@sema-agent/settings-schema 14.4.0 → 14.6.0

package/dist/one-time-migrations.js

@@ -33,6 +33,7 @@ import { outgoingPath, redactSecrets } from "./config-fns.js";
 import { LANE_ENV_OWNER, STORE_ENV_KEYS, isLaneEnvKey } from "./execution-lane-index.js";
 import { EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js";
 import { INTEGER } from "./integer.js";
+import { isPlainJsonObject } from "./plain-json-object.js";
 import { RUNTIME_LIFT_TARGETS } from "./runtime-lift-targets.js";
 import { RETIRED_ROLE_WORDS } from "./retired-role-words.js";
 import { REMOTE_EXEC_DOCUMENT, RemoteExecSpec } from "./remote-exec.js";
@@ -197,7 +198,7 @@ export const ONE_TIME_MIGRATIONS = [
  * 重跑恒等:第二次跑零改动,只剩第一次就 `refused` 的那几张收据(那些坐标原样留着,读侧照旧拒)。
  */
 export function migrateStoredDocuments(docs, opts) {
-    if (!isPlainObject(docs))
+    if (!isPlainJsonObject(docs))
         throw new TypeError("migrateStoredDocuments: `docs` must be a { domain: document } object");
     switch (opts.coverage) {
         case "scope":
@@ -229,7 +230,7 @@ export function migrateStoredDocuments(docs, opts) {
  * 不是对象 ⇒ 原样返回(判形是读者的事)。
  */
 export function migrateEffectiveSnapshot(effective) {
-    if (!isPlainObject(effective))
+    if (!isPlainJsonObject(effective))
         return { effective, receipts: [] };
     const docs = {};
     for (const [k, v] of Object.entries(effective))
@@ -251,13 +252,7 @@ export function migrateEffectiveSnapshot(effective) {
             next[k] = v;
     return { effective: next, receipts: m.receipts };
 }
-function isPlainObject(v) {
-    if (v === null || typeof v !== "object" || Array.isArray(v))
-        return false;
-    const proto = Object.getPrototypeOf(v);
-    return proto === Object.prototype || proto === null;
-}
-const has = (o, k) => isPlainObject(o) && Object.prototype.hasOwnProperty.call(o, k);
+const has = (o, k) => isPlainJsonObject(o) && Object.prototype.hasOwnProperty.call(o, k);
 const without = (o, k) => {
     const { [k]: _gone, ...rest } = o;
     return rest;
@@ -291,12 +286,12 @@ function stepRuntimeDomain(out, coverage, receipts) {
     if (raw === undefined)
         return;
     const refuse = (reason) => void receipts.push(refused("SS-M1", "runtime", [], reason));
-    if (isPlainObject(raw) && Object.keys(raw).length === 0) {
+    if (isPlainJsonObject(raw) && Object.keys(raw).length === 0) {
         delete out.runtime;
         receipts.push(receipt("SS-M1", "runtime", [], "dropped-inert"));
         return;
     }
-    if (!isPlainObject(raw))
+    if (!isPlainJsonObject(raw))
         return refuse("the stored runtime document is not a JSON object — the scope does not read today either; fix it by hand");
     if (coverage === "partial" && !RUNTIME_LIFT_TARGETS.every((target) => has(out, target))) {
         return refuse("a runtime document migrates only together with its scope's governance and limits documents (coverage \"scope\") — on its own there is no telling whether governance was ever set");
@@ -305,7 +300,7 @@ function stepRuntimeDomain(out, coverage, receipts) {
     if (!parsed.success)
         return refuse("the stored runtime document does not read under the 10.x runtime schema — the scope does not read today either; fix it by hand");
     const limitsRaw = out.limits;
-    if (limitsRaw !== undefined && !isPlainObject(limitsRaw))
+    if (limitsRaw !== undefined && !isPlainJsonObject(limitsRaw))
         return refuse("the scope's limits document is not a JSON object — the scope does not read today either; fix limits first");
     const trio = GOVERNANCE_TRIO.filter((k) => has(raw, k) && raw[k] !== undefined);
     if (trio.length > 0) {
@@ -323,7 +318,7 @@ function stepRuntimeDomain(out, coverage, receipts) {
     const limitKeys = LIMIT_KEYS.filter((k) => parsed.data[k] !== undefined);
     if (limitKeys.length > 0) {
         // 迁移前的读法(消费方):`limits` 有这一键 ⇒ limits 赢;没有 ⇒ 读 runtime 上的值。
-        const limits = isPlainObject(limitsRaw) ? { ...limitsRaw } : {};
+        const limits = isPlainJsonObject(limitsRaw) ? { ...limitsRaw } : {};
         let added = false;
         for (const k of limitKeys) {
             if (Object.prototype.hasOwnProperty.call(limits, k))
@@ -346,13 +341,13 @@ function stepRuntimeDomain(out, coverage, receipts) {
