@sema-agent/server 7.43.0 → 7.44.0

package/dist/config-provider.js

@@ -1,40 +1,3 @@
-/**
- * ConfigProvider — the dual-mode seam over WHERE the effective config comes from (see
- * sema-registry docs/DUAL-MODE-DESIGN.md §4).
- *
- * The service consumes the config-center through EXACTLY two transport calls — `fetchEffective` (pull the
- * effective config, ETag-conditional) and `fetchSkillContent` (lazy-pull one skill body by content hash).
- * Everything downstream (applyEffective / applyRuntimeGates / resolveMcpServers / mcpForScenario / the
- * skill overlay) is transport-agnostic: it operates on the returned `EffectiveConfig` / skill string.
- *
- * STATUS — FULLY provider-routed (提示词装配协议 §9.5-1/-3): boot AND the 60s refresh loop both pull
- * through `configProvider.fetchEffective` (main.ts), so `CONFIG_PROVIDER=local` gets the same ongoing
- * poll as the fleet path — a config.d edit lands within one poll (the local etag is the store's raws
- * hash). The caller runs a whole-candidate gate over `domainErrors` (§9.5-5): on refresh an invalid
- * domain rejects the candidate and the last-known-good keeps serving; boot stays tolerant per-domain
- * (no LKG exists yet).
- *
- * This module factors those two calls behind a `ConfigProvider` interface with two backends:
- *
- *   - {@link RemoteConfigProvider} — the existing behaviour. DELEGATES verbatim to the exported
- *     `facade.fetchEffective` / `facade.fetchSkillContent` (HTTP + Bearer + ETag + hash
- *     verify). No HTTP is reimplemented here; this is a thin wrapper that binds baseUrl/token/worker.
- *
- *   - {@link LocalConfigProvider} — reads the SAME config contract from the local filesystem via
- *     `@sema-agent/registry-core/node` `FileConfigStore` (`.env` + `config.d/<domain>.json` → an
- *     `EffectiveConfig` through the SAME resolver the center uses). The registry `EffectiveConfig`
- *     is a structural SUPERSET of the service-local `EffectiveConfig` the consumers expect, so we map
- *     it down to EXACTLY that shape (see `mapToServiceEffective`). Skills are stored locally WITH their
- *     bodies (the local store doesn't split content into a manifest), so `fetchSkillContent` is a
- *     content-addressed lookup over the local skills domain (absent → undefined, mirroring a remote 404).
- *
- * SECRET BOUNDARY (unchanged in both modes): the config plane carries only env-NAME refs — `apiKeyEnv`,
- * `envRefs`/`headerRefs`, `tokenEnv`. The real secret VALUE is never stored in config.d/<domain>.json and
- * never read by this module; it is resolved from `process.env` downstream (config-center/facade.ts
- * `applyEffective`/`resolveMcpServers`). The local store is symmetric with the remote center on this: it
- * ships NAMEs only. (Unit test asserts the local path resolves env-NAME→value via process.env and never
- * persists a value.)
- */
 import { createHmac, randomBytes } from "node:crypto";
 import { FileConfigStore } from "@sema-agent/registry-core/node";
 import { findSkillContent, skillContentHash, refIntegrityIssues, siblingResolver, } from "@sema-agent/registry-core";
@@ -42,35 +5,14 @@ import { redactSecrets } from "./trace/redact.js";
 import { fetchEffective as remoteFetchEffective, fetchSkillContent as remoteFetchSkillContent, ConfigCenterHttpError, } from "./config-center/facade.js";
 import { createLogger } from "./observability/logger.js";
 const logger = createLogger();
-/**
- * domainError strings must not echo raw config operands (self-review, information-surface lens):
- * ref-integrity messages quote the referenced value verbatim, and tolerant-read parse failures carry
- * zod/JSON.parse fragments of the file text — a controlled value pasted into the wrong slot (say, a
- * credential in a model-ref position) would otherwise ride `config_candidate_rejected` /
- * `config_domain_invalid` into the structured log stream. This runs at the producing boundary (the
- * local provider is the only domainErrors producer): shared secret-shape redaction first, then every
- * quoted operand becomes a short one-way fingerprint — keyed per process so the fingerprint is not a
- * dictionary-comparable digest of the value, while equal operands still correlate within one log
- * stream. The issue `path` stays clear; it is how the operator locates the entry.
