@sema-agent/settings-schema 10.1.1 → 11.0.0

package/conformance/cases/z01-every-domain-empty-object/meta.json

@@ -1,5 +1,5 @@
 {
   "contributor": "contract",
-  "claim": "十七个域各给一份**合法空文档** `{}` ⇒ 零告警、每域落 schema 默认。覆盖律的第一份:每个域至少被两条 case 摸过。它同时钉住「设了空」这一形在三腿上的读数,以及 local-root 腿对五个非便携域各报一条 unread-config-file。",
+  "claim": "十六个域各给一份**合法空文档** `{}` ⇒ 零告警、每域落 schema 默认。覆盖律的第一份:每个域至少被两条 case 摸过。它同时钉住「设了空」这一形在三腿上的读数,以及 local-root 腿对五个非便携域各报一条 unread-config-file。",
   "firstRedOn": []
 }

package/conformance/cases/z02-every-domain-unknown-key/expected.json

@@ -28,6 +28,9 @@
         "servers": []
       },
       "models": {
+        "atMention": {
+          "mode": "all"
+        },
         "models": [],
         "roles": {},
         "tierGroups": []
@@ -44,7 +47,6 @@
       "rosters": {
         "rosters": []
       },
-      "runtime": {},
       "scenarios": {
         "scenarios": []
       },
@@ -59,24 +61,6 @@
       }
     },
     "warnings": [
-      {
-        "domain": "governance",
-        "keys": [
-          [
-            "zzzUnknown"
-          ]
-        ],
-        "kind": "unknown-keys-dropped"
-      },
-      {
-        "domain": "runtime",
-        "keys": [
-          [
-            "zzzUnknown"
-          ]
-        ],
-        "kind": "unknown-keys-dropped"
-      },
       {
         "domain": "models",
         "keys": [
@@ -167,6 +151,15 @@
         ],
         "kind": "unknown-keys-dropped"
       },
+      {
+        "domain": "governance",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
       {
         "domain": "entitlement",
         "keys": [
@@ -247,6 +240,9 @@
         "servers": []
       },
       "models": {
+        "atMention": {
+          "mode": "all"
+        },
         "models": [],
         "roles": {},
         "tierGroups": []
@@ -263,7 +259,6 @@
       "rosters": {
         "rosters": []
       },
-      "runtime": {},
       "scenarios": {
         "scenarios": []
       },
@@ -277,18 +272,163 @@
         "workers": []
       }
     },
-    "warnings": [],
+    "warnings": [
+      {
+        "domain": "models",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "rosters",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "skills",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "mcp",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "plugins",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "scenarios",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "systems",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "collab",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "workers",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "hosts",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "governance",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "entitlement",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "execution",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "projects",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "prompts",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-dropped"
+      },
+      {
+        "domain": "limits",
+        "keys": [
+          [
+            "zzzUnknown"
+          ]
+        ],
+        "kind": "unknown-keys-carried"
+      }
+    ],
     "metadata": {
       "version": 7,
       "updatedAt": "2026-09-16T00:00:00.000Z"
     },
-    "why": "受理:十七个域各带一个未知键 —— 十六个被 schema 剥掉(读腿报 unknown-keys-dropped)、limits 承运(unknown-keys-carried);严写同样剥 / 承运、不铸告警,受理形等于读腿十七格。"
+    "why": "受理:十六个域各带一个未知键 —— 十五个被 schema 剥掉(读腿报 unknown-keys-dropped)、limits 承运(unknown-keys-carried);严写同样剥 / 承运、不铸告警,受理形等于读腿十六格。"
   },
   "wire": {
     "derive": true
   },
   "localRoot": {
     "derive": true,
-    "localVersion": 2336752390152956
+    "localVersion": 567413778934550
   }
 }

package/conformance/cases/z02-every-domain-unknown-key/input.json

@@ -34,9 +34,6 @@
     "hosts": {
       "zzzUnknown": 1
     },
-    "runtime": {
-      "zzzUnknown": 1
-    },
     "governance": {
       "zzzUnknown": 1
     },

