@sema-agent/settings-schema 14.6.0 → 14.8.0

package/dist/hash.js

@@ -7,6 +7,8 @@
  * container restart (drift) or serve a stale 304 (ETag), so we don't want the 32-bit ~77k boundary here
  * (council finding). Output length isn't a contract (values are only compared for equality before/after).
  */
+import { UNINSPECTABLE, containerView, inspect, valueOfDescriptor } from "./own-key-read.js";
+import { jsonShapeOf } from "./plain-json-object.js";
 /** Max nesting stableStringify will hash. A real EffectiveConfig nests ~10-15 deep; this generous cap turns a
  *  pathologically deep OR cyclic value (e.g. a poisoned `model.extraBody` = z.unknown()) into a DETERMINISTIC
  *  throw instead of a `RangeError: Maximum call stack` that would crash every scoped-worker `/effective` poll
@@ -37,13 +39,68 @@ export function stableStringify(v, depth = 0) {
     // crash every scoped-worker poll. Treat undefined like null for hashing.
     if (v === undefined)
         return "null";
-    if (v === null || typeof v !== "object")
-        return JSON.stringify(v);
-    if (Array.isArray(v))
-        return `[${v.map((x) => stableStringify(x, depth + 1)).join(",")}]`;
-    const obj = v;
-    const keys = Object.keys(obj).sort();
-    return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k], depth + 1)}`).join(",")}}`;
+    // the shape is asked of the seat (total); a node whose members cannot be read is REFUSED loudly with the package's one sentence — a hash of "what could be read" would be a hash of something else.
+    // Every container is read through the package's ONE whole-container read (`containerView`, wide): its members and ONE descriptor each are fixed when they are listed (objects: own
+    // enumerable string keys; arrays: own indexes + `length`); a value only ever comes from such a descriptor — not from `[[Get]]` (a proxy's `get` / `has` traps are not asked), not
+    // through the prototype chain (a hole stays a hole), not from a method of the array (an own `map` is not called).
+    // VALUE ORDER = the hash's own order: object keys sorted, array indexes ascending; each member's value is taken from its listed descriptor right before its subtree is hashed,
+    // so getters run in the order the hash emits them (a value-first read would run them in insertion order and change the hash of a successful read).
+    // Every raw read happens inside `inspect`, the recursion outside it: a refusal raised by a child (depth, unreadable) is never re-labelled by its parent.
+    const shape = jsonShapeOf(v);
+    switch (shape) {
+        case "null":
+        case "primitive":
+            return JSON.stringify(v);
+        case "uninspectable":
+            throw new TypeError(`stableStringify: ${UNINSPECTABLE} — refusing to hash`);
+        case "array": {
+            // the length is the listed `length` value through `ToLength(ToNumber(·))`; an index that is not an own member is a hole (it hashes as nothing between two commas)
+            const view = readOrRefuse(() => containerView(v, true, "wide"));
+            const length = readOrRefuse(() => lengthOf(view.length));
+            const byIndex = new Map(view.members);
+            let out = "";
+            for (let i = 0; i < length; i++) {
+                const d = byIndex.get(String(i));
+                out += `${i === 0 ? "" : ","}${d === undefined ? "" : stableStringify(readOrRefuse(() => valueOfDescriptor(v, d)), depth + 1)}`;
+            }
+            return `[${out}]`;
+        }
+        case "plain":
+        case "non_plain_object": {
+            if (typeof v === "function")
+                return JSON.stringify(v); // not data (and never was hashed as an object)
+            // the package's one whole-container read (wide): the members — own ENUMERABLE string keys, `Object.keys`' set — and ONE descriptor each are fixed when the keys are listed