 // ── SS-M2:hosts 超界 ───────────────────────────────────────────────────────────────────────────────────
 function stepHostsBounds(out, receipts) {
     const doc = out.hosts;
-    if (!isPlainObject(doc) || !Array.isArray(doc.hosts))
+    if (!isPlainJsonObject(doc) || !Array.isArray(doc.hosts))
         return;
     const rows = doc.hosts;
     let kept = [];
     const dropped = [];
     rows.forEach((row, index) => {
-        const name = isPlainObject(row) ? row.name : undefined;
+        const name = isPlainJsonObject(row) ? row.name : undefined;
         if (typeof name === "string" && name.length > HOST_NAME_MAX)
             dropped.push(index);
         else
@@ -402,8 +397,8 @@ const UNCHANGED = { kind: "unchanged" };
 function migrateWorkerRow(raw) {
     const refuse = (field, reason) => ({ kind: "refused", field, reason });
     const enabled = raw.enabled !== false;
-    const laneKeysOf = (rec) => (isPlainObject(rec) ? Object.keys(rec).filter(isLaneEnvKey) : []);
-    const storeKeysOf = (rec) => (isPlainObject(rec) ? STORE_ENV_KEYS.filter((k) => Object.hasOwn(rec, k)) : []);
+    const laneKeysOf = (rec) => (isPlainJsonObject(rec) ? Object.keys(rec).filter(isLaneEnvKey) : []);
+    const storeKeysOf = (rec) => (isPlainJsonObject(rec) ? STORE_ENV_KEYS.filter((k) => Object.hasOwn(rec, k)) : []);
     const envLaneKeys = laneKeysOf(raw.env);
     const secretLaneKeys = laneKeysOf(raw.secretEnv);
     const envStoreKeys = storeKeysOf(raw.env);
@@ -432,12 +427,12 @@ function migrateWorkerRow(raw) {
     const needLane = !hasExecution && (enabled || laneTouched);
     const needStore = !hasStore && (enabled || storeTouched);
     const w = structuredClone(raw);
-    const runtime = isPlainObject(w.runtime) ? w.runtime : {};
+    const runtime = isPlainJsonObject(w.runtime) ? w.runtime : {};
     w.runtime = runtime;
-    const env = isPlainObject(w.env) ? w.env : {};
-    const secretEnv = isPlainObject(w.secretEnv) ? w.secretEnv : {};
-    const coords = isPlainObject(w.coords) ? w.coords : {};
-    const secretRefs = isPlainObject(w.secretRefs) ? w.secretRefs : {};
+    const env = isPlainJsonObject(w.env) ? w.env : {};
+    const secretEnv = isPlainJsonObject(w.secretEnv) ? w.secretEnv : {};
+    const coords = isPlainJsonObject(w.coords) ? w.coords : {};
+    const secretRefs = isPlainJsonObject(w.secretRefs) ? w.secretRefs : {};
     const dropped = [];
     const drop = (container, slot, key) => {
         delete container[key];
@@ -601,9 +596,9 @@ function migrateWorkerRow(raw) {
         }
     }
     // 被搬空的 env / secretEnv 整键去掉(它们是可选字段;留一个 `{}` 只是噪声)
-    if (isPlainObject(w.env) && Object.keys(env).length === 0 && isPlainObject(raw.env) && Object.keys(raw.env).length > 0)
+    if (isPlainJsonObject(w.env) && Object.keys(env).length === 0 && isPlainJsonObject(raw.env) && Object.keys(raw.env).length > 0)
         delete w.env;
-    if (isPlainObject(w.secretEnv) && Object.keys(secretEnv).length === 0 && isPlainObject(raw.secretEnv) && Object.keys(raw.secretEnv).length > 0)
+    if (isPlainJsonObject(w.secretEnv) && Object.keys(secretEnv).length === 0 && isPlainJsonObject(raw.secretEnv) && Object.keys(raw.secretEnv).length > 0)
         delete w.secretEnv;
     // 改写后的行仍读不进 7.x 形 ⇒ 不写回半成品:拒,原文留盘(读口 `readWorkersRows` 扣下它)。判据与拒句是读口那一只(`workerRowVerdict`)。
     const verdict = workerRowVerdict(w, "migrated");
@@ -613,12 +608,12 @@ function migrateWorkerRow(raw) {
 }
 function stepWorkers6x(out, receipts) {
     const doc = out.workers;
-    if (!isPlainObject(doc) || !Array.isArray(doc.workers))
+    if (!isPlainJsonObject(doc) || !Array.isArray(doc.workers))
         return;
     const rows = doc.workers;
     let next;
     rows.forEach((row, index) => {
-        if (!isPlainObject(row) || typeof row.name !== "string")
+        if (!isPlainJsonObject(row) || typeof row.name !== "string")
             return; // 认不出名字:整域读侧判
         const r = migrateWorkerRow(row);
         switch (r.kind) {
@@ -646,7 +641,7 @@ function stepWorkers6x(out, receipts) {
 // ── SS-M5:模型钥匙二选一 ──────────────────────────────────────────────────────────────────────────────
 function stepModelKeyOneOf(out, receipts) {
     const doc = out.models;
-    if (!isPlainObject(doc) || !Array.isArray(doc.models))
+    if (!isPlainJsonObject(doc) || !Array.isArray(doc.models))
         return;
     const rows = doc.models;
