@sema-agent/server 7.151.0 → 7.152.0

package/dist/http/active-run-conflict.js

@@ -6,6 +6,28 @@ import { recordFailOpen } from "../observability/fail-open.js";
 import { refusalBody } from "./refusal-body.js";
 import { trustedCheckpointId } from "../checkpoint-identity.js";
 export const ACTIVE_RUN_CONFLICT_BASE_TEXT = "session already has an active run — POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)";
+function holderOf(holder) {
+    return holder ? holder : null;
+}
+export async function occupantOf(runStore, holder) {
+    const activeTaskId = holderOf(holder);
+    if (activeTaskId === null || runStore === undefined)
+        return { activeTaskId };
+    const status = (await runFactsOf(runStore, activeTaskId))?.status;
+    return status !== undefined && (status === "running" || isParkedRunStatus(status)) ? { activeTaskId, activeTaskStatus: status } : { activeTaskId };
+}
+export async function refusalOccupantOf(runStore, holder) {
+    try {
+        return await occupantOf(runStore, holder);
+    }
+    catch {
+        recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
+        return { activeTaskId: holderOf(holder) };
+    }
+}
+export async function readSessionOccupant(runStore, sessionId) {
+    return occupantOf(runStore, await runStore.getActiveTaskId(sessionId));
+}
 export function resumeEntryForGate(kind, ids) {
     switch (kind) {
         case "human":
@@ -42,24 +64,31 @@ function activeRunConflictBody(message, facts) {
     return body;
 }
 export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
-    const baseFacts = { activeTaskId: activeTaskId ?? null };
+    const baseFacts = { activeTaskId: holderOf(activeTaskId) };
     const base = activeRunConflictBody(ACTIVE_RUN_CONFLICT_BASE_TEXT, baseFacts);
-    if (!activeTaskId)
+    if (baseFacts.activeTaskId === null)
         return base;
-    try {
-        const status = deps.runStore === undefined ? undefined : (await runFactsOf(deps.runStore, activeTaskId))?.status;
-        if (status === undefined || (!isParkedRunStatus(status) && status !== "running"))
-            return base;
-        if (status === "running") {
-            const lastAt = deps.turnActivity?.(activeTaskId);
-            return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
-                ...baseFacts,
-                activeTaskStatus: status,
-                ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
-            });
+    const holder = baseFacts.activeTaskId;
+    const occupant = await refusalOccupantOf(deps.runStore, holder);
+    const status = occupant.activeTaskStatus;
+    if (status === undefined)
+        return activeRunConflictBody(ACTIVE_RUN_CONFLICT_BASE_TEXT, occupant);
+    if (status === "running") {
+        let lastAt;
+        try {
+            lastAt = deps.turnActivity?.(holder);
+        }
+        catch {
+            recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
         }
+        return activeRunConflictBody("session already has an active run — POST /v1/runs/{activeTaskId}/steer injects a message into the running turn (queued, applied at the next turn boundary), or POST /v1/runs/{activeTaskId}/cancel stops it (same-instance interactive runs abort immediately)", {
+            ...occupant,
+            ...(lastAt !== undefined ? { msSinceLastActivity: Math.max(0, Date.now() - lastAt) } : {}),
+        });
+    }
+    let pendingGate;
+    try {
         const cs = deps.checkpointStore;
-        let pendingGate;
         if (cs?.findPendingTokenBySession) {
             const runBinding = { gateKinds: LIVE_RUN_GATE_KINDS, axis: "run" };
             const scope = (await cs.peekPendingScope?.(sessionId, runBinding)) ?? undefined;
@@ -68,7 +97,7 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
             const gate = row?.gate;
             const kind = gate?.kind;
             const cardSessionId = row?.sessionId;
-            const decidePath = kind && cardSessionId ? resumeEntryForGate(kind, { sessionId: cardSessionId, taskId: activeTaskId }) : null;
+            const decidePath = kind && cardSessionId ? resumeEntryForGate(kind, { sessionId: cardSessionId, taskId: holder }) : null;
             const governanceForced = governanceOriginOf(gate, deps.governance);
             const checkpointId = trustedCheckpointId(row?.checkpointId, token);
             if (kind && decidePath) {
@@ -80,13 +109,13 @@ export async function buildActiveRunConflict(deps, sessionId, activeTaskId) {
                 };
             }
         }
-        return activeRunConflictBody(pendingGate
-            ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
-            : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`, { ...baseFacts, activeTaskStatus: status, ...(pendingGate ? { pendingGate } : {}) });
     }
     catch {
         recordFailOpen("server.approvals.active-run-conflict-material-unavailable");
-        return base;
+        pendingGate = undefined;
     }
+    return activeRunConflictBody(pendingGate
+        ? `session already has an active run — it is parked waiting for a decision (${status}); resolve it via POST ${pendingGate.decidePath}, or POST /v1/runs/{activeTaskId}/cancel abandons it`
+        : `session already has an active run — it is parked (${status}); POST /v1/runs/{activeTaskId}/cancel abandons it (its pending decision could not be located on this instance)`, { ...occupant, ...(pendingGate ? { pendingGate } : {}) });
 }
 //# sourceMappingURL=active-run-conflict.js.map

package/dist/http/approval-sweeps.d.ts

@@ -1,7 +1,7 @@
 /**
  * 审批扫腿([ref] 切片:`http/server.ts` 5196–5488 逐字搬家,正文一字未改)——两条不经 HTTP 路由的赎回口:
  * ①`denyExpiredApprovals`([ref] D-D,SLA 到期的 deny-sweep,main.ts 的 reaper 按拍调);
- * ②`redeemParkedAsk`([ref],live 回决腿的 PARKED 赎回席,装配层接进协调器的晚绑座)。
+ * ②`redeemParkedAsk`([ref],决断口停驻臂的 PARKED 赎回席,装配层接进协调器的晚绑座)。
  * 两者都走 resume 家族的 `resumeCheckpoint`,所以它们的属主是「谁在无 HTTP 请求的情况下替人做决定」这件事,
  * 不是请求流水线。`createWallClockJumpGuard` 建的 `denySweepClockGuard` 是 ① 的私有件,随它同居。
  * ctx 字段 3 只(`deps` / `resumeCheckpoint` / `decisionRowAdmits`),机器算(closure-free-vars)与手抄一致。

