@sema-agent/settings-schema 10.1.0 → 11.0.0

package/dist/config-fns.d.ts

@@ -1,6 +1,6 @@
 /**
- * Pure config functions + data shapes — LIFTED verbatim out of sema-registry's `store.ts` (the half that
- * depends only on `./types`, zero app/DB/next coupling). sema-registry re-exports these so its existing
+ * Pure config functions + data shapes — LIFTED verbatim out of web-admin's `store.ts` (the half that
+ * depends only on `./types`, zero app/DB/next coupling). web-admin re-exports these so its existing
  * `@/lib/config` importers keep working unchanged (ONE copy of the code, here).
  *
  * Two DETERMINISM refactors vs. the original store.ts (so the package is wall-clock-free and a local file
@@ -10,45 +10,22 @@
  *   2. `emptyEffective()` seeds the epoch (`new Date(0).toISOString()`) instead of the wall clock, matching
  *      the stores' existing "epoch sentinel" reduce seed.
  *
- * The fat `ConfigStore` interface itself STAYS in sema-registry (app-only, ~32 publish/RBAC/worker-status
+ * The fat `ConfigStore` interface itself STAYS in web-admin (app-only, ~32 publish/RBAC/worker-status
  * methods); only the narrow {@link ConfigReader} (reader.ts) is carried here.
  */
 import { z } from "zod";
-import { type DomainConfig, type DomainName, type EffectiveConfig, type EffectiveWire } from "./types.js";
-/** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
- *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
- *  space-spanning auth credentials (`Bearer <token>`) FIRST (the token pass can't see across the space), then
- *  any secret-shaped run (`%` kept in the run so a percent-encoded secret stays whole for the percent-aware
- *  containsSecretToken). invariant ①: a secret VALUE never rides an error. R13/R14.
- *
- *  **Output invariant** (S-712 verification pass N1 + codex review [high] ×2; 6.3.0): a string holding a private-key
- *  PEM header ANYWHERE ({@link PRIVATE_KEY_PEM_HEADER}) in ANY of its {@link secretScanForms} `forms` is withheld WHOLE, a
- *  string whose normalization did not finish (`unresolved`) is withheld WHOLE, and no result trips `containsSecretToken` on
- *  any of its forms.
- *  The whole-string judgement is ONE rule — both detectors run over the normalized forms: the PEM header on every form of
- *  the ORIGINAL text, `containsSecretToken` on every form of the targeted result; what could not be normalized does not go
- *  out (6.3.0, codex r1 F1: `-----BEGIN+PRIVATE+KEY` form-encoded headers and four-layer encodings both rode out).
- *  6.3.0 (codex review of v6.1.0 [high]): `key=` + a percent-encoded PEM showed its header only on a decoded form
- *  (`-----BEGIN%20PRIVATE%20KEY` — `%20` is not in `[A-Z0-9 ]`), and the detector's anchored decode missed it behind
- *  the `key=` prefix, so the whole key rode out through coordinates, zod `received` / `message` and entry identity.
- *  The PEM header is judged BEFORE any replacement: the token pass can rewrite the header itself away
- *  (`sk-note:-----BEGIN` is one token-charset run that starts with `sk-`, so it becomes `[redacted-secret]` and the
- *  key body after it would ride out untouched — codex verification round). A PEM header carries spaces, so the
- *  targeted passes can never isolate it. Every free-text warning face that goes through here (coordinates, error text)
- *  inherits the same guarantee; the entry identity face additionally has to be an identifier ({@link isDisclosableIdentity}).
- *  Write and display read the private-key header at the same PLACE and with the same regex since 10.0.0: the validation-side
- *  detector `containsSecretToken` reads {@link PRIVATE_KEY_PEM_HEADER} anywhere in a string too, on the raw text and its first three
- *  percent layers. They do NOT yet read the same FORMS: this redactor reads more (deeper layers, the `+` and boundary readings of
- *  `secretScanForms`), so a header spelled only in one of those forms is withheld on display but still passes write validation —
- *  an open gap (a pin in the 10.0.0 test file registers it), not a contract. The redactor also keeps its own PEM check on the ORIGINAL
- *  text's forms because the token pass above can rewrite the header away before `containsSecretToken` ever sees the result. */
+import { type DomainConfig, type DomainName, type EffectiveConfig, type EffectiveWire, type RetiredDomainName } from "./types.js";
 export declare function redactSecrets(text: string): string;
-/** Sanitize a ZodError IN PLACE so no surfaced error (message / `received` / nested `unionErrors`) echoes a
- *  pasted secret. RECURSES into `unionErrors` (a `z.union` failure nests a ZodError per member — e.g. RoleTarget
- *  `{model}|{select}`) and redacts string path segments too. The ONE sanitizer every validation entry point
- *  uses (parseDomain / validateDomain / validateRemoteExec / write*). R14. */
+/** Sanitize a ZodError IN PLACE so no surfaced error (message / any issue field / nested issues) echoes a pasted secret.