     let next;
@@ -682,17 +677,17 @@ function rewriteAtMention(holder, document, at, receipts) {
     return { ...without(holder, "atModelAllowlist"), atMention };
 }
 function stepAtMention(out, receipts) {
-    if (isPlainObject(out.models)) {
+    if (isPlainJsonObject(out.models)) {
         const next = rewriteAtMention(out.models, "models", [], receipts);
         if (next !== undefined)
             out.models = next;
     }
     const rosters = out.rosters;
-    if (isPlainObject(rosters) && Array.isArray(rosters.rosters)) {
+    if (isPlainJsonObject(rosters) && Array.isArray(rosters.rosters)) {
         const rows = rosters.rosters;
         let next;
         rows.forEach((row, index) => {
-            if (!isPlainObject(row))
+            if (!isPlainJsonObject(row))
                 return;
             const r = rewriteAtMention(row, "rosters", ["rosters", index], receipts);
             if (r === undefined)
@@ -707,7 +702,7 @@ function stepAtMention(out, receipts) {
 // ── SS-M8:退役的角色词 ────────────────────────────────────────────────────────────────────────────────
 /** 一个 `roles` 图上的退役角色词键删掉(值不论 —— 没有角色读它);逐键一张 `dropped-inert` 收据。返回改后的图或 `undefined`(没改 / 不是对象:判形是读者的事)。 */
 function withoutRetiredRoles(roles, document, at, receipts) {
-    if (!isPlainObject(roles))
+    if (!isPlainJsonObject(roles))
         return undefined;
     const present = RETIRED_ROLE_WORDS.filter((w) => Object.prototype.hasOwnProperty.call(roles, w));
     if (present.length === 0)
@@ -721,17 +716,17 @@ function withoutRetiredRoles(roles, document, at, receipts) {
 }
 function stepRetiredRoleWords(out, receipts) {
     const models = out.models;
-    if (isPlainObject(models)) {
+    if (isPlainJsonObject(models)) {
         const roles = withoutRetiredRoles(models.roles, "models", [], receipts);
         if (roles !== undefined)
             out.models = { ...models, roles };
     }
     const rosters = out.rosters;
-    if (isPlainObject(rosters) && Array.isArray(rosters.rosters)) {
+    if (isPlainJsonObject(rosters) && Array.isArray(rosters.rosters)) {
         const rows = rosters.rosters;
         let next;
         rows.forEach((row, index) => {
-            if (!isPlainObject(row))
+            if (!isPlainJsonObject(row))
                 return;
             const roles = withoutRetiredRoles(row.roles, "rosters", ["rosters", index], receipts);
             if (roles === undefined)
@@ -749,16 +744,16 @@ function stepRetiredRoleWords(out, receipts) {
  *  消失);异名 ⇒ 原 `roles.default` 作「被压过」删掉、`default` 搬入。`default` 不是非空串 ⇒ 拒(今天它让整个 models 域读不进,不替运维猜)。 */
 function stepModelsDefault(out, receipts) {
     const doc = out.models;
-    if (!isPlainObject(doc) || !Object.prototype.hasOwnProperty.call(doc, "default"))
+    if (!isPlainJsonObject(doc) || !Object.prototype.hasOwnProperty.call(doc, "default"))
         return;
     const name = doc.default;
     if (typeof name !== "string" || name === "") {
         receipts.push(refused("SS-M9", "models", ["default"], "models.default is not a catalog name — it does not read today either; fix it by hand"));
         return;
     }
-    const roles = isPlainObject(doc.roles) ? doc.roles : {};
+    const roles = isPlainJsonObject(doc.roles) ? doc.roles : {};
     const prior = roles.default;
-    if (prior !== undefined && !(isPlainObject(prior) && prior.model === name))
+    if (prior !== undefined && !(isPlainJsonObject(prior) && prior.model === name))
         receipts.push(receipt("SS-M9", "models", ["roles", "default"], "dropped-shadowed"));
     receipts.push(moved("SS-M9", "models", ["default"], { document: "models", path: ["roles", "default"] }));
     out.models = { ...without(doc, "default"), roles: { ...roles, default: { model: name } } };
@@ -769,7 +764,7 @@ function stepModelsDefault(out, receipts) {
  *  overlay,catalog 的 digest 是引擎铸的,替运维机械转就是第二个编译器 / 第二个铸点。`prompts` 不是对象 ⇒ 不动(判形是读者的事)。 */
 function stepPromptsAxes(out, receipts) {
     const doc = out.prompts;
-    if (!isPlainObject(doc))
+    if (!isPlainJsonObject(doc))
         return;
     let next = doc;
     if (has(doc, "bindings") && doc.bindings !== undefined) {
@@ -820,7 +815,7 @@ function stripFragments(schema, value, path, onStrip, depth = 0) {
         return value.slice(0, hash);
     }
     if (s instanceof z.ZodDiscriminatedUnion) {