+            // (a later change to the object by a getter does not change what is hashed); keys sorted; each member's value comes from ITS listed descriptor right before its subtree is hashed
+            const members = readOrRefuse(() => containerView(v, false, "wide")).members.slice().sort(([a], [b]) => (a < b ? -1 : 1));
+            let out = "";
+            for (const [key, d] of members) {
+                const value = readOrRefuse(() => valueOfDescriptor(v, d));
+                out += `${out === "" ? "" : ","}${JSON.stringify(key)}:${stableStringify(value, depth + 1)}`;
+            }
+            return `{${out}}`;
+        }
+        default: {
+            const unhandled = shape;
+            throw new Error(`stableStringify: unhandled shape ${String(unhandled)}`);
+        }
+    }
+}
+/** One raw read of a node's member (inside `inspect`); unreadable ⇒ the package's one refusal sentence. */
+function readOrRefuse(read) {
+    const r = inspect(read);
+    if (!r.ok)
+        throw new TypeError(`stableStringify: ${r.sentence} — refusing to hash`);
+    return r.value;
+}
+/** An array's length from its listed `length` value: `ToLength(ToNumber(value))` — the unary plus is `ToNumber` (a BigInt / Symbol throws, an object is converted through
+ *  `valueOf` / `toString`), not a number ⇒ 0, truncated — with the allocation limit of an array: a length beyond the largest array length (2^32 − 1 — only a proxy's descriptor
+ *  trap can report one) throws before a single index is hashed (the caller refuses with the one sentence). */
+function lengthOf(value) {
+    const n = +value;
+    const length = Number.isNaN(n) || n <= 0 ? 0 : Math.floor(n);
+    if (length > 2 ** 32 - 1)
+        throw new RangeError("Invalid array length");
+    return length;
 }
 const FNV64_OFFSET = 0xcbf29ce484222325n;
 const FNV64_PRIME = 0x100000001b3n;

package/dist/hooks-config.js

@@ -209,6 +209,15 @@ function hookIsArray(v) {
         return false; // 已撤销的 Proxy:读不出 ⇒ 不是数组
     }
 }
+/** `Symbol.iterator` WITHOUT the `Symbol` free name: the classifier closure is copied by consumers' generators whose registered built-ins do not include `Symbol` (a new built-in word
+ *  in the closure is a change they must follow), so the well-known symbol is taken from the one place every realm keeps it — `Array.prototype` is iterable by it. Read once at load;
+ *  a process in which `Array.prototype` has lost its iterator cannot say which objects hold content off their own keys, so the module refuses to load rather than answer "none do". */
+const HOOK_ITERATOR_SYMBOL = (() => {
+    const found = Object.getOwnPropertySymbols(Array.prototype).find((s) => s.description === "Symbol.iterator");
+    if (found === undefined)
+        throw new Error("hooks classifier: Array.prototype has no Symbol.iterator");
+    return found;
+})();
 /** The first own key of `node` (in key order) that names a guard event with a value other than null / undefined / `[]` (CC `ei`). */
 function hookGuardKeyOf(node) {
     for (const key of Object.keys(node)) {
@@ -227,7 +236,7 @@ function hookLooksLikeMatcher(value) {
     const inner = Object.hasOwn(value, "hooks") ? value.hooks : undefined;
     if (hookIsArray(inner))
         return inner.length > 0;
-    return hookIsRecord(inner) && (Object.hasOwn(value, "matcher") || typeof inner.type === "string");
+    return hookIsRecord(inner) && (Object.hasOwn(value, "matcher") || (Object.hasOwn(inner, "type") && typeof inner.type === "string"));
 }
 /**
  * The coordinate of the first guard sign in `root`'s subtree, or undefined: each object answers for itself before its members are searched (its own
@@ -263,8 +272,14 @@ function hookGuardSignIn(root, rootPath, place) {
                 isList = true;
                 break;
             case "plain":
-            case "non_plain_object":
                 break; // searched as an object below
+            case "non_plain_object":
+                // an object whose content is supplied by the iteration protocol (a Map, a Set, a generator …) holds that content OFF its own keys: the own-key search below