package/dist/http/approval-sweeps.js

@@ -19,6 +19,7 @@ import { storedBodyReplayRefusal } from "./stored-body-replay.js";
 import { refusalBody } from "./refusal-body.js";
 import { CARD_EXPIRE_OUTCOME, expireCardUnderStoredScope } from "../card-settle-stored-scope.js";
 import { DENY_SWEEP_PAGE_ROWS } from "../plugins/checkpoint-store-face.js";
+import { ruleReceiptOf } from "./route-ctx.js";
 const BLOCKED_SCALAR_KEYS = ["errorCode", "blockedBy", "field", "reason", "count", "cap", "index"];
 function blockedScalars(body) {
     const out = {};
@@ -258,8 +259,10 @@ export function createApprovalSweeps(ctx) {
             ...(req.updatedInput !== undefined ? { updatedInput: req.updatedInput } : {}),
         };
         const remember = req.remember === "session" ? { grantedBy: req.principal ?? null, laneCannotRecord: "decide_once" } : undefined;
-        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, answerer);
-        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}), gateGeneration: checkpointRevOf(cp) };
+        const persistRule = req.persistRule !== undefined ? { slot: req.persistRule, inputWasEdited: req.updatedInput !== undefined } : undefined;
+        const out = await resumeCheckpoint(cp.sessionId, req.decision, req.note, hostDecisionFacts(req.decider, req.principal), req.httpReq, undefined, binding, remember, true, answerer, undefined, persistRule);
+        const rule = out.status >= 200 && out.status < 300 ? ruleReceiptOf(out, persistRule) : undefined;
+        return { status: out.status, body: out.body, ...(remember !== undefined ? { rememberApplied: out.rememberApplied === true } : {}), ...(rule !== undefined ? { rule } : {}) };
     }
     return { denyExpiredApprovals, redeemParkedAsk };
 }

package/dist/http/checkpoint-ctx.d.ts

@@ -44,6 +44,7 @@ import type { CheckpointCtx } from "./route-ctx.js";
 import type { TaskRequestBody } from "./wire-types.js";
 import type { ProjectContext } from "../project-context.js";
 import type { MemorySeed } from "../project-registry.js";
+import type { PermissionModeWrite } from "../permission-mode-admission.js";
 import type { InertToolListEntry } from "../rule-entry-list.js";
 import { type Refusal } from "./refusal-body.js";
 /** allow 层读法从这一版起(7.117.0):此前的写者对 `settings.permissions.allow` 是另一种读法(≤7.114.x 名单 / 7.115.0–7.116.x 表态)。规则见顶注「allow 读法问」。 */
@@ -82,6 +83,7 @@ export declare function buildCheckpointCtx(fields: {
     projectContext?: ProjectContext | undefined;
     memorySeed?: MemorySeed | null | undefined;
     writerVersion: string;
+    permissionModeWrite: PermissionModeWrite | undefined;
 }, sealer: CheckpointCtxSealer | undefined, sessionId: string): SealedCheckpointCtx;
 /**
  * 退役请求键问:**退役的请求键**闭集 = 两张处置表之并(新提交在键闭集门 400;存体里还带着它 = 这份体是更早的写者写下的)。键住在哪张表就是它的处置格,规则全文见头注「退役请求键问」。

package/dist/http/checkpoint-ctx.js

@@ -45,6 +45,7 @@ export function buildCheckpointCtx(fields, sealer, sessionId) {
         ...(fields.promptScreened === true ? { promptScreened: true } : {}),
         ...(fields.projectContext !== undefined ? { projectContext: fields.projectContext } : {}),
         ...(fields.memorySeed !== undefined ? { memorySeed: fields.memorySeed } : {}),
+        ...(fields.permissionModeWrite !== undefined ? { permissionModeWrite: fields.permissionModeWrite } : {}),
     };
     return sealCheckpointCtx(ctx, sealer, sessionId);
 }

package/dist/http/dispatch.d.ts

@@ -43,9 +43,13 @@ export interface HealthDeploymentModsSection {
  */
 export declare function readCredentialOk(req: IncomingMessage, config: ServiceConfig): boolean;
 /**
- * `GET /health` 这次请求的**读者档**(`health-reader.ts` 头注:三档与每档拿什么)—— 读的是上面那一只读路谓词,不另立第二份「凭据」读法:
- * 没配服务凭据 ⇒ `open`(谓词的第一臂);配了而谓词认 ⇒ `credentialed`;配了而谓词不认 ⇒ `anonymous`。
+ * `GET /health` 这次请求的**读者档**(`health-reader.ts` 头注:四档与每档拿什么)—— 唯一判官。读的是上面那一只读路谓词与请求的通道事实(`request-channel.ts`),不另立第二份「凭据」读法:
+ * 没配服务凭据 ⇒ `open`(谓词的第一臂);配了而谓词认 ⇒ `credentialed`;配了而谓词不认 ⇒ 按通道穷举:经本机控制 socket ⇒ `engine-user`,经 TCP ⇒ `anonymous`
+ * (TCP 对端地址不读 —— 没有回环档)。`credentialed` 先于 `engine-user`:经 socket 带了凭据的读者归凭据档(两档投影相同,先后只影响「它证明了什么」)。
+ * 通道一臂只在这一面换档:读路谓词、全局凭据门与身份来源闭集都不读通道(通道不是凭据)。
  * 调用点必须在鉴权桥预认证**之后**(已验登录令牌是谓词的一臂,读的是预认证挂上的身份)。
+ * **圈禁的身份不算读路凭据**(名册的非人档;`/health` 不声明权力,判官 `requestConfinedTier`):这次请求只按它出示的 service / trace 凭据分档 ——
+ * 与别的空间的登录令牌([ref])同一读法:探针面从不拒,身份不算,读者按没出示凭据分档(没出示 ⇒ 照上面按通道穷举:经本机控制 socket 仍是 `engine-user`,通道不是凭据、圈禁也不改它)。
  */
 export declare function healthReaderOf(req: IncomingMessage, config: ServiceConfig): HealthReader;
 export declare function createDispatch(ctx: {

