@sema-agent/settings-schema 10.1.1 → 11.1.0

package/dist/one-time-migrations.js

@@ -0,0 +1,828 @@
+/**
+ * @sema-agent/settings-schema/one-time-migrations —— 一次性迁移族(11.0.0)。持久面唯一允许的过渡形,**窗关之后的下一个 major 整族删**。
+ *
+ * ## 律(一条,写在最前:什么变少了)
+ * **读路径上零抬升臂。** 旧形只有一种去处:这里登记的一次性迁移把它改写成新形(调用方写回、幂等、登记窗);读写两面遇旧形一律
+ * 响亮拒,拒句点名迁移 id(墓碑:retired 域 `RETIRED_DOMAINS` / 域 schema 里的retired 键墓碑字段 / 拒句尾的迁移指路)。11.0.0 之前,同样的
+ * 旧形由读路径上五只常驻臂每次读都抬一遍(治理三闸从 `runtime` 抬升、未知键扫描为 `runtime` 豁免、hosts 夹紧、调度店 durable 键重铸、
+ * workers 6.x 读时抬升),窗口只写在散文里、几个 major 都没关上。现在常驻臂 0 只;唯一的读时改写是调度店的 SS-M3(登记在本表、
+ * lazy-on-read,理由见那一行),随本族一起删。
+ *
+ * **迁移只认形、不认义**:每一步的输入形在新契约下非法、输出形合法 ⇒ 重跑恒等,新写入的数据永远不会被当成旧数据再改一次,不需要版本围栏;
+ * 同一串字节换意思的改动一律**换表示**(SS-M6 因此是「`atModelAllowlist` → `atMention`」换字段,而不是翻 `[]` 的义)。
+ *
+ * ## 入口(纯函数:不读环境、不读墙钟、不改入参、**不抬任何版本号**)
+ *  · {@link migrateStoredDocuments} —— 一组**存储文档**(域名 → 文档)。一个 scope 的全部草稿、一个 principal 层(个人 models / mcp /
+ *    skills / plugins)、回滚史里的一条单域行,各调一次;`coverage` 说这组文档是不是一个 scope 的全集(只有 SS-M1 要知道:缺席的
+ *    `governance` 是「从未设过」还是「没给」)。缺的域 = 不动。
+ *  · {@link migrateEffectiveSnapshot} —— 一份**冻结的 effective**(发布快照、回滚历史里的整份快照、引擎的 last-known-good 文件)。改写规则
+ *    与草稿同(零语义变 ⇒ 不越过发布审批:改的是表示,不是已批准的内容);不从草稿重建;`version` / `updatedAt` 与其余信封键原样。
+ *  · {@link migrateSchedulerRecords} —— 调度店的记录(SS-M3;`parseSchedulerStore` 读时调它)。
+ * 每条改动出一张 {@link MigrationReceipt}(闭集 `appliedAs` 词,只点名坐标、不带值);**没改的文档原样(同一引用)返回**,被移除的文档
+ * (retired 域)从结果里消失 —— 调用方据此判「哪份要写回、哪份要删」。**版本号归调用方**:草稿版本(待审的发布申请据它判「草稿动没动」)、
+ * 快照的 `version` / `globalRevision` 一概不动 —— 迁移改的是表示,要不要因此抬版本是调用方的决定,本包不替它做。
+ *
+ * ## 窗(规则写在这里一次,日期只在登记表)
+ * 窗 = 引入版本的发布日 + 30 天(`removableAfter`);窗关之后的**下一个 major** 删整族(删什么 = 那一行的 `removal`;导出名删除是本包的
+ * 硬破坏,所以不是 minor)。未发布形:`releasedOn` / `removableAfter` 两格写 `null`,抬 `package.json` 到 `introducedIn` 的发布准备提交
+ * 回填。到期门 `test/one-time-migration-window-gate.test.ts`:今天晚于 `removableAfter` ⇒ 红(点名 `removal`);`package.json` ≥
+ * `introducedIn` 而两格仍 `null` ⇒ 红(回填门)。删码之后存量若还带旧形,由那一行 `afterRemoval` 点名的**既有**响亮臂接住。
+ */
+import { z } from "zod";
+import { outgoingPath, redactSecrets } from "./config-fns.js";
+import { LANE_ENV_OWNER, STORE_ENV_KEYS, isLaneEnvKey } from "./execution-lane-index.js";
+import { EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js";
+import { INTEGER } from "./integer.js";
+import { DOMAIN_SCHEMAS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, NON_SECRET_URL, isDomainName, isRetiredDomainName } from "./types.js";
+import { workerRowVerdict } from "./worker-row-verdict.js";
+import { unwrapSchema } from "./zod-unwrap.js";
+export { MIGRATION_APPLIED_AS, ONE_TIME_MIGRATION_IDS } from "./migration-receipt.js";
+export { migrateSchedulerRecords } from "./scheduler-store-migration.js";
+// ── 登记表 ─────────────────────────────────────────────────────────────────────────────────────────────
+/** wire 删码位的 id(闭集;`W` = wire):没有存储形要改写、没有收据,与数据迁移同表登记只为让「什么时候删、删什么、删后谁接住」只写一处。 */
+export const WIRE_RETIREMENT_IDS = ["SS-W1"];
+/** 一次性迁移登记表 —— 本族各条窗的**唯一属主**。别处只写「窗见 `ONE_TIME_MIGRATIONS` 登记表」。 */
+export const ONE_TIME_MIGRATIONS = [
+    {
+        id: "SS-M1",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "the retired `runtime` domain document: the governance trio (autonomy / commandPolicy / approvalRequire) moves into `governance` when that domain " +
+            "was never set (else it is dropped — the set governance won); each of the five limit keys moves into `limits` when `limits` lacks it (else it is " +
+            "dropped — limits won); keys the runtime schema never read are dropped; then the runtime document is removed. Needs the whole scope " +
+            "(coverage \"scope\"); a partial set without both governance and limits is refused",
+        removal: "the next major after the window: delete the SS-M1 step (its private 10.x runtime schema included) and the `coverage` option of migrateStoredDocuments (SS-M1 is its only " +
+            "reader); RETIRED_DOMAINS stays — the SS-M1 clause leaves its sentence",
+        afterRemoval: "the RETIRED_DOMAINS tombstone (permanent): parseDomain / buildEffective / readEffectiveWire / FileConfigStore / readBundle refuse a runtime document that carries " +
+            "facts (RetiredDomainError). A rollback-history row that holds only a runtime document cannot be migrated on its own — rolling back to it is refused " +
+            "by the same tombstone (unrecoverable by design)",
+    },
+    {
+        id: "SS-M2",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "hosts: an entry whose name is longer than 63 characters is removed, and an array over 1024 entries keeps its first 1024 — exactly what the " +
+            "read-side clamp did on every read since 0.8.1",
+        removal: "the next major after the window: delete the SS-M2 step; the two hosts bound messages lose their SS-M2 clause",
+        afterRemoval: "the hosts schema bounds (read and write): an over-long name drops its entry on read (`entry-dropped`), an over-long array degrades the hosts " +
+            "domain to its default (`domain-defaulted`)",
+    },
+    {
+        id: "SS-M3",
+        oldForm: "rewritten-on-read",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "scheduler store: a durable record (lifetime not \"session\") still keyed by its session chain gets scope := principal ?? \"default\". Lazy-on-read: " +
+            "parseSchedulerStore applies it and the next writer persists it (a separate migration write would only add a competing writer) — the one read-time " +