-        if (!isPlainObject(value))
+        if (!isPlainJsonObject(value))
             return value;
         const disc = s._zod.def.discriminator;
         for (const option of s.options) {
@@ -842,7 +837,7 @@ function stripFragments(schema, value, path, onStrip, depth = 0) {
         return value;
     }
     if (s instanceof z.ZodObject) {
-        if (!isPlainObject(value))
+        if (!isPlainJsonObject(value))
             return value;
         let next;
         for (const [k, fieldSchema] of Object.entries(s.shape)) {
@@ -866,7 +861,7 @@ function stripFragments(schema, value, path, onStrip, depth = 0) {
         return next ?? value;
     }
     if (s instanceof z.ZodRecord) {
-        if (!isPlainObject(value))
+        if (!isPlainJsonObject(value))
             return value;
         let next;
         for (const [k, el] of Object.entries(value)) {

package/dist/plain-json-object.d.ts

@@ -0,0 +1,31 @@
+/**
+ * 包内私有(不进主桶、不进 exports 表):**「纯 JSON 对象」的唯一谓词** —— 不是 `null`、不是数组、原型是 `null` 或「原型自己的原型是 `null`」(即 `Object.prototype`:JSON 解析出来的对象恒如此;
+ * `Date` / `Map` / 类实例 / 建在别的对象原型上的记录原型链更深,都不是)。**已知的边**:原型是某个 null 原型对象的对象(`Object.create(Object.create(null))`)、`class X extends null` 的实例,
+ * 链上第二环也是 `null`,读成朴素 —— 它们只能由程序造出,JSON 解析不出来;读者按它的**自有**成员读,继承来的成员不计(托管层 http hook 名单对只靠继承可见的名单键 fail-closed;请求面 `env` / `headers` 收成 `{}` 不修 —— 读者级遍历继承成员与谓词级再加判据都对 `Object.prototype` 上的可枚举污染敏感,而这一侧丢的是数据、失败可见、不在安全轴)。**不按「原型恒等本 realm 的 `Object.prototype`」判**:另一个 realm(`vm` 新上下文、iframe)里 `JSON.parse` 出来的普通对象,
+ * 原型是**那个 realm** 的 `Object.prototype`,按恒等判会被读成非朴素;而任何 realm 的 `Object.prototype` 自身原型都是 `null`,所以链上第二环是 `null` 这一条与 realm 无关,不需要为 realm 加特例。包里凡要问「这个值是不是一个 JSON 对象」的地方都读它,不各写一份:读域文档的键集对比(`./config-fns`)、一次性迁移的文档形判
+ * (`./one-time-migrations`)、`config.d` 文档形(`./config-d-file`)、`extraBody` 的形闸与秘密走查(`./types`)、settings 单元读法与严格 JSON 深度判(`./settings-units` / `./safety-merge-spec`)、
+ * 请求面传输的记录读法与描述件(`./mcp-request-entry`)、workers 行读口(`./workers-rows`)、有效配置线上载荷读口(`./config-fns` 的 `readEffectiveWire`)、http hook 名单的设置袋(`./http-hook-allowlists`)、
+ * fleet 线上载荷的受护判(`./fleet`)、符合性语料的比较器 / 派生 / 语料读口 / 元数据拆分(`./conformance/*`)。零 import。
+ * **形状分类核 {@link jsonShapeOf} 是座位的本体**(唯一读原型的地方),`isPlainJsonObject` 由它派生(`plain` 那一格)。**总(不抛)**:检视就抛的对象(已撤销的 Proxy、`getPrototypeOf` 陷阱抛)
+ * 核答 `uninspectable`、判官答 `false`,不抛出去 —— 全包经座位的读口因此拒而不抛,律在座位上收一处,不在每个读器各包一个 `try`;读者对 `uninspectable` 一律按最严处置(hooks ⇒ 拒整份文档;名单 ⇒ `malformed`;传输 ⇒ 整只不交)。
+ *
+ * **唯一的第二处是 `./hooks-config` 的 `hookShapeOf` / `hookIsRecord`,与 {@link jsonShapeOf} / 本函数逐字同文(调用名归一后)**:hooks 分类器的闭包要被消费方生成器整函数抄走(闭包里的自由名只有 `HOOK_EVENTS`),闭包里不能 import 本模块 ——
+ * 同文由 `test/plain-json-object-single-seat-14.6.0.test.ts` 逐字证明(漂开即红),闭包契约多注入一个名字时(S-2133)把它并回这里。
+ * 同一个门也数全包:返回类型是 `x is Record<string, unknown>` 的函数、读原型的调用点,除这两处之外一处不许有;内联的「typeof 对象 ∧ 非 null ∧ 非数组」合取则**一处都不许有**(座位里它是分开的 `if` 臂,不是合取)。
+ *
+ * **读者要的答案不只是「是不是朴素对象」时,调本模块的 {@link jsonShapeOf}**(六词形状分类),不在读者里再推一遍形状:例如托管层的 http hook 名单,非朴素的**对象**袋必须 fail-closed(读成空名单并告警),
+ * 而 `null` / 原始值 / 数组仍是「整份设置不是对象 ⇒ 两键都缺」—— 两种不同的答案,只能由形状分类给。`isPlainJsonObject` 就是 `jsonShapeOf` 的「朴素」那一格。
+ */
+export declare function isPlainJsonObject(v: unknown): v is Record<string, unknown>;
+/** 一个值的形状(六词,闭集):`plain` = 朴素对象(原型是 `null` 或原型自己的原型是 `null`;{@link isPlainJsonObject} 就是这一格);`non_plain_object` = 是对象但不朴素(类实例 / `Map` / `Date` / 建在别的对象原型上的记录,以及**函数** —— 函数是对象、不是纯数据,
+ *  JSON 里不会有;读者对「是对象但不朴素」一律 fail-closed,函数不能从缝里漏过去);`array`;`null`;`primitive` = 其余(字符串 / 数 / 布尔 / `undefined` / symbol / bigint);
+ *  `uninspectable` = **读形状就抛**的对象(已撤销的 Proxy:连 `Array.isArray` 都抛;`getPrototypeOf` 陷阱抛的活 Proxy)—— 不是「不朴素」(那句要读者劝人「拷成纯对象」,对撤销的 Proxy 做不到),读者对它 fail-closed 并说全包唯一的「检视不了」那一句。
+ *  读者对这六个词**只许穷举 `switch` 加 `never` 默认臂**(加第七个词时每个读者编译红),不许 `===` 链逐个比(单座门看着)。 */
+export type JsonShape = ReturnType<typeof jsonShapeOf>;
+/** 值的形状分类 —— 本包里「是对象但不朴素」与「根本不是对象」要给不同答案的读者调它(见头注)。读原型的就是这一只(判官 {@link isPlainJsonObject} 由它派生)。 */
+export declare function jsonShapeOf(v: unknown): "plain" | "non_plain_object" | "array" | "null" | "primitive" | "uninspectable";
+/**
+ * `Array.isArray` 的**总**版(不抛):已撤销的 Proxy 连「是不是数组」都读不出 ⇒ 不是数组。读者要问「这个值是不是数组」且值可能来自嵌入方(非 JSON)时调它,不直接 `Array.isArray`。
+ * 分类器闭包里不能 import,`./hooks-config` 的 `hookIsArray` 与本函数**逐字同文**(同一个门证明,与 `hookIsRecord` 同律)。
+ */