+                // would find nothing and a guard held inside would vanish with the dropped piece. It cannot be shown free of guard signs ⇒ a sign at its own coordinate (same arm as
+                // "uninspectable"). Every other non-plain object (a class instance, a Date, a function) keeps what it holds on its own keys, searched below.
+                if (HOOK_ITERATOR_SYMBOL in node)
+                    return pathTo(frame, []);
+                break;
             default: {
                 const unhandled = shape;
                 throw new Error(`hookGuardSignIn: unhandled shape ${String(unhandled)}`);
@@ -418,7 +433,7 @@ function hookBlockRead(hooks, reject, drop) {
             drop("hooks-not-object", ["hooks"]);
         return undefined;
     }
-    if (hookLooksLikeMatcher(hooks) || typeof hooks.type === "string") {
+    if (hookLooksLikeMatcher(hooks) || (Object.hasOwn(hooks, "type") && typeof hooks.type === "string")) {
         reject("hooks-is-matcher", ["hooks"]);
         return undefined;
     }

package/dist/http-hook-allowlists.d.ts

@@ -29,21 +29,25 @@ export declare const HttpHookAllowlistSettings: z.ZodObject<{
 }, z.core.$loose>;
 export type HttpHookAllowlistSettings = z.infer<typeof HttpHookAllowlistSettings>;
 /**
- * 一个设置层对两键的读数。键缺席 = 这一层不设限;`[]` = 这一层一个都不许。`source` = 这一层是哪个设置源(闭集 `SETTINGS_SOURCES`,原样回显进
- * `sources`);准入由判官按源经 `layerAdmission` 判,调用方不预先筛层、不给档。
+ * 一个设置层对两键的读数(读器交出的读数里的 `layer`)。键缺席 = 这一层不设限;`[]` = 这一层一个都不许。`source` = 这一层是哪个设置源(闭集 `SETTINGS_SOURCES`,原样回显进
+ * `sources`);准入由判官按源经 `layerAdmission` 判,调用方不预先筛层、不给档。读器交出的是寻常对象(不冻结)。
+ * **判官经读器读每一层**(与读器同一只读法,见 `httpHookUrlVerdict`):读器交出的层、调用方手造的寻常层、本 realm 的 `JSON.parse` 出来的层都按内容判,同一份内容同一个答案(另一个 realm 的数组按坏形,见 CHANGELOG 例外 ⑤)。读器交出的层里坏形名单已读成 `[]`(点名在读器的 `malformed`),所以同一份坏形设置直接交判官答 `malformed`、先过读器再交判官答 `empty` —— 坏形的告警看读器那一份读数。
  */
 export interface HttpHookAllowlistLayer {
     readonly source: SettingsSource;
     readonly allowedHttpHookUrls?: readonly string[];
     readonly httpHookAllowedEnvVars?: readonly string[];
 }
-/** 一层的读法结果:层读数 + 读成空名单的坏形键(调用方据此告警;读法本身不出句)。 */
+/**
+ * 一层的读法结果:层读数 + 读成空名单的坏形键(调用方据此告警;读法本身不出句)。由 {@link readHttpHookAllowlistLayer} 交出:普通对象、不冻结(与 v14.6.0 同形)。
+ * 读器对自己交出的 `layer` 再读,名单逐位同,`malformed` 只在第一次读出现(坏键第一次已读成 `[]`,再读是空名单);交判官与交它的副本同答。
+ */
 export interface HttpHookAllowlistLayerRead {
     readonly layer: HttpHookAllowlistLayer;
     readonly malformed: readonly HttpHookAllowlistKey[];
 }
 /**
- * 从一层的原始设置对象读出两键(唯一读法)。键缺席(或值为 `undefined`)⇒ 不设;字符串数组 ⇒ 原样(过 `captureAllowlist`〔包内私有〕,与判官同一只读法);其余一切(非数组、含非串条目或洞、取值或读元素时抛、`null`)
+ * 从一层的原始设置对象读出两键,过 `allowlistsOf`〔包内私有〕—— 与判官同一只读法:键缺席(或值为 `undefined`)⇒ 不设;字符串数组 ⇒ 原样的捕获副本;其余一切(非数组、含非串条目或洞、取值或读元素时抛、`null`)
  * ⇒ **读成 `[]`**(CC 同向:坏形名单 = 一个都不许)并在 `malformed` 点名。整份设置不是对象(`null` / 原始值 / 数组)⇒ 两键都缺。
  * **是对象但不朴素**(类实例 / `Map` / 建在别的对象原型上的记录 / 函数 —— JSON 解析不出来,只能是嵌入方程序拼的)⇒ 同样 fail-closed:两键都读成 `[]` 并点名 `malformed`。
  * 把它当「没有设置」读,等于把一层带名单的托管设置静默丢掉、方向放行(与本模块「坏形 = 一个都不许」的失败方向相反)。
@@ -51,17 +55,26 @@ export interface HttpHookAllowlistLayerRead {
  * 原型是带成员的 null 原型对象的对象(`Object.create(<null 原型的名单袋>)`)是一例:它按座位的判据读成朴素、按**自有**键读,名单键只在原型上 ⇒ 坏形。它只能由程序造出,JSON 解析不出来(座位头注 `./plain-json-object` 同写)。
  */
 export declare function readHttpHookAllowlistLayer(source: SettingsSource, settings: unknown): HttpHookAllowlistLayerRead;
-/** 拦下一只 http hook 的原因。`rule`:`empty` = 有一张准入名单是空的(那一层改对之前一只都不许;**名单形坏 —— 非串数组、含非串条目或洞、读它或读它的元素时 getter 抛 —— 也读成空**,所以 `empty` 不一定是写成了 `[]`);`url` = 没命中那几张名单里的任何模式。
- *  `sources` = 不放行它的那几张名单所在的层(入参序)。零 URL 回显 —— URL 调用方自己有,按受众给显示形。 */
+/** 拦下一只 http hook 的原因。`rule`(闭集,先到先得:`malformed` 先于 `empty` 先于 `url`):
+ *  `malformed` = 有一层判官读不出 —— ① 源读不出:`layers` 本身不是朴素数组 / 读不出 / 两份观测对不上,或某层的 `source` 缺席 / 只靠继承可见 / 读不出 / 两份不一致 / 不是串、层不是对象
+ *  ⇒ 那一层没有可信的源,不点名;② 源读得出、名单读不出(读器对同一份设置报 `malformed` 的那些形:不是朴素串数组 —— 另一个 realm 的数组、带框架挂件的数组、含非串条目或洞 ——、
