@sema-agent/server 7.98.0 → 7.99.0

package/dist/center-credential.js

@@ -0,0 +1,131 @@
+import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { resolve as resolvePath } from "node:path";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+export class CenterCredentialUnavailableError extends Error {
+    reason;
+    constructor(reason) {
+        super(`center credential unavailable: ${reason}`);
+        this.reason = reason;
+        this.name = "CenterCredentialUnavailableError";
+    }
+}
+export const CENTER_TOKEN_ENV = "SEMA_REGISTRY_TOKEN";
+export const CENTER_TOKEN_FILE_ENV = "SEMA_REGISTRY_TOKEN_FILE";
+export function readCenterCredentialDeclaration(env = process.env) {
+    const token = env.SEMA_REGISTRY_TOKEN ?? "";
+    const file = env.SEMA_REGISTRY_TOKEN_FILE ?? "";
+    if (token !== "" && file !== "") {
+        throw new Error(`${CENTER_TOKEN_ENV} and ${CENTER_TOKEN_FILE_ENV} are both set — pick exactly one: ${CENTER_TOKEN_ENV} carries the credential value, ` +
+            `${CENTER_TOKEN_FILE_ENV} names a file re-read on every request (rotation without restart). Two writers on one credential is a guess, not a config.`);
+    }
+    if (file !== "")
+        return { from: "file", path: resolvePath(file) };
+    if (token !== "")
+        return { from: "env", token };
+    return { from: "absent" };
+}
+const digest16 = (s) => createHash("sha256").update(s, "utf8").digest("hex").slice(0, 16);
+function jwtSubject(bearer) {
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(bearer.split(".")[1] ?? "", "base64url").toString("utf8"));
+    }
+    catch (err) {
+        return { missing: `payload is not JSON (${err instanceof Error ? err.name : "parse error"})` };
+    }
+    if (parsed === null || typeof parsed !== "object" || !("sub" in parsed))
+        return { missing: "no sub claim" };
+    return typeof parsed.sub === "string" && parsed.sub !== "" ? { sub: parsed.sub } : { missing: "sub is not a non-empty string" };
+}
+function classify(bearer, worker) {
+    if (looksLikeJwt(bearer)) {
+        const s = jwtSubject(bearer);
+        return { ok: true, kind: "user-jwt", bearer, identity: "sub" in s ? `user-jwt:${digest16(s.sub)}` : `user-jwt-opaque:${digest16(bearer)}` };
+    }
+    return { ok: true, kind: "pull-token", bearer, identity: pullTokenIdentity(worker), workerScoped: bearer.startsWith("wpt_") };
+}
+export function pullTokenIdentity(worker) {
+    return `pull-token:${worker ?? "global"}`;
+}
+const NONE = { ok: true, kind: "none", identity: "none" };
+export function createCenterCredentialSource(declaration, worker, deps = {}) {
+    switch (declaration.from) {
+        case "absent":
+            return { origin: declaration, declared: false, read: () => NONE, health: () => ({ state: "ok" }) };
+        case "env": {
+            const fixed = classify(declaration.token, worker);
+            return { origin: { from: "env" }, declared: true, read: () => fixed, health: () => ({ state: "ok" }) };
+        }
+        case "file": {
+            const readFile = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
+            const now = deps.now ?? Date.now;
+            let health = { state: "ok" };
+            const fail = (reason) => {
+                health = health.state === "unreadable" ? { ...health, reason, failures: health.failures + 1 } : { state: "unreadable", reason, since: now(), failures: 1 };
+                return { ok: false, reason };
+            };
+            return {
+                origin: declaration,
+                declared: true,
+                read() {
+                    let text;
+                    try {
+                        text = readFile(declaration.path);
+                    }
+                    catch (err) {
+                        const code = err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "read error";
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is unreadable (${code})`);
+                    }
+                    const bearer = text.trim();
+                    if (bearer === "")
+                        return fail(`${CENTER_TOKEN_FILE_ENV} ${declaration.path} is empty`);
+                    health = { state: "ok" };
+                    return classify(bearer, worker);
+                },
+                health: () => health,
+            };
+        }
+    }
+}
+export function scopedTokenNeedsWorker(read, worker) {
+    return read.ok && read.kind === "pull-token" && read.workerScoped && !worker;
+}
+export function centerStateBin(worker, identity) {
+    return `${worker === undefined ? "global" : `worker-${digest16(worker)}`}.id-${digest16(identity)}`;
+}
+export function credentialIdentityNow(source) {
+    const r = source.read();
+    return r.ok ? r.identity : undefined;
+}
+export function answerStillCurrent(source, usedIdentity) {
+    return usedIdentity !== undefined && credentialIdentityNow(source) === usedIdentity;
+}
+export function createIdentityBins(source, make) {
+    const bins = new Map();
+    return () => {
+        const identity = credentialIdentityNow(source);
+        if (bins.has(identity))
+            return bins.get(identity);
+        const made = make(pinCredential(source, identity));
+        bins.set(identity, made);
+        return made;
+    };
+}
+function pinCredential(source, identity) {
+    return {
+        origin: source.origin,
+        declared: source.declared,
+        read() {
+            const r = source.read();
+            if (!r.ok)
+                return r;
+            if (identity === undefined) {
+                return { ok: false, reason: "this state bin was opened while the center credential was unreadable (identity unknown) — it never talks to the center; the next call runs in the current identity's bin" };
+            }
+            return r.identity === identity ? r : { ok: false, reason: "center credential identity changed — this request belongs to the previous identity's state bin and is not sent" };
+        },
+        health: () => source.health(),
+    };
+}
+//# sourceMappingURL=center-credential.js.map