+export declare function isJsonArray(v: unknown): v is unknown[];

package/dist/plain-json-object.js

@@ -0,0 +1,52 @@
+/**
+ * 包内私有(不进主桶、不进 exports 表):**「纯 JSON 对象」的唯一谓词** —— 不是 `null`、不是数组、原型是 `null` 或「原型自己的原型是 `null`」(即 `Object.prototype`:JSON 解析出来的对象恒如此;
+ * `Date` / `Map` / 类实例 / 建在别的对象原型上的记录原型链更深,都不是)。**已知的边**:原型是某个 null 原型对象的对象(`Object.create(Object.create(null))`)、`class X extends null` 的实例,
+ * 链上第二环也是 `null`,读成朴素 —— 它们只能由程序造出,JSON 解析不出来;读者按它的**自有**成员读,继承来的成员不计(托管层 http hook 名单对只靠继承可见的名单键 fail-closed;请求面 `env` / `headers` 收成 `{}` 不修 —— 读者级遍历继承成员与谓词级再加判据都对 `Object.prototype` 上的可枚举污染敏感,而这一侧丢的是数据、失败可见、不在安全轴)。**不按「原型恒等本 realm 的 `Object.prototype`」判**:另一个 realm(`vm` 新上下文、iframe)里 `JSON.parse` 出来的普通对象,
+ * 原型是**那个 realm** 的 `Object.prototype`,按恒等判会被读成非朴素;而任何 realm 的 `Object.prototype` 自身原型都是 `null`,所以链上第二环是 `null` 这一条与 realm 无关,不需要为 realm 加特例。包里凡要问「这个值是不是一个 JSON 对象」的地方都读它,不各写一份:读域文档的键集对比(`./config-fns`)、一次性迁移的文档形判
+ * (`./one-time-migrations`)、`config.d` 文档形(`./config-d-file`)、`extraBody` 的形闸与秘密走查(`./types`)、settings 单元读法与严格 JSON 深度判(`./settings-units` / `./safety-merge-spec`)、
+ * 请求面传输的记录读法与描述件(`./mcp-request-entry`)、workers 行读口(`./workers-rows`)、有效配置线上载荷读口(`./config-fns` 的 `readEffectiveWire`)、http hook 名单的设置袋(`./http-hook-allowlists`)、
+ * fleet 线上载荷的受护判(`./fleet`)、符合性语料的比较器 / 派生 / 语料读口 / 元数据拆分(`./conformance/*`)。零 import。
+ * **形状分类核 {@link jsonShapeOf} 是座位的本体**(唯一读原型的地方),`isPlainJsonObject` 由它派生(`plain` 那一格)。**总(不抛)**:检视就抛的对象(已撤销的 Proxy、`getPrototypeOf` 陷阱抛)
+ * 核答 `uninspectable`、判官答 `false`,不抛出去 —— 全包经座位的读口因此拒而不抛,律在座位上收一处,不在每个读器各包一个 `try`;读者对 `uninspectable` 一律按最严处置(hooks ⇒ 拒整份文档;名单 ⇒ `malformed`;传输 ⇒ 整只不交)。
+ *
+ * **唯一的第二处是 `./hooks-config` 的 `hookShapeOf` / `hookIsRecord`,与 {@link jsonShapeOf} / 本函数逐字同文(调用名归一后)**:hooks 分类器的闭包要被消费方生成器整函数抄走(闭包里的自由名只有 `HOOK_EVENTS`),闭包里不能 import 本模块 ——
+ * 同文由 `test/plain-json-object-single-seat-14.6.0.test.ts` 逐字证明(漂开即红),闭包契约多注入一个名字时(S-2133)把它并回这里。
+ * 同一个门也数全包:返回类型是 `x is Record<string, unknown>` 的函数、读原型的调用点,除这两处之外一处不许有;内联的「typeof 对象 ∧ 非 null ∧ 非数组」合取则**一处都不许有**(座位里它是分开的 `if` 臂,不是合取)。
+ *
+ * **读者要的答案不只是「是不是朴素对象」时,调本模块的 {@link jsonShapeOf}**(六词形状分类),不在读者里再推一遍形状:例如托管层的 http hook 名单,非朴素的**对象**袋必须 fail-closed(读成空名单并告警),
+ * 而 `null` / 原始值 / 数组仍是「整份设置不是对象 ⇒ 两键都缺」—— 两种不同的答案,只能由形状分类给。`isPlainJsonObject` 就是 `jsonShapeOf` 的「朴素」那一格。
+ */
+export function isPlainJsonObject(v) {
+    const shape = jsonShapeOf(v);
+    return shape === "plain";
+}
+/** 值的形状分类 —— 本包里「是对象但不朴素」与「根本不是对象」要给不同答案的读者调它(见头注)。读原型的就是这一只(判官 {@link isPlainJsonObject} 由它派生)。 */
+export function jsonShapeOf(v) {
+    try {
+        if (v === null)
+            return "null";
+        if (Array.isArray(v))
+            return "array";
+        if (typeof v === "function")
+            return "non_plain_object";
+        if (typeof v !== "object")
+            return "primitive";
+        const proto = Object.getPrototypeOf(v);
+        return proto === null || Object.getPrototypeOf(proto) === null ? "plain" : "non_plain_object";
+    }
+    catch {
+        return "uninspectable"; // 读形状就抛(已撤销的 Proxy 连 `Array.isArray` 都抛、`getPrototypeOf` 陷阱抛):不是「不朴素」,是读不出 —— 读者按最严处置
+    }
+}
+/**
+ * `Array.isArray` 的**总**版(不抛):已撤销的 Proxy 连「是不是数组」都读不出 ⇒ 不是数组。读者要问「这个值是不是数组」且值可能来自嵌入方(非 JSON)时调它,不直接 `Array.isArray`。
+ * 分类器闭包里不能 import,`./hooks-config` 的 `hookIsArray` 与本函数**逐字同文**(同一个门证明,与 `hookIsRecord` 同律)。
+ */
+export function isJsonArray(v) {
+    try {
+        return Array.isArray(v);
+    }
+    catch {
+        return false; // 已撤销的 Proxy:读不出 ⇒ 不是数组
+    }
+}

package/dist/portable-domains.d.ts

@@ -0,0 +1,31 @@
+/** The domains a single-machine TOC carries: what `FileConfigStore` reads out of `config.d/`, and the
+ *  **default**域集 of the bundle helpers (`exportBundle`/`readBundle`). 每个被排除的域必须在
+ *  {@link NON_PORTABLE_DOMAIN_REASONS} 里有一条成文理由(禁裸排除,#282 件5 附带裁定)。
+ *
+ *  ⚠️ 口径诚实(对抗复审 复审 round1 F4):这是**默认集与本地读取集,不是 API 级硬边界** —— `exportBundle`
+ *  / `readBundle` 的 `domains` 参数可显式传任意 `DomainName`(bundle.ts 不拒非便携域)。把非便携域搬进
+ *  bundle 的那条口子归调用方纪律(以及各自域的导出面),不是本常量能挡住的;要不要把 bundle API 收窄到
+ *  `PortableDomain` 是一个独立的行为面裁定(#282 未决项,需三问),本批不擅自改。
+ *
+ *  🔴 **开新顶层域时必须同步登记本表**(成案 = 消费方 #322 真事故):域表是**闭集**,不在这里的
+ *  域名,`config.d/<域>.json` 不会被读进 effective —— 消费方拿到的是「该域缺席」,和文件不存在**逐字
+ *  同形**。当年 `limits` 域就是这样在单机腿静默丢了一整片限额发布(远端腿同批可用,所以更难看出来)。