package/conformance/cases/z02-every-domain-unknown-key/meta.json

@@ -1,5 +1,5 @@
 {
   "contributor": "contract",
-  "claim": "十七个域各给一份带同名未知键的文档 ⇒ 十六个闭世界域报 unknown-keys-dropped、limits(open-world)报 unknown-keys-carried。覆盖律的第二份,同时把「剥」与「承运」两条告警在同一份文档上分开钉死 —— 两者混为一谈的消费方会把承运的键当成丢了的键去补。",
+  "claim": "十六个域各给一份带同名未知键的文档 ⇒ 十五个闭世界域报 unknown-keys-dropped、limits(open-world)报 unknown-keys-carried。覆盖律的第二份,同时把「剥」与「承运」两条告警在同一份文档上分开钉死 —— 两者混为一谈的消费方会把承运的键当成丢了的键去补。",
   "firstRedOn": []
 }

package/dist/api/auth-bridge.d.ts

@@ -1,11 +1,11 @@
 /**
  * `api/auth-bridge` — the 鉴权桥 contract: how a WORKER (the worker service / any data-plane service) verifies a
- * registry-minted USER access JWT and maps it into its existing `x-agent-principal` identity system.
- * (REGISTRY-REBUILD-DESIGN §5, M3 — registry half = JWKS already shipped; service half = ONE verifier
+ * web-admin-minted USER access JWT and maps it into its existing `x-agent-principal` identity system.
+ * (REGISTRY-REBUILD-DESIGN §5, M3 — web-admin half = JWKS already shipped; service half = ONE verifier
  * middleware implementing the rules below. This file is the schema + normative spec the service copies.)
  *
- * TRUST MODEL (single trust root, zero new worker config): the worker already trusts the registry for its
- * effective config; it extends the SAME trust to the registry's JWKS. A bearer token that is a well-formed
+ * TRUST MODEL (single trust root, zero new worker config): the worker already trusts web-admin for its
+ * effective config; it extends the SAME trust to web-admin's JWKS. A bearer token that is a well-formed
  * JWT and verifies against that JWKS with the checks below IS the user — `sub` feeds x-agent-principal
  * directly (owner semantics / costQuota / entitlement are already principal-keyed). Existing
  * SERVICE_AUTH_TOKENS / wpt_ bearer branches are untouched; this is an ADDITIONAL branch tried when the
@@ -19,25 +19,26 @@
  *     token whose header alg is absent. Pin the list in the JWT library call — never read alg from the
  *     token to decide how to verify.
  *
- *  R2 KEY SOURCE. Verification keys come from the registry JWKS endpoint `GET {registryBaseUrl}` +
- *     REGISTRY_JWKS_PATH ("/api/auth/sso/jwks"; response shape = `Jwks` below, public members only:
+ *  R2 KEY SOURCE. Verification keys come from the web-admin JWKS endpoint `GET {webAdminBaseUrl}` +
+ *     WEB_ADMIN_JWKS_PATH ("/api/auth/sso/jwks"; response shape = `Jwks` below, public members only:
  *     kty/n/e/kid/use/alg). Match the token header `kid` against cached keys.
  *
  *  R3 KID-MISS FORCED REFRESH + THROTTLE. kid found in cache → use the cached key (no fetch on the hot
  *     path). kid NOT in cache → force ONE JWKS refetch, then retry the match (this is the key-ROTATION
- *     window: a freshly rotated registry would otherwise reject every new token until the cache expired).
+ *     window: a freshly rotated web-admin would otherwise reject every new token until the cache expired).
  *     Forced refreshes are throttled to at most one per `jwksRefreshMinIntervalSec` (default 60s) —
  *     otherwise an attacker spraying random-kid tokens turns the verifier into a JWKS-fetch DoS cannon.
  *     Within the throttle window an unknown kid fails as `invalid_signature` WITHOUT fetching.
  *     (Decision function: `shouldForceJwksRefresh`.)
  *
- *  R4 ISSUER PIN. `iss` MUST equal the CONFIGURED issuer exactly (VerifierConfig.issuer = the registry's
+ *  R4 ISSUER PIN. `iss` MUST equal the CONFIGURED issuer exactly (VerifierConfig.issuer = web-admin's
  *     SSO_ISSUER, trailing slash stripped on both sides). A missing or different iss → `unknown_issuer`.
  *     Never derive the expected issuer from the token or from request headers.
  *
  *  R5 TIME WINDOW WITH SKEW. `exp` is REQUIRED: reject when nowSec > exp + clockSkewSec. `nbf`, when
- *     present: reject when nowSec < nbf - clockSkewSec. clockSkewSec default 60 (DEFAULT_CLOCK_SKEW_SEC).
- *     Both failures classify as `expired`. (Decision function: `classifyTimeClaims`.)
+ *     present: reject when nowSec < nbf - clockSkewSec. `iat`, when present: reject when nowSec < iat - clockSkewSec