package/dist/config-catalog.js

@@ -74,7 +74,7 @@ export const CONFIG_CATALOG = [
     r("ATTACHMENT_ORPHAN_GRACE_MS", "limitsHttp", "number", "附件孤儿对象 GC 宽限(ms;0=关本腿,坏值回默认+warn)", { staticDefault: "3600000", danger: DATA, center: cLimits("attachmentOrphanGraceMs") }),
     r("ATTACHMENT_UNBOUND_TTL_MS", "limitsHttp", "number", "未绑定附件的 TTL(ms)", { staticDefault: String(24 * 3600 * 1000), danger: DATA, configKey: "attachmentUnboundTtlMs", center: cLimits("attachmentUnboundTtlMs") }),
     r("AUTH_BRIDGE_AUDIENCE", "auth", "string", "registry SSO-JWT 验签期望 aud", { danger: SEC }),
-    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-591 起也是托管形判据的一条证据 —— 只认显式值,不认 center 回退)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);但**托管判据不读那条回退**(fleet 管理轴 ≠ 租户轴)", configKey: "authBridgeIssuer" }),
+    r("AUTH_BRIDGE_ISSUER", "auth", "url", "registry SSO-JWT issuer(auth bridge 的开关之一;S-671 / C-R100 ① 起**不是**托管证据 —— 多租户只认 REQUIRE_PRINCIPAL=true)", { danger: SEC, derivedDefaultNote: "缺席 ⇒ 桥的装配处回退到 configCenter.baseUrl(配了 center 即默认开桥);显式值与回退值在托管判定上同判(都不算)", configKey: "authBridgeIssuer" }),
     r("AUTH_BRIDGE_JWKS_URL", "auth", "url", "registry SSO-JWT 的 JWKS 地址(缺省从 issuer 派生)", { danger: SEC }),
     r("AUTONOMY", "auth", "enum", "运维 autonomy 模式,tighten-only 叠到每个 TaskSpec(read-only/plan ⇒ 只读手,ask ⇒ 恒 shellGate);center 腿热且 non-sticky", { danger: SEC, enumValues: AUTONOMY_MODES, configKey: "autonomy", center: cGov("autonomy") }),
     r("AUTO_MODE_CLASSIFIER_FALLBACK", "approval", "enum", "auto 分类器席答不出裁决时的梯子(main=主模型代判 / none=只留分类器那一级,整条拒)", { enumValues: ["main", "none"], danger: SEC, derivedDefaultNote: "未设/空串 ⇒ 不铸键,跟随引擎缺省 main(core 7.18.0 起;空串按未设,与其余词表旋钮同判);none = 7.77.0 及以前的行为逐字;词表外的值启动期拒启。权限轴放宽,升级须知见 DEPLOY-PREREQS", configKey: "autoModeClassifierFallback" }),
@@ -394,7 +394,8 @@ export const CONFIG_CATALOG = [
     r("SEMA_PIP_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 pip index 地址"),
     r("SEMA_REGISTRY_ADMIN_TOKEN", "integrations", "secret", "写 center 的管理凭证(仅 boot 上报执行公钥用;刻意不入 ServiceConfig —— 不进 configHash/日志面)", { danger: SEC, scope: "bootstrap-only" }),
     r("SEMA_REGISTRY_DRY_RUN", "integrations", "boolean", "center 腿 dry-run(拉而不应用)", { staticDefault: "false" }),
-    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN", "integrations", "secret", "center 拉取凭据(值形;与 SEMA_REGISTRY_TOKEN_FILE 二选一,都设=拒启)", { danger: SEC }),
+    r("SEMA_REGISTRY_TOKEN_FILE", "integrations", "path", "center 拉取凭据文件(每条中心请求都重读 ⇒ 轮换 / 换账号不重启;与 SEMA_REGISTRY_TOKEN 二选一,都设=拒启;文件不可读=响亮 + 健康态 unreadable,不当作无凭证)", { danger: SEC }),
     r("SEMA_REGISTRY_URL", "integrations", "url", "sema-registry 地址(设了=remote 配置源开关)"),
     r("SEMA_REGISTRY_WORKER", "integrations", "string", "本 worker 在 center 的名字(per-worker effective)"),
     r("SEMA_UV_INDEX", "orchestration", "url", "SANDBOX_PKG_SOURCE=custom 的显式 uv index 地址"),