+            "rewrite left in the package",
+        removal: "the next major after the window: delete scheduler-store-migration.ts, its call in parseSchedulerStore and the `one-time-migration` arm of SchedulerParseWarning",
+        afterRemoval: "no loud arm: a durable record still stored under its old session key is never found by its durable key (the job looks gone) — stated here " +
+            "instead of keeping a compatibility read",
+    },
+    {
+        id: "SS-M4",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "workers: a 6.x row (env.REMOTE_EXEC + lane keys, runtime.sessionBackend / memoryBackend / db, coords.tidb*, secretRefs.tidbPasswordEnv, store " +
+            "keys in env) is rewritten into runtime.execution + runtime.store; a row the step would have to guess for, or that still does not read after the " +
+            "rewrite, is refused and kept verbatim (readWorkersRows holds it on read). Runs last: the rewritten row is judged after every other step's " +
+            "rewrite (SS-M7's fragment strip included)",
+        removal: "the next major after the window: delete the SS-M4 step; the 6.x tombstone fields of WorkerSpec and the reserved-env signpost stay — their SS-M4 clause goes",
+        afterRemoval: "the 6.x tombstone fields of WorkerSpec and the reserved-env refusal (permanent): a residual 6.x row is held by readWorkersRows, never rewritten",
+    },
+    {
+        id: "SS-M5",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "models: an entry carrying both sealedApiKey and apiKeyEnv loses apiKeyEnv (the sealed key won — the effective reading before 11.0.0)",
+        removal: "the next major after the window: delete the SS-M5 step; the ModelEntry one-key rule loses its SS-M5 clause",
+        afterRemoval: "the ModelEntry one-key rule (permanent): a residual dual-key entry is dropped on read (`entry-dropped`) and refused on write",
+    },
+    {
+        id: "SS-M6",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "models / rosters: atModelAllowlist → atMention by shape — [] → {mode:\"all\"}, a non-empty list → {mode:\"only\",models}; an absent key stays " +
+            "absent (the global default is all, a roster inherits); a document carrying both keys is refused (the step does not pick a winner)",
+        removal: "the next major after the window: delete the SS-M6 step; the atModelAllowlist tombstone fields stay — their SS-M6 clause goes",
+        afterRemoval: "the atModelAllowlist tombstone fields (permanent): a residual list is refused on read and write (models: the domain degrades to its default; " +
+            "rosters: the scope fails to read)",
+    },
+    {
+        id: "SS-M7",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "every NON_SECRET_URL seat in a domain document (derived from the domain schemas, not listed by hand — today models.models[].baseUrl, " +
+            "mcp.servers[].transport.url, execution.sessionMirror.engineUrl, workers.workers[].coords.gitApiBaseUrl): `#` and everything after it are removed " +
+            "(a fragment never goes on the wire)",
+        removal: "the next major after the window: delete the SS-M7 step and its schema walk; the NON_SECRET_URL fragment rule loses its SS-M7 clause",
+        afterRemoval: "the NON_SECRET_URL shape judge, which refuses a fragment (`#` included) on read and write",
+    },
+    {
+        id: "SS-M9",
+        oldForm: "refused",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "models: the structural `default` key → `roles.default = {model}` by what the default model was before 11.0.0 (the server's default " +
+            "resolution read `default` first, and the main task ran it): `roles.default` absent ⇒ moved there; the same name already there ⇒ " +
+            "moved (the duplicate goes); a different `roles.default` ⇒ that one is dropped as shadowed and `default` moves in; a `default` that is " +
+            "not a non-empty string is refused (it does not read today either)",
+        removal: "the next major after the window: delete the SS-M9 step; the models.default tombstone field stays — its SS-M9 clause goes",
+        afterRemoval: "the models.default tombstone field (permanent): a residual key is refused on read and write (the models domain degrades to its default)",
+    },
+    {
+        // 一条 wire 位的删码登记,不是数据迁移(id 在 WIRE_RETIREMENT_IDS,不在收据闭集)。
+        id: "SS-W1",
+        oldForm: "not-stored",
+        introducedIn: "11.0.0",
+        releasedOn: "2026-10-10",
+        removableAfter: "2026-11-09",
+        rewrites: "nothing stored: the flat engine-state dialect of the fleet wire — InstanceHealth.draining / InstanceHealth.drainingSince and " +
+            "InstanceAnnouncement.ready / InstanceAnnouncement.draining / InstanceAnnouncement.restart / InstanceAnnouncement.generation / " +
+            "InstanceAnnouncement.leaseState / InstanceAnnouncement.leaseUntil (and the same flat keys /health passes through untyped) — stays on " +
+            "both shapes for its contraction window: engines keep sending it for readers that predate the engine signal, and no reader in this " +
+            "package reads it (the engine's state is read only from EngineSignal under ENGINE_SIGNAL_KEY)",
+        removal: "the next major after the window: delete the flat engine-state dialect from InstanceHealth and InstanceAnnouncement and this row; " +
+            "engines stop sending it in the same wave",