+ *  读它或读它的元素时 getter 抛、两份观测不一致、名单键只靠继承可见、层对象不朴素)⇒ 点名那一层;
+ *  `empty` = 有一张准入名单真是空的 `[]`(那一层改对之前一只都不许;读器交出的层里坏形名单已是 `[]`,交判官也答 `empty` —— 坏形点名看读器的 `malformed`);
+ *  `url` = 没命中那几张名单里的任何模式。
+ *  `sources` = 不放行它的、读得出源的那几层(入参序)—— 所以 `rule: "malformed"` 时 `sources` 可以是空的(只有源读不出的层在拦)。零 URL 回显 —— URL 调用方自己有,按受众给显示形。 */
 export interface HttpHookUrlBlock {
     readonly list: "allowedHttpHookUrls";
-    readonly rule: "empty" | "url";
+    readonly rule: "malformed" | "empty" | "url";
     readonly sources: readonly SettingsSource[];
 }
 /**
  * 一只 http hook 的 URL 过不过名单:每一张准入的 `allowedHttpHookUrls` 都要有一条模式按放行出口({@link urlAllowPatternMatches})命中它。
- * 没有准入层写这张名单 ⇒ 不限(`undefined`)。`workspace` = 宿主对工作区信任的读数(读口抛或闭集外按 `declined` 交),与 `layerAdmission` 同一个入参。
+ * 没有准入层写这张名单 ⇒ 不限(`undefined`)。`layers` 的每一层经读器读({@link readHttpHookAllowlistLayer} 同一只读法;读不出源 ⇒ 坏形层,全拦、`rule: "malformed"`)。
+ * `workspace` = 宿主对工作区信任的读数(读口抛或闭集外按 `declined` 交),与 `layerAdmission` 同一个入参。
  */
 export declare function httpHookUrlVerdict(url: string, layers: readonly HttpHookAllowlistLayer[], workspace: WorkspaceTrustState): HttpHookUrlBlock | undefined;
-/** 一只 http hook 实际可插值进请求头的环境变量:它自己的 `allowedEnvVars` 与每一张准入的 `httpHookAllowedEnvVars` 取交(保持 hook 自己的序)。 */
+/**
+ * 一只 http hook 实际可插值进请求头的环境变量:它自己的 `allowedEnvVars` 与每一张准入的 `httpHookAllowedEnvVars` 取交(保持 hook 自己的序)。
+ * `layers` 同 {@link httpHookUrlVerdict}(坏形层 ⇒ 一个都不放);`hookVars` 只许普通的串数组({@link plainArrayOf};不是 ⇒ 当空,一个都不放)。
+ */
 export declare function httpHookEnvVarsAllowed(hookVars: readonly string[], layers: readonly HttpHookAllowlistLayer[], workspace: WorkspaceTrustState): string[];

package/dist/http-hook-allowlists.js

@@ -15,8 +15,8 @@
  * 判官出结构不出句:放行 ⇒ `undefined`;拦下 ⇒ {@link HttpHookUrlBlock}(哪张名单 / 为什么 / 出自哪几层),用户面那一句由各宿主按它铸。
  */
 import { z } from "zod";
-import { captureStringArray } from "./definition-copy.js";
-import { jsonShapeOf } from "./plain-json-object.js";
+import { captureDenseArray, inspect, isStringEntry, readKey } from "./own-key-read.js";
+import { isJsonArray, isPlainJsonArray, jsonShapeOf } from "./plain-json-object.js";
 import { layerAdmission } from "./settings-sources.js";
 import { urlAllowPatternMatches } from "./url-pattern.js";
 /** 两键(闭集,声明序)。 */
@@ -31,129 +31,207 @@ export const HttpHookAllowlistSettings = z
     httpHookAllowedEnvVars: z.array(z.string()).optional(),
 })
     .passthrough();
+/** 坏形的那一份读数(名单按 `[]` 读、点名 malformed)。每次一份新数组。 */
+const malformedList = () => ({ list: [], malformed: true });
+const UNSET = { kind: "unset" };
+const BAD = { kind: "bad" };
 /**
- * 一张名单的**唯一读法**(读器与判官共用,两边永远同答):**取值 + 复制 + 检视整段在一个 try 里**,名单键只读一次;名单本身走包内的串数组捕获读法
- * `captureStringArray`(`./definition-copy`:按下标 / `hasOwn` / 一次读 / 非串即坏 / 定义语义写入,不走迭代协议,交副本)—— 与请求面 `args` 同一只读法。
- * 键没写(取到 `undefined`)⇒ `undefined`(不设);是串数组 ⇒ 一份已校验的捕获副本;其余一切 ⇒ 读成 `[]` 并标 `malformed`(fail-closed:一个都不许)——
- * 取值抛(键本身是会抛的 getter)、不是串数组(含稀疏数组的洞 —— 不顺原型链读;`length` 不是安全非负整数;读元素时抛),一个也不抛出去。
+ * 安全轴的数组(`layers` / `hookVars` / 两张名单)的描述符观测 D —— **只许朴素数组**,一条规则:座位的朴素数组判据({@link isPlainJsonArray}:是数组、原型恒等于本 realm 的 `Array.prototype`、
+ * `constructor` / `filter` / `flatMap` / `Symbol.iterator` 与本 realm 的内建恒等 —— 子类、假原型、`null` / 换过的原型、谎报原型或对这几只成员说谎的 Proxy、另一个 realm 的数组都不是);整容器读({@link denseArrayView},`wide` 归类)一次列自有键 ——
+ * 稠密(`length` 是安全非负整数、自有下标正好 `0 … length-1`),且**自有键只有下标与 `length`**:任何别的自有键(方法覆盖、`constructor`、任意串键、符号键 —— 含 `Symbol.species`)
+ * ⇒ 不是朴素数组,整个输入按坏形、不读元素(v14.6.0 的判官调过调用方数组自己的 `filter`,子类 / 自有方法 / species 构造器让它拦下或少放;本版一律拦,拦集不缩)。
+ * 元素值取自那一份描述符(访问器下标调它的 getter 一次),逐个过 `isEntry`(不过即停、后面的不读);交出一份定义语义造的副本。不是 / 读不出 ⇒ `undefined`。
  */
-function captureAllowlist(holder, key) {
-    try {
-        const v = holder[key];
-        if (v === undefined)
-            return undefined;
-        const list = captureStringArray(v); // 串数组的唯一读法(`./definition-copy`):按下标 / hasOwn / 一次读 / 非串即坏 / 定义语义写入,交副本
-        return list === undefined ? { list: [], malformed: true } : { list, malformed: false };