package/dist/config-center/center-request.d.ts

@@ -0,0 +1,60 @@
+import { type CenterCredentialSource } from "../center-credential.js";
+export declare const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+/** 已装 settings-schema 的 major(机器派生)。版本号不成形 ⇒ 模块装载即抛(装坏了的包不该带着一个猜出来的
+ *  major 去跟中心协商 wire 形)。 */
+export declare const SETTINGS_SCHEMA_MAJOR: string;
+/** 一个中心端点 = 基址 + 凭证来源(`ServiceConfig.configCenter` 结构上满足)。 */
+export interface CenterEndpoint {
+    readonly baseUrl: string;
+    readonly credential: CenterCredentialSource;
+}
+/** 中心路由闭集。 */
+export type CenterRoute = {
+    readonly kind: "effective";
+    readonly worker?: string | undefined;
+    readonly principal?: string | undefined;
+} | {
+    readonly kind: "skill-content";
+    readonly contentHash: string;
+} | {
+    readonly kind: "prompt-artifact";
+    readonly digest: string;
+} | {
+    readonly kind: "prompt-blob";
+    readonly digest: string;
+} | {
+    readonly kind: "fleet-leases";
+} | {
+    readonly kind: "fleet-instances";
+} | {
+    readonly kind: "fleet-usage";
+} | {
+    readonly kind: "execution-keys";
+};
+/**
+ * 拉取视图(`/api/config/effective`)查询串的**唯一拼装点**:`?principal=`(per-principal 视图)、`?worker=`
+ * (worker 作用域视图;对 `wpt_<self>` 是授权必需,对全量令牌无害)。
+ * [ref] E-15:执行体绑 scope 的参数将来加在这里(契约字段 settings-schema 6.0.0;本批不铸)。
+ */
+export declare function pullViewQuery(view: {
+    readonly worker?: string | undefined;
+    readonly principal?: string | undefined;
+}): string;
+export interface CenterRequestInit {
+    readonly method?: "GET" | "POST" | "DELETE";
+    /** JSON 请求体(在场 ⇒ `content-type: application/json`)。 */
+    readonly json?: unknown;
+    /** 条件请求(`if-none-match`)。 */
+    readonly etag?: string | undefined;
+    readonly timeoutMs: number;
+    readonly fetchImpl?: typeof fetch;
+}
+/**
+ * 对中心发一条请求。返回响应与**这次请求所用凭证的身份**(调用方据此给拿回来的候选打分箱标记,
+ * 见 `boot/config-center.ts` 的 LKG / prompt 状态分箱)。
+ */
+export declare function centerFetch(center: CenterEndpoint, route: CenterRoute, init: CenterRequestInit): Promise<{
+    res: Response;
+    identity: string;
+}>;
+//# sourceMappingURL=center-request.d.ts.map