+ *  Every string an issue carries is redacted, string path segments included, and the walk RECURSES into the issues zod nests
+ *  inside an issue — `invalid_union.errors` (one issue list per union member, e.g. RoleTarget `{model}|{select}`) and
+ *  `invalid_key` / `invalid_element`.issues — because a nested issue's message can echo the same value. Non-string path
+ *  segments other than numbers (zod types a path as `PropertyKey[]`) leave as their redacted `String()` form, so a path read
+ *  off a sanitized error is always `string | number`. The error's `message` is re-derived from the
+ *  sanitized issues at the end (zod caches it on first read, so an earlier read would otherwise keep the raw text).
+ *  The ONE sanitizer every validation entry point uses (parseDomain / validateDomain / validateRemoteExec / write*). R14. */
 export declare function sanitizeZodError(err: z.ZodError): z.ZodError;
-/** Result of a CAS write (sema-registry's `ConfigStore.setDomainsIfUnchanged`): applied (new `version`) or
+/** Result of a CAS write (web-admin's `ConfigStore.setDomainsIfUnchanged`): applied (new `version`) or
  *  rejected because the version moved (`currentVersion` = what it is now, so the caller can re-read + retry). */
 export type CasWriteResult = {
     ok: true;
@@ -57,10 +34,10 @@ export type CasWriteResult = {
     ok: false;
     currentVersion: number;
 };
-/** sema-registry's lifecycle bookkeeping for one worker (its OWN clock — design/25 决策3). */
+/** web-admin's lifecycle bookkeeping for one worker (its OWN clock — design/25 决策3). */
 export interface WorkerLifecycleRecord {
     name: string;
-    /** when sema-registry FIRST saw this worker — TTL is measured from here. */
+    /** when web-admin FIRST saw this worker — TTL is measured from here. */
     firstSeenAt: string;
     /** last time the reverse-proxy saw traffic to it (idle detection). */
     lastActiveAt?: string;
@@ -153,6 +130,19 @@ export interface PublishedSnapshot {
  *  Seeds the epoch (`new Date(0)`) so it's deterministic (the wall-clock default was the original store.ts
  *  non-determinism — see the file header). */
 export declare function emptyEffective(): EffectiveConfig;
+/**
+ * 一个**retired 域**的文档带着事实 —— 读存储文档的每个读者同一只拒(`parseDomain` 写、`buildEffective` 向店要、`readEffectiveWire` 看 wire、
+ * `FileConfigStore` 与 `readBundle` 读 `config.d/`)。`message` 是墓碑表那一行的整句(点名retired版本、事实今天住哪、改写存量的一次性迁移);
+ * `code` 是机读码,`domain` / `migration` 是那一行的两格。墓碑是拒,不是读法:它从不把旧文档读成任何值。
+ */
+export declare class RetiredDomainError extends Error {
+    readonly domain: RetiredDomainName;
+    readonly code: "retired_domain";
+    readonly migration: string;
+    constructor(domain: RetiredDomainName);
+}
+/** 墓碑判一次:`raw` 是retired 域 `domain` 的文档,带事实 ⇒ 抛 {@link RetiredDomainError}。 */
+export declare function refuseRetiredDomain(domain: RetiredDomainName, raw: unknown): void;
 /** Validate + fill defaults for a domain payload (or the schema's empty default when absent/invalid). */
 export declare function parseDomain<K extends DomainName>(domain: K, raw: unknown): DomainConfig[K];
 /** 一条告警的**坐标**:从域文档根出发的段序列。字符串段 = 对象键(逐字,含 `.` 也逐字);数字段 =
@@ -173,6 +163,16 @@ export type ConfigPath = readonly (string | number)[];
  *  **刻意不提供 parse 反函数**:2.1.0 起没有任何一处把坐标读回来(回写走 `keptIndex` 那本账),给它
  *  一个反函数就是给下一个人一条「在串上做事」的路。 */
 export declare function formatConfigPath(p: ConfigPath): string;
+/** 带用户写的键段的坐标出门前的**唯一**一道(6.3.0,codex r1 F2):字符串段过 {@link outgoingSegment} —— 与 `error` 文案