+ *     (issued in the future). clockSkewSec default 60 (DEFAULT_CLOCK_SKEW_SEC), one tolerance for all three.
+ *     These failures classify as `expired`. (Decision function: `classifyTimeClaims`.)
  *
  *  R6 PRINCIPAL. `sub` MUST be a non-empty string — it becomes `VerifiedIdentity.principal` and feeds the
  *     existing x-agent-principal pipeline verbatim. Empty/missing sub → `malformed`.
@@ -48,14 +49,17 @@
  *
  *  R8 OFFLINE GRACE / FAIL-CLOSED. JWKS fetch fails (network/5xx/malformed body): keys already cached
  *     remain USABLE for up to `offlineGraceSec` (default 24h, DEFAULT_OFFLINE_GRACE_SEC) measured from the
- *     last SUCCESSFUL fetch — a registry blip must not take the whole data plane down. Past the grace, or
+ *     last SUCCESSFUL fetch — a web-admin blip must not take the whole data plane down. Past the grace, or
  *     with no cache at all, verification fails CLOSED as `jwks_unavailable` (never fail-open, never skip
  *     signature checks). (Decision function: `jwksWithinOfflineGrace`.)
  *
  *  R9 OUTPUT. Success → `VerifiedIdentity { principal: sub, role: token.role, grantId: token.jti,
- *     scope: token.scope }` (`scope` = the multi-tenant active scope claim, `api/scopes`; absent = "global").
- *     `role` is the registry RBAC role claim (string, informational for the worker's own authz mapping);
- *     `grantId` is the jti when the registry stamps one (absent today — optional forever). Failure → one
+ *     scope: token.scope, iat: token.iat }` (`scope` = the multi-tenant active scope claim, `api/scopes`; read it with
+ *     `readTokenScope` — an absent claim is refused, not read as "global"; `iat` = issued-at, integer seconds, carried
+ *     verbatim — a reader that learns a principal was deleted at T cuts off its tokens issued before T; absent claim ⇒ no
+ *     `iat` key; present but not a non-negative integer ⇒ the token is `malformed`).
+ *     `role` is web-admin RBAC role claim (string, informational for the worker's own authz mapping);
+ *     `grantId` is the jti when web-admin stamps one (absent today — optional forever). Failure → one
  *     of AUTH_BRIDGE_ERROR_CODES; the HTTP surface answers 401 with a GENERIC message (no error detail
  *     disclosure to the caller; the code goes to logs/metrics only).
  *
@@ -67,8 +71,8 @@
  * library; THESE shapes pin down its configuration), browser-safe.
  */
 import { z } from "zod";
-/** The registry JWKS endpoint, relative to the registry origin (shipped; public by design, RFC 7517 §5). */
-export declare const REGISTRY_JWKS_PATH = "/api/auth/sso/jwks";
+/** The web-admin JWKS endpoint, relative to the web-admin origin (shipped; public by design, RFC 7517 §5). */
+export declare const WEB_ADMIN_JWKS_PATH = "/api/auth/sso/jwks";
 /** R1 — the ONLY acceptable JWS algorithms. */
 export declare const AUTH_BRIDGE_ALGS: readonly ["RS256"];
 export type AuthBridgeAlg = (typeof AUTH_BRIDGE_ALGS)[number];
@@ -78,172 +82,51 @@ export declare const DEFAULT_CLOCK_SKEW_SEC = 60;
 export declare const DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC = 60;
 /** R8 — default seconds a cached JWKS stays usable after fetches start failing (24h), then fail-closed. */
 export declare const DEFAULT_OFFLINE_GRACE_SEC: number;
-/** One RSA public JWK as the registry publishes it (public members ONLY — a `d`/`p`/`q` here is a registry
+/** R6 — the longest principal the data plane accepts: the engine's principal gate refuses a longer one (400), because every
+ *  scope / owner column a principal lands in verbatim is that wide — an over-long principal would truncate at the insert and
+ *  split one identity into two. Anyone validating or minting a principal (a token `sub`, a membership row, an outbound
+ *  principal header) checks against THIS value. */
+export declare const PRINCIPAL_MAX_LENGTH = 190;
+/** One RSA public JWK as web-admin publishes it (public members ONLY — a `d`/`p`/`q` here is a web-admin
  *  bug, but the verifier MUST still never use/echo private members). */
-export declare const RegistryJwk: z.ZodObject<{
+export declare const WebAdminJwk: z.ZodObject<{
     kty: z.ZodLiteral<"RSA">;
-    /** modulus, base64url */