package/dist/config-center/center-request.js

@@ -0,0 +1,71 @@
+import settingsSchemaPackage from "@sema-agent/settings-schema/package.json" with { type: "json" };
+import { CenterCredentialUnavailableError } from "../center-credential.js";
+export const SCHEMA_MAJOR_HEADER = "x-sema-schema-major";
+export const SETTINGS_SCHEMA_MAJOR = (() => {
+    const version = settingsSchemaPackage.version;
+    const m = /^(\d+)\.\d+\.\d+/.exec(version);
+    if (m === null)
+        throw new Error(`cannot derive ${SCHEMA_MAJOR_HEADER}: @sema-agent/settings-schema package.json has version ${JSON.stringify(version)}`);
+    return m[1];
+})();
+export function pullViewQuery(view) {
+    const parts = [];
+    if (view.principal !== undefined)
+        parts.push(`principal=${encodeURIComponent(view.principal)}`);
+    if (view.worker)
+        parts.push(`worker=${encodeURIComponent(view.worker)}`);
+    return parts.length === 0 ? "" : `?${parts.join("&")}`;
+}
+function contentRoot(kind) {
+    switch (kind) {
+        case "user-jwt":
+            return "/api/v1/me";
+        case "pull-token":
+        case "none":
+            return "/api/config";
+    }
+}
+function routePath(route, kind) {
+    switch (route.kind) {
+        case "effective":
+            return `/api/config/effective${pullViewQuery(route)}`;
+        case "skill-content":
+            return `${contentRoot(kind)}/skills/content/${encodeURIComponent(route.contentHash)}`;
+        case "prompt-artifact":
+            return `${contentRoot(kind)}/prompts/epoch-artifacts/${encodeURIComponent(route.digest)}`;
+        case "prompt-blob":
+            return `${contentRoot(kind)}/prompts/blobs/${encodeURIComponent(route.digest)}`;
+        case "fleet-leases":
+            return "/api/fleet/leases";
+        case "fleet-instances":
+            return "/api/fleet/instances";
+        case "fleet-usage":
+            return "/api/fleet/usage";
+        case "execution-keys":
+            return "/api/config/execution-keys";
+    }
+}
+export async function centerFetch(center, route, init) {
+    const scheme = new URL(center.baseUrl).protocol;
+    if (scheme !== "http:" && scheme !== "https:")
+        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
+    const cred = center.credential.read();
+    if (!cred.ok)
+        throw new CenterCredentialUnavailableError(cred.reason);
+    const headers = { [SCHEMA_MAJOR_HEADER]: SETTINGS_SCHEMA_MAJOR };
+    if (cred.kind !== "none")
+        headers.authorization = `Bearer ${cred.bearer}`;
+    if (init.json !== undefined)
+        headers["content-type"] = "application/json";
+    if (init.etag)
+        headers["if-none-match"] = init.etag;
+    const url = `${center.baseUrl.replace(/\/+$/, "")}${routePath(route, cred.kind)}`;
+    const res = await (init.fetchImpl ?? fetch)(url, {
+        method: init.method ?? "GET",
+        headers,
+        ...(init.json !== undefined ? { body: JSON.stringify(init.json) } : {}),
+        signal: AbortSignal.timeout(init.timeoutMs),
+    });
+    return { res, identity: cred.identity };
+}
+//# sourceMappingURL=center-request.js.map

package/dist/config-center/http-client.d.ts

@@ -1,6 +1,7 @@
 import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
 import type { ScenarioRuling } from "../capabilities/scenarios.js";
 import type { EffectiveConfig, ExecutionRuling } from "./types.js";
+import { type CenterEndpoint } from "./center-request.js";
 /** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
  *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
  *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
@@ -12,8 +13,11 @@ import type { EffectiveConfig, ExecutionRuling } from "./types.js";
  *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
  *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
  *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
- *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。 */
-export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+ *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。
+ *
+ *  `credentialIdentity`(S-651 / [ref] E-15):这次拉取所用凭证的身份(`center-credential.ts`)。调用方拿它给
+ *  候选打分箱标记 —— LKG / prompt 活动状态只许落进**拉到它的那个身份**的箱。 */
+export declare function fetchEffective(center: CenterEndpoint, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     effective: EffectiveConfig;
     etag?: string;
     domainErrors?: Array<{
@@ -21,6 +25,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
         error: string;
     }>;
     readWarnings: readonly EffectiveReadWarning[];
+    credentialIdentity: string;
 } | null>;
 /**
  * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
@@ -41,7 +46,7 @@ export declare function fetchEffective(baseUrl: string, token: string, etag: str
  * fail-closes (core then DENIES the optional `allowWorkflows` cap — an outage must never silently GRANT). ETag is
  * content-hashed (`p-<hash>`); an `if-none-match` poll is cheap. Mirrors `fetchEffective` (Bearer + 8s + scheme guard).
  */
-export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
+export declare function fetchPrincipalCaps(center: CenterEndpoint, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
     runtimeCaps: EntitlementRuntimeCaps | null;
     configured: boolean;
     scenario?: ScenarioRuling;
@@ -68,7 +73,7 @@ export declare function fetchPrincipalCaps(baseUrl: string, token: string, princ
  * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
  * 因此 304 在传输层就是 fail-loud。
  */
-export declare function fetchPrincipalOrgMemory(baseUrl: string, token: string, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
+export declare function fetchPrincipalOrgMemory(center: CenterEndpoint, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
 /** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
  *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
 export declare class ConfigCenterHttpError extends Error {
@@ -76,18 +81,21 @@ export declare class ConfigCenterHttpError extends Error {
     constructor(message: string, status: number);
 }
 /**
- * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
+ * Fetch one skill's body by content hash (`GET <content root>/skills/content/<hash>`, Bearer; the root is
+ * `/api/v1/me` for a user-JWT credential and `/api/config` otherwise — center-request.ts) and VERIFY its
  * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
  * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
  * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
  * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
  * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".
  */
-export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
+export declare function fetchSkillContent(center: CenterEndpoint, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
 /** [ref]b / [ref]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
  *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
  *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
- *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。 */
-export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
-export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
+ *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。路径根按凭证种类(B-5,center-request.ts)。
+ *  ⚠️ 现状(S-651 取证车MS 总表第 8 条):`fetchPromptBlob` 在 `src/` 里**没有生产调用点**,真走得到的内容
+ *  拉取只有 skill 正文与 prompt 产物两条;它与另两条共用同一张路由表,本批不为它新接线。 */
+export declare function fetchPromptArtifact(center: CenterEndpoint, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
+export declare function fetchPromptBlob(center: CenterEndpoint, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/config-center/http-client.js