+ *  ({@link sanitizeZodError})、身份否决({@link isDisclosableIdentity})**同一只**脱敏器,不另设判据;数字段(下标)原样。
+ *  键段是用户写的,完全可能就是一条粘错位置的凭据:被丢 Record 条目的键、未知键告警(`unknown-keys-dropped` /
+ *  `-carried`)的键名都一样(后者 0.19.0 起从不过脱敏器,`sk-…` 形的未知键名原样进告警与投影)。schema 已知的字段名
+ *  脱敏器原样放行,所以坐标里「它是哪个字段」照旧可读。经它的坐标就是出门形 —— {@link droppedKeys} /
+ *  {@link carriedUnknownKeys} 这两只扫描交给告警的 `keys` 同样是它的产物。
+ *
+ *  11.0.0 起导出:读告警之外还有两处铸坐标的面 —— 一次性迁移的收据(`./one-time-migrations`)与 workers 的逐行终判(`readWorkersRows`
+ *  的 `held[].field`),它们与告警走同一道,不另抄一份判据;消费方自己拼坐标出门(日志 / 界面)时也调它。 */
+export declare function outgoingPath(p: ConfigPath): ConfigPath;
 /** 一条被丢掉的条目的**身份**(S-712):只从被丢条目**原文**里取,三键各自可缺。
  *
  *  律(一条,不分域):`name` / `id` 取**字符串**形、`enabled` 取**布尔**形,类型不对 ⇒ 不带该键(不猜、
@@ -181,8 +181,9 @@ export declare function formatConfigPath(p: ConfigPath): string;
  *  {@link redactSecrets} 原样放行 —— 坐标段必须在场,所以打码出门;身份是可缺的,打过码的串不再是任何条目的身份,
  *  所以是**不带**而不是打码)。三键都读不出 ⇒ 整个身份缺席(不铸空对象)。
  *
- *  **缺席 = 读不出**(不是字符串,或是字符串但不能原样出门),两种原因刻意不分:对消费方的正确处置相同
- *  (身份未知 ⇒ 按未知处置,例如 fail-closed),而一个「被扣下」的标记本身就在说「这里有一段像凭据的东西」。
+ *  **扣名 ≠ 读不出**(11.0.0,N-4 / S-759):`name` / `id` 是字符串但不能原样出门 ⇒ 身份带 `nameWithheld: true` / `idWithheld: true`;
+ *  不是字符串 ⇒ 什么都不带。两种处置对消费方不同:「这一行在场、有名、名被扣下」的启用行仍是一条在场的条目(server 据此铸无名占位,
+ *  不走「零启用」捷径),「没有名」的行不是。标记只说「有一个名、没给出」,不说为什么(秘密形 / 超长 / 字符集外是同一个记号)。
  *
  *  为什么要带:条目被丢之后它的名字从目录里消失,只给坐标的话,消费方要知道「丢的是谁」只能拿坐标回读
  *  原文档 —— 而它手里那份原文档未必是这一次读到的那份。铸告警的这一层判的就是那条原文,在这里取一次、
@@ -191,6 +192,10 @@ export interface DroppedEntryIdentity {
     name?: string;
     id?: string;
     enabled?: boolean;
+    /** `name` was a string that {@link isDisclosableIdentity} would not let out (11.0.0). Absent with a `name` present or with no string name. */
+    nameWithheld?: true;
+    /** `id` was a string that {@link isDisclosableIdentity} would not let out (11.0.0). */
+    idWithheld?: true;
 }
 /**
  * 一条条目为什么被丢 —— **机读原因**的闭集(S-1295)。词与**丢弃点**一一对应:`DroppedEntry` 只有一个铸点
@@ -202,8 +207,7 @@ export interface DroppedEntryIdentity {
  * 为什么是词而不是 `error` 句:句子随 zod 小版本改字、可经脱敏,拿它当判据就是拿实现当契约;wire 上也不许有自由文本。
  * 这张表由 `test/dropped-entry-reason-code-s1295.test.ts` 的两格咬住:穷举 `switch`(给表加词而不补臂 ⇒ `tsc` 红,门 = `npm run typecheck`)与
  * 满射格(每个词至少有一个真丢弃点触发它 = 没有死词;每个被丢条目的词都在表里 = 没有无词的丢弃点)。
- * 边界(如实登记):本表只管 `salvageEntries` 铸的 {@link DroppedEntry};读路径上另一条按名剔条目的臂
- * (`hosts-grandfathered`,主机名超长)走它自己的告警臂,不是 `DroppedEntry`,不在本表。
+ * 读路径上剔条目的只有 `salvageEntries` 这一处(11.0.0 起 hosts 的读侧夹紧臂已retired),所以本表覆盖读路径上每一条被丢的条目。
  */
 export declare const DROPPED_ENTRY_REASON_CODES: readonly ["entry-schema-invalid", "entry-key-invalid", "entry-unreadable"];
 export type DroppedEntryReasonCode = (typeof DROPPED_ENTRY_REASON_CODES)[number];
@@ -232,8 +236,8 @@ export declare const DISCLOSABLE_IDENTITY_RE: RegExp;
  *   ② **否决**(「无密钥形」):坐标脱敏器 {@link redactSecrets} 原样放行 —— 集内照样有密钥形(`sk-…` / `ghp_…` /
  *      `AKIA…` / 三段 JWT 的字符全在集内),而且判它的必须是坐标段、`error` 文案({@link sanitizeZodError})用的**同一只**
  *      脱敏器:两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现;集内的残例 = `@` 之后的单点 `eyJ…` 串,裸探测器
- *      判阴、脱敏器会改,语料 c41 钉着);∧ 不是带 userinfo 的 URL —— 校验侧 `NON_SECRET_URL` 拒写的同一只判定
- *      (`carriesUserinfo`,包内私有;opus 腿 L1:`postgres://svc:pw@h` 的字符全在集内)。
+ *      判阴、脱敏器会改,语料 c41 钉着)。带 userinfo 的 URL(opus 腿 L1:`postgres://svc:pw@h` 的字符全在集内)由同一只脱敏器扣下
+ *      (11.0.0 S-811 起它对 URL 候选段问 `carriesUserinfo`),不再单列一条否决。
  *  入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些字符串答 false,谓词形会让调用方的