- */
 const OPERAND_FINGERPRINT_KEY = randomBytes(16);
 function redactConfigError(text) {
     return redactSecrets(text).replace(/"[^"]*"|'[^']*'/g, (m) => `"#${createHmac("sha256", OPERAND_FINGERPRINT_KEY).update(m.slice(1, -1)).digest("hex").slice(0, 8)}"`);
 }
-/** Sentinel returned by {@link raceBootFetch} when the boot pull outlived its budget — the caller
- *  starts serving on the env fallback and the SAME promise settles in the background (never cancelled). */
 export const BOOT_FETCH_DEFERRED = Symbol("boot-fetch-deferred");
-/**
- * Race the boot config pull against a wall-clock budget (clay 2026-07-17: a black-holed center made
- * the SYNCHRONOUS boot pull hang ~5.7s on the TOC lane — the "local server takes 5s to start" report).
- * Inside the budget → the fetch result verbatim (the healthy-center fast path is unchanged, typically
- * <300ms). Past it → {@link BOOT_FETCH_DEFERRED}; the fetch is NOT aborted — the caller chains a
- * background continuation that triggers a refresh tick when it finally settles. The timer is unref'd
- * (never holds the loop) and cleared as soon as the fetch wins.
- */
 export function raceBootFetch(fetch, budgetMs) {
     if (budgetMs <= 0)
-        return Promise.resolve(BOOT_FETCH_DEFERRED); // explicit "never block boot" posture
+        return Promise.resolve(BOOT_FETCH_DEFERRED);
     let timer;
     const budget = new Promise((res) => {
         timer = setTimeout(() => res(BOOT_FETCH_DEFERRED), budgetMs);
@@ -78,11 +20,6 @@ export function raceBootFetch(fetch, budgetMs) {
     });
     return Promise.race([fetch.finally(() => clearTimeout(timer)), budget]);
 }
-/**
- * RemoteConfigProvider — DELEGATES to the exported config-center HTTP functions. No HTTP is reimplemented;
- * baseUrl/token/worker are bound once and passed through. The two delegate fns are injectable (defaulting
- * to the real config-center exports) so a unit test can assert delegation without module-mocking.
- */
 export class RemoteConfigProvider {
     cc;
     deps;
@@ -93,22 +30,13 @@ export class RemoteConfigProvider {
     }
     async fetchEffective(etag) {
         const fn = this.deps.fetchEffective ?? remoteFetchEffective;
-        // 5th arg = worker scope; transport (fetchImpl) stays the config-center's default.
         const r = await fn(this.cc.baseUrl, this.cc.token, etag, undefined, this.cc.worker);
         if (r === null || r.domainErrors === undefined)
             return r;
-        // [2281] 裁B:远程腿从此也产 domainErrors(http-client 消费端校验)。与本地腿同一条产出边界纪律:
-        // error 文本先过 redactConfigError(zod 错误会回声违规值——operand 指纹化,防受控值经
-        // config_candidate_rejected/config_domain_invalid 进结构化日志流)。
         return { ...r, domainErrors: r.domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })) };
     }
     async fetchSkillContent(contentHash) {
         const fn = this.deps.fetchSkillContent ?? remoteFetchSkillContent;
-        // Honor the ConfigProvider contract symmetrically with the local backend: an UNKNOWN hash → undefined
-        // (caller keeps its baseline), and ONLY a hard error (non-404 HTTP / hash mismatch) throws. The remote
-        // transport throws a ConfigCenterHttpError(status=404) for an unknown hash; we translate that single
-        // case to undefined and re-throw everything else, so both backends return the same thing for the same
-        // "unknown hash" input (substitutability — the whole point of this seam).
         try {
             return await fn(this.cc.baseUrl, this.cc.token, contentHash);
         }
@@ -119,20 +47,10 @@ export class RemoteConfigProvider {
         }
     }
 }
-/**
- * LocalConfigProvider — reads the SAME config contract from disk via `FileConfigStore`. `getEffective()`
- * returns the registry `EffectiveConfig` (all domains, defaults filled); `getVersion()` returns a
- * stable change-detector. We map that down to the service-local `EffectiveConfig` shape and surface the
- * version as the etag (so the caller's "skip re-apply if etag unchanged" works locally too).