@@ -2,15 +2,11 @@ import { createHash } from "node:crypto";
 import { readEffectiveWire, PrincipalCapsWire } from "@sema-agent/settings-schema";
 import { centerPromptsFromEffective } from "../prompts-domain-validate.js";
 import { foldEffectiveReadWarning } from "./read-warnings.js";
-export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective${worker ? `?worker=${encodeURIComponent(worker)}` : ""}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+import { centerFetch } from "./center-request.js";
+import { answerStillCurrent } from "../center-credential.js";
+const CENTER_PULL_TIMEOUT_MS = 8000;
+export async function fetchEffective(center, etag, fetchImpl = fetch, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (res.status === 304)
         return null;
     if (!res.ok)
@@ -29,10 +25,10 @@ export async function fetchEffective(baseUrl, token, etag, fetchImpl = fetch, wo
             domainErrors.push(f);
     }
     const effective = wire;
-    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
+    return { effective, etag: res.headers.get("etag") ?? undefined, readWarnings: warnings, credentialIdentity: identity, ...(domainErrors.length > 0 ? { domainErrors } : {}) };
 }
-export async function fetchPrincipalCaps(baseUrl, token, principal, etag, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker);
+export async function fetchPrincipalCaps(center, principal, etag, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, etag, fetchImpl, worker);
     if (raw === null)
         return null;
     const parsedBody = PrincipalCapsWire.safeParse(raw.json);
@@ -84,31 +80,29 @@ function assertPrincipalEcho(echoed, principal) {
         throw new Error(`config-center principal-caps response echoes principal ${JSON.stringify(echoed)} but ${JSON.stringify(principal)} was requested — discarding the whole response`);
     }
 }
-async function requestPrincipalView(baseUrl, token, principal, etag, fetchImpl, worker) {
-    const scheme = new URL(baseUrl).protocol;
-    if (scheme !== "http:" && scheme !== "https:")
-        throw new Error(`SEMA_REGISTRY_URL must be http(s), got "${scheme}"`);
-    const params = new URLSearchParams({ principal });
-    if (worker)
-        params.set("worker", worker);
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/effective?${params.toString()}`;
-    const res = await fetchImpl(url, {
-        headers: { authorization: `Bearer ${token}`, ...(etag ? { "if-none-match": etag } : {}) },
-        signal: AbortSignal.timeout(8000),
-    });
+async function requestPrincipalView(center, principal, etag, fetchImpl, worker) {
+    const { res, identity } = await centerFetch(center, { kind: "effective", principal, worker }, { etag, timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
+    const stillCurrent = () => {
+        if (!answerStillCurrent(center.credential, identity)) {
+            throw new Error("center credential identity changed while the principal view was in flight — response discarded; the next lookup runs under the current credential");
+        }
+    };
     if (res.status === 304) {
         if (!etag)
             throw new Error("config-center returned 304 to a non-conditional principal-caps request");
+        stillCurrent();
         return null;
     }
     if (!res.ok)
         throw new Error(`config-center principal-caps HTTP ${res.status}`);
     const responseEtag = res.headers.get("etag");
-    return { json: await res.json(), ...(responseEtag !== null ? { etag: responseEtag } : {}) };
+    const json = await res.json();
+    stillCurrent();
+    return { json, ...(responseEtag !== null ? { etag: responseEtag } : {}) };
 }
 const PrincipalOrgMemoryEnvelope = PrincipalCapsWire.pick({ principal: true, orgMemory: true });
-export async function fetchPrincipalOrgMemory(baseUrl, token, principal, fetchImpl = fetch, worker) {
-    const raw = await requestPrincipalView(baseUrl, token, principal, undefined, fetchImpl, worker);
+export async function fetchPrincipalOrgMemory(center, principal, fetchImpl = fetch, worker) {
+    const raw = await requestPrincipalView(center, principal, undefined, fetchImpl, worker);
     if (raw === null)
         throw new Error("config-center returned 304 to a non-conditional org-directory fetch");
     const parsed = PrincipalOrgMemoryEnvelope.safeParse(raw.json);
@@ -126,9 +120,8 @@ export class ConfigCenterHttpError extends Error {
         this.name = "ConfigCenterHttpError";
     }
 }
-export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/skills/content/${encodeURIComponent(contentHash)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchSkillContent(center, contentHash, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "skill-content", contentHash }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`skill content HTTP ${res.status} for ${contentHash}`, res.status);
     const content = await res.text();
@@ -138,16 +131,14 @@ export async function fetchSkillContent(baseUrl, token, contentHash, fetchImpl =
         throw new Error(`skill content hash mismatch for ${contentHash}: computed sha256:${got}`);
     return content;
 }
-export async function fetchPromptArtifact(baseUrl, token, artifactDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/epoch-artifacts/${encodeURIComponent(artifactDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptArtifact(center, artifactDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-artifact", digest: artifactDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt artifact HTTP ${res.status} for ${artifactDigest}`, res.status);
     return await res.json();
 }
-export async function fetchPromptBlob(baseUrl, token, contentDigest, fetchImpl = fetch) {
-    const url = `${baseUrl.replace(/\/+$/, "")}/api/config/prompts/blobs/${encodeURIComponent(contentDigest)}`;
-    const res = await fetchImpl(url, { headers: { authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(8000) });
+export async function fetchPromptBlob(center, contentDigest, fetchImpl = fetch) {
+    const { res } = await centerFetch(center, { kind: "prompt-blob", digest: contentDigest }, { timeoutMs: CENTER_PULL_TIMEOUT_MS, fetchImpl });
     if (!res.ok)
         throw new ConfigCenterHttpError(`prompt blob HTTP ${res.status} for ${contentDigest}`, res.status);
     const bytes = new Uint8Array(await res.arrayBuffer());