  *  否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判(运行期收到非字符串照答 false、不抛)。
  *  不可披露的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
@@ -255,7 +259,7 @@ export declare function isReportableRefusalName(name: string): boolean;
  *  不动其余键的坐标。 */
 export type EntryKeptIndex = Readonly<Record<string, readonly number[]>>;
 /** {@link salvageEntries} 的结果。`raw` 是剔掉坏条目后的文档;**什么都没丢时返回原引用**
- *  (与 {@link grandfatherHostsRead} 同纪律:好数据穿过读路径 byte 不变)。
+ *  (好数据穿过读路径 byte 不变)。
  *
  *  `keptIndex`(2.1.0)是抢救**自带**的坐标账:`raw` 里的数组被压缩了,谁拿这份压缩文档去诊断,谁
  *  报出来的下标就是压缩后的下标。把位移随结果一起交出去,回写就能在**一个**铸点完成
@@ -293,11 +297,14 @@ export interface EntrySalvageResult {
  * ③ 域级判据(重名 / 悬空 ref)不在本函数视野内 —— 丢条目救不了它们,调用方据此回落整域档位;
  * ④ 只认 `ZodArray` / `ZodRecord` 两种条目集合形 —— 别的形(元组等)不抢救,退回整域档位(保守方向)。
  */
-export declare function salvageEntries(schema: z.ZodTypeAny, raw: unknown): EntrySalvageResult;
+export declare function salvageEntries(schema: z.ZodType, raw: unknown): EntrySalvageResult;
 /**
  * Shared GC predicate for worker-status rows (F10) — keeps memory/sqlite/tidb identical. Given the rows'
  * `{name, updatedAt}` and the GC options, returns the names to prune (A: not in `keepNames`; B: older than
  * `ttlMs`). Pass neither selector → prunes nothing (guards against a wipe-all). See `ConfigStore.gcWorkerStatuses`.
+ *
+ * `now` is REQUIRED (11.0.0): this package never reads the wall clock (the determinism rule in the file header) — the
+ * TTL arm used to fall back to `new Date()`, the one argless clock left in the package. The caller owns the time.
  */
 export declare function statusRowsToPrune(rows: {
     name: string;
@@ -305,41 +312,16 @@ export declare function statusRowsToPrune(rows: {
 }[], opts: {
     keepNames?: string[];
     ttlMs?: number;
-    now?: Date;
+    now: Date;
 }): string[];
-/**
- * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
- * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
- * which made `emptyEffective`/the memory store non-deterministic). Every caller now supplies it explicitly.
- */
-/** Lift the governance trio out of a LEGACY runtime doc (pre-0.6 stored runtime carried autonomy/commandPolicy/
- *  approvalRequire). Used as the governance domain's read fallback when governance was NEVER set — so a 0.5
- *  store upgrades with zero data migration and zero gate loss. An explicitly-set governance domain WINS
- *  (its absence-of-a-key then means "center not managing", never "fall back to legacy runtime").
- *
- *  SUNSET (2.0.0): removal is a **persistent-data** break — a store still carrying the 0.5 shape would lose
- *  its guardrails silently, so this arm cannot simply be deleted at a minor. It goes at the next MAJOR, with
- *  the standard persistent-data treatment (a loud refusal naming the domain + a one-time migration on the
- *  writer side), and the closing condition is observable rather than a promise: `buildEffective` now emits
- *  `legacy-governance-lifted` every time the arm actually fires, so a deployment can prove it no longer does. */
-export declare function legacyGovernanceFromRuntime(rawRuntime: unknown): unknown;
-/** A warning emitted by {@link buildEffective} when it clamps/degrades instead of throwing (0.8.1), or by
+/** A warning emitted by {@link buildEffective} when it degrades instead of throwing, or by
  *  {@link FileConfigStore} when a file it will never read sits in `config.d/` (0.19.0). Callers route it to
  *  their audit stream; omitting the callback keeps the resilience but drops the telemetry.