     n: z.ZodString;
-    /** exponent, base64url */
     e: z.ZodString;
-    /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
     kid: z.ZodString;
     use: z.ZodOptional<z.ZodLiteral<"sig">>;
-    alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    kty: z.ZodLiteral<"RSA">;
-    /** modulus, base64url */
-    n: z.ZodString;
-    /** exponent, base64url */
-    e: z.ZodString;
-    /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-    kid: z.ZodString;
-    use: z.ZodOptional<z.ZodLiteral<"sig">>;
-    alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    kty: z.ZodLiteral<"RSA">;
-    /** modulus, base64url */
-    n: z.ZodString;
-    /** exponent, base64url */
-    e: z.ZodString;
-    /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-    kid: z.ZodString;
-    use: z.ZodOptional<z.ZodLiteral<"sig">>;
-    alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-}, z.ZodTypeAny, "passthrough">>;
-export type RegistryJwk = z.infer<typeof RegistryJwk>;
-/** The JWKS document. `{keys: []}` is VALID (registry with SSO disabled) — every token then fails as
- *  `invalid_signature` (there is a registry, it just mints nothing). */
-export declare const RegistryJwks: z.ZodObject<{
-    keys: z.ZodArray<z.ZodObject<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">>, "many">;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    alg: z.ZodOptional<z.ZodEnum<{
+        RS256: "RS256";
+    }>>;
+}, z.core.$loose>;
+export type WebAdminJwk = z.infer<typeof WebAdminJwk>;
+/** The JWKS document. `{keys: []}` is VALID (web-admin with SSO disabled) — every token then fails as
+ *  `invalid_signature` (there is a web-admin, it just mints nothing). */
+export declare const WebAdminJwks: z.ZodObject<{
     keys: z.ZodArray<z.ZodObject<{
         kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">>, "many">;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    keys: z.ZodArray<z.ZodObject<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
-        n: z.ZodString;
-        /** exponent, base64url */
-        e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
-        kid: z.ZodString;
-        use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        kty: z.ZodLiteral<"RSA">;
-        /** modulus, base64url */
         n: z.ZodString;
-        /** exponent, base64url */
         e: z.ZodString;
-        /** RFC 7638 thumbprint of the public JWK — the rotation-stable key id tokens carry in their header. */
         kid: z.ZodString;
         use: z.ZodOptional<z.ZodLiteral<"sig">>;
-        alg: z.ZodOptional<z.ZodEnum<["RS256"]>>;
-    }, z.ZodTypeAny, "passthrough">>, "many">;
-}, z.ZodTypeAny, "passthrough">>;
-export type RegistryJwks = z.infer<typeof RegistryJwks>;
+        alg: z.ZodOptional<z.ZodEnum<{
+            RS256: "RS256";
+        }>>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type WebAdminJwks = z.infer<typeof WebAdminJwks>;
 /** Everything the service verifier is allowed to be configured with. In the zero-new-config deployment the
- *  worker derives `jwksUrl` from the registry base URL it already has (config pull) + REGISTRY_JWKS_PATH,
- *  and `issuer` from the same registry identity — but both stay explicit here so a split deployment
+ *  worker derives `jwksUrl` from web-admin base URL it already has (config pull) + WEB_ADMIN_JWKS_PATH,
+ *  and `issuer` from the same web-admin identity — but both stay explicit here so a split deployment
  *  (issuer behind a proxy ≠ fetch URL) is expressible. */
 export declare const VerifierConfig: z.ZodObject<{
-    /** R4 — the EXACT expected `iss` (the registry's SSO_ISSUER). Compare with trailing slash stripped. */
     issuer: z.ZodString;
-    /** R2 — absolute JWKS URL. Default: issuer (or the worker's registry base URL) + REGISTRY_JWKS_PATH. */
     jwksUrl: z.ZodOptional<z.ZodString>;
-    /** R7 — when set, `aud` must contain this value; unset = aud ignored. */
     audience: z.ZodOptional<z.ZodString>;
-    /** R5 — seconds of exp/nbf tolerance. Default DEFAULT_CLOCK_SKEW_SEC (60). */
     clockSkewSec: z.ZodDefault<z.ZodNumber>;
-    /** R3 — min seconds between forced kid-miss refetches. Default 60. */