+ *  今日的兜底:漏登记的文件会被 `FileConfigStore`(`./node`)的 `"unread-config-file"` 警告点名(fail-loud,
+ *  见 getEffective),但那只在消费方接了 `onWarning` 时才响 —— **登记仍是第一现场的义务**。 */
+export declare const PORTABLE_DOMAINS: readonly ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits"];
+export type PortableDomain = (typeof PORTABLE_DOMAINS)[number];
+/**
+ * 非便携域的**排除理由表**(#282 件5 附带裁定:禁裸排除)。
+ *
+ * `satisfies Record<Exclude<DomainName, PortableDomain>, string>` 让键集在**编译期**双向咬死:新开一个
+ * 域却不放进 PORTABLE_DOMAINS ⇒ 这里缺行 ⇒ 编译错;把某域改成便携却忘了删行 ⇒ 多余键 ⇒ 编译错。
+ * (此前是「理由写在注释里」,机器只能做子串匹配——域名出现在文件任何角落都算数,等于没门;对抗复审
+ * 复审 round1 F3。)理由要写**为什么它不该被单机/跨部署搬运**,带出处。
+ */
+export declare const NON_PORTABLE_DOMAIN_REASONS: {
+    readonly workers: "FLEET-only:单机没有 reconciler,`{workers:[]}` 的 schema 默认就是正确语义(缺席不需要 stub)。";
+    readonly hosts: "FLEET-only:同 workers —— 单机无机器注册表/自动排布,空注册表即正确语义。";
+    readonly systems: "FLEET-only:系统接入/凭据下发的元数据(nonce+路由)属于 web-admin 侧生命周期,单机 lane 无对应执法点。";
+    readonly projects: "TENANT IDENTITY DATA,不是可搬运的配置:登记簿随包复制进另一个部署 = 凭空多出的身份登记(design/142 §1.4 威胁模型①「carried-in foreign projectId」换了身 import 的衣服)。要带走走 142 §5 的导出面(service 半场)。";
+    readonly entitlement: "per-PRINCIPAL 商务/治理数据(tier·预算上限·kill-switch·allowlist),与 projects 同威胁模型(#282 件5 附带裁定,此前是唯一裸排除项):(a) 搬走 = 把一个租户的商务档复制进另一部署;(b) 反向也不成立 —— 单机 TOC 无 principal 轴(无鉴权语境、无 `/effective?principal=` 解析面),本地 entitlement.json 只会造出一份**永不被执法**的假管控面(真执法点在 service / web-admin 边界)。缺席语义如实:本地 buildEffective 给它 schema 默认值(空表),这**不等于**把远端 kill-switch/预算上限搬到了本地 —— 单机 lane 本就没有那个执法点。";
+};

package/dist/portable-domains.js

@@ -0,0 +1,30 @@
+/** The domains a single-machine TOC carries: what `FileConfigStore` reads out of `config.d/`, and the
+ *  **default**域集 of the bundle helpers (`exportBundle`/`readBundle`). 每个被排除的域必须在
+ *  {@link NON_PORTABLE_DOMAIN_REASONS} 里有一条成文理由(禁裸排除,#282 件5 附带裁定)。
+ *
+ *  ⚠️ 口径诚实(对抗复审 复审 round1 F4):这是**默认集与本地读取集,不是 API 级硬边界** —— `exportBundle`
+ *  / `readBundle` 的 `domains` 参数可显式传任意 `DomainName`(bundle.ts 不拒非便携域)。把非便携域搬进
+ *  bundle 的那条口子归调用方纪律(以及各自域的导出面),不是本常量能挡住的;要不要把 bundle API 收窄到
+ *  `PortableDomain` 是一个独立的行为面裁定(#282 未决项,需三问),本批不擅自改。
+ *
+ *  🔴 **开新顶层域时必须同步登记本表**(成案 = 消费方 #322 真事故):域表是**闭集**,不在这里的
+ *  域名,`config.d/<域>.json` 不会被读进 effective —— 消费方拿到的是「该域缺席」,和文件不存在**逐字
+ *  同形**。当年 `limits` 域就是这样在单机腿静默丢了一整片限额发布(远端腿同批可用,所以更难看出来)。
+ *  今日的兜底:漏登记的文件会被 `FileConfigStore`(`./node`)的 `"unread-config-file"` 警告点名(fail-loud,
+ *  见 getEffective),但那只在消费方接了 `onWarning` 时才响 —— **登记仍是第一现场的义务**。 */
+export const PORTABLE_DOMAINS = ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits"];
+/**
+ * 非便携域的**排除理由表**(#282 件5 附带裁定:禁裸排除)。
+ *
+ * `satisfies Record<Exclude<DomainName, PortableDomain>, string>` 让键集在**编译期**双向咬死:新开一个
+ * 域却不放进 PORTABLE_DOMAINS ⇒ 这里缺行 ⇒ 编译错;把某域改成便携却忘了删行 ⇒ 多余键 ⇒ 编译错。
+ * (此前是「理由写在注释里」,机器只能做子串匹配——域名出现在文件任何角落都算数,等于没门;对抗复审
+ * 复审 round1 F3。)理由要写**为什么它不该被单机/跨部署搬运**,带出处。
+ */
+export const NON_PORTABLE_DOMAIN_REASONS = {
+    workers: "FLEET-only:单机没有 reconciler,`{workers:[]}` 的 schema 默认就是正确语义(缺席不需要 stub)。",
+    hosts: "FLEET-only:同 workers —— 单机无机器注册表/自动排布,空注册表即正确语义。",
+    systems: "FLEET-only:系统接入/凭据下发的元数据(nonce+路由)属于 web-admin 侧生命周期,单机 lane 无对应执法点。",
+    projects: "TENANT IDENTITY DATA,不是可搬运的配置:登记簿随包复制进另一个部署 = 凭空多出的身份登记(design/142 §1.4 威胁模型①「carried-in foreign projectId」换了身 import 的衣服)。要带走走 142 §5 的导出面(service 半场)。",
+    entitlement: "per-PRINCIPAL 商务/治理数据(tier·预算上限·kill-switch·allowlist),与 projects 同威胁模型(#282 件5 附带裁定,此前是唯一裸排除项):(a) 搬走 = 把一个租户的商务档复制进另一部署;(b) 反向也不成立 —— 单机 TOC 无 principal 轴(无鉴权语境、无 `/effective?principal=` 解析面),本地 entitlement.json 只会造出一份**永不被执法**的假管控面(真执法点在 service / web-admin 边界)。缺席语义如实:本地 buildEffective 给它 schema 默认值(空表),这**不等于**把远端 kill-switch/预算上限搬到了本地 —— 单机 lane 本就没有那个执法点。",
+};

package/dist/safety-merge-spec.d.ts

@@ -4,8 +4,12 @@
  * law. This formalizes settings-core's v2-design §3 merge-spec into a published-data contract; the SEMANTIC
  * author is settings-core, web-admin maintains the formalized artifact here (this package), the axis VALUE domains
  * are core's (@sema-agent/core SAFETY_AXIS_VOCABULARY — validated by a dev-only conformance test, never a runtime
- * import). Each consumer keeps its OWN key→category map (client's SemaSettings KEY_CONTRACTS, web-admin's
- * config-field→category map); THIS file is only the shared category spec they all cite — no third copy of the law.