  *
  *  0.19.0 加了两个 kind(additive union member —— 用 `switch` 穷举本类型的消费方需补臂):
  *  `"unknown-keys-dropped"` / `"unread-config-file"`,成案见 {@link droppedKeys}(消费方
  *  #322:配置写了、进程跑着、值没到,而没有任何一个字说出来)。 */
-export type EffectiveReadWarning = 
-/** `droppedNames` 有界(6.3.0,S-813:与未知键同一只 `DROP_SCAN_MAX_KEYS`),超界时带 `droppedTotal`(= 按名剔掉的真实条数)——
- *  缺席 = 列表是穷举。`truncatedFrom` 另是一件事:hosts 数组超 `HOSTS_ARRAY_MAX` 被切片前的长度。 */
-{
-    domain: "hosts";
-    kind: "hosts-grandfathered";
-    droppedNames: string[];
-    droppedTotal?: number;
-    truncatedFrom?: number;
-} | {
+export type EffectiveReadWarning = {
     domain: DomainName;
     kind: "domain-defaulted";
     error: unknown;
@@ -349,8 +331,8 @@ export type EffectiveReadWarning =
  *  `["commandPolicy",0,"typo"]`),见
  *  {@link droppedKeys} 的扫描边界。**1.5.0**:①{@link EXTENSION_NAMESPACES} 登记的扩展键(别的写者按契约
  *  放在文档里、本包刻意不认的键,如壳写在 models 条目上的 `sema*`)**不算未知键**——既不点名也不计数;
- *  ②`keys` 有界(`DROP_SCAN_MAX_KEYS`),超界时带 `truncatedFrom`(= 真实未知键总数,与 `hosts-grandfathered`
- *  同形),消费方据此知道列表**不是穷举**——把有界诊断当穷举决策输入,是服务端消费方在配置门上三次被复审打穿的根因。 */
+ *  ②`keys` 有界(`DROP_SCAN_MAX_KEYS`),超界时带 `truncatedFrom`(= 真实未知键总数),消费方据此知道列表**不是穷举**
+ *  ——把有界诊断当穷举决策输入,是服务端消费方在配置门上三次被复审打穿的根因。 */
  | {
     domain: DomainName;
     kind: "unknown-keys-dropped";
@@ -365,14 +347,6 @@ export type EffectiveReadWarning =
     keys: ConfigPath[];
     truncatedFrom?: number;
 }
-/** 0.5 期的 runtime 文档里还带着治理三闸,而 governance 域从未被设过 —— 读侧抬升腿真生效了。
- *  `keys` = 这次抬起来的那几个键。**照旧生效,只是不再无声**:兼容窗要能关掉,前提是有人知道它还开着。
- *  2.0.0 起。 */
- | {
-    domain: "governance";
-    kind: "legacy-governance-lifted";
-    keys: ConfigPath[];
-}
 /** 一条**条目**没通过它自己的 entry schema,被单独丢掉了(域内其余条目照常生效)。`path` = 段坐标
  *  (`["models",3]` / `["roles","summarize"]`),与 `unknown-keys-dropped` 的坐标形同一套。逐条一发 —— 载荷是
  *  O(域里的条目数),与被读文档同阶,不放大,故不设条数上限(有上限的是**单条**告警里的键列表)。
@@ -407,7 +381,7 @@ export type EffectiveReadWarning =
  *  (给联合加一条新臂,实测这三处各红一条,`satisfies` 那行零诊断);而「新 kind 三处都处置了、却忘了登记
  *  进本表」这半条缝,由 `test/warning-projection-derived-4.0.0.test.ts` 的闭集格看着(本表 == 从 AST 解出的
  *  臂集,逐字同集同序)。 */
-export declare const WARNING_KINDS: readonly ["hosts-grandfathered", "domain-defaulted", "unknown-keys-dropped", "unknown-keys-carried", "legacy-governance-lifted", "entry-dropped", "unread-config-file"];
+export declare const WARNING_KINDS: readonly ["domain-defaulted", "unknown-keys-dropped", "unknown-keys-carried", "entry-dropped", "unread-config-file"];
 export type WarningKind = (typeof WARNING_KINDS)[number];
 /** 逐臂剥字段的**分配式**映射:`W` 是裸类型参数,条件类型因此对联合的每一员分别作用(而不是先塌成交集)。 */
 type PerArmOmit<W, K extends string> = W extends unknown ? Omit<W, K> : never;
@@ -453,13 +427,13 @@ export declare function projectWarning(w: EffectiveReadWarning): WarningProjecti
  * **闭集穷举**:`switch` 覆盖 {@link EffectiveReadWarning} 的每个 `kind`,新 kind 不声明处置 = 编译红
  * (#157 的闭集纪律)。只分两类,没有第三类:**带坐标的回写,不带坐标的原样返回**。
  *
- * 为什么 `entry-dropped` 也回写:它**不是**「恒为原坐标」,只是不经**铸它那一层自己**的表 —— 上面那条律
- * 说的就是这件事。{@link salvageEntries} 铸 `entry-dropped` 时用的是它**入参**那份文档的坐标;如果那份
- * 文档本身已被外层(hosts 的 {@link grandfatherHostsRead})压缩过,外层照样要回写它一次。把「不动」写成
- * 一条臂的性质,就是把「哪一层」这件事错记在了「哪个 kind」上。
+ * 为什么 `entry-dropped` 也有回写臂:它**不是**「恒为原坐标」,只是不经**铸它那一层自己**的表 —— 上面那条律
+ * 说的就是这件事。{@link salvageEntries} 铸 `entry-dropped` 时用的是它**入参**那份文档的坐标;若那份文档本身被外层
+ * 压缩过,外层照样要回写它一次。今天读路径上只有一个压缩点(11.0.0 起 hosts 的读侧夹紧臂已retired),所以这一臂当下
+ * 只对 `keptIndex` 为空的表恒等;把「不动」写成一条臂的性质,就是把「哪一层」这件事错记在了「哪个 kind」上。
  *
  * **恒等纪律**:没有任何一条路径真的变了(含 `keptIndex` 为空)⇒ 返回**同一个对象引用**,连 `keys`
- * 数组也不复制(与 {@link grandfatherHostsRead} 的「没夹紧就返回原引用」同一条 byte 不变律)。