     jwksRefreshMinIntervalSec: z.ZodDefault<z.ZodNumber>;
-    /** R8 — seconds a stale cache survives fetch failures before fail-closed. Default 86400 (24h). */
     offlineGraceSec: z.ZodDefault<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    issuer: string;
-    clockSkewSec: number;
-    jwksRefreshMinIntervalSec: number;
-    offlineGraceSec: number;
-    jwksUrl?: string | undefined;
-    audience?: string | undefined;
-}, {
-    issuer: string;
-    jwksUrl?: string | undefined;
-    audience?: string | undefined;
-    clockSkewSec?: number | undefined;
-    jwksRefreshMinIntervalSec?: number | undefined;
-    offlineGraceSec?: number | undefined;
-}>;
+}, z.core.$strip>;
 export type VerifierConfig = z.infer<typeof VerifierConfig>;
 /** The pre-parse (all-optional-defaults) input shape, for consumers assembling config by hand. */
 export type VerifierConfigInput = z.input<typeof VerifierConfig>;
@@ -252,28 +135,12 @@ export declare const AUTH_BRIDGE_ERROR_CODES: readonly ["expired", "invalid_sign
 export type AuthBridgeErrorCode = (typeof AUTH_BRIDGE_ERROR_CODES)[number];
 /** R9 success output — what the verifier middleware hands the existing principal pipeline. */
 export declare const VerifiedIdentity: z.ZodObject<{
-    /** = token `sub`. Feeds x-agent-principal / owner semantics / costQuota / entitlement keying verbatim. */
     principal: z.ZodString;
-    /** = token `role` claim (registry RBAC: admin/editor/viewer/…) — informational; the worker maps it to
-     *  its own authz, it does NOT replace worker-side entitlement checks. */
     role: z.ZodOptional<z.ZodString>;
-    /** = token `jti` when present (the auth_grants grant id — audit correlation). Absent today; optional forever. */
     grantId: z.ZodOptional<z.ZodString>;
-    /** = token `scope` claim when present (the active tenant scope, `api/scopes`) — transparently forwarded
-     *  to the worker's principal pipeline. ABSENT means the pre-scope/default token: semantically "global"
-     *  (use `tokenScopeOf` from api/scopes to normalize). Optional forever — backward compatible. */
     scope: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    principal: string;
-    scope?: string | undefined;
-    role?: string | undefined;
-    grantId?: string | undefined;
-}, {
-    principal: string;
-    scope?: string | undefined;
-    role?: string | undefined;
-    grantId?: string | undefined;
-}>;
+    iat: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
 export type VerifiedIdentity = z.infer<typeof VerifiedIdentity>;
 /** The verifier's total result — exactly one of ok/error. */
 export type AuthBridgeResult = {
@@ -308,12 +175,14 @@ export declare function shouldForceJwksRefresh(kid: string, cache: JwksCacheSnap
 export declare function jwksWithinOfflineGrace(cache: Pick<JwksCacheSnapshot, "lastFetchSuccessMs" | "nowMs">, cfg: Pick<VerifierConfig, "offlineGraceSec">): boolean;
 /**
  * R5 — classify the token's time window. `exp` REQUIRED (a JWT without exp is not acceptable here —
- * registry tokens always carry one; classify a missing exp as "expired" so it can never live forever).
- * All values in SECONDS (JWT NumericDate).
+ * web-admin tokens always carry one; classify a missing exp as "expired" so it can never live forever).
+ * `nbf` / `iat`, when present, must not lie beyond now + skew (not yet valid / issued in the future).
+ * All values in SECONDS (JWT NumericDate); one tolerance (`clockSkewSec`) for all three.
  */
 export declare function classifyTimeClaims(claims: {
     exp?: number;
     nbf?: number;
+    iat?: number;
 }, nowSec: number, clockSkewSec: number): "ok" | "expired";
 /**
  * R6/R7/R9 — map a signature-verified payload to the identity, or reject. Pure: call AFTER the JWT
@@ -325,6 +194,7 @@ export declare function toVerifiedIdentity(payload: {
     jti?: unknown;
     aud?: unknown;
     scope?: unknown;
+    iat?: unknown;
 }, cfg?: Pick<VerifierConfig, "audience">): AuthBridgeResult;
 /** Cheap pre-filter: does this bearer LOOK like a JWT (three non-empty dot-separated segments)? Use it to
  *  route between the existing static-token branch and this verifier — NOT as any kind of validation. */