- */
 export class LocalConfigProvider {
     kind = "local";
     store;
-    /** [875]b 可观测性:config_loaded 日志要能回答「到底读的哪个目录」——复验实录:只设 LOCAL_DATA_ROOT 时
-     *  config.d 静默读不到且 0 模型无告警(CONFIG_LOCAL_DIR 才是本 lane 的选目录旋钮)。 */
     root;
-    /** 注入 store(测试缝)时保持其自带行为;自建时 fetchEffective 每次按调用铸新 store 挂 warning 座
-     *  (见 fetchEffective 头注)。 */
     #injectedStore;
     constructor(root, store) {
         this.root = root;
@@ -140,29 +58,12 @@ export class LocalConfigProvider {
         this.store = store ?? new FileConfigStore(root);
     }
     async fetchEffective(etag) {
-        // SINGLE store read: derive BOTH the etag AND the mapped payload from ONE atomic raws snapshot. Reading
-        // getVersion() and getEffective() separately would pair an etag from snapshot A with a payload from
-        // snapshot B if config.d is rewritten between the two awaits — a consumer could then cache etag=A bound
-        // to payload-B and, once files settle back to A, skip re-applying the now-correct config (304-skip
-        // staleness). `eff.version` IS the authoritative version of THIS payload (file-store getEffective()
-        // invariant), so it is the only correct source for the etag. Cost: we compute `eff` even on an
-        // unchanged poll, but that preserves snapshot consistency — see finding #3.
-        // [898] tolerant read(0.10.12):catalog 域坏文件 ⇒ 该域 default+domainErrors 单列(不再连坐整包回落
-        // env);gate 域坏文件仍 throw(走 caller 的整包 catch)。坏文件文本 hash 参与 version(坏≠absent、
-        // 坏→修好均 bump),304-skip 纪律不漏拍——所以坏域场景下 etag 对比照旧安全。
-        // [3073]#204④:判形失败(schema 坏形/重名条目)走的是 buildEffective 的 `onWarning`(parse 层落
-        // default),不走 READ 层 throw——不接这个座,domainErrors 恒空,域被静默清空而排障 hint 只能谎报
-        // 「文件空」。warning 座是 store 构造级而 fetch 可能重叠(boot 超窗后台腿 vs 首拍 refresh),
-        // 共享缓冲会把别次快照的警告错记到本次结果(codex F2)——故自建形每次 fetch 铸新 store 配本地
-        // 收集器(FileConfigStore 无跨调用状态,按次构造零成本);注入 store(测试缝)保持其自带行为。
         const parseWarnings = [];
         const store = this.#injectedStore ??
             new FileConfigStore(this.root, {
                 onWarning: (w) => {
                     if (w.kind === "domain-defaulted")
                         parseWarnings.push({ domain: w.domain, error: w.error instanceof Error ? w.error.message : String(w.error) });
-                    // registry-core 0.19.0 响亮化三 kind(LANDING-7.38 接线件③):dropped/unread=operator 写了但没生效
-                    // (与 defaulted 同级),carried=承运但键表方(stage-limits)才认——都入诊断面,禁静默丢。
                     else if (w.kind === "unknown-keys-dropped")
                         parseWarnings.push({ domain: w.domain, error: `unknown keys dropped by domain schema: ${w.keys.join(", ")}` });
                     else if (w.kind === "unknown-keys-carried")
@@ -174,46 +75,25 @@ export class LocalConfigProvider {
         const { effective: eff, domainErrors } = await store.getEffective({ tolerant: true });
         const tag = String(eff.version);
         if (etag !== undefined && etag === tag)
-            return null; // unchanged → mirror remote 304
-        // 提示词装配协议 §9.5-4 read-side cross-domain reference validation: dangling refs (a roster naming a
-        // model that isn't in the catalog, …) fold into domainErrors, so the caller's candidate gate rejects
-        // the tree whole on refresh (boot warns and proceeds — no LKG exists yet). Write-side zod is
-        // per-domain only and the center runs this check on its write path; the local lane never had it.
-        // The resolver gets THIS snapshot's domain values as `pending` (builder output is default-filled for
-        // every domain), so the check never re-reads config.d — the one-atomic-snapshot invariant above holds.
+            return null;
         const refErrors = [];
         const resolve = siblingResolver(store, eff);
         for (const d of ["rosters", "workers", "models", "collab", "systems", "entitlement"]) {
             const issues = await refIntegrityIssues(d, eff[d], resolve);
-            // path CLEAR (locates the entry) + message operand-fingerprinted (see redactConfigError).