package/dist/http/dispatch.js

@@ -6,16 +6,18 @@ import { publicStoreProbeError } from "../store-live-probe.js";
 import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
 import { admitBridgeIdentity, ssoForeignScope } from "../auth-bridge.js";
 import { ROUTE_METHOD_ORDER } from "./route-ctx.js";
-import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest } from "./route-table.js";
+import { READ_CREDENTIAL_ROUTES, PUBLIC_ROUTES, POST_CREDENTIAL_ROUTES, routeLabel, isBillableSubmitPath, billableKindOf, isCredentialGatedRewrite, isMethodDispatchedSubmitPath, lookupRoute, isProbePath, isSubscriptionRequest, declaredPowerOf } from "./route-table.js";
 import { sendJson, sendError, sendHttpError, isSseResponse, endSseWithError } from "./send.js";
 import { admissionRefusalOf, readinessOf, healthReadinessKeys, sendReadyz, sendBillableRefusal, billableRefusalOf, billableRefusalFrame } from "./readiness.js";
-import { ENGINE_SIGNAL_KEY, buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, healthDrainingKeys, memberLeaseOf, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
+import { ENGINE_SIGNAL_KEY } from "@sema-agent/settings-schema/fleet";
+import { buildEngineSignal, fleetMembershipKeys, healthConfigLedgerKeys, memberLeaseOf, mintEngineSignal, restartActionable } from "../fleet/engine-signal.js";
 import { buildHealthSelfReport } from "./health-self-report.js";
 import { projectHealthBody } from "./health-reader.js";
+import { requestChannelOf } from "./request-channel.js";
 import { projectHealthStoreSection, unwiredStorePosture } from "../store-posture.js";
 import { autoBackgroundOnTimeout as autoBackgroundOnTimeoutFact, autoBackgroundOnTimeoutWord, deploymentModPackages as deploymentModPackagesFact } from "../capability-facts.js";
 import { hostBackgroundShellEnabled } from "../config.js";
-import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, systemFor, gatedSubject, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
+import { actsForDeployment, admitRunIdentity, authorized, bearerPresentedButUnverified, devOpenDeployment, requestConfinedTier, systemFor, gatedSubject, sendPrincipalConfined, sendPrincipalRefusal, sendUnauthorized, traceTokenPresented, verifiedIdentitySource } from "./principal-gate.js";
 import { hasServiceAuth, passesCredentialGate } from "../identity-source.js";
 import { inflightTotal } from "../fleet/drain-entry.js";
 const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
@@ -29,7 +31,21 @@ export function readCredentialOk(req, config) {
 export function healthReaderOf(req, config) {
     if (!hasServiceAuth(config))
         return "open";
-    return readCredentialOk(req, config) ? "credentialed" : "anonymous";
+    const confined = requestConfinedTier(req, config, declaredPowerOf("GET", "/health")) !== undefined;
+    const credentialed = confined ? systemFor(req, config) !== undefined || traceTokenPresented(req, config) : readCredentialOk(req, config);
+    if (credentialed)
+        return "credentialed";
+    const channel = requestChannelOf(req);
+    switch (channel) {
+        case "control-socket":
+            return "engine-user";
+        case "tcp":
+            return "anonymous";
+        default: {
+            const unknownChannel = channel;
+            throw new Error(`health reader: request channel ${String(unknownChannel)} has no reader tier`);
+        }
+    }
 }
 function credentialAttribution(req, credential, config) {
     switch (credential) {
@@ -211,7 +227,6 @@ export function createDispatch(ctx) {
             const fullBody = {
                 status: "ok",
                 ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
-                ...healthDrainingKeys(signal),
                 ...(() => {
                     const breakdown = deps.drainState?.inflightBreakdown?.();
                     return breakdown ? { inflight: inflightTotal(breakdown), inflightBreakdown: breakdown } : {};
@@ -317,6 +332,11 @@ export function createDispatch(ctx) {
             sendError(res, 403, "auth.scope_mismatch", "forbidden — the sign-in token was issued for a different scope than the one this worker serves: send a sign-in token issued for this worker's scope, or send this request to a worker of your token's scope");
             return;
         }
+        const confined = requestConfinedTier(req, deps.config, declaredPowerOf(method, url));
+        if (confined !== undefined) {
+            sendPrincipalConfined(res, confined);
+            return;
+        }
         if (await dispatchSegment(READ_CREDENTIAL_ROUTES, req, res, url, search, method, allow.pre, ctx, (r) => readCredentialOk(r, deps.config)))
             return;
         if (await dispatchSegment(PUBLIC_ROUTES, req, res, url, search, method, allow.pre, ctx, undefined, false))

package/dist/http/durable-run-leg.js

@@ -113,7 +113,6 @@ function launchDurableRun(ctx, runStore, args, sessionId, taskId, trustedInterna
             coordinator: deps.toolApproval,
             streamApprovalOn: resolveStreamApprovalGate({
                 toolApprovalEnabled: true,
-                streamApprovalEnabled: deps.config.streamApproval?.enabled === true,
                 backend: deps.backend,
                 checkpointStore: deps.checkpointStore,
             }).active,