-    }
-    catch {
-        return { list: [], malformed: true };
-    }
+function plainArrayOf(v, isEntry) {
+    return isPlainJsonArray(v) ? captureDenseArray(v, "wide", isEntry, "refuse") : undefined; // 拷贝循环是内核那一份(与串数组读法同一只)
 }
-function presenceOf(bag, key) {
-    try {
-        return Object.hasOwn(bag, key) ? "own" : key in bag ? "inherited" : "absent";
-    }
-    catch {
-        return "unreadable";
+const isAny = (_entry) => true;
+/** 判官直接拿到的数组(`layers` / `hookVars`):描述符观测({@link plainArrayOf})与普通读({@link agreesByOrdinaryReading})两份一致才算读到;否则 `undefined`。设置里的名单不走这一只 —— 两键的描述符观测要先于任何普通读(见 {@link allowlistsOf})。 */
+function bothObservations(v, isEntry) {
+    const seen = plainArrayOf(v, isEntry);
+    return seen !== undefined && agreesByOrdinaryReading(v, seen) ? seen : undefined;
+}
+/**
+ * 观测 D(描述符通道,本包的读内核):名单键经 `readKey` 读一次 —— 缺席 / 自有 `undefined` ⇒ 不设;自有 ⇒ {@link plainArrayOf}(只许普通的串数组;不是 ⇒ 坏形);
+ * 只靠继承可见 / 读不出 ⇒ 坏形。
+ */
+function describedList(holder, key) {
+    const read = readKey(holder, key);
+    switch (read.presence) {
+        case "absent":
+            return UNSET;
+        case "inherited":
+        case "unreadable":
+            return BAD;
+        case "own": {
+            if (read.value === undefined)
+                return UNSET;
+            const list = plainArrayOf(read.value, isStringEntry);
+            return list === undefined ? BAD : { kind: "list", list };
+        }
+        default: {
+            const unhandled = read;
+            throw new Error(`describedList: unhandled presence ${String(unhandled.presence)}`);
+        }
     }
 }
 /**
- * 从一层的原始设置对象读出两键(唯一读法)。键缺席(或值为 `undefined`)⇒ 不设;字符串数组 ⇒ 原样(过 `captureAllowlist`〔包内私有〕,与判官同一只读法);其余一切(非数组、含非串条目或洞、取值或读元素时抛、`null`)
- * ⇒ **读成 `[]`**(CC 同向:坏形名单 = 一个都不许)并在 `malformed` 点名。整份设置不是对象(`null` / 原始值 / 数组)⇒ 两键都缺。
- * **是对象但不朴素**(类实例 / `Map` / 建在别的对象原型上的记录 / 函数 —— JSON 解析不出来,只能是嵌入方程序拼的)⇒ 同样 fail-closed:两键都读成 `[]` 并点名 `malformed`。
- * 把它当「没有设置」读,等于把一层带名单的托管设置静默丢掉、方向放行(与本模块「坏形 = 一个都不许」的失败方向相反)。
- * 名单键**只靠继承可见**(不是自有键)⇒ 同样 fail-closed:该键读成 `[]` 并点名 `malformed`(自有键盖过继承键;自有键值为 `undefined` 仍是「不设」)。
- * 原型是带成员的 null 原型对象的对象(`Object.create(<null 原型的名单袋>)`)是一例:它按座位的判据读成朴素、按**自有**键读,名单键只在原型上 ⇒ 坏形。它只能由程序造出,JSON 解析不出来(座位头注 `./plain-json-object` 同写)。
+ * 观测 G(普通读通道)与描述符那份 `seen` 是否一致:座位判数组、`length` 经 `[[Get]]` 等于 `seen.length`、逐下标「是不是自有」(`Object.hasOwn` —— 14.6.0 读器读名单的读法)、
+ * 「在不在」(`i in v`,HasProperty —— v14.6.0 判官对 `layers` / `hookVars` 的 `filter` 按它跳过下标)且 `[[Get]]` 的值与 `seen` 同一(`Object.is`)。
+ * 读量以 `seen` 的长度为界(长度不同即不一致,不逐位扫);读不出 ⇒ 不一致。名单、判官的 `layers` / `hookVars` 都用这一只。
  */
-export function readHttpHookAllowlistLayer(source, settings) {
-    const shape = jsonShapeOf(settings);
-    let bag = Object.create(null); // 空袋没有原型:不存在 / 非对象的层看不见 `Object.prototype` 上的污染键,仍「两键都缺」
-    let refuseBoth = false; // 是对象但不朴素 ⇒ 两键都读成 [](fail-closed)
+function agreesByOrdinaryReading(v, seen) {
+    const same = inspect(() => {
+        if (!isJsonArray(v) || v.length !== seen.length)
+            return false;
+        for (let i = 0; i < seen.length; i++)
+            if (!Object.hasOwn(v, i) || !(i in v) || !Object.is(v[i], seen[i]))
+                return false;
+        return true;
+    });
+    return same.ok && same.value;
+}
+/**
+ * 名单在一个对象上的**唯一读法**(读器读设置对象、判官读层对象,都调这一只 —— 两边对同一个对象永远同答):先问座位它是什么形(`jsonShapeOf`,一次)——
+ *  · 朴素对象 ⇒ **两份观测一致才算读到**:先对每个要的键做描述符观测 D({@link describedList}),再逐键做普通读 G({@link agreesByOrdinaryReading},v14.6.0 读器与判官普通读的合取)对拍 ——
+ *    两份都「不设」⇒ 不设;都是同一张串名单 ⇒ D 的捕获副本;其余一切(只一份读到、内容不同、任一份读不出 / 坏形、名单键只靠继承可见)⇒ `[]` + malformed(fail-closed:对无状态构造,拦集包含
+ *    「只看 G」的 14.6.0 与「只看 D」的读法各自的拦集,两份不一致也拦;普通对象上两份观测恒同,JSON 面零变化)。挡不住的(如实):有状态陷阱 —— 两次都答同一份假名单,
+ *    或第一次观测改了第二次观测的答案;G 是本模块读名单时唯一的 `[[Get]]`,只作对拍 —— 交出去的值取自 D;
+ *  · 是对象但不朴素(类实例 / `Map` / 建在别的对象原型上的记录 / 函数 —— JSON 解析不出来,只能是嵌入方程序拼的)或读形状就抛(已撤销的 Proxy)⇒ 要的键都读成 `[]` + malformed
+ *    (fail-closed:把它当「没有名单」读,等于把一层带名单的设置静默丢掉、方向放行);