+ * 数组也不复制(好数据穿过读路径 byte 不变)。
  */
 export declare function rebaseWarningPaths(w: EffectiveReadWarning, keptIndex: EntryKeptIndex): EffectiveReadWarning;
 /**
@@ -499,59 +473,6 @@ export declare const EXTENSION_NAMESPACES: Partial<Record<DomainName, ReadonlyAr
  *  本身——键名里可以含 `.`(`semaX.foo` 是一个键不是两层),段形让这件事不必再靠文法猜;前缀契约就是前缀
  *  契约(`semaGPT_5` / `semaX-v2` 都是成员,后缀不设未声明的文法)。 */
 export declare function isReservedExtensionKey(domain: DomainName, parent: ConfigPath, key: string): boolean;
-/**
- * 一次未知键扫描的结果:`keys` 有界(≤ {@link DROP_SCAN_MAX_KEYS}),`total` 是**截断前**的真实未知键数
- * (超界仍数完 —— 扫描本就 O(文档键数),上限只界**告警载荷**不界扫描);`total > keys.length` ⇔ 列表被截断。
- *
- * **4.0.0(BREAKING)**:{@link droppedKeys} / {@link carriedUnknownKeys} 从「只回 `keys` 数组」改成回本形。
- * 成案:上界与真实总数此前都是私有的,于是一个自装配读腿的消费方(不走 {@link parseDomainLoud} 的
- * `onWarning`、自己拿这两只函数做诊断)在**结构上**铸不出 `truncatedFrom` —— 拿到 64 条,既不知道是不是刚好
- * 64 条,也没有第二个公开面可以问「一共多少」。而本包自己的告警面从 1.5.0 起就带着 `truncatedFrom`:
- * 同一件事在两个公开面上一个说、一个不说。上界 {@link DROP_SCAN_MAX_KEYS} 仍然**私有** —— 它是告警载荷的
- * 上界,不是契约(改它不该让任何消费方红);消费方要的是「有没有截断、截断前多少条」,那就是 `total`。
- */
-export interface UnknownKeyScan {
-    keys: ConfigPath[];
-    total: number;
-}
-/**
- * 一份域文档里被域 schema **丢掉的键**(zod 对象默认 `"strip"`),段坐标形({@link ConfigPath})。
- *
- * 成案(消费方 #322 真事故):往 `runtime` 文档里加一个不属于该域的键,两条腿都会把它剥掉,
- * `domainErrors` 空、解析"成功"——配置写了、值没到、零告警。剥除行为本身是**刻意的前向兼容**
- * (新 center 的新键不该炸老消费方),所以修法不是收紧成 `.strict()`,而是让它**响亮**:
- * {@link buildEffective} 每域解析成功后调用本函数,非空即发 `"unknown-keys-dropped"` 警告。
- *
- * **嵌套也扫**(对抗复审 复审 F2 真 finding):`{infraCostRates:{toolCalMicroUsd:10}}` 这种**拼错的嵌套
- * 键**在顶层看不见(`infraCostRates` 键还在),只看顶层等于对计费面的错键完全失明。故按 raw↔parsed
- * 的键集逐层对比(对象逐键、数组同长时逐下标),不依赖任何 zod 内省。
- *
- * `runtime` 域的治理三件({@link GOVERNANCE_MIRROR_KEYS})**不算被丢**:0.5 期 runtime 文档携带它们是
- * 成文的抬升位(本文件的 governance 抬升函数会把它们抬进 governance 域),报出来是噪声。豁免只在顶层。
- *
- * 返回 {@link UnknownKeyScan}:`keys` 是**有界**的点名列表,`total` 是截断前的真实总数(4.0.0 BREAKING,
- * 此前只回 `keys` —— 见 {@link UnknownKeyScan} 的成案)。本包自己的告警(`unknown-keys-dropped`)也是拿这两个
- * 数拼出来的,**一个铸点**:消费方自铸的 `truncatedFrom` 与告警里那个恒等。
- *
- * 边界(如实登记):① 深度上限 {@link DROP_SCAN_MAX_DEPTH}、键数上限 {@link DROP_SCAN_MAX_KEYS}(告警
- * 载荷有界,超出即少报**点名**——`total` 不少报);② 数组长度不同就整段跳过(元素级裁剪由各自的 clamp 告警
- * 负责);③ 只比对纯 JSON 对象——raw 若是类实例/Proxy 这类形状不扫;④ 读 raw 的值可能触发访问器,整段包
- * try/catch 且**绝不**让其错误外泄(错误文案可能带 secret,与 parseDomain 的 R13 同纪律),扫描失败即当作
- * "没看见"(`{ keys: [], total: 0 }`),不影响解析。
- */
-export declare function droppedKeys(domain: DomainName, raw: unknown, parsed: unknown): UnknownKeyScan;
-/**
- * 一份已解析的 open-world 域文档里,**本包不认识但已承运**的键(段坐标)。非 open-world 域恒空
- * (它们的未知键走 {@link droppedKeys} 那条更重的「被丢了」告警)。
- *
- * 返回 {@link UnknownKeyScan}(4.0.0 BREAKING,与 {@link droppedKeys} 同形同律:`keys` 有界、`total` 是
- * 截断前的真实总数)。非 open-world 域返回的也是这个形(`{ keys: [], total: 0 }`),不是别的东西 ——
- * 「这个域没有承运未知键」与「这个域不参与承运」在消费方那里是同一个处置。
- *
- * 边界(如实):只看 {@link OPEN_WORLD_KNOWN_KEYS} 登记了的层级 —— 未登记层级(如某个未知键自己的
- * 子树)不再下探,那本就是消费方自定义的内容,逐层猜没有意义。
- */
-export declare function carriedUnknownKeys(domain: DomainName, parsed: unknown): UnknownKeyScan;
 /**
  * 一域的 parse + **静默剥键/静默承运两条告警**(0.19.0)。`buildEffective` 与 `FileConfigStore.getDomain`
  * 共用这一个判据 —— 此前只有 effective 那条路径有门,而 `getDomain` 是 `exportBundle` 的读法
@@ -565,14 +486,12 @@ export declare function parseDomainLoud<K extends DomainName>(domain: K, raw: un
  *  this call explicitly (compile error until it's classified). Per-domain rationale:
  *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability catalogs — empty = the
  *      capability disappears (fail-closed), no gate is lost.