             if (issues.length > 0)
                 refErrors.push({ domain: d, error: issues.map((i) => `${i.path.join(".")}: ${redactConfigError(i.message)}`).join("; ") });
         }
-        // parse 层判形失败与 READ 层坏文件同渠道:两者都是「坏域落 default」,候选门(§9.5-5)与排障 hint
-        // 需要同样看见——此前判形失败静默(domainErrors 空+域被清空),比坏文件更隐蔽。
         const parseErrors = parseWarnings.map((w) => ({ domain: w.domain, error: redactConfigError(w.error) }));
         const errors = [...domainErrors.map((de) => ({ domain: de.domain, error: redactConfigError(de.error) })), ...parseErrors, ...refErrors];
         return { effective: mapToServiceEffective(eff, eff.version), etag: tag, ...(errors.length > 0 ? { domainErrors: errors } : {}) };
     }
     async fetchSkillContent(contentHash) {
-        // The local store keeps skill BODIES inline (no manifest split), so this is a content-addressed lookup
-        // over the skills domain. Absent hash → undefined (mirrors a remote 404 → caller keeps the baseline).
         const skills = await this.store.getDomain("skills");
         if (!skills)
             return undefined;
         return findSkillContent(skills, contentHash);
     }
 }
-/**
- * Map the registry `EffectiveConfig` (superset, all domains) → the service-local `EffectiveConfig`
- * the consumers (`applyEffective`, `resolveMcpServers`, …) expect. The two are structurally compatible
- * for every field the consumers read; this projection makes that explicit (and drops control-plane-only
- * domains the service never consumes: rosters, systems, workers, hosts, integrations, access).
- *
- * Skills are mapped to the MANIFEST shape (name/description/scenarios/contentHash/enabled) — the same
- * shape RemoteConfigProvider's `/effective` ships — so the lazy `fetchSkillContent`-by-hash path is
- * identical in both modes. The local content hash is the `contentHash` the store already computed.
- */
 export function mapToServiceEffective(eff, version) {
     return {
         version,
@@ -226,62 +106,33 @@ export function mapToServiceEffective(eff, version) {
                 api: m.api,
                 ...(m.baseUrl !== undefined ? { baseUrl: m.baseUrl } : {}),
                 ...(m.apiKeyEnv !== undefined ? { apiKeyEnv: m.apiKeyEnv } : {}),
-                // RL-1(P4 A0 发现,2026-08-02;autoCompactTokens/promptGuidance 同类病族):CLOSED 投影剥掉
-                // sealedApiKey 会让本地 lane 的 sealed 模型绕过 applyEffective 的毒丸臂(严格互斥纪律)⇒
-                // 静默烧网关共享 key——正是毒丸臂声称杜绝的事故。携带它,无 opener 时毒丸自然接管(fail-loud)。
                 ...(m.sealedApiKey !== undefined ? { sealedApiKey: m.sealedApiKey } : {}),
-                // 同族连带:quotaWeight 被剥 ⇒ 本地 lane 配额倍率静默归 1(weight-at-burn 面失真)。
                 ...(m.quotaWeight !== undefined ? { quotaWeight: m.quotaWeight } : {}),
                 tier: m.tier,
                 reasoning: m.reasoning,
                 vision: m.vision,
                 ...(m.contextWindow !== undefined ? { contextWindow: m.contextWindow } : {}),
                 ...(m.maxTokens !== undefined ? { maxTokens: m.maxTokens } : {}),
-                // codex F5 ([818]① 1M dual-window): an EXPLICIT `autoCompactTokens` must survive this CLOSED
-                // projection. [2373]B-6d:registry-core 0.13.0 已把它收进 ModelEntry schema(types.d.ts:157/212)
-                // ——旧注的「strip-mode 会在上游丢值」的 honest gap 已随那次 schema addition 关闭,结构读改类型直读。
                 ...(typeof m.autoCompactTokens === "number" ? { autoCompactTokens: m.autoCompactTokens } : {}),
-                // A-067 C2-M1(F1a,本函数第 6 例同形丢字段):charsPerToken 远程腿 toModel 一直消费
-                // (apply-effective charsPerTokenOf 判形),本 CLOSED 投影此前剥掉 ⇒ 本地 lane 的 token
-                // 估算静默退回 env 默认/core 4。判形归 toModel 单点(此处只过境,不重判)。
                 ...(typeof m.charsPerToken === "number" ? { charsPerToken: m.charsPerToken } : {}),
                 ...(m.cost !== undefined ? { cost: m.cost } : {}),
                 ...(m.extraBody !== undefined ? { extraBody: m.extraBody } : {}),
-                // registry-core 0.10.13 promptGuidance ([998]⑤c): the CLOSED projection must pass it through or
-                // the local lane silently drops the configured sentences (autoCompactTokens 同类病).