+ *  · 不是对象(`null` / 原始值 / 数组)⇒ 都缺。
+ * 交出零原型的袋(只含读到的键)。
+ */
+function allowlistsOf(holder, keys) {
+    const out = Object.create(null); // 零原型:原型上被污染成只读的同名键不让赋值抛
+    const shape = jsonShapeOf(holder);
     switch (shape) {
-        case "plain":
-            bag = settings;
+        case "plain": {
+            // 安全轴的名单要**两份观测一致才算读到**:先对所有要的键做描述符观测 D(在任何普通读之前 —— 一个键的普通读改不动另一个键已经拿到的观测),再逐键做普通读 G 对拍
+            const described = keys.map((key) => describedList(holder, key));
+            keys.forEach((key, i) => {
+                const d = described[i];
+                if (d.kind === "bad") {
+                    out[key] = malformedList();
+                    return;
+                }
+                const got = inspect(() => holder[key]);
+                const agrees = got.ok && (d.kind === "unset" ? got.value === undefined : agreesByOrdinaryReading(got.value, d.list));
+                if (!agrees)
+                    out[key] = malformedList();
+                else if (d.kind === "list")
+                    out[key] = { list: d.list, malformed: false };
+            });
             break;
+        }
         case "non_plain_object":
-        case "uninspectable": // 读形状就抛的对象(已撤销的 Proxy)同样 fail-closed:读不出就不能当「没有设置」放行
-            refuseBoth = true;
+        case "uninspectable":
+            for (const key of keys)
+                out[key] = malformedList();
             break;
         case "array":
         case "null":
         case "primitive":
-            break; // 整份设置不是对象 ⇒ 两键都缺
+            break;
         default: {
             const unhandled = shape;
-            throw new Error(`readHttpHookAllowlistLayer: unhandled shape ${String(unhandled)}`);
+            throw new Error(`allowlistsOf: unhandled shape ${String(unhandled)}`);
         }
     }
-    const bad = Object.create(null); // 读成 [] 的坏形键(零原型的标记袋;`malformed` 数组出口只用定义语义造,见下)
-    // 累加器也零原型:`{}` 继承 `Object.prototype`,原型上被污染成只读(只有 getter)的同名键会让下面的赋值抛(读器该 fail-closed,不是抛)
+    return out;
+}
+/**
+ * 从一层的原始设置对象读出两键,过 `allowlistsOf`〔包内私有〕—— 与判官同一只读法:键缺席(或值为 `undefined`)⇒ 不设;字符串数组 ⇒ 原样的捕获副本;其余一切(非数组、含非串条目或洞、取值或读元素时抛、`null`)
+ * ⇒ **读成 `[]`**(CC 同向:坏形名单 = 一个都不许)并在 `malformed` 点名。整份设置不是对象(`null` / 原始值 / 数组)⇒ 两键都缺。
+ * **是对象但不朴素**(类实例 / `Map` / 建在别的对象原型上的记录 / 函数 —— JSON 解析不出来,只能是嵌入方程序拼的)⇒ 同样 fail-closed:两键都读成 `[]` 并点名 `malformed`。
+ * 把它当「没有设置」读,等于把一层带名单的托管设置静默丢掉、方向放行(与本模块「坏形 = 一个都不许」的失败方向相反)。
+ * 名单键**只靠继承可见**(不是自有键)⇒ 同样 fail-closed:该键读成 `[]` 并点名 `malformed`(自有键盖过继承键;自有键值为 `undefined` 仍是「不设」)。
+ * 原型是带成员的 null 原型对象的对象(`Object.create(<null 原型的名单袋>)`)是一例:它按座位的判据读成朴素、按**自有**键读,名单键只在原型上 ⇒ 坏形。它只能由程序造出,JSON 解析不出来(座位头注 `./plain-json-object` 同写)。
+ */
+export function readHttpHookAllowlistLayer(source, settings) {
+    const read = allowlistsOf(settings, HTTP_HOOK_ALLOWLIST_KEYS);
+    // 累加器零原型:`{}` 继承 `Object.prototype`,原型上被污染成只读(只有 getter)的同名键会让赋值抛(读器该 fail-closed,不是抛)
     const lists = Object.create(null);
     for (const key of HTTP_HOOK_ALLOWLIST_KEYS) {
-        if (refuseBoth) {
-            lists[key] = [];
-            bad[key] = true;
-            continue;
-        }
-        // 对袋的每一次触碰(`in` / `hasOwn` / 取值)都经守护:先问这个键在袋里怎么在场(一只守护的探针),再取值(`captureAllowlist`,自带守护)
-        const presence = presenceOf(bag, key);
-        switch (presence) {
-            case "absent":
-                continue;
-            case "inherited": // 名单键只靠继承可见 ⇒ 不能当「没有名单」放行
-            case "unreadable": // 袋读不出(`has` / `getOwnPropertyDescriptor` 陷阱抛)⇒ 同样 fail-closed
-                lists[key] = [];
-                bad[key] = true;
-                continue;
-            case "own": {
-                const read = captureAllowlist(bag, key); // 取值也在 try 里、只读一次:键是会抛的自有 getter ⇒ 坏形,不是抛出读器
-                if (read === undefined)
-                    continue;
-                lists[key] = read.list;
-                if (read.malformed)
-                    bad[key] = true;
-                break;
-            }
-            default: {