+        afterRemoval: "a body that still carries the flat keys is read exactly as today: the heartbeat shape strips them, /health passes them through " +
+            "untyped, and no judge reads them — an engine that does not carry EngineSignal is no-engine-signal, never routable",
+    },
+];
+/**
+ * 迁移一组存储文档(见文件头「入口」)。纯函数;没改的文档原样返回;**不抬任何版本号**(结果里没有版本 —— 那是调用方的)。
+ * 重跑恒等:第二次跑零改动,只剩第一次就 `refused` 的那几张收据(那些坐标原样留着,读侧照旧拒)。
+ */
+export function migrateStoredDocuments(docs, opts) {
+    if (!isPlainObject(docs))
+        throw new TypeError("migrateStoredDocuments: `docs` must be a { domain: document } object");
+    switch (opts.coverage) {
+        case "scope":
+        case "partial":
+            break;
+        default: {
+            const unhandled = opts.coverage;
+            throw new TypeError(`migrateStoredDocuments: coverage must be "scope" or "partial" (got ${JSON.stringify(unhandled)})`);
+        }
+    }
+    const out = { ...docs };
+    const receipts = [];
+    // 步序的律:纯改写步在前,拿新 schema 终判改写结果的步(SS-M4)最后 —— 它判的是**全部**改写之后的行,别的步能修好的形(例:SS-M7 剥掉的
+    // fragment)不会先被它拒掉(否则一跑 refused、二跑才过:既不是一次完成,也不幂等)。
+    stepRuntimeDomain(out, opts.coverage, receipts);
+    stepHostsBounds(out, receipts);
+    stepModelKeyOneOf(out, receipts);
+    stepAtMention(out, receipts);
+    stepModelsDefault(out, receipts);
+    stepUrlFragments(out, receipts);
+    stepWorkers6x(out, receipts);
+    return { docs: out, receipts };
+}
+/**
+ * 迁移一份冻结的 effective(见文件头「入口」):域键过与 {@link migrateStoredDocuments} 同一组步(coverage `"scope"` —— effective 里每个域
+ * 都物化了),其余键(`version` / `updatedAt` / wire 上的 `skills` 清单形 …)原样。键序保持;被移除的retired 域不在;effective 没改 ⇒ 同一引用。
+ * 不是对象 ⇒ 原样返回(判形是读者的事)。
+ */
+export function migrateEffectiveSnapshot(effective) {
+    if (!isPlainObject(effective))
+        return { effective, receipts: [] };
+    const docs = {};
+    for (const [k, v] of Object.entries(effective))
+        if (isDomainName(k) || isRetiredDomainName(k))
+            docs[k] = v;
+    const m = migrateStoredDocuments(docs, { coverage: "scope" });
+    const changed = Object.keys(docs).some((k) => !Object.prototype.hasOwnProperty.call(m.docs, k) || m.docs[k] !== docs[k]) || Object.keys(m.docs).some((k) => !Object.prototype.hasOwnProperty.call(docs, k));
+    if (!changed)
+        return { effective, receipts: m.receipts };
+    const next = {};
+    for (const [k, v] of Object.entries(effective)) {
+        if (!(isDomainName(k) || isRetiredDomainName(k)))
+            next[k] = v;
+        else if (Object.prototype.hasOwnProperty.call(m.docs, k))
+            next[k] = m.docs[k];
+    }
+    for (const [k, v] of Object.entries(m.docs))
+        if (!Object.prototype.hasOwnProperty.call(next, k))
+            next[k] = v;
+    return { effective: next, receipts: m.receipts };
+}
+function isPlainObject(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return false;
+    const proto = Object.getPrototypeOf(v);
+    return proto === Object.prototype || proto === null;
+}
+const has = (o, k) => isPlainObject(o) && Object.prototype.hasOwnProperty.call(o, k);
+const without = (o, k) => {
+    const { [k]: _gone, ...rest } = o;
+    return rest;
+};
+// 收据的三只铸点。坐标里的键段是用户写的(未知键名、zod issue 路径里的 Record 键),完全可能就是一条粘错位置的凭据 ⇒ 与读侧告警坐标
+// 走同一道出门(`outgoingPath`,codex r1 F1);拒因句过 `redactSecrets`。收据从不带值。
+function receipt(migration, document, path, appliedAs) {
+    return { migration, document, path: outgoingPath(path), appliedAs };
+}
+function moved(migration, document, path, to) {
+    return { migration, document, path: outgoingPath(path), appliedAs: "moved", to: { document: to.document, path: outgoingPath(to.path) } };
+}
+function refused(migration, document, path, reason) {
+    return { migration, document, path: outgoingPath(path), appliedAs: "refused", reason: redactSecrets(reason) };
+}
+// ── SS-M1:retired `runtime` 域 ────────────────────────────────────────────────────────────────────────────
+/** 10.x 的 runtime 域 schema(迁移私有:判「这份 runtime 文档迁移前读不读得进」—— 读不进的文档今天就让整个 scope 读不出,没有生效读法可保)。 */
+const RUNTIME_10X = z.object({
+    rateLimitPerMin: INTEGER.nonnegative().optional(),
+    maxTaskCostUsd: z.number().finite().nonnegative().optional(),
+    maxTaskTokens: INTEGER.nonnegative().optional(),
+    maxPrincipalCostUsd: z.number().finite().nonnegative().optional(),
+    costQuotaWindowSec: INTEGER.positive().optional(),
+});
+const GOVERNANCE_TRIO = ["autonomy", "commandPolicy", "approvalRequire"];
+const LIMIT_KEYS = ["rateLimitPerMin", "maxTaskCostUsd", "maxTaskTokens", "maxPrincipalCostUsd", "costQuotaWindowSec"];
+function stepRuntimeDomain(out, coverage, receipts) {
+    if (!Object.prototype.hasOwnProperty.call(out, "runtime"))
+        return;
+    const raw = out.runtime;
+    if (raw === undefined)
+        return;
+    const refuse = (reason) => void receipts.push(refused("SS-M1", "runtime", [], reason));
+    if (isPlainObject(raw) && Object.keys(raw).length === 0) {
+        delete out.runtime;
+        receipts.push(receipt("SS-M1", "runtime", [], "dropped-inert"));
+        return;
+    }
+    if (!isPlainObject(raw))
+        return refuse("the stored runtime document is not a JSON object — the scope does not read today either; fix it by hand");
+    if (coverage === "partial" && !(has(out, "governance") && has(out, "limits"))) {
+        return refuse("a runtime document migrates only together with its scope's governance and limits documents (coverage \"scope\") — on its own there is no telling whether governance was ever set");
+    }
+    const parsed = RUNTIME_10X.safeParse(raw);
+    if (!parsed.success)