                 ...(m.promptGuidance !== undefined ? { promptGuidance: m.promptGuidance } : {}),
                 enabled: m.enabled,
             })),
             roles: eff.models.roles ?? {},
-            // [874] registry-core 0.10.11:池结构级 `default?`(catalog name 目录键,与 roles.default 角色词两回事)。
-            // 本 mapper 是 CLOSED 投影——不直通则本地 lane 静默丢键(autoCompactTokens 同类病),applyEffective 的
-            // resolveDefaultModelName 第一优先级在本地 lane 永远点不亮。写面悬空 ref 由 registry-core superRefine
-            // fail-loud;存量/未经 schema 的路径仍由消费方 warn 降级(config-center/facade.ts resolveDefaultModelName)。
-            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}), // [2373]B-6c:0.13.0 类型直读(types.d.ts:641)
+            ...(eff.models.default !== undefined ? { default: eff.models.default } : {}),
             ...(eff.models.atModelAllowlist !== undefined ? { atModelAllowlist: eff.models.atModelAllowlist } : {}),
-            // registry-core 0.9.0 档位组: verbatim passthrough — applyEffective's resolveActiveTiers reads
-            // these structurally off eff.models (the remote lane ships them JSON-verbatim; the local lane must too).
-            // [2373]B-6b:0.13.0 类型直读(EffectiveConfig.models 面已声明四键,宽铸删)。本地 lane 的
-            // eff 来自 FileConfigStore 原始 JSON(非 zod 输出),tierGroups 的 ZodDefault 恒在场性不适用——门保留。
             ...(eff.models.tierGroups !== undefined ? { tierGroups: eff.models.tierGroups } : {}),
             ...(eff.models.activeTierGroup !== undefined ? { activeTierGroup: eff.models.activeTierGroup } : {}),
         },
-        // registry-core 0.7 DELETED the teams domain (BREAKING, no compat key) — the local lane ships an EMPTY
-        // teams face: applyEffective's teams branch no-ops and the team scenario falls back to the builtin
-        // TEAM_PERSONAS base (a permanent base, not a stopgap). Its successor is `collab` below.
         teams: { teams: [] },
-        // collab domain: verbatim structural passthrough — FileConfigStore reads
-        // config.d/collab.json (PORTABLE_DOMAINS includes collab since 0.7) and applyEffective's
-        // projectCollabToTeams consumes the same shape on both lanes. Optional-chained against shape drift.
         ...(eff.collab?.templates?.length ? { collab: { templates: eff.collab.templates } } : {}),
         skills: {
             skills: (eff.skills.skills ?? []).map((s) => ({
                 name: s.name,
                 description: s.description,
                 scenarios: s.scenarios ?? [],
-                // The local store keeps the body inline; content-address it HERE so the manifest carries the same
-                // `sha256:<hex>` the remote /effective ships — and `fetchSkillContent` (findSkillContent) resolves
-                // the same hash back to the body. (skillContentHash is byte-identical to the center's hash.)
                 contentHash: skillContentHash(s.content),
                 enabled: s.enabled,
             })),
@@ -293,8 +144,6 @@ export function mapToServiceEffective(eff, version) {
                     scenarios: s.scenarios ?? [],
                     enabled: s.enabled,
                     ...(s.allowTools !== undefined ? { allowTools: s.allowTools } : {}),
-                    // E23: carry the per-server inbound-elicitation opt-in (default OFF). Typed end-to-end since
-                    // registry-core 0.1.34 added `McpServerSpec.elicitation?: boolean`.