-                const unhandled = presence;
-                throw new Error(`readHttpHookAllowlistLayer: unhandled presence ${String(unhandled)}`);
-            }
-        }
+        const captured = read[key];
+        if (captured !== undefined)
+            lists[key] = captured.list;
     }
-    // `malformed` 用 filter 造(定义语义)—— `push` 会命中 `Object.prototype` 上继承的数字键 setter、吞掉点名;层是普通对象(返回值的运行期形状与 v14.5.0 同),`...lists` 是定义语义拷贝,污染下不抛
-    const malformed = HTTP_HOOK_ALLOWLIST_KEYS.filter((key) => bad[key] === true);
+    // `malformed` 用 filter 造(定义语义)—— `push` 会命中 `Object.prototype` 上继承的数字键 setter、吞掉点名;返回形与 v14.6.0 同(普通对象、不冻结),字面量与 `...lists` 都是定义语义,污染下不抛
+    const malformed = HTTP_HOOK_ALLOWLIST_KEYS.filter((key) => read[key]?.malformed === true);
     return { layer: { source, ...lists }, malformed };
 }
+const MALFORMED_LAYER = { source: undefined, list: [], malformed: true };
 /**
- * 一层的某张名单:按 `[[Get]]` 读(名单放在原型上的手造层 —— 类 getter、`Object.create(defaults)` —— 照旧生效,与 v14.5.0 同答),
- * 过 `captureAllowlist`〔包内私有〕—— 与读器**同一只读法**,产出一份已校验的捕获副本,判官只读这份副本(元素只读一次)。
- * 读到 `undefined` ⇒ 没写(`undefined`);取值时 getter 抛、或读到的不是串数组(污染出非数组、含非串条目或洞、读 `length` / 元素的 getter 或 Proxy 陷阱抛)⇒ 读成 `[]`(fail-closed:一个都不许),不抛。
- * 原型污染出来的名单只会让准入名单取交后更窄 —— 方向是拦,不是放;读器造的缺席层也是普通对象,污染下同样被收紧(fail-closed,判决的 `sources` 点名该层)。
+ * 一层的 `source`,与名单同一条双读一致律:层是对象(朴素与否都读)⇒ 自有描述符那份(`readKey`)与普通读那份(`[[Get]]`)是同一个值、且是串 ⇒ 那个词
+ * (闭集不在这里判:读得出的词交 `layerAdmission`,闭集外的词在那里响亮抛 —— 那是宿主代码写错了词,不是数据坏形);
+ * 其余一切(不是对象 / 读形状就抛、`source` 缺席 / 只靠继承可见 / 读不出、两份不一致、不是串)⇒ `undefined`(判官把这一层当坏形层,判决词 `malformed`)。
  */
-function listOf(layer, key) {
-    return captureAllowlist(layer, key)?.list;
+function sourceOf(element) {
+    const shape = jsonShapeOf(element);
+    switch (shape) {
+        case "plain":
+        case "non_plain_object": {
+            const described = readKey(element, "source");
+            if (described.presence !== "own")
+                return undefined;
+            const got = inspect(() => element.source);
+            return got.ok && Object.is(got.value, described.value) && typeof described.value === "string" ? described.value : undefined;
+        }
+        case "array":
+        case "null":
+        case "primitive":
+        case "uninspectable":
+            return undefined;
+        default: {
+            const unhandled = shape;
+            throw new Error(`sourceOf: unhandled shape ${String(unhandled)}`);
+        }
+    }
 }
-/** 进判决的那几层(入参序):`layerAdmission` 答 `admitted` 的层。每一层都问 —— 闭集外的源 / 工作区读数在这里响亮抛,哪怕那一层没写名单。 */
-function admittedLayers(layers, workspace) {
-    return layers.filter((l) => layerAdmission(l.source, workspace, "httpHookAllowlists") === "admitted");
+/**
+ * 进判决的那几层(入参序)与它们对 `key` 那张名单的读数(`list` 缺 = 这一层不设)。**判官经读器读每一层**,与读器同一只读法,没有「是不是读器交出的」判:
+ * `layers` 数组见 {@link bothObservations}(不是朴素数组 / 读不出 / 两份观测对不上 ⇒ 整个当一张坏形层);每个元素先读源({@link sourceOf})——
+ * 读不出 ⇒ **坏形层**:名单按 `[]`,不问准入(它没有可信的源),进判决、全拦(判决词 `malformed`);
+ * 读得出 ⇒ 问 `layerAdmission`(闭集外的源 / 工作区读数在这里响亮抛 RangeError,哪怕那一层没写名单),准入的才进判决,名单与「读不出」= 读器读这个元素的读数({@link allowlistsOf},两键、双读一致律原样;读不出 ⇒ 判决词 `malformed`、点名这一层)。
+ * 于是读器交出的层、它的副本、手造的寻常层、本 realm 的 `JSON.parse` 出来的层同一份内容同一个答案(另一个 realm 的数组按坏形);读器对自己交出的 `layer` 再读,名单逐位同(`malformed` 只在第一次读出现)。
+ */
+function admittedLists(layers, workspace, key) {
+    const elements = bothObservations(layers, isAny);
+    if (elements === undefined)
+        return [MALFORMED_LAYER];
+    return elements.flatMap((element) => {
+        const source = sourceOf(element);
+        if (source === undefined)
+            return [MALFORMED_LAYER];
+        // 闭集外的词:`layerAdmission` 经源表那一只判官抛 RangeError(与 14.6.0 同句同类)—— 判官不另写闭集表
+        if (layerAdmission(source, workspace, "httpHookAllowlists") !== "admitted")
+            return [];
+        const captured = allowlistsOf(element, HTTP_HOOK_ALLOWLIST_KEYS)[key];
+        return [{ source: source, list: captured?.list, malformed: captured?.malformed === true }];
