {
                 return readCredentialText(text, spec, worker, now());
             };
             return {
-                origin: { from: "file", path: spec.path },
+                origin: credentialOriginOf(spec),
                 declared: true,
                 read() {
                     const r = readOnce();

package/dist/config-catalog.d.ts

@@ -2,6 +2,7 @@ import { type RetiredEnvWire } from "@sema-agent/settings-schema";
 import type { ServiceConfig, ServiceConfigGroups } from "./config-types.js";
 import type { ConfigKnobRecord } from "./config.js";
 import type { RestartSlice } from "./web-admin-client/restart-signal.js";
+import { type EnvNameAllowlistKnob } from "./env-name-allowlist-knobs.js";
 export declare const CATALOG_VALUE_TYPES: readonly ["boolean", "number", "string", "enum", "csv", "json", "path", "url", "secret", "opaque"];
 export type CatalogValueType = (typeof CATALOG_VALUE_TYPES)[number];
 export declare const CATALOG_TIMINGS: readonly ["hot", "restart", "deploy", "inert"];
@@ -19,15 +20,33 @@ export type CatalogDangerAxis = (typeof CATALOG_DANGER_AXES)[number];
 export declare const URL_CREDENTIAL_POLICIES: readonly ["refuse", "mask"];
 export type UrlCredentialPolicy = (typeof URL_CREDENTIAL_POLICIES)[number];
 /**
- * secret 行的值**装着几枚凭据、按什么读出来**(闭集;只在 `type: "secret"` 的行上,其余行恒缺席)—— 本服务凭据的颗粒按本服务读这只变量的那一只解析器定:
- *  · `whole`       —— 整值是一枚(令牌 / 口令 / 私钥 / 一只模型密钥;名单型旋钮的原文也按凭据类整值对待);
+ * secret 行的值**装着几枚本服务凭据、按什么读出来**(闭集;只在 `type: "secret"` 的行上,其余行恒缺席)—— 本服务凭据的颗粒按本服务读这只变量的那一只解析器定:
+ *  · `whole`       —— 整值是一枚(令牌 / 口令 / 私钥 / 一只模型密钥);
  *  · `token-table` —— `tok=system` 逗号表,每个 `tok` 是一枚(`SERVICE_AUTH_TOKENS`;读法 = `auth-keys.ts` `parseServiceAuthTokens`,`loadConfig` 同读);
- *  · `key-set`     —— `{kid,key,status}` JSON 数组,每个 `key` 是一枚(`APPROVAL_HMAC_KEYS`;读法 = `auth-keys.ts` `parseApprovalHmacKeys`,`loadConfig` 同读)。
- * 读者只有一个:自有凭据声明的值臂(`server-secret-env.ts`)—— 整值总在内,列表形另把每一枚交给引擎 ⇒ 一枚令牌换了个变量名放着,与原变量同扣。
- * 词加一个而读者不补 ⇒ 编译红(读者是穷举 switch);secret 行不写 ⇒ 编译红(`r()` 的 secret 重载要它)。不上 wire。
+ *  · `key-set`     —— `{kid,key,status}` JSON 数组,每个 `key` 是一枚(`APPROVAL_HMAC_KEYS`;读法 = `auth-keys.ts` `parseApprovalHmacKeys`,`loadConfig` 同读);
+ *  · `name-list`   —— 零枚:原文是一张环境变量名单(名单型旋钮;读法 = `config.ts` `parseEnvNameAllowlist`)。名单不是凭据,原文不交引擎比值;
+ *    旋钮变量本身照按名扣(它的原文可能夹着被错展开进来的令牌,所以是 secret 行:目录只回在场位、名进自有凭据声明、不进任何子进程)。
+ * 读者只有一个:自有凭据声明的值臂(`server-secret-env.ts`)—— 交给引擎的恰是颗粒读出来的那几枚(列表形另把每一枚交出去 ⇒ 一枚令牌换了个变量名放着,与原变量同扣)。
+ * 词加一个而读者不补 ⇒ 编译红(读者是穷举 switch);secret 行不写 ⇒ 编译红(`r()` 的 secret 重载要它);哪只行取 `name-list` 由行名定类({@link SecretRowForm}),写反 ⇒ 编译红。不上 wire。
  */
-export declare const SECRET_CREDENTIAL_FORMS: readonly ["whole", "token-table", "key-set"];
+export declare const SECRET_CREDENTIAL_FORMS: readonly ["whole", "token-table", "key-set", "name-list"];
 export type SecretCredentialForm = (typeof SECRET_CREDENTIAL_FORMS)[number];
+/** 装着本服务凭据值的颗粒(`name-list` 以外的词):名单型旋钮以外的每条 secret 行、bake-runner 的凭据行都取其一。 */
+export type CredentialValueForm = Exclude<SecretCredentialForm, "name-list">;
+/**
+ * secret 行的颗粒**按行名定类**:名单型旋钮(闭集 `EnvNameAllowlistKnob`,叶表 `env-name-allowlist-knobs.ts` —— 「哪只变量是名单」只在那里写一次)恒 `name-list`,
+ * 其余恒是装着凭据值的颗粒。目录行写反(旋钮写 `whole`、凭据写 `name-list`)⇒ `r()` 的 secret 重载当场编译红 —— 列与旋钮闭集不会说两样。
+ */
+export type SecretRowForm<N extends string> = N extends EnvNameAllowlistKnob ? "name-list" : CredentialValueForm;
+/**
+ * 配置目录**之外**的本包凭据变量:bake-runner 进程(构建宿主守护进程)自己读的凭据 —— 目录只装服务进程读的 env(D1 对账门把 `bake-runner/` 整只排除),
+ * runner 的键不是目录行,却是本包的自有凭据。自有凭据声明(`server-secret-env.ts`)把目录 secret 行与本表并成**一张**「名 → 颗粒」,三个进程入口
+ * (stage-01 / run-local / bake-runner)同读这一份(不按「归谁消费」切):名全声明,值按颗粒逐枚交引擎 ⇒ 名单型旋钮点到它(名是或值是)拒启、任何宿主腿都不交它与它的副本。
+ * 读点 `bake-runner/main.ts` `loadEnv` 按本表的键读(键改名而读点不跟 ⇒ 编译红)。不上 wire,不进 `GET /v1/config/catalog`。
+ */
+export declare const BAKE_RUNNER_CREDENTIAL_ENV: {
+    readonly BAKE_RUNNER_TOKEN: "whole";
+};
 /** 域 = 配置九组(类型锁步:组集变了这里跟着红)。 */
 export type CatalogDomain = keyof ServiceConfigGroups;
 export declare const CATALOG_RESTART_SLICES: readonly RestartSlice[];
@@ -103,7 +122,7 @@ export interface ConfigCatalogSpec {
     readonly scope?: "bootstrap-only";
     /** url 行的凭据处置披露({@link UrlCredentialPolicy});url 行必填(`r()` 的 url 重载要它,缺 ⇒ 编译红),其余行写不进来。 */
     readonly credentialPolicy?: UrlCredentialPolicy;
-    /** secret 行的凭据颗粒({@link SecretCredentialForm});secret 行必填(`r()` 的 secret 重载要它,缺 ⇒ 编译红),其余行写不进来。 */
+    /** secret 行的凭据颗粒({@link SecretCredentialForm});secret 行必填(`r()` 的 secret 重载要它,缺 ⇒ 编译红;取哪一类按行名定 —— {@link SecretRowForm}),其余行写不进来。 */
     readonly credentialForm?: SecretCredentialForm;
 }
 export interface ConfigCatalogRowCenter {