+ * import). The settings-document UNIT table — which keys of a settings file carry a merge contract, where each sits,
+ * which category below it maps into, and how its raw value reads — is published by this package too, as
+ * `SETTINGS_UNITS` (`./settings-units.ts`, 14.6.0): a consumer reads it instead of keeping a key→category map of its
+ * own for those ten units (the http-hook allowlist keys are the one exception: `./http-hook-allowlists` keys and reads them
+ * itself, with its own malformed-value reading — see the `./settings-units` header). THIS file is the category spec every unit
+ * cites — no second copy of the law.
  *
  * Per-category behavior is fully determined by `mergeShape` + `minTrust` + `tighten` + `enforcement` + `fail` — and,
  * for a MEMBERIZED category (one that declares `members`, 1.1.0), by its member rows: each member's own floor and
@@ -14,6 +18,16 @@
  * admitted or rejected as one value under its `minTrust`. A resolver reads this table and has NO per-key
  * special-casing.
  *
+ * COMPARISON (14.6.0) — "which of two values is stricter" has ONE implementation, {@link tightenVerdict}, and it reads
+ * ORDER only, never spelling (an empty-set sentinel, a "≤ 0 means off" cap, CC's `"disable"`, a mode alias are the value
+ * owner's reading — `readSettingsUnit` for a settings unit).
+ * A category's `tighten` answers ONLY the value of a `whole` unit mapped into it (today: `permissionMode`'s enumRank,
+ * `additionalDirectories`' setNarrower, `none` for the rest).
+ * A DECLARED member's comparator is derived from its row's value class ({@link memberTighten}: `boolPole` ⇒ boolStricter
+ * at that pole; `list` ⇒ setUnion for a tighten member, setNarrower for a loosen one). A memberized category's whole value
+ * and its UNDECLARED members have NO comparator — they only have the category floor's admission (the paragraph above);
+ * asking for one is a RangeError, never a fallback to the category rule.
+ *
  * MEMBER-LEVEL ADMISSION (1.1.0 — the WRITTEN layer of the permission-rule dual-channel ruling, [ref] ④;
  * the executing layer is core's `prepareCcImport` door + `RuleAddOrigin`, the resolver/shell halves are cli's):
  *   A category may declare `members`, each with its own admission floor and DIRECTION. Today only `permissions`
@@ -53,8 +67,8 @@
 import { z } from "zod";
 /** How values from different layers/principals combine for a category. */
 export declare const MergeShape: z.ZodEnum<{
-    concat: "concat";
     replace: "replace";
+    concat: "concat";
     denyFirst: "denyFirst";
     runAll: "runAll";
     overrideByName: "overrideByName";
@@ -121,7 +135,14 @@ export type MemberDirection = z.infer<typeof MemberDirection>;
  *  must be the LOOSEN floor (the category's), so a consumer that predates this field (its schema strips
  *  `boolPole`) reads the row as tighten@<loosen-floor> and withholds BOTH poles from low-trust layers —
  *  fail-closed (it loses only the convenience of low-trust tightening, it can never admit a loosening write).
- *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}. */
+ *  Resolution is value-aware: pass the candidate value to {@link memberAdmission} / {@link memberMinTrust}.
+ *
+ *  `list` (14.6.0) — the VALUE-CLASS seat of a member whose value is a string list (`permissions.allow` / `deny` / `ask`,
+ *  `sandboxNetwork.filesystem.denyWrite` / `denyRead`). A row declares exactly ONE value class — `boolPole` (a boolean)
+ *  or `list` — and the member's comparator is derived from it ({@link resolveMemberTighten}); neither or both is a
+ *  RangeError there, never a guess (a future numeric member is neither, so it can never be silently read as a list —
+ *  its value class has to be designed first). The seat carries no floor, so admission reads exactly as before, and a
+ *  consumer whose schema predates it strips it. */
 export declare const MemberAdmission: z.ZodObject<{
     direction: z.ZodEnum<{
         loosen: "loosen";
@@ -146,6 +167,7 @@ export declare const MemberAdmission: z.ZodObject<{
             task: "task";
         }>;
     }, z.core.$strip>>;
+    list: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strip>;
 export type MemberAdmission = z.infer<typeof MemberAdmission>;
 /** The RESOLVED admission a consumer branches on — the category fallback already applied, so `minTrust` is never
@@ -180,7 +202,12 @@ export type FailMode = z.infer<typeof FailMode>;
  *  from LOOSEST→STRICTEST — the category's whole vocabulary: a word outside it is refused, and a ONE-word order (11.0.0:
  *  `shellGate`, whose engine vocabulary is the single floor word) is the degenerate rank where the only merge is identity;
  *  `boolStricter.strict` is the bool value that is the tighter one; `setNarrower` = a subset is tighter; `policyDenyWins` =
- *  deny beats allow; `none` = not rank-tightenable (replace / conflict-reject). */
+ *  deny beats allow (a fold law BETWEEN a category's members, not an order on one value); `none` = not rank-tightenable
+ *  (replace / conflict-reject); `setUnion` (14.6.0) = a superset is tighter; `numericLower` (14.6.0) = a smaller number is
+ *  tighter, `+Infinity` (no limit) the loosest. A parameter may only change the ORDER (`strict`, `order`), so the two
+ *  appended words take none: a literal that reads as "empty set" or "no limit" is a spelling, normalized by the value's
+ *  owner before it reaches the comparator. Executed by {@link tightenVerdict}. The two words are appended at the tail
+ *  (README 发版纪律: a consumer holding an exhaustive table over `rule` goes compile-red at pickup — the pickup cost). */
 export declare const TightenRule: z.ZodDiscriminatedUnion<[z.ZodObject<{
     rule: z.ZodLiteral<"none">;
 }, z.core.$strip>, z.ZodObject<{
@@ -193,12 +220,43 @@ export declare const TightenRule: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strip>, z.ZodObject<{
     rule: z.ZodLiteral<"enumRank">;
     order: z.ZodArray<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    rule: z.ZodLiteral<"setUnion">;
+}, z.core.$strip>, z.ZodObject<{
+    rule: z.ZodLiteral<"numericLower">;
 }, z.core.$strip>], "rule">;
 export type TightenRule = z.infer<typeof TightenRule>;
+/** Where `candidate` lands relative to `existing` under a {@link TightenRule} (14.6.0; closed, in this order):
+ *  `equal` · `stricter` · `looser` · `unordered` (comparable values, neither side contains the other — two different sets,
+ *  two different `none` values) · `unreadable` (a side is outside the rule's normalized domain — absent, misspelled,
+ *  the wrong type). */
+export declare const TIGHTEN_VERDICTS: readonly ["equal", "stricter", "looser", "unordered", "unreadable"];
+export type TightenVerdict = (typeof TIGHTEN_VERDICTS)[number];
+/**
+ * THE comparator (14.6.0): where `candidate` lands relative to `existing` under `rule`. One implementation for every
+ * consumer — the shell's resolver, the server's catalog column, the profile loader — so "stricter" has one reading.