- *    - hosts: empty registry = no auto-placement targets (availability-only); self-registration re-lands
- *      entries as approved:false = 待批 (fail-closed). Plus the precise grandfather clamp runs FIRST.
+ *    - hosts: empty host registry = no auto-placement targets (availability-only); self-registration re-lands
+ *      entries as approved:false = 待批 (fail-closed).
  *    - rosters: THROW — a lost roster makes resolveEffectiveForWorker fall back to the FULL models catalog
  *      ("global(fallback)"), silently WIDENING every restricted worker's model access. 放权,不许.
  *    - workers: THROW — an empty fleet spec would make the reconciler RETIRE every managed worker
  *      (destructive apply — far worse than a read outage).
- *    - runtime: THROW — defaulting drops centrally-published rate/cost ceilings = unbounded spend (fail-open
- *      on the budget axis).
  *    - governance: THROW — defaulting drops autonomy/commandPolicy/approvalRequire = the consumer falls back
  *      to env/defaults with the operator's guardrails silently gone. 放权,不许.
  *    - entitlement: THROW — defaulting drops the org kill-switch/budget ceilings/tier restrictions for every
@@ -596,7 +515,6 @@ export declare const DOMAIN_READ_FALLBACK: {
     readonly collab: "default";
     readonly workers: "throw";
     readonly hosts: "default";
-    readonly runtime: "throw";
     readonly governance: "throw";
     readonly entitlement: "throw";
     readonly execution: "throw";
@@ -604,43 +522,27 @@ export declare const DOMAIN_READ_FALLBACK: {
     readonly prompts: "default";
     readonly limits: "throw";
 };
-/** Result of {@link grandfatherHostsRead}. `raw` is the (possibly clamped) document to parse; when NOTHING
- *  was clamped it is the ORIGINAL reference — well-formed data stays byte-identical through the read path. */
-export interface GrandfatherHostsReadResult {
-    raw: unknown;
-    /** Host names DROPPED because they exceed HOST_NAME_MAX (63) — truncating would forge a NEW identity that
-     *  matches no ORCH_HOST_ID (and could collide into the duplicate-name refine), so the entry is skipped whole. */
-    droppedNames: string[];
-    /** How many hosts were dropped by name — the TRUE count. `droppedNames` carries labels for at most `DROP_SCAN_MAX_KEYS` (64,
-     *  the same bound as the unknown-key scan) of them; each label goes through the outgoing redaction, and a document with
-     *  thousands of over-long names must not cost thousands of scans on every read (6.3.0, S-813). Same shape as
-     *  {@link UnknownKeyScan}'s `{ keys, total }`. */
-    droppedTotal: number;
-    /** Set when the hosts array (after drops) exceeded HOSTS_ARRAY_MAX (1024) and was sliced — the pre-slice length. */
-    truncatedFrom?: number;
-    /** 这次夹紧造成的**下标位移表**(与 {@link EntrySalvageResult.keptIndex} 同一种账、同一条律):本函数
-     *  是读路径的**第二个压缩点**,`raw` 里的 hosts 数组被剔过条目,谁拿这份文档去诊断,谁报出来的下标就是
-     *  夹紧后的下标。只在**按名剔条目**时登记 —— 纯截断保留的是原数组的**前缀**,幸存者下标不动,登记一份
-     *  恒等映射只会把「有没有位移」从表的在场性挪成表的内容(见 {@link EntryKeptIndex})。 */
-    keptIndex: EntryKeptIndex;
-}
-/** READ-path grandfather clamp for the 0.8.0 hosts tightening (0.8.1, S3 M-1). Clamps ONLY the two bounds
- *  0.8.0 added (name > 63 → drop the entry; array > 1024 → slice) so 0.7-era legal stored data keeps reading;
- *  everything else (regex, types, duplicates) is left for parseDomain — this is a targeted grandfather, not a
- *  lenient parser. PURE + idempotent; returns the ORIGINAL reference when nothing exceeds the bounds.