package/dist/config-center/skills-mcp.d.ts

@@ -2,6 +2,7 @@ import type { A2aServerSpec, McpServerSpec } from "@sema-agent/core";
 import type { CenterMcp, ScopedA2aPeer } from "../config-types.js";
 import type { Logger } from "../observability/logger.js";
 import type { LoadedSkill } from "../capabilities/skills.js";
+import type { CenterEndpoint } from "./center-request.js";
 import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./types.js";
 /**
  * Merge center skills OVER the image baseline ([ref]-sibling B1; `sema-registry docs/MCP-SKILLS.md`). Load order =
@@ -13,7 +14,9 @@ import type { CenterA2aPeer, CenterMcpServer, CenterSkillManifest } from "./type
  */
 export declare function applyCenterSkills(baseline: LoadedSkill[], manifest: {
     skills: CenterSkillManifest[];
-}, baseUrl: string, token: string, logger?: Logger, fetchImpl?: typeof fetch, 
+}, 
+/** S-651:中心端点(基址 + 凭证来源;每次正文拉取取一次值)。 */
+center: CenterEndpoint, logger?: Logger, fetchImpl?: typeof fetch, 
 /** LKG 姊妹面(clay 拍 2026-07-18):skill 正文的 content-addressed 盘缓存目录。读序=内存→盘(验
  *  hash,坏文件忽略)→中心(成功后 best-effort 回写)。让 LKG-boot 在中心不可达时不再于正文拉取上
  *  挂数秒(live 实测黑洞 +5.3s/skill 批),顺带省正常 refresh 的重复拉取。undefined=无盘缓存(原行为)。 */

package/dist/config-center/skills-mcp.js

@@ -5,7 +5,7 @@ import { CONTENT_ORIGIN_WORDS, describeBadContentOrigin, isContentOriginWord } f
 import { fetchSkillContent } from "./http-client.js";
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { describeBadWireName, isUsableWireName } from "../wire-name-bound.js";
-export async function applyCenterSkills(baseline, manifest, baseUrl, token, logger, fetchImpl = fetch, diskCacheDir) {
+export async function applyCenterSkills(baseline, manifest, center, logger, fetchImpl = fetch, diskCacheDir) {
     const { promises: fsp } = await import("node:fs");
     const { join: joinPath } = await import("node:path");
     const diskRead = async (hash) => {
@@ -50,7 +50,7 @@ export async function applyCenterSkills(baseline, manifest, baseUrl, token, logg
             if (content === undefined)
                 content = await diskRead(m.contentHash);
             if (content === undefined) {
-                content = await fetchSkillContent(baseUrl, token, m.contentHash, fetchImpl);
+                content = await fetchSkillContent(center, m.contentHash, fetchImpl);
                 diskWrite(m.contentHash, content);
             }
             contentCache.set(m.contentHash, content);