+ * It reads ORDER only: each rule has a normalized domain, and a side outside it is `unreadable` (spellings are normalized
+ * by the value's owner first — `readSettingsUnit` for a settings unit):
+ *  · `enumRank`     — a word of `order`; the higher rank is stricter, the same word `equal`;
+ *  · `boolStricter` — a boolean (strict equality, never truthiness: the string `"false"` is unreadable, not `true`);
+ *                     the `strict` pole is stricter;
+ *  · `setUnion`     — an array of strings, as a SET (order and duplicates do not count): a proper superset is stricter,
+ *                     a proper subset looser, the same set `equal`, neither containing the other `unordered`;
+ *  · `setNarrower`  — the same domain, the opposite direction;
+ *  · `numericLower` — a finite number or `+Infinity` (no limit, the loosest): the smaller is stricter;
+ *  · `none`         — a strict JSON value no deeper than {@link MAX_HASH_DEPTH}: `equal` when `stableStringify` agrees
+ *                     (key order does not count), else `unordered`;
+ *  · `policyDenyWins` — a RangeError: it is the fold law BETWEEN a category's members, not an order on one value —
+ *                     compare a member through {@link memberTighten}.
+ * Both sides must be present: absence is not a value (`undefined` ⇒ `unreadable`); "an absent landing spot takes the
+ * write" is the loading law's business, not the comparator's. A rule word outside the closed set (a JavaScript /
+ * deserialized caller) is a RangeError, never a silent verdict.
+ */
+export declare function tightenVerdict(rule: TightenRule, existing: unknown, candidate: unknown): TightenVerdict;
 export declare const MergeCategorySpec: z.ZodObject<{
     mergeShape: z.ZodEnum<{
-        concat: "concat";
         replace: "replace";
+        concat: "concat";
         denyFirst: "denyFirst";
         runAll: "runAll";
         overrideByName: "overrideByName";
@@ -223,6 +281,10 @@ export declare const MergeCategorySpec: z.ZodObject<{
     }, z.core.$strip>, z.ZodObject<{
         rule: z.ZodLiteral<"enumRank">;
         order: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        rule: z.ZodLiteral<"setUnion">;
+    }, z.core.$strip>, z.ZodObject<{
+        rule: z.ZodLiteral<"numericLower">;
     }, z.core.$strip>], "rule">;
     enforcement: z.ZodEnum<{
         gate: "gate";
@@ -268,6 +330,7 @@ export declare const MergeCategorySpec: z.ZodObject<{
                 task: "task";
             }>;
         }, z.core.$strip>>;
+        list: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type MergeCategorySpec = z.infer<typeof MergeCategorySpec>;
@@ -288,14 +351,17 @@ export declare const SAFETY_MERGE_SPEC: {
             readonly allow: {
                 readonly direction: "loosen";
                 readonly minTrust: "global";
+                readonly list: true;
             };
             readonly deny: {
                 readonly direction: "tighten";
                 readonly minTrust: "local";
+                readonly list: true;
             };
             readonly ask: {
                 readonly direction: "tighten";
                 readonly minTrust: "local";
+                readonly list: true;
             };
         };
     };
@@ -429,10 +495,12 @@ export declare const SAFETY_MERGE_SPEC: {
             readonly "filesystem.denyWrite": {
                 readonly direction: "tighten";
                 readonly minTrust: "local";
+                readonly list: true;
             };
             readonly "filesystem.denyRead": {
                 readonly direction: "tighten";
                 readonly minTrust: "local";
+                readonly list: true;
             };
         };
     };
@@ -608,3 +676,17 @@ export declare function memberAdmission<C extends SafetyMergeCategory>(category:
 /** A member's admission FLOOR from the published table — the word a resolver compares the layer's trust against
  *  (`isAtLeast(layer, floor)` ⇒ admitted; the ladder is {@link trustRank}). Convenience over {@link memberAdmission}. */
 export declare function memberMinTrust<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>, value?: unknown): MinTrust;
+/**
+ * Derive one member's comparator off a category spec VALUE (14.6.0; the single implementation — {@link memberTighten} binds
+ * it to {@link SAFETY_MERGE_SPEC}). The comparator follows from the row's VALUE CLASS and direction, never from the category's
+ * `tighten` (that answers only a `whole` unit's value — the file header):
+ *  · `boolPole` ⇒ `{ rule: "boolStricter", strict: boolPole.strict }`;
+ *  · `list` ⇒ `setUnion` for a `tighten` member (a superset narrows more), `setNarrower` for a `loosen` member (a subset grants less).
+ * A row declaring NEITHER value class or BOTH is a RangeError (nothing to derive / two readings) — never a default; so are the
+ * misuse arms {@link resolveMemberAdmission} has (a whole-key category, an undeclared member).
+ * @param categoryLabel only decorates the error message.
+ */
+export declare function resolveMemberTighten(spec: MergeCategorySpec, member: string, categoryLabel?: string): TightenRule;
+/** A declared member's comparator from the published table (see {@link resolveMemberTighten}); compare two of its values with
+ *  {@link tightenVerdict}. Unknown category or member ⇒ RangeError (never the category rule as a fallback). */
+export declare function memberTighten<C extends SafetyMergeCategory>(category: C, member: SafetyMergeMember<C>): TightenRule;