+        return refuse("the stored runtime document does not read under the 10.x runtime schema — the scope does not read today either; fix it by hand");
+    const limitsRaw = out.limits;
+    if (limitsRaw !== undefined && !isPlainObject(limitsRaw))
+        return refuse("the scope's limits document is not a JSON object — the scope does not read today either; fix limits first");
+    const trio = GOVERNANCE_TRIO.filter((k) => has(raw, k) && raw[k] !== undefined);
+    if (trio.length > 0) {
+        // 迁移前的读法:governance 域**从未设过**(店里没有这份文档)⇒ 读侧从 runtime 抬升三闸;设过 ⇒ 设过的那份赢,runtime 上的三闸从未生效。
+        if (out.governance === undefined) {
+            out.governance = Object.fromEntries(trio.map((k) => [k, raw[k]]));
+            for (const k of trio)
+                receipts.push(moved("SS-M1", "runtime", [k], { document: "governance", path: [k] }));
+        }
+        else {
+            for (const k of trio)
+                receipts.push(receipt("SS-M1", "runtime", [k], "dropped-shadowed"));
+        }
+    }
+    const limitKeys = LIMIT_KEYS.filter((k) => parsed.data[k] !== undefined);
+    if (limitKeys.length > 0) {
+        // 迁移前的读法(消费方):`limits` 有这一键 ⇒ limits 赢;没有 ⇒ 读 runtime 上的值。
+        const limits = isPlainObject(limitsRaw) ? { ...limitsRaw } : {};
+        let added = false;
+        for (const k of limitKeys) {
+            if (Object.prototype.hasOwnProperty.call(limits, k))
+                receipts.push(receipt("SS-M1", "runtime", [k], "dropped-shadowed"));
+            else {
+                limits[k] = parsed.data[k];
+                added = true;
+                receipts.push(moved("SS-M1", "runtime", [k], { document: "limits", path: [k] }));
+            }
+        }
+        if (added)
+            out.limits = limits;
+    }
+    const handled = new Set([...trio, ...limitKeys]);
+    for (const k of Object.keys(raw))
+        if (!handled.has(k))
+            receipts.push(receipt("SS-M1", "runtime", [k], "dropped-inert")); // runtime schema 从未读过的键
+    delete out.runtime;
+}
+// ── SS-M2:hosts 超界 ───────────────────────────────────────────────────────────────────────────────────
+function stepHostsBounds(out, receipts) {
+    const doc = out.hosts;
+    if (!isPlainObject(doc) || !Array.isArray(doc.hosts))
+        return;
+    const rows = doc.hosts;
+    let kept = [];
+    const dropped = [];
+    rows.forEach((row, index) => {
+        const name = isPlainObject(row) ? row.name : undefined;
+        if (typeof name === "string" && name.length > HOST_NAME_MAX)
+            dropped.push(index);
+        else
+            kept.push({ row, index });
+    });
+    if (kept.length > HOSTS_ARRAY_MAX) {
+        for (const { index } of kept.slice(HOSTS_ARRAY_MAX))
+            dropped.push(index);
+        kept = kept.slice(0, HOSTS_ARRAY_MAX);
+    }
+    if (dropped.length === 0)
+        return;
+    for (const index of dropped.sort((a, b) => a - b))
+        receipts.push(receipt("SS-M2", "hosts", ["hosts", index], "dropped-inert"));
+    out.hosts = { ...doc, hosts: kept.map((k) => k.row) };
+}
+// ── SS-M4:workers 6.x 行 ───────────────────────────────────────────────────────────────────────────────
+/** 6.x 删除项:`[容器, 键]`。 */
+const SIX_X_STORE_FIELDS = [
+    ["runtime", "sessionBackend"],
+    ["runtime", "memoryBackend"],
+    ["runtime", "db"],
+    ["coords", "tidbHost"],
+    ["coords", "tidbPort"],
+    ["coords", "tidbUser"],
+    ["secretRefs", "tidbPasswordEnv"],
+];
+/** 引擎 `MEMORY_ENGINE` 的两族词(比较前 trim + 小写)。 */
+const MEMORY_ENGINE_ON_WORDS = ["on", "true", "1", "yes", "enabled"];
+const MEMORY_ENGINE_OFF_WORDS = ["off", "false", "0", "no", "disabled"];
+/** 引擎 `MYSQL_PORT` 的缺省 —— 旧形没写端口时引擎连的就是它。 */
+const MYSQL_DEFAULT_PORT = 3306;
+const isLaneWord = (v) => typeof v === "string" && EXECUTION_LANE_WORDS.some((w) => w === v);
+const isStoreWord = (v) => typeof v === "string" && STORE_BACKENDS.some((w) => w === v);
+const isMemoryBackendWord = (v) => typeof v === "string" && MEMORY_ENGINE_BACKENDS.some((w) => w === v);
+/** 拒因里只点名形如词的值(短、小写);其余一律不回显(值可能是粘错位置的凭据)。 */
+const describeWord = (v) => (typeof v === "string" && /^[a-z0-9][a-z0-9-]{0,31}$/.test(v) ? `"${v}"` : "(value not shown)");
+const UNCHANGED = { kind: "unchanged" };
+/**
+ * 一行的 6.x 改写。规则(每个旧键恰好一种去处):车道 —— `env.REMOTE_EXEC` 是车道词 ⇒ `runtime.execution.lane`,同车道的 env 键 ⇒ `coords`、
+ * 同车道的 `secretEnv` 密钥 ⇒ `secretRefs`;别车道的键与 `REQUIRE_EXECUTION_LANE` ⇒ 丢(引擎只读被点名车道那一臂);enabled 且无车道 ⇒ 拒
+ * (不替运维猜车道)。店 —— `sessionBackend` ⇒ `store.session`(`tidb` ⇒ `mysql`);`memoryBackend` ⇒ 丢(从未到达引擎);`coords.tidb*` +
+ * `runtime.db` ⇒ `store.db`(缺端口 ⇒ 3306),`tidbPasswordEnv` ⇒ `dbPasswordEnv`;无 host ⇒ `store.backend = local`;env 里的
+ * `DB_BACKEND` / `MEMORY_ENGINE` / `MEMORY_ENGINE_BACKEND` ⇒ 搬进 `store`。表达不了 ⇒ 拒:值写错了栏、不认识的词、新旧两形并存、
+ * `DB_BACKEND=pg` 配 MySQL 族坐标。不是 6.x 形的行(没有任何旧键,该有的块都在)⇒ 不动 —— 它读不读得进是 `readWorkersRows` 的事。
+ */
+function migrateWorkerRow(raw) {
+    const refuse = (field, reason) => ({ kind: "refused", field, reason });
+    const enabled = raw.enabled !== false;
+    const laneKeysOf = (rec) => (isPlainObject(rec) ? Object.keys(rec).filter(isLaneEnvKey) : []);
+    const storeKeysOf = (rec) => (isPlainObject(rec) ? STORE_ENV_KEYS.filter((k) => Object.hasOwn(rec, k)) : []);
+    const envLaneKeys = laneKeysOf(raw.env);
+    const secretLaneKeys = laneKeysOf(raw.secretEnv);
+    const envStoreKeys = storeKeysOf(raw.env);
+    const secretStoreKeys = storeKeysOf(raw.secretEnv);
+    const oldStoreFields = SIX_X_STORE_FIELDS.filter(([c, k]) => has(raw[c], k));