- *
- *  SUNSET (2.0.0): same persistent-data class as the governance lift — it goes at the next MAJOR. This one was
- *  never silent (`hosts-grandfathered` fires whenever it clamps), so the closing condition is already
- *  observable: a deployment that has not seen that warning across a full read cycle no longer needs the arm. */
-export declare function grandfatherHostsRead(raw: unknown): GrandfatherHostsReadResult;
-export declare function buildEffective(version: number, getRaw: (d: DomainName) => unknown, updatedAt: string, onWarning?: (w: EffectiveReadWarning) => void): EffectiveConfig;
+/** 一个读者向店要文档的口:配置域,以及墓碑表里的retired 域({@link RETIRED_DOMAINS})—— 后者只为让墓碑看见没迁的旧文档。 */
+export type StoredDocumentReader = (d: DomainName | RetiredDomainName) => unknown;
+/**
+ * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
+ * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
+ * which made `emptyEffective`/the memory store non-deterministic). Every caller now supplies it explicitly.
+ *
+ * 11.0.0:`getRaw` 也会被问到墓碑表里的retired 域(今天只有 `runtime`)。店里还留着一份**带事实**的retired 域文档 ⇒ 整份 effective 抛
+ * {@link RetiredDomainError}(拒句点名改写它的一次性迁移);缺席或 `{}` ⇒ 不理会。读写两面同一只 schema:读路径上不再有任何抬升臂。
+ */
+export declare function buildEffective(version: number, getRaw: StoredDocumentReader, updatedAt: string, onWarning?: (w: EffectiveReadWarning) => void): EffectiveConfig;
 /** READ-side tolerant judgment for a GET /effective **wire payload**(the {@link EffectiveWire} contract)at
- *  its CONSUMPTION boundary — a service pulling from a remote center passes the parsed JSON here instead of
+ *  its CONSUMPTION boundary — a service pulling from a remote web-admin passes the parsed JSON here instead of
  *  type-asserting it(0.12.0,[2281] 裁B:「两个契约共用一个拼写不是一个被检查的契约」——拼写副本要在
  *  消费端被真校验)。ONE judgment, two legs: every known domain goes through the SAME `parseDomain` +
  *  {@link DOMAIN_READ_FALLBACK} policy as {@link buildEffective}(catalog 域坏形 → schema default + warning;
- *  gate 域坏形 → throw,caller 的整包 catch 决定回落),including the governance legacy-lift and the hosts
- *  read-grandfather — DELEGATED to buildEffective, not re-implemented(单判据双腿消费,§M4)。
+ *  gate 域坏形 → throw,caller 的整包 catch 决定回落),including the retired-domain tombstone — DELEGATED to
+ *  buildEffective, not re-implemented(单判据双腿消费,§M4)。A retired domain on the wire (an older web-admin still
+ *  ships `runtime`) is judged by the same tombstone: carrying facts ⇒ {@link RetiredDomainError}; `{}` (what an older
+ *  web-admin materialises for an unset domain) carries nothing and is dropped from the result — it never rides through as
+ *  an open-world key.
  *
  *  `skills` is the ONE wire divergence: on the wire it is a MANIFEST(content → contentHash,
  *  {@link SkillsManifest}),so the full skills-domain schema would reject every LEGAL manifest and silently
@@ -648,14 +550,13 @@ export declare function buildEffective(version: number, getRaw: (d: DomainName)
  *  same "default" fallback tier as the skills domain itself.
  *
  *  OPEN-WORLD on unknown top-level keys: they ride through VERBATIM(never validated, never dropped)— a
- *  newer center's new domain reaches an older service untouched(§M2 能力面语义:读不到即走老路,不该炸),
- *  and the legacy `teams` key(not a domain since 0.7, services still consume it for backward compat)keeps
- *  flowing. Throws ONLY on garbage no caller can partially trust: a non-object payload, or a missing/
+ *  newer web-admin's new domain reaches an older engine untouched(§M2 能力面语义:读不到即走老路,不该炸),
+ *  and so does any key no domain names(the 0.6-era `teams` key included — not a domain since 0.7, and no engine reads it). Throws ONLY on garbage no caller can partially trust: a non-object payload, or a missing/
  *  non-finite `version` — that is not "a bad domain", it is not an effective config at all. */
 export declare function readEffectiveWire(raw: unknown, onWarning?: (w: EffectiveReadWarning) => void): EffectiveWire;
 /** 档位组→引擎单表的唯一解析点(0.9.0)。返回 ACTIVE 档位组的绑定表(剔除未绑档),即 core
- *  `RunnerDeps.tiers` 要吃的那张单表——组切换=center 换这张表下发,零新引擎机制。无 active 组/未命中/
- *  组内一档未绑 → `undefined`(引擎档位层恒惰性,与「未配 tiers」逐字同义)。消费方(center /effective
+ *  `RunnerDeps.tiers` 要吃的那张单表——组切换=web-admin 换这张表下发,零新引擎机制。无 active 组/未命中/
+ *  组内一档未绑 → `undefined`(引擎档位层恒惰性,与「未配 tiers」逐字同义)。消费方(web-admin /effective
  *  投影、service applyEffective 接线)都走这一个函数,不要各自解析。 */
 export declare function resolveActiveTiers(models: Pick<DomainConfig["models"], "tierGroups" | "activeTierGroup">): Record<string, string> | undefined;
 export {};