package/dist/config-invariants.d.ts

@@ -28,9 +28,9 @@ import type { ServiceConfigFlat } from "./config-types.js";
  */
 export declare const LIVENESS_HEARTBEAT_MS = 30000;
 /** 闭集:新增一条不变量必须在这里加词(拼错 = 编译红,而不是运行期悄悄不判)。 */
-export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane" | "hosted-requires-principal";
+export type CrossInvariantId = "run-stale-heartbeat" | "bind-posture" | "bake-runner-credential" | "direct-door-anchors" | "operator-principals-required" | "bake-operator-principals" | "sensitive-write-patterns" | "leader-host-lane" | "leader-durable-store" | "device-durable-store" | "device-durable-approval" | "model-provider-word" | "gateway-url-userinfo" | "model-route-endpoint" | "require-execution-lane";
 /** 表读的键集(取自平铺配置型 ⇒ 键名/类型永不与真配置漂)。 */
-export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models" | "authBridgeIssuer">>;
+export type CrossInvariantView = Readonly<Pick<ServiceConfigFlat, "runStaleSec" | "authToken" | "authTokens" | "allowUnauthedWrites" | "imageBakes" | "directApprovalDoor" | "durableApproval" | "approvalHmacKeys" | "principalJwtPubkeys" | "principalJwtIss" | "principalJwtAud" | "requirePrincipal" | "operatorPrincipals" | "sensitiveWritePatterns" | "leaderEnabled" | "remoteExec" | "requireExecutionLane" | "dbBackend" | "tidb" | "pg" | "envModel" | "gatewayBaseUrl" | "gatewayFallbackUrls" | "anthropic" | "models">>;
 export interface CrossInvariantInput {
     /** 现役配置(boot 期 = 候选自身)。 */
     readonly live: CrossInvariantView;

package/dist/config-invariants.js

@@ -1,5 +1,4 @@
 import { assertGuardPatternsUsable } from "./deployment-governance.js";
-import { hostedPrincipalRefusal } from "./hosted-posture.js";
 import { modelProviderRefusal } from "./model-provider.js";
 import { modelRouteUrlRefusal } from "./model-route-url.js";
 import { modelRouteEndpointRefusal } from "./model-route-endpoint.js";
@@ -82,13 +81,6 @@ export const CONFIG_CROSS_INVARIANTS = [
             ? "IMAGE_BAKES_ENABLED with an EMPTY OPERATOR_PRINCIPALS is a world-writable bake door (the runner runs build.sh on the privileged build host)"
             : undefined,
     },
-    {
-        id: "hosted-requires-principal",
-        keys: ["requirePrincipal", "principalJwtPubkeys", "principalJwtIss", "principalJwtAud", "authBridgeIssuer"],
-        restartReason: "hosted-posture",
-        bootAnchor: { file: "src/config.ts", marker: "CROSS-INVARIANT:hosted-requires-principal" },
-        check: ({ next }) => hostedPrincipalRefusal(next),
-    },
     {
         id: "sensitive-write-patterns",
         keys: ["sensitiveWritePatterns"],