+    const hasExecution = has(raw.runtime, "execution");
+    const hasStore = has(raw.runtime, "store");
+    const laneTouched = envLaneKeys.length + secretLaneKeys.length > 0;
+    const storeTouched = oldStoreFields.length + envStoreKeys.length + secretStoreKeys.length > 0;
+    if (!laneTouched && !storeTouched)
+        return UNCHANGED; // 没有任何 6.x 键:不是本步的形
+    if (hasExecution && laneTouched) {
+        return refuse(["runtime", "execution"], `declares runtime.execution AND execution-lane keys in env / secretEnv (${[...envLaneKeys, ...secretLaneKeys].join(", ")}) — keep one form; the migration does not pick a winner`);
+    }
+    // 新形的店字段有两处:`runtime.store` 与 `secretRefs.dbPasswordEnv`。任一在场 ∧ 还有旧店字段 ⇒ 两形并存,不挑赢家。
+    const newStoreFields = [...(hasStore ? ["runtime.store"] : []), ...(has(raw.secretRefs, "dbPasswordEnv") ? ["secretRefs.dbPasswordEnv"] : [])];
+    if (newStoreFields.length > 0 && storeTouched) {
+        const old = [...oldStoreFields.map(([c, k]) => `${c}.${k}`), ...envStoreKeys.map((k) => `env.${k}`), ...secretStoreKeys.map((k) => `secretEnv.${k}`)];
+        return refuse(["runtime", "store"], `declares the 7.0.0 store fields (${newStoreFields.join(", ")}) AND 6.x store fields (${old.join(", ")}) — keep one form; the migration does not pick a winner`);
+    }
+    const secretStoreKey = secretStoreKeys[0];
+    if (secretStoreKey !== undefined)
+        return refuse(["secretEnv", secretStoreKey], `${secretStoreKey} is set from a host secret — the migration cannot read it; declare runtime.store by hand`);
+    if (has(raw.secretEnv, "REMOTE_EXEC"))
+        return refuse(["secretEnv", "REMOTE_EXEC"], "the execution lane is set from a host secret — the migration cannot read it; declare runtime.execution.lane by hand");
+    const needLane = !hasExecution && (enabled || laneTouched);
+    const needStore = !hasStore && (enabled || storeTouched);
+    const w = structuredClone(raw);
+    const runtime = isPlainObject(w.runtime) ? w.runtime : {};
+    w.runtime = runtime;
+    const env = isPlainObject(w.env) ? w.env : {};
+    const secretEnv = isPlainObject(w.secretEnv) ? w.secretEnv : {};
+    const coords = isPlainObject(w.coords) ? w.coords : {};
+    const secretRefs = isPlainObject(w.secretRefs) ? w.secretRefs : {};
+    const dropped = [];
+    const drop = (container, slot, key) => {
+        delete container[key];
+        dropped.push([slot, key]);
+    };
+    // ── 车道
+    if (needLane) {
+        const rx = env.REMOTE_EXEC;
+        if (rx === undefined || rx === "") {
+            if (enabled) {
+                return refuse(["env", "REMOTE_EXEC"], `an enabled worker names no execution lane (env.REMOTE_EXEC is unset) — it boots with no hands and still reports tasks completed. ` +
+                    `The migration does not guess a lane: set runtime.execution.lane (${EXECUTION_LANE_WORDS.join(" | ")}) by hand, or disable the worker`);
+            }
+            for (const k of envLaneKeys)
+                drop(env, "env", k); // 停用且没点名车道 ⇒ 每个车道键都是惰性的
+            for (const k of secretLaneKeys)
+                drop(secretEnv, "secretEnv", k);
+        }
+        else {
+            if (!isLaneWord(rx)) {
+                return refuse(["env", "REMOTE_EXEC"], `env.REMOTE_EXEC ${describeWord(rx)} is not an execution lane (${EXECUTION_LANE_WORDS.join(" | ")}) — the engine refuses to start with it; set runtime.execution.lane by hand`);
+            }
+            const lane = rx;
+            const laneCoords = {};
+            const laneSecretRefs = {};
+            for (const k of envLaneKeys) {
+                if (k === "REMOTE_EXEC") {
+                    delete env[k];
+                    continue;
+                }
+                const owner = LANE_ENV_OWNER.get(k);
+                if (owner === undefined || owner.lane !== lane) {
+                    drop(env, "env", k); // REQUIRE_EXECUTION_LANE(声明了车道就恒渲 true)与别车道的键(引擎只读被点名那一臂)
+                    continue;
+                }
+                const v = env[k];
+                if (owner.secret) {
+                    return refuse(["env", k], `${k} is a secret of lane "${lane}" but env carries it as a literal value — the migration does not move a value into a secret slot: put it in the host secret source and reference it from runtime.execution.secretRefs.${k}`);
+                }
+                if (typeof v !== "string")
+                    return refuse(["env", k], `env.${k} is not a string`);
+                laneCoords[k] = v;
+                delete env[k];
+            }
+            for (const k of secretLaneKeys) {
+                const owner = LANE_ENV_OWNER.get(k);
+                if (owner === undefined || owner.lane !== lane) {
+                    drop(secretEnv, "secretEnv", k);
+                    continue;
+                }
+                const v = secretEnv[k];
+                if (!owner.secret) {
+                    return refuse(["secretEnv", k], `${k} is a non-secret coordinate of lane "${lane}" but is set from a host secret — the migration cannot read the value; write it in runtime.execution.coords.${k} by hand`);
+                }
+                if (typeof v !== "string")
+                    return refuse(["secretEnv", k], `secretEnv.${k} is not a string`);
+                laneSecretRefs[k] = v;
+                delete secretEnv[k];
+            }
+            runtime.execution = { lane, coords: laneCoords, secretRefs: laneSecretRefs };
+        }