package/dist/http/health-reader.d.ts

@@ -1,12 +1,18 @@
 /**
- * `GET /health` 的**读者分档** —— 同一张面四种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、持凭运维),
+ * `GET /health` 的**读者分档** —— 同一张面五种读者(k8s / Docker 探针、壳在带凭据之前读的自报位、嵌入宿主的引擎身份验证、同机附着方、持凭运维),
  * 键集按**读者**而不是按「这个键敏不敏感」定。
  *
- * ## 规则(一条)
- * 读者三档,答案只有一处:
+ * ## 律:证明只有两种,判官只有一只
+ * 一次请求的读者能向本服务证明的只有两件事 —— **凭据**(读路谓词 `dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal)
+ * 与**通道**(请求从本机控制 socket 进来,`request-channel.ts`:能穿过数据根下私有目录的只有引擎的 OS 用户与 root)。TCP 对端地址**不是**证明 ——
+ * 它说的是包从哪只接口进来,不说包是谁发的(同机反代 / TCP 中继 / 共享绑址上更具体的回环绑定都让它失真),所以没有「回环档」,转发头也不读。
+ * 读者四档,答案只有一处(`dispatch.ts` 的 `healthReaderOf`;本文件只持有闭集与出口):
  *  · `open`        —— 部署没配任何服务凭据(单机 / loopback 开发形;全局凭据门不武装):全键,字节同分档之前;
- *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据(`dispatch.ts` 的 `readCredentialOk`:service token ∨ 只读 trace token ∨ 已验 principal):全键;
- *  · `anonymous`   —— 配了服务凭据而这次请求没出示:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
+ *  · `credentialed` —— 配了服务凭据,且这次请求出示了**读路谓词**认的凭据:全键;
+ *  · `engine-user`  —— 配了服务凭据、没出示凭据,但请求经**本机控制 socket** 到达:全键。它换来的只是这一面的自描述(本面按构造不带任何秘密),
+ *    **不是凭据**:别的任何口照旧要凭据(通道不进读路谓词、全局门与身份来源闭集 —— 宿主车道上模型跑的命令也是引擎的 OS 用户);
+ *    这是一条显式的披露政策 —— 「引擎的 OS 用户有权读引擎的自描述」;
+ *  · `anonymous`   —— 配了服务凭据,这次请求既没出示凭据、也不是经控制 socket 来的:**只拿显式白名单** {@link ANONYMOUS_HEALTH_KEYS}。
  * 白名单 = 存活位(`status`)+ 壳的 pre-credential 自报位三键(`auth` / `operator` / `center`,`health-self-report.ts` 铸;壳在带凭据**之前**要读的就是它们)。
  * 其余的键 —— 现有的(`dataRoot` / `pid` / `configHash` / `sessionBackend` / `startedAt` / `port` / `version` / `engineSignal` …)与将来新长的 —— 对匿名读者一律不出:
  * 这是**白名单**(挑出四键),不是黑名单(剥掉几键)—— 黑名单形下每个新键默认漏出,这一面又恒在凭据门之前、缺省全网卡监听(安全轴 fail-closed)。
@@ -14,14 +20,15 @@
  * ## 谁读哪一档
  *  · 探针(k8s `httpGet` / Docker `HEALTHCHECK`):只要 HTTP 200 —— 匿名也是 200,存活位在白名单里;摘流语义的探针读 `/readyz`(不分档,体只有就绪位);
  *  · 壳的 pre-credential 读路:`auth` / `operator` / `center` 三键(7.121.0)—— 白名单;
- *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):宿主就是带着部署的服务凭据起的引擎,身份验证带同一枚凭据读 —— 在 `credentialed` 档;
+ *  · 嵌入宿主的引擎身份验证(`pid` ∧ `dataRoot`,见 `test/health-identity-contract.test.ts`):带部署的服务凭据读 ⇒ `credentialed`;经控制 socket 读 ⇒ `engine-user`;
  *    没配服务凭据的嵌入形(桌面宿主自起、不配凭据)在 `open` 档,与改前逐字节同;
+ *  · 同机附着方(没有令牌的壳 / 桌面宿主附着别的进程起的引擎):经控制 socket 读 ⇒ `engine-user`(读法见 USAGE「同机附着方怎么读身份」);
  *  · 持凭运维 / 编排器:`credentialed` 档,全键。
  *
  * 没有旋钮:一个放宽用的旋钮就是一把「把路径指纹重新开给匿名方」的钥匙,而本规则要的恰是它没有这把钥匙。
  */
-/** 读者三档(闭集;顺序无语义)。 */
-export declare const HEALTH_READERS: readonly ["open", "credentialed", "anonymous"];
+/** 读者四档(闭集;顺序无语义)。 */
+export declare const HEALTH_READERS: readonly ["open", "credentialed", "engine-user", "anonymous"];
 export type HealthReader = (typeof HEALTH_READERS)[number];
 /**
  * 匿名读者的**显式白名单**:存活位 + 自报位三键。穷举 —— 加一个进来是一次有意的、要过评审的放宽(它会对没有凭据的任何人可见)。
@@ -29,7 +36,7 @@ export type HealthReader = (typeof HEALTH_READERS)[number];
  */
 export declare const ANONYMOUS_HEALTH_KEYS: readonly ["status", "auth", "operator", "center"];
 /**
- * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` 原样,`anonymous` 只挑白名单。
+ * 键集判官 —— `/health` 体按读者出口的**唯一**一道:`open` / `credentialed` / `engine-user` 原样,`anonymous` 只挑白名单。
  * 入参是按全键铸好的体(铸点不分读者:一个事实一个铸点,读者分档只在出口);返回新对象,不改入参。
  */
 export declare function projectHealthBody(reader: HealthReader, body: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;

package/dist/http/health-reader.js

@@ -1,9 +1,10 @@
-export const HEALTH_READERS = ["open", "credentialed", "anonymous"];
+export const HEALTH_READERS = ["open", "credentialed", "engine-user", "anonymous"];
 export const ANONYMOUS_HEALTH_KEYS = ["status", "auth", "operator", "center"];
 export function projectHealthBody(reader, body) {
     switch (reader) {
         case "open":
         case "credentialed":
+        case "engine-user":
             return body;
         case "anonymous": {
             const closed = {};

package/dist/http/health-self-report.js

@@ -30,7 +30,7 @@ export function buildHealthSelfReport(deps) {
     const required = kinds.includes("service_token");
     return {
         auth: { required, kinds, identityAttach: kinds.some(carriesCallerIdentity) ? "available" : "unavailable", serviceTokenActsForDeployment: required && serviceTokenDeclaredActsForDeployment(config) },
-        operator: operatorLane(deps).available ? "present" : "absent",
+        operator: operatorLane(deps, "operate").available ? "present" : "absent",
         center: {
             ...(issuer !== undefined ? { issuer: buildDisplaySafeUrl(issuer) } : {}),
             ...(webBaseUrl !== undefined ? { webBaseUrl: buildDisplaySafeUrl(webBaseUrl) } : {}),