package/dist/config-lkg.d.ts

@@ -1,8 +1,10 @@
 /** 落盘信封。`effective`/`etag` 逐字=当时的 fetchEffective 返回(JSON verbatim 面)。 */
 export interface PersistedLkg {
-    formatVersion: 1;
+    formatVersion: 2;
     savedAt: string;
     worker: string;
+    /** 拉到这份候选时所用凭证的身份(`center-credential.ts`;摘要形,不含凭证原文)。 */
+    identity: string;
     etag?: string;
     effective: Record<string, unknown>;
 }
@@ -10,21 +12,58 @@ export interface PersistedLkg {
  *  hash 另拉)——黑洞中心下 LKG-boot 会在 skill 正文拉取上再挂数秒(live 实测 +5.3s)。正文按
  *  `<dir>/<sha-hex>` 落盘,读侧**必验 hash**(content-addressed 的全部意义;坏文件=忽略重拉)。 */
 export declare function defaultSkillCacheDir(): string;
-/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema)。`CONFIG_LKG_PATH` 覆写;
- *  `CONFIG_LKG_ENABLED=false` 关闭(读写双关)。🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是
- *  **fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
-export declare function defaultLkgPath(worker: string | undefined): string;
+/** 默认路径(scheduler store 同门:SEMA_CONFIG_DIR → ~/.sema),按「worker + 凭证身份」分箱。`CONFIG_LKG_PATH`
+ *  覆写(单一路径 ⇒ 不分箱,信封的 worker + identity 核仍守读回);`CONFIG_LKG_ENABLED=false` 关闭(读写双关)。
+ *  🪦 正名前的 `CONFIG_LKG_DISABLED` 自 server 3.0.0 起是**fail-loud 墓碑**——设了(任何值)即拒启并指路新名,不再被读取。 */
+export declare function defaultLkgPath(worker: string | undefined, identity: string): string;
 /** 原子落盘一个干净候选(tmp+rename,0600)。BEST-EFFORT:失败=一条 warn 的素材(调用方发),绝不
  *  影响在飞的应用链——LKG 缓存丢失的代价只是下次冷启动回到 env 兜底。 */
-export declare function saveLkg(path: string, worker: string | undefined, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
+export declare function saveLkg(path: string, worker: string | undefined, identity: string, effective: Record<string, unknown>, etag: string | undefined): Promise<void>;
 /**
  * 读盘上 LKG。返回 undefined 的所有情形都「安静地回 env 兜底」(调用方 warn 点名 reason):
- * 文件缺席/JSON 坏/信封形不对/worker 不匹配(防同名文件跨 worker 串包)/prompts 面复判失败。
+ * 文件缺席/JSON 坏/信封形不对/worker 或凭证身份不匹配(防同名文件跨 worker / 跨账号串包;`CONFIG_LKG_PATH`
+ * 单一路径时这是唯一的一道)/prompts 面复判失败。
  */
-export declare function loadLkg(path: string, worker: string | undefined): Promise<{
+export declare function loadLkg(path: string, worker: string | undefined, identity: string): Promise<{
     lkg: PersistedLkg;
 } | {
     lkg?: undefined;
     reason: string;
 }>;
+/** 7.98.0 及以前的默认 LKG 路径(按当时的写法逐字保留 —— 这是盘上已有文件的名字,不是现行分箱规则)。 */
+export declare function legacyV1LkgPath(worker: string | undefined): string;
+export type LegacyLkgMigration = {
+    readonly outcome: "none";
+}
+/** `retireError`:新箱已写好,只是旧文件没退役成(改名 / 留副本失败)—— 只响一行,不影响已写好的箱。 */
+ | {
+    readonly outcome: "migrated";
+    readonly from: string;
+    readonly retiredTo: string;
+    readonly retireError?: string;
+} | {
+    readonly outcome: "not-migrated";
+    readonly path: string;
+    readonly reason: string;
+};
+/**
+ * formatVersion 1 LKG 的一次性迁移(规则一句:**身份推得出来才迁,推不出来就响亮拒**)。判序:
+ *  1. `legacyPath` ≠ `binPath` 时**先看本身份的箱**:箱里已有文件 ⇒ `none`(箱自己说话,旧文件是好是坏都不再相关,
+ *     不许一个坏旧文件把有效的箱挡成 env 兜底 —— 7.99.0 修复验证 N4)。箱查不了(非 ENOENT)⇒ 响亮拒。
+ *  2. 旧文件没有(ENOENT / ENOTDIR)或不是 formatVersion 1 信封 ⇒ `none`。旧默认路径上却读不了 / 不是 JSON ⇒
+ *     `not-migrated`(响亮,不当它不存在);`CONFIG_LKG_PATH` 同路径时这两形由 loadLkg 自己报(不重复打一行)。
+ *  3. v1 信封只记 worker:唯一推得出身份的形是拉取令牌(身份 = worker,`pullTokenIdentity`)。此刻身份正是它、worker
+ *     对得上、载荷过 {@link lkgPayloadProblem} ⇒ **先写后退役**(修复验证 N9):先按新格式把它写进 `binPath`(原子写,
+ *     0600),写成了才把旧文件改名 `<legacyPath>.migrated-v1`。写失败 ⇒ `not-migrated`,旧文件原样留在原位,下一次
+ *     照常可迁;写成之后改名失败 ⇒ 仍是 `migrated`(`retireError` 响一行),箱已在 ⇒ 下一次按判序 1 不再看旧文件。
+ *     同路径(`CONFIG_LKG_PATH`)时新箱的写入会原子替换旧文件本身,所以旧字节在写之前留一份 `.migrated-v1` 副本
+ *     (副本失败同样只进 `retireError`:载荷正要写进新箱,不是丢数据)。
+ *  4. 其余一律 `not-migrated`:拒因点名旧文件路径与出路(删掉它;中心下一份干净候选会写本身份自己的 LKG),不改名、不读回。
+ */
+export declare function migrateV1Lkg(o: {
+    legacyPath: string;
+    binPath: string;
+    worker: string | undefined;
+    identity: string;
+}): Promise<LegacyLkgMigration>;
 //# sourceMappingURL=config-lkg.d.ts.map