+    }
+    // ── 店
+    if (needStore) {
+        if (Object.hasOwn(runtime, "memoryBackend"))
+            drop(runtime, "runtime", "memoryBackend"); // 从未到达引擎
+        const sessionRaw = runtime.sessionBackend;
+        const host = coords.tidbHost;
+        const hostSet = typeof host === "string" && host !== "";
+        const dbBackendRaw = env.DB_BACKEND;
+        const dbBackendSet = dbBackendRaw !== undefined && dbBackendRaw !== "";
+        const named = hostSet || dbBackendSet || sessionRaw === "tidb";
+        const sqlCoordFields = [
+            [runtime, "runtime", "db"],
+            [coords, "coords", "tidbHost"],
+            [coords, "coords", "tidbPort"],
+            [coords, "coords", "tidbUser"],
+            [secretRefs, "secretRefs", "tidbPasswordEnv"],
+        ];
+        if (!enabled && !named) {
+            // 停用、旧形没点名任何店 ⇒ 不替它发明一个;旧字段全是惰性的
+            if (Object.hasOwn(runtime, "sessionBackend"))
+                drop(runtime, "runtime", "sessionBackend");
+            for (const [c, slot, k] of sqlCoordFields)
+                if (Object.hasOwn(c, k))
+                    drop(c, slot, k);
+            for (const k of STORE_ENV_KEYS)
+                if (Object.hasOwn(env, k))
+                    drop(env, "env", k);
+        }
+        else {
+            let session;
+            if (sessionRaw === undefined)
+                session = "auto"; // 6.x 的缺省
+            else if (sessionRaw === "tidb")
+                session = "mysql";
+            else if (sessionRaw === "memory" || sessionRaw === "auto")
+                session = sessionRaw;
+            else
+                return refuse(["runtime", "sessionBackend"], `runtime.sessionBackend ${describeWord(sessionRaw)} is not a 6.x session backend (tidb | memory | auto)`);
+            delete runtime.sessionBackend;
+            let backend;
+            if (dbBackendSet) {
+                if (!isStoreWord(dbBackendRaw))
+                    return refuse(["env", "DB_BACKEND"], `env.DB_BACKEND ${describeWord(dbBackendRaw)} is not a store backend (${STORE_BACKENDS.join(" | ")}) — the engine refuses to start with it`);
+                backend = dbBackendRaw;
+            }
+            else {
+                backend = hostSet || sessionRaw === "tidb" ? "mysql" : "local";
+            }
+            delete env.DB_BACKEND;
+            const sqlCoordsPresent = sqlCoordFields.filter(([c, , k]) => Object.hasOwn(c, k));
+            const store = { backend, session };
+            if (backend === "mysql") {
+                if (hostSet) {
+                    const port = coords.tidbPort;
+                    store.db = {
+                        host,
+                        port: port === undefined ? MYSQL_DEFAULT_PORT : port,
+                        ...(Object.hasOwn(coords, "tidbUser") ? { user: coords.tidbUser } : {}),
+                        ...(Object.hasOwn(runtime, "db") ? { database: runtime.db } : {}),
+                    };
+                }
+                if (Object.hasOwn(secretRefs, "tidbPasswordEnv"))
+                    secretRefs.dbPasswordEnv = secretRefs.tidbPasswordEnv;
+                for (const [c, , k] of sqlCoordsPresent)
+                    delete c[k];
+            }
+            else if (backend === "pg") {
+                if (sqlCoordsPresent.length > 0) {
+                    return refuse(["env", "DB_BACKEND"], `env.DB_BACKEND=pg but the SQL coordinates are the MySQL family (coords.tidb* / runtime.db / secretRefs.tidbPasswordEnv, rendered as MYSQL_*) — the migration does not move a MySQL server's coordinates onto pg; declare runtime.store by hand`);
+                }
+            }
+            else {
+                for (const [c, slot, k] of sqlCoordsPresent)
+                    drop(c, slot, k); // 非 SQL 店:SQL 坐标是「声明不用」的惰性件
+            }
+            const memory = {};
+            const engineRaw = env.MEMORY_ENGINE;
+            if (engineRaw !== undefined) {
+                const word = typeof engineRaw === "string" ? engineRaw.trim().toLowerCase() : undefined;
+                if (word !== undefined && MEMORY_ENGINE_ON_WORDS.includes(word))
+                    memory.engine = "on";
+                else if (word !== undefined && MEMORY_ENGINE_OFF_WORDS.includes(word))
+                    memory.engine = "off";
+                else if (word !== "")
+                    return refuse(["env", "MEMORY_ENGINE"], "env.MEMORY_ENGINE is not an on/off word — the engine refuses to start with it");
+                delete env.MEMORY_ENGINE;
+            }
+            const memoryBackendRaw = env.MEMORY_ENGINE_BACKEND;
+            if (memoryBackendRaw !== undefined) {
+                if (!isMemoryBackendWord(memoryBackendRaw)) {
+                    return refuse(["env", "MEMORY_ENGINE_BACKEND"], `env.MEMORY_ENGINE_BACKEND ${describeWord(memoryBackendRaw)} is not a memory backend (${MEMORY_ENGINE_BACKENDS.join(" | ")}) — the engine refuses to start with it`);
+                }
+                memory.backend = memoryBackendRaw;
+                delete env.MEMORY_ENGINE_BACKEND;
+            }
+            if (Object.keys(memory).length > 0)
+                store.memory = memory;
+            runtime.store = store;
+        }
+    }
+    // 被搬空的 env / secretEnv 整键去掉(它们是可选字段;留一个 `{}` 只是噪声)
+    if (isPlainObject(w.env) && Object.keys(env).length === 0 && isPlainObject(raw.env) && Object.keys(raw.env).length > 0)
+        delete w.env;