package/dist/http/owner-access.d.ts

@@ -32,7 +32,7 @@ import { type SessionFace } from "../session-incarnation.js";
 import { type Admitted, type Caller, type FaceId, type ListFaceId, type ListFilter, type OwnedReading, type Qual, type RunFaceId, type SessionFaceId, type WorkflowFaceId } from "../owner-faces.js";
 import { type Person, type Subject } from "../owner-brands.js";
 import { type OwnerAwareSessionStore, type SessionListItem } from "../security.js";
-import { type OperatorRoster } from "./principal-gate.js";
+import type { OperatorRoster } from "../operator-roster.js";
 import { type RouteDeps } from "./route-ctx.js";
 import type { FlatServiceDeps } from "./server.js";
 import type { AgentRosterRouteId } from "./routes/agents-roster.js";
@@ -96,9 +96,8 @@ export declare const ROUTE_FACES: {
     readonly "run-task-stop": "run.supervise";
     readonly "elicitation-respond": null;
     readonly "question-respond": null;
-    readonly "tool-approval-respond": null;
-    readonly "tool-approval-read": null;
     readonly "task-ask-decision": null;
+    readonly "task-ask-read": null;
     readonly "run-permission-mode": "run.supervise";
     readonly "run-memory-capture-optout": "run.drive";
     readonly "session-init": null;

package/dist/http/owner-access.js

@@ -16,7 +16,7 @@ export function callerOf(req, w) {
     const subject = gatedSubject(req, w.config);
     return {
         subject,
-        operator: explicitOperatorOk(subject === undefined ? undefined : personOf(subject), w.config),
+        operator: explicitOperatorOk(subject === undefined ? undefined : personOf(subject), w.config, "operate"),
         fleet: actsForDeployment(req, w.config, () => subject),
         traceRead: traceTokenPresented(req, w.config),
         principalRequired: DEPLOYMENT_SHAPE_PREDICATES.principalRequired.holds(w.config),
@@ -24,7 +24,7 @@ export function callerOf(req, w) {
     };
 }
 export function callerOfDecision(base, decider, roster) {
-    return { ...base, subject: deciderSubjectOf(base.subject, decider), operator: explicitOperatorOk(decider, roster), fleet: undefined, traceRead: false };
+    return { ...base, subject: deciderSubjectOf(base.subject, decider), operator: explicitOperatorOk(decider, roster, "operate"), fleet: undefined, traceRead: false };
 }
 export function deciderSubjectOf(requestSubject, decider) {
     return decider === undefined ? undefined : subjectOf(decider, requestSubject === undefined ? undefined : partsOf(requestSubject).scenario);
@@ -47,9 +47,8 @@ export const ROUTE_FACES = {
     "run-task-stop": "run.supervise",
     "elicitation-respond": null,
     "question-respond": null,
-    "tool-approval-respond": null,
-    "tool-approval-read": null,
     "task-ask-decision": null,
+    "task-ask-read": null,
     "run-permission-mode": "run.supervise",
     "run-memory-capture-optout": "run.drive",
     "session-init": null,

package/dist/http/principal-gate.d.ts

@@ -1,7 +1,8 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { ServiceConfig } from "../config-types.js";
+import { type NonPersonTier, type OperatorPower, type OperatorRoster } from "../operator-roster.js";
 import { type Person, type Subject } from "../owner-brands.js";
-import type { Caller } from "../owner-faces.js";
+import { type Caller } from "../owner-faces.js";
 import { type IdentitySource, type RunIdentity } from "../identity-source.js";
 import type { Logger } from "../observability/logger.js";
 /** Coerce a possibly-repeated request header to a single string (or undefined). */
@@ -126,23 +127,50 @@ export declare function actsForDeployment(req: IncomingMessage, config: ServiceC
  */
 export declare function serviceTokenDeclaredActsForDeployment(config: Pick<ServiceConfig, "serviceTokenActsForDeployment">): boolean;
 /**
- * 运维名册 —— 「谁是 operator」读的两格(都住在部署配置里):具名名单 `OPERATOR_PRINCIPALS` 与单用户形的显式声明 `OPERATOR_SINGLE_USER`。
- * 两者互斥(声明只在单用户形、名单为空时成立;否则拒启 —— 一个事实一个来源,`config-invariants.ts` 的 `operator-single-user`)。
- */
-export type OperatorRoster = Pick<ServiceConfig, "operatorPrincipals" | "operatorSingleUser">;
-/**
- * 🔴 **「谁是 operator」的唯一读法**([ref],[ref] ① 裁 A;IMAGE-API-DESIGN.md §P2.4a MUST-FIX 的那一只门)。
+ * 🔴 **「这位验过的人在这台部署上持不持这只运维权力」的唯一读法**([ref],[ref] ① 裁 A;IMAGE-API-DESIGN.md §P2.4a MUST-FIX 的那一只门)。
+ * 档表与人 → 档的读法住在叶子 `operator-roster.ts`(`ROSTER_TIERS` / `rosterTierOf`);本函数 = 「人落在某档 ∧ 那一档持 `power`」。
  *  · 名单为空 ⇒ **没人是**(没有任何形把「空名单」读成「人人是」—— 那条读法 `isOperator` 已删);
- *  · 名单非空 ⇒ 验过的主体在名单里才是;
- *  · 单用户形显式声明 `OPERATOR_SINGLE_USER=true` ⇒ 这台部署的**每个调用方**都是(单用户形只有一位用户,能到这台部署的就是他;边界是部署自己的
- *    凭据门 —— 没配凭据的部署上,能连上端口的都是)。声明只在单用户形成立(起服不变量)。
+ *  · 名单非空 ⇒ 验过的人在名单里才是;全运维档(`OPERATOR_PRINCIPALS`)持每一只权力,排空档(`OPERATOR_DRAIN_PRINCIPALS`)只持 `drain`;
+ *  · 单用户形显式声明 `OPERATOR_SINGLE_USER=true` ⇒ 这台部署的**每个调用方**落全运维档(单用户形只有一位用户,能到这台部署的就是他;边界是部署自己的
+ *    凭据门 —— 没配凭据的部署上,能连上端口的都是)。声明只在单用户形、且各档名单都空时成立(起服不变量)。
+ * `power` 必填、零缺省:运维面的门与放宽位传 `"operate"`,排空口传它声明行的 `power`(`routes/admin-drain.ts`)。
  * `person` 必须是验过的人(`gatedPerson` / `personOf(主体)`),绝不是自述头,也不是带场景的主体(名册登记的是人)。全部运维面(审批队列、steer / interrupt / wake 的属主门旁路、记忆运维口、bake 门……)读这一只 —— 只答授权;
  * 送话口的文本框架(`trusted`)从不读它(调用方的话恒 `trusted: false`,见 `routes/runs.ts` steer 口的注);
  * 🔴 SINGLE mint point (E1):不要再造兄弟。
  */
-export declare function explicitOperatorOk(person: Person | undefined, roster: OperatorRoster): boolean;
-/** 「这台部署**有没有**运维」的唯一读法(名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane` 读这一只(整理阀门的可达性告警随本条退役)。单用户形上,装了运维面的进程里它恒真(`operator-declaration-required`:服务进程起服第 1 段、`createHttpServer` 对不声明的单用户形拒),多租形上空名单 ⇒ 假。 */
-export declare function operatorRosterPresent(roster: OperatorRoster): boolean;
+export declare function explicitOperatorOk(person: Person | undefined, roster: OperatorRoster, power: OperatorPower): boolean;
+/** 「这台部署上**有没有**人能持这只权力」的唯一读法(持它的某档名单非空 ∨ 单用户声明在场)—— 能力事实 `operatorLane` 读这一只(整理阀门的可达性告警随本条退役)。单用户形上,装了运维面的进程里它恒真(`operator-declaration-required`:服务进程起服第 1 段、`createHttpServer` 对不声明的单用户形拒),多租形上持它的各档名单都空 ⇒ 假。 */
+export declare function operatorRosterPresent(roster: OperatorRoster, power: OperatorPower): boolean;
+/**
+ * 🔴 **圈禁的唯一判官**(三个读点,同一只判:请求的人 —— {@link requestConfinedTier},分派层整次请求判一次;决定证明推出的决定者 —— 直连门决定口验过证明之后,
+ * `routes/approvals-assistant.ts` 的 `admitDirectDoorDecider`;设备行的属主 —— {@link deviceOwnerConfinedTier},设备 hello 准入,`device-ws-hub.ts`)。`person` 落在**非人档** ∧ 这一条路由没声明那一档持的权力(`power` = 路由声明行的 `power` 列,缺席 = 没声明)
+ * ⇒ 答那一档(调用方 403 `auth.principal_confined`,{@link sendPrincipalConfined});人档 / 不在名册 / 路由声明了它持的权力 ⇒ `undefined`(照常往下判)。
+ * 不是第二套鉴权:身份读法、名册来源都不新;它答的是「这只验过的身份在本请求上能不能用」——与 [ref] `auth.scope_mismatch` 同一位置的第二个原因。
+ */
+export declare function confinedTierOf(person: Person | undefined, roster: OperatorRoster, power: OperatorPower | undefined): NonPersonTier | undefined;
+/**
+ * 请求读点:这次请求的人在本路由上被不被圈禁。**只在名册里有非人档的名字时读人**(`rosterHasNonPersonNames`;没声明的部署零新读、逐字节同今天)。
+ * 读的是这次请求里**任一只验得过的人**(`verifiedPerson`:三来源按身份边界的序),**不**因同一请求另带了一枚验不过的 Bearer 而读成「没有人」——
+ * 那条律(`gatedSubject`)只收窄身份、从不授权;圈禁是收窄的另一面,请求里只要出示了一只被圈禁的身份就判它(读路凭据谓词照样会认那只身份,
+ * 例如直连门 principal 令牌 + 坏 Bearer 的 `/health`,所以这里不能比它少认)。**不判场景头**(不把「REQUIRE 401 先于场景头 400」的既有序提前改掉)。
+ * 读人只在人名坏形时抛(`assertPrincipalShape` 的 400):非人档的名字由起服 / 装配不变量 `operator-roster-well-formed` 保证都是合形的主体名,坏形的串
+ * 永远对不上任何一个 ⇒ 本请求没有可圈禁的身份 ⇒ 不判(下游每一次读人都抛同一只、同一处答 400)。这不是放宽臂:名单里的人永远读得出来。
+ */
+export declare function requestConfinedTier(req: IncomingMessage, config: ServiceConfig, power: OperatorPower | undefined): NonPersonTier | undefined;
+/**
+ * 设备读点:设备行的属主此刻被不被圈禁。设备车道不经 HTTP(`GET /v1/device/ws` 凭设备密钥对握手,不带任何一枚人的凭据),所以请求读点看不到它;设备行按**属主**绑定,
+ * 登记那一刻的属主是验过的人 —— `http/execution-context.ts` 的 `deviceOwnerDomainOf` 是复合身份 `{ tenant, subject }` 的唯一铸点,`subject` 格逐字节取自 `gatedPerson` ——
+ * 于是行里存的就是一只持久的属主串,按恢复管线(`recoveredSubject` → `personOf`;与组织信封的发件人同一条)读回那位人,再交同一只判官。设备车道上没有任何路由声明过权力
+ * (`power` 缺席):落在非人档的属主在这条车道上整个不算数 —— 它登记的设备不许连上、不许为它执行指令(HTTP 面同一位置已 403)。
+ * 读的是名册**现态**(`roster` 每次现读,不拍快照、不把「登记时在哪一档」记在设备行里)。名册只来自 env、起服冻结 ⇒ 进程内连着的设备不会被挪档;挪档后的重启,新进程的每一次 hello 按新名册判。
+ */
+export declare function deviceOwnerConfinedTier(owner: {
+    readonly subject: string;
+}, roster: OperatorRoster): NonPersonTier | undefined;
+/** 圈禁拒句(一档一句,模块级常量;冻结门按常量解引用逐字钉)。不回显主体名;点名名单所在的 env 与这一档能用的那一条路由。 */
+export declare const PRINCIPAL_CONFINED_DRAIN = "forbidden \u2014 this caller is a drain-only service principal on this deployment (it is named in OPERATOR_DRAIN_PRINCIPALS), and that identity counts only on POST /v1/admin/drain: every other endpoint refuses it; use an identity that is not on that list for anything else";
+/** `403 auth.principal_confined` 的唯一铸点(一档一句,穷举 switch:加一只非人档不接句子 = 编译红)。 */
+export declare function sendPrincipalConfined(res: ServerResponse, tier: NonPersonTier): void;
 /**
  * 起服一行:部署声明 `SERVICE_TOKEN_ACTS_FOR_DEPLOYMENT=false` ⇒ `service_token_posture { actsForDeployment: false }`(info);缺省不打。
  * 声明形让运维面板开位当天成片 401,而「位关了」与「token 错了」在 wire 上同体(反探测律),这一行是起服时唯一一处说清这台部署选了哪一读法的地方。
@@ -154,14 +182,14 @@ export declare function buildServiceTokenPostureNotice(config: Pick<ServiceConfi
         actsForDeployment: false;
     };
 } | undefined;
-/** operator 面族在「名单为空」这一形上的**唯一**拒发口:事实 `operatorLane`(`capability-facts.ts`)为假 ⇒ 这一面对任何
- *  身份都打不通 = 这台部署上不可用 ⇒ 501,不是鉴权拒(403 只留给「名单非空而你不在名单上」)。能力位读的是同一只事实。 */
-export declare function sendOperatorPrincipalsRequired(res: ServerResponse): void;
+/** operator 面族在「持这只权力的名单都空」这一形上的**唯一**拒发口:事实 `operatorLane(d, power)`(`capability-facts.ts`)为假 ⇒ 这一面对任何
+ *  身份都打不通 = 这台部署上不可用 ⇒ 501,不是鉴权拒(403 只留给「名单非空而你不在名单上」)。能力位读的是同一只事实。一只权力一句(穷举 switch)。 */
+export declare function sendOperatorPrincipalsRequired(res: ServerResponse, power: OperatorPower): void;
 /**
- * 「这台部署没有运维名册」时**唯一**的出路句 —— 与 {@link operatorRosterPresent} 同一对旋钮,所以句子不比事实少说一条出路:
- * 名单 `OPERATOR_PRINCIPALS`(具名运维;多租形只有这一条),或单用户形的显式声明 `OPERATOR_SINGLE_USER=true`(只在 `REQUIRE_PRINCIPAL` 未开且名单为空时成立,
- * 否则起服拒 —— 句子把它限定在单用户部署上)。拒发口 {@link sendOperatorPrincipalsRequired}、能力事实闭集 `operator_principals_empty` 的义、记忆整理阀门的起服告警
- * 都说这一句,别处不再各写一份。
+ * 「这台部署上没有人持这只权力」时**唯一**的出路句 —— 与 {@link operatorRosterPresent} 同一组旋钮(档表里持 `power` 的各档名单 + 单用户声明),所以句子不比事实少说一条出路:
+ * 持它的每一档名单(按档表的规范序列出;`operate` 只有 `OPERATOR_PRINCIPALS`,`drain` 另有 `OPERATOR_DRAIN_PRINCIPALS`),或单用户形的显式声明 `OPERATOR_SINGLE_USER=true`
+ * (只在 `REQUIRE_PRINCIPAL` 未开且各档名单都空时成立,否则起服拒 —— 句子把它限定在单用户部署上)。拒发口 {@link sendOperatorPrincipalsRequired}、能力事实闭集 `operator_principals_empty` 的义、
+ * 记忆整理阀门的起服告警都说这一句,别处不再各写一份。
  */
-export declare function buildOperatorRosterWayOut(): string;
+export declare function buildOperatorRosterWayOut(power: OperatorPower): string;
 //# sourceMappingURL=principal-gate.d.ts.map

package/dist/http/principal-gate.js

@@ -1,7 +1,9 @@
 import { timingSafeEqual } from "node:crypto";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
-import { PRINCIPAL_TOKEN_HEADER, verifiedPerson, verifiedSubject, scenarioHeaderOf, scenarioWithoutPrincipalError, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope } from "../security.js";
+import { HttpError, PRINCIPAL_TOKEN_HEADER, verifiedPerson, verifiedSubject, scenarioHeaderOf, scenarioWithoutPrincipalError, ssoVerifiedPrincipal, ssoVerifiedPrincipalInc, ssoVerifiedScope } from "../security.js";
+import { ROSTER_TIERS, ROSTER_TIER_ORDER, rosterHasNonPersonNames, rosterNamesOf, rosterTierOf, tierHolds, tierIsPerson } from "../operator-roster.js";
 import { personOf } from "../owner-brands.js";
+import { recoveredSubject } from "../owner-faces.js";
 import { IDENTITY_SOURCES, runIdentityClaimOverflow } from "../identity-source.js";
 import { sendError } from "./send.js";
 import { canonicalAddress } from "../net-address.js";
@@ -159,23 +161,71 @@ export function actsForDeployment(req, config, subject) {
 export function serviceTokenDeclaredActsForDeployment(config) {
     return config.serviceTokenActsForDeployment === true;
 }
-export function explicitOperatorOk(person, roster) {
-    if (roster.operatorSingleUser === true)
-        return true;
-    return roster.operatorPrincipals.length > 0 && person !== undefined && roster.operatorPrincipals.includes(person);
+export function explicitOperatorOk(person, roster, power) {
+    const tier = rosterTierOf(person, roster);
+    return tier !== undefined && tierHolds(tier, power);
 }
-export function operatorRosterPresent(roster) {
-    return roster.operatorSingleUser === true || roster.operatorPrincipals.length > 0;
+export function operatorRosterPresent(roster, power) {
+    return roster.operatorSingleUser === true || ROSTER_TIER_ORDER.some((tier) => tierHolds(tier, power) && rosterNamesOf(tier, roster).length > 0);
+}
+export function confinedTierOf(person, roster, power) {
+    const tier = rosterTierOf(person, roster);
+    if (tier === undefined || tierIsPerson(tier))
+        return undefined;
+    if (power !== undefined && tierHolds(tier, power))
+        return undefined;
+    return tier;
+}
+export function requestConfinedTier(req, config, power) {
+    if (!rosterHasNonPersonNames(config))
+        return undefined;
+    let person;
+    try {
+        person = verifiedPerson(req, config);
+    }
+    catch (e) {
+        if (e instanceof HttpError)
+            return undefined;
+        throw e;
+    }
+    return confinedTierOf(person, config, power);
+}
+export function deviceOwnerConfinedTier(owner, roster) {
+    return confinedTierOf(personOf(recoveredSubject(owner.subject)), roster, undefined);
+}
+export const PRINCIPAL_CONFINED_DRAIN = "forbidden — this caller is a drain-only service principal on this deployment (it is named in OPERATOR_DRAIN_PRINCIPALS), and that identity counts only on POST /v1/admin/drain: every other endpoint refuses it; use an identity that is not on that list for anything else";
+export function sendPrincipalConfined(res, tier) {
+    switch (tier) {
+        case "drain":
+            sendError(res, 403, "auth.principal_confined", PRINCIPAL_CONFINED_DRAIN);
+            return;
+        default: {
+            const unknownTier = tier;
+            throw new Error(`sendPrincipalConfined: unknown confined tier ${String(unknownTier)}`);
+        }
+    }
 }
 export function buildServiceTokenPostureNotice(config) {
     if (serviceTokenDeclaredActsForDeployment(config))
         return undefined;
     return { event: "service_token_posture", fields: { actsForDeployment: false } };
 }
-export function sendOperatorPrincipalsRequired(res) {
-    sendError(res, 501, "capability.operator_principals_required", `this endpoint is operator-only and this deployment has no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can be an operator; ${buildOperatorRosterWayOut()}`);
+export function sendOperatorPrincipalsRequired(res, power) {
+    switch (power) {
+        case "operate":
+            sendError(res, 501, "capability.operator_principals_required", `this endpoint is operator-only and this deployment has no operator roster (OPERATOR_PRINCIPALS is empty and OPERATOR_SINGLE_USER is not declared), so no caller can be an operator; ${buildOperatorRosterWayOut(power)}`);
+            return;
+        case "drain":
+            sendError(res, 501, "capability.operator_principals_required", `this endpoint is open to this deployment's operators and its drain-only service principals, and it names neither (OPERATOR_PRINCIPALS and OPERATOR_DRAIN_PRINCIPALS are empty and OPERATOR_SINGLE_USER is not declared), so no caller can call it; ${buildOperatorRosterWayOut(power)}`);
+            return;
+        default: {
+            const unknownPower = power;
+            throw new Error(`sendOperatorPrincipalsRequired: unknown power ${String(unknownPower)}`);
+        }
+    }
 }
-export function buildOperatorRosterWayOut() {
-    return "configure OPERATOR_PRINCIPALS with the named operator principals, or — on a single-user deployment (REQUIRE_PRINCIPAL off) — declare OPERATOR_SINGLE_USER=true";
+export function buildOperatorRosterWayOut(power) {
+    const rosters = ROSTER_TIER_ORDER.filter((tier) => tierHolds(tier, power)).map((tier) => `${ROSTER_TIERS[tier].env} with the named ${ROSTER_TIERS[tier].holders}`);
+    return `configure ${rosters.join(" or ")}, or — on a single-user deployment (REQUIRE_PRINCIPAL off) — declare OPERATOR_SINGLE_USER=true`;
 }
 //# sourceMappingURL=principal-gate.js.map

package/dist/http/request-channel.d.ts

@@ -0,0 +1,23 @@
+/**
+ * **通道事实**(纯叶,只依赖 `node:http` 的型):一条请求从本服务的哪一只监听口进来。
+ *
+ * ## 律(一条)
+ * 闭集 {@link REQUEST_CHANNELS} = `tcp`(TCP 监听口)· `control-socket`(本机控制 socket,`control-socket.ts`)。
+ * 唯一写者 = 控制 socket 那只 `http.Server` 的请求监听器({@link markControlSocketRequest},`http/server.ts` 里恰一处调用);唯一读法 = {@link requestChannelOf}。
+ * **缺标 ⇒ `tcp`**(fail-closed):没被那只监听器标过的请求一律按 TCP 读。不按 `req.socket.remoteAddress` 缺席反推 —— TCP 连接断开之后它同样缺席,反推形是 fail-open。
+ *
+ * ## 通道换来什么(不换来什么)
+ * 控制 socket 证明的是「对端是引擎的 OS 用户(或 root)」—— 能穿过私有目录的只有他们。宿主车道上模型跑的命令也是这个用户,所以**通道不是凭据**:
+ * 它不进读路谓词(`dispatch.ts` 的 `readCredentialOk`)、不进全局凭据门、不进身份来源闭集(`identity-source.ts` 的 `IDENTITY_SOURCES`);
+ * 它只换来 `/health` 的读者档 `engine-user`(引擎自描述的全键,`health-reader.ts`)、诊断面远程来源门的「本机」一读、限流的地址回落键。
+ * 读它的每一处都**穷举**本闭集(`switch` + `never`),没有一处写「等于某一词」的比较 —— 加一种通道不接 ⇒ 编译红,而不是默认得到某一档。
+ */
+import type { IncomingMessage } from "node:http";
+/** 请求通道的闭集(顺序无语义)。 */
+export declare const REQUEST_CHANNELS: readonly ["tcp", "control-socket"];
+export type RequestChannel = (typeof REQUEST_CHANNELS)[number];
+/** **唯一写者**:控制 socket 那只 `http.Server` 的请求监听器在把请求交给共享监听器之前调一次。别处调用 = 把 TCP 请求读成本机用户(源码门钉调用点恰一处)。 */
+export declare function markControlSocketRequest(req: IncomingMessage): void;
+/** 这条请求从哪一只监听口进来 —— 唯一读法;缺标 ⇒ `tcp`。 */
+export declare function requestChannelOf(req: IncomingMessage): RequestChannel;
+//# sourceMappingURL=request-channel.d.ts.map