+    });
 }
 /**
  * 一只 http hook 的 URL 过不过名单:每一张准入的 `allowedHttpHookUrls` 都要有一条模式按放行出口({@link urlAllowPatternMatches})命中它。
- * 没有准入层写这张名单 ⇒ 不限(`undefined`)。`workspace` = 宿主对工作区信任的读数(读口抛或闭集外按 `declined` 交),与 `layerAdmission` 同一个入参。
+ * 没有准入层写这张名单 ⇒ 不限(`undefined`)。`layers` 的每一层经读器读({@link readHttpHookAllowlistLayer} 同一只读法;读不出源 ⇒ 坏形层,全拦、`rule: "malformed"`)。
+ * `workspace` = 宿主对工作区信任的读数(读口抛或闭集外按 `declined` 交),与 `layerAdmission` 同一个入参。
  */
 export function httpHookUrlVerdict(url, layers, workspace) {
-    const refusing = admittedLayers(layers, workspace).flatMap((l) => {
-        const list = listOf(l, "allowedHttpHookUrls");
-        return list !== undefined && !list.some((p) => urlAllowPatternMatches(url, p)) ? [{ source: l.source, empty: list.length === 0 }] : [];
-    });
+    const refusing = admittedLists(layers, workspace, "allowedHttpHookUrls").flatMap(({ source, list, malformed }) => list !== undefined && !list.some((p) => urlAllowPatternMatches(url, p)) ? [{ source, malformed, empty: list.length === 0 }] : []);
     if (refusing.length === 0)
         return undefined;
-    return { list: "allowedHttpHookUrls", rule: refusing.some((r) => r.empty) ? "empty" : "url", sources: refusing.map((r) => r.source) };
+    const sources = refusing.flatMap(({ source }) => (source === undefined ? [] : [source]));
+    const rule = refusing.some((r) => r.malformed) ? "malformed" : refusing.some((r) => r.empty) ? "empty" : "url";
+    return { list: "allowedHttpHookUrls", rule, sources };
 }
-/** 一只 http hook 实际可插值进请求头的环境变量:它自己的 `allowedEnvVars` 与每一张准入的 `httpHookAllowedEnvVars` 取交(保持 hook 自己的序)。 */
+/**
+ * 一只 http hook 实际可插值进请求头的环境变量:它自己的 `allowedEnvVars` 与每一张准入的 `httpHookAllowedEnvVars` 取交(保持 hook 自己的序)。
+ * `layers` 同 {@link httpHookUrlVerdict}(坏形层 ⇒ 一个都不放);`hookVars` 只许普通的串数组({@link plainArrayOf};不是 ⇒ 当空,一个都不放)。
+ */
 export function httpHookEnvVarsAllowed(hookVars, layers, workspace) {
-    const lists = admittedLayers(layers, workspace)
-        .map((l) => listOf(l, "httpHookAllowedEnvVars"))
+    const lists = admittedLists(layers, workspace, "httpHookAllowedEnvVars")
+        .map(({ list }) => list)
         .filter((list) => list !== undefined);
-    return hookVars.filter((v) => lists.every((list) => list.includes(v)));
+    const vars = bothObservations(hookVars, isStringEntry) ?? []; // 只许朴素的串数组,且两份观测一致才算读到;否则一个都不放
+    return vars.filter((v) => lists.every((list) => list.includes(v)));
 }

package/dist/index.d.ts

@@ -7,6 +7,9 @@ export * from "./execution-lanes.js";
 export * from "./url-shape.js";
 export * from "./url-credential.js";
 export * from "./default-model.js";
+export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js";
+export { DEFAULT_MODEL_KEY, ENV_MODEL_TABLE_KEYS, buildEnvModelBaseline, envModelTableDeclared, envModelTableWriteRefusal, mintedCheapId, planEnvModelTableWrite, readEnvModelSlots, type EnvCheapSlot, type EnvModelBaseline, type EnvModelTableEntry, type EnvModelTableKey, type EnvModelTableLanding, type EnvModelTableReceipt, type EnvModelTableRoleRow, type EnvModelTableTarget, type EnvModelTableWriteInput, type EnvModelTableWriteIntent, type EnvModelTableWritePlan, type EnvRoleBinding, type EnvSnapshot, } from "./env-model-table.js";
+export { CONFIG_ROOT_DOCUMENTS, ENV_MODELS_DECISIONS, ENV_MODELS_DOCUMENT, ROOT_DOCUMENT_UNREADABLE_REASONS, envModelsDecisionTag, type ConfigRootDocument, type EnvModelsDecision, type EnvModelsDecisionWord, type MarkedMigrationId, type MigrationMarker, type RootDocumentUnreadableReason } from "./config-root-documents.js";
 export * from "./loopback.js";
 export * from "./hash.js";
 export * from "./sha256.js";
@@ -29,6 +32,8 @@ export * from "./api/auth-bridge.js";
 export * from "./api/scopes.js";
 export * from "./api/pull-token.js";
 export * from "./api/feedback.js";
+export * from "./api/credentials.js";
+export * from "./sandbox-git.js";
 export * from "./web-admin-env.js";
 export * from "./web-admin-