+    if (isPlainObject(w.secretEnv) && Object.keys(secretEnv).length === 0 && isPlainObject(raw.secretEnv) && Object.keys(raw.secretEnv).length > 0)
+        delete w.secretEnv;
+    // 改写后的行仍读不进 7.x 形 ⇒ 不写回半成品:拒,原文留盘(读口 `readWorkersRows` 扣下它)。判据与拒句是读口那一只(`workerRowVerdict`)。
+    const verdict = workerRowVerdict(w, "migrated");
+    if (verdict !== undefined)
+        return refuse(verdict.field, verdict.reason);
+    return { kind: "rewritten", row: w, dropped };
+}
+function stepWorkers6x(out, receipts) {
+    const doc = out.workers;
+    if (!isPlainObject(doc) || !Array.isArray(doc.workers))
+        return;
+    const rows = doc.workers;
+    let next;
+    rows.forEach((row, index) => {
+        if (!isPlainObject(row) || typeof row.name !== "string")
+            return; // 认不出名字:整域读侧判
+        const r = migrateWorkerRow(row);
+        switch (r.kind) {
+            case "unchanged":
+                return;
+            case "refused":
+                receipts.push(refused("SS-M4", "workers", ["workers", index, ...r.field], r.reason));
+                return;
+            case "rewritten":
+                next ??= [...rows];
+                next[index] = r.row;
+                receipts.push(receipt("SS-M4", "workers", ["workers", index], "rewritten"));
+                for (const field of r.dropped)
+                    receipts.push(receipt("SS-M4", "workers", ["workers", index, ...field], "dropped-inert"));
+                return;
+            default: {
+                const unhandled = r;
+                throw new Error(`SS-M4: unhandled row outcome ${JSON.stringify(unhandled)}`);
+            }
+        }
+    });
+    if (next !== undefined)
+        out.workers = { ...doc, workers: next };
+}
+// ── SS-M5:模型钥匙二选一 ──────────────────────────────────────────────────────────────────────────────
+function stepModelKeyOneOf(out, receipts) {
+    const doc = out.models;
+    if (!isPlainObject(doc) || !Array.isArray(doc.models))
+        return;
+    const rows = doc.models;
+    let next;
+    rows.forEach((row, index) => {
+        if (!(has(row, "sealedApiKey") && has(row, "apiKeyEnv")))
+            return;
+        const r = row;
+        if (r.sealedApiKey === undefined || r.apiKeyEnv === undefined)
+            return;
+        next ??= [...rows];
+        next[index] = without(r, "apiKeyEnv");
+        receipts.push(receipt("SS-M5", "models", ["models", index, "apiKeyEnv"], "dropped-shadowed"));
+    });
+    if (next !== undefined)
+        out.models = { ...doc, models: next };
+}
+// ── SS-M6:atModelAllowlist → atMention ────────────────────────────────────────────────────────────────
+/** 一个位上的 `atModelAllowlist` 按形改写;读不进的旧值(不是字符串数组)/ 两形并存 ⇒ 拒。返回改后的对象或 `undefined`(没改)。 */
+function rewriteAtMention(holder, document, at, receipts) {
+    if (!Object.prototype.hasOwnProperty.call(holder, "atModelAllowlist"))
+        return undefined;
+    const list = holder.atModelAllowlist;
+    if (Object.prototype.hasOwnProperty.call(holder, "atMention")) {
+        receipts.push(refused("SS-M6", document, [...at, "atModelAllowlist"], "both atModelAllowlist and atMention are set — keep one; the migration does not pick a winner"));
+        return undefined;
+    }
+    if (!Array.isArray(list) || !list.every((n) => typeof n === "string")) {
+        receipts.push(refused("SS-M6", document, [...at, "atModelAllowlist"], "atModelAllowlist is not a list of model names — it does not read today either; fix it by hand"));
+        return undefined;
+    }
+    const atMention = list.length === 0 ? { mode: "all" } : { mode: "only", models: [...list] };
+    receipts.push(moved("SS-M6", document, [...at, "atModelAllowlist"], { document, path: [...at, "atMention"] }));
+    return { ...without(holder, "atModelAllowlist"), atMention };
+}
+function stepAtMention(out, receipts) {
+    if (isPlainObject(out.models)) {
+        const next = rewriteAtMention(out.models, "models", [], receipts);
+        if (next !== undefined)
+            out.models = next;
+    }
+    const rosters = out.rosters;
+    if (isPlainObject(rosters) && Array.isArray(rosters.rosters)) {
+        const rows = rosters.rosters;
+        let next;
+        rows.forEach((row, index) => {
+            if (!isPlainObject(row))
+                return;
+            const r = rewriteAtMention(row, "rosters", ["rosters", index], receipts);
+            if (r === undefined)
+                return;
+            next ??= [...rows];
+            next[index] = r;
+        });
+        if (next !== undefined)
+            out.rosters = { ...rosters, rosters: next };
+    }
+}
+// ── SS-M9:models.default → roles.default ──────────────────────────────────────────────────────────────
+/** 迁移前「缺省模型是谁」的生效读法 = server 的缺省解析以结构键 `default` 为第一级,主任务真跑它(N-7 两答复现:`default` = A、`roles.default`
+ *  = B 时主任务跑 A,core 的 `default` 角色解到 B)。所以并过去的是 `default` 的值:`roles.default` 缺席 ⇒ 搬入;同名 ⇒ 搬入(重复的那一份
+ *  消失);异名 ⇒ 原 `roles.default` 作「被压过」删掉、`default` 搬入。`default` 不是非空串 ⇒ 拒(今天它让整个 models 域读不进,不替运维猜)。 */
+function stepModelsDefault(out, receipts) {
+    const doc = out.models;
+    if (!isPlainObject(doc) || !Object.prototype.hasOwnProperty.call(doc, "default"))
+        return;
+    const name = doc.default;
+    if (typeof name !== "string" || name === "") {
+        receipts.push(refused("SS-M9", "models", ["default"], "models.default is not a catalog name — it does not read today either; fix it by hand"));
+        return;
+    }
+    const roles = isPlainObject(doc.roles) ? doc.roles : {};
+    const prior = roles.default;