                     ...(s.elicitation !== undefined ? { elicitation: s.elicitation } : {}),
                 };
                 if (s.transport.kind === "stdio") {
@@ -319,22 +168,13 @@ export function mapToServiceEffective(eff, version) {
                 };
             }),
         },
-        // prompts 域投影(a 实现班车,[985]a §3/[1234]① 位):**catalog 轴打通 local lane**——catalog 是
-        // center 铸好的 immutable envelope(免 covering 解析,server 零解析义务红线 [1042]②b 不破),
-        // config.d/prompts.json 携带 `catalog` 即以 wire 双轴形(registry-core `EffectivePromptsWire`)下发,
-        // 与 remote lane 的 additive prompts key 同门(adoptCenterPrompts→validatePromptsDomain,core verify
-        // 全管线)。bindings(declaration 轴原料)仍不投影:covering 解析半场恒在 center,local lane 的
-        // declaration 轴维持不透传(那不是遗漏,是分工)。
         ...(eff.prompts?.catalog !== undefined
             ? { prompts: { schemaVersion: 1, catalog: eff.prompts.catalog } }
             : {}),
         scenarios: {
-            // ([1057] 注记保留:declaration 轴 remote lane only——covering 解析半场在 center(web),
-            // local FileConfigStore 只有 bindings 原文而 server 零解析义务([1042]②b 红线)。)
             scenarios: (eff.scenarios.scenarios ?? []).map((sc) => ({
                 name: sc.name,
                 toolset: sc.toolset,
-                // ([1053] 0.10.15:ScenarioEntry.prompt 字段已删——scenario 级提示词走 center prompts binding)
                 enabled: sc.enabled,
             })),
         },
@@ -345,39 +185,16 @@ export function mapToServiceEffective(eff, version) {
             ...(eff.runtime.maxPrincipalCostUsd !== undefined ? { maxPrincipalCostUsd: eff.runtime.maxPrincipalCostUsd } : {}),
             ...(eff.runtime.costQuotaWindowSec !== undefined ? { costQuotaWindowSec: eff.runtime.costQuotaWindowSec } : {}),
         },
-        // #322 批1(registry-core 0.19.0 第 17 域):`limits` 整包透传——本地腿的最后一米在此收口;漏了
-        // 这行,14 键在 local lane 整域消失、继续吃 env 基线(LANDING-7.38 接线件②的事故形)。
         ...(eff.limits !== undefined ? { limits: eff.limits } : {}),
-        // Governance trio (autonomy/commandPolicy/approvalRequire): moved OUT of runtime into the dedicated
-        // governance domain (registry-core 0.6, runtime double-write mirror removed in 0.7.1 — buildEffective
-        // still READ-lifts legacy raw runtime values into governance, so old on-disk config keeps working).
-        // Mapped to the service-local `governance` slot; applyEffective's gatesView consumes it with priority.
-        // The registry shapes are IDENTICAL to the service's Autonomy/CommandRule declarations (straight passthrough).
         governance: {
             ...(eff.governance.autonomy !== undefined ? { autonomy: eff.governance.autonomy } : {}),
             ...(eff.governance.commandPolicy !== undefined ? { commandPolicy: eff.governance.commandPolicy } : {}),
             ...(eff.governance.approvalRequire !== undefined ? { approvalRequire: eff.governance.approvalRequire } : {}),
         },
-        // NOTE: entitlement is NOT mapped — the ruling is that the local lane never carries it (by design;
-        // TOB governance concept) and the fleet scenario ruling rides center's caps view, not /effective.
     };
 }
-/**
- * Pick the backend off a CLOSED `provider` enum (`local` | `remote` | undefined): LOCAL when
- * `CONFIG_PROVIDER=local`, OR when no config-center URL is configured (a lone box with config.d/ on disk
- * and no control plane). REMOTE otherwise (a configured center URL, the default fleet posture). A
- * `CONFIG_PROVIDER=remote` with no URL is a misconfiguration — we fall through to local rather than
- * constructing a remote provider with no endpoint (the caller would have skipped the remote pull entirely
- * under the old code path; local-with-empty-config.d degrades to env the same way). An UNRECOGNIZED value
- * (typo / wrong case) is NOT treated as remote: it defaults to local (non-network) with a warn, so a
- * fat-fingered knob can never silently source config from an unintended/stale network endpoint.
- */
 export function createConfigProvider(input) {
     const p = input.provider;
-    // Closed enum: only `local` | `remote` | undefined are valid. An unrecognized/typo'd value (`Local`,
-    // `LOCAL`, ` local`, garbage) must NOT silently fall through to the network source — pick the non-network
-    // safe default (local) and warn, so a misconfigured knob never sources config (incl. env-NAME refs that
-    // gate secret wiring) from a possibly-stale remote URL the operator didn't intend. See finding #4.
     if (p !== undefined && p !== "local" && p !== "remote") {
         logger.warn("config_provider_unrecognized", {
             provider: p,

package/dist/config-types.js

@@ -1,7 +1,2 @@
-/**
- * #270 §4 —— 托管留存的**灰度档**闭集。`as const` 数组是词表的唯一真源(config 解析、能力位、审计行
- * 的 `mode` 列共读它);两词之外的值在启动期响亮拒 —— 一个拼错的档位静默落回 `audit-only` 会让运维
- * 以为在删、其实没删,而拼成别的方向就是反过来那件更坏的事。
- */
 export const RETENTION_MODES = ["audit-only", "enforce"];
 //# sourceMappingURL=config-types.js.map