+    if (prior !== undefined && !(isPlainObject(prior) && prior.model === name))
+        receipts.push(receipt("SS-M9", "models", ["roles", "default"], "dropped-shadowed"));
+    receipts.push(moved("SS-M9", "models", ["default"], { document: "models", path: ["roles", "default"] }));
+    out.models = { ...without(doc, "default"), roles: { ...roles, default: { model: name } } };
+}
+// ── SS-M7:URL fragment ────────────────────────────────────────────────────────────────────────────────
+/** 这只(已展开的)schema 是不是一个 `NON_SECRET_URL` 座位:就是它,或是「先归一、再交给它」的管道(`z.string().trim().pipe(NON_SECRET_URL)`)。 */
+function isUrlSeat(s) {
+    return s === NON_SECRET_URL || (s instanceof z.ZodPipe && unwrapSchema(s.out) === NON_SECRET_URL);
+}
+/**
+ * 顺着域 schema 走文档,在每个 URL 座位上剥 fragment。座位由 schema 派生(不手抄座位表):对象逐键、数组逐元素、Record 逐值、
+ * 判别联合按判别值取那一支、普通联合只认「某一支是 URL 座位」的字符串值(对象值不进普通联合 —— 哪一支说了算猜不出,不猜)。
+ * 写时复制:没改 ⇒ 原引用。
+ */
+function stripFragments(schema, value, path, onStrip, depth = 0) {
+    if (depth > 32)
+        return value;
+    const s = unwrapSchema(schema);
+    if (isUrlSeat(s)) {
+        if (typeof value !== "string")
+            return value;
+        const hash = value.indexOf("#");
+        if (hash < 0)
+            return value;
+        onStrip(path);
+        return value.slice(0, hash);
+    }
+    if (s instanceof z.ZodDiscriminatedUnion) {
+        if (!isPlainObject(value))
+            return value;
+        const disc = s._zod.def.discriminator;
+        for (const option of s.options) {
+            const o = unwrapSchema(option);
+            if (!(o instanceof z.ZodObject))
+                continue;
+            const lit = unwrapSchema(o.shape[disc]);
+            if (lit instanceof z.ZodLiteral && lit.values.has(value[disc]))
+                return stripFragments(o, value, path, onStrip, depth + 1);
+        }
+        return value;
+    }
+    if (s instanceof z.ZodUnion) {
+        if (typeof value !== "string")
+            return value;
+        for (const option of s.options)
+            if (isUrlSeat(unwrapSchema(option)))
+                return stripFragments(option, value, path, onStrip, depth + 1);
+        return value;
+    }
+    if (s instanceof z.ZodObject) {
+        if (!isPlainObject(value))
+            return value;
+        let next;
+        for (const [k, fieldSchema] of Object.entries(s.shape)) {
+            if (!Object.prototype.hasOwnProperty.call(value, k))
+                continue;
+            const v = stripFragments(fieldSchema, value[k], [...path, k], onStrip, depth + 1);
+            if (v !== value[k])
+                (next ??= { ...value })[k] = v;
+        }
+        return next ?? value;
+    }
+    if (s instanceof z.ZodArray) {
+        if (!Array.isArray(value))
+            return value;
+        let next;
+        value.forEach((el, i) => {
+            const v = stripFragments(s.element, el, [...path, i], onStrip, depth + 1);
+            if (v !== el)
+                (next ??= [...value])[i] = v;
+        });
+        return next ?? value;
+    }
+    if (s instanceof z.ZodRecord) {
+        if (!isPlainObject(value))
+            return value;
+        let next;
+        for (const [k, el] of Object.entries(value)) {
+            const v = stripFragments(s._zod.def.valueType, el, [...path, k], onStrip, depth + 1);
+            if (v !== el)
+                (next ??= { ...value })[k] = v;
+        }
+        return next ?? value;
+    }
+    return value;
+}
+/** 本包域 schema 里全部 URL 座位的坐标模式(派生;数组 / Record 位写 `*`)—— 迁移不用它,它给钉与说明看「今天派生出哪些座位」。 */
+export function urlSeatPatterns() {
+    const out = [];
+    const walk = (schema, path, depth) => {
+        if (depth > 32)
+            return;
+        const s = unwrapSchema(schema);
+        if (isUrlSeat(s))
+            return void out.push(path.join("."));
+        if (s instanceof z.ZodDiscriminatedUnion) {
+            const disc = s._zod.def.discriminator;
+            for (const option of s.options) {
+                const o = unwrapSchema(option);
+                if (!(o instanceof z.ZodObject))
+                    continue;
+                const lit = unwrapSchema(o.shape[disc]);
+                const word = lit instanceof z.ZodLiteral ? [...lit.values].join("|") : "?";
+                walk(o, [...path.slice(0, -1), `${path[path.length - 1] ?? ""}{${disc}=${word}}`], depth + 1);
+            }
+            return;
+        }
+        if (s instanceof z.ZodUnion) {
+            if (s.options.some((o) => isUrlSeat(unwrapSchema(o))))
+                out.push(path.join("."));
+            return;
+        }
+        if (s instanceof z.ZodObject) {
+            for (const [k, f] of Object.entries(s.shape))
+                walk(f, [...path, k], depth + 1);
+            return;
+        }
+        if (s instanceof z.ZodArray)
+            return walk(s.element, [...path, "*"], depth + 1);
+        if (s instanceof z.ZodRecord)
+            return walk(s._zod.def.valueType, [...path, "*"], depth + 1);
+    };
+    for (const [d, schema] of Object.entries(DOMAIN_SCHEMAS))
+        walk(schema, [d], 0);
+    return out;
+}
+function stepUrlFragments(out, receipts) {
+    for (const d of Object.keys(out)) {
+        if (!isDomainName(d))
+            continue;
+        const doc = out[d];
+        if (doc === undefined)
+            continue;
+        const next = stripFragments(DOMAIN_SCHEMAS[d], doc, [], (path) => receipts.push(receipt("SS-M7", d, path, "rewritten")));
+        if (next !== doc)
+            out[d] = next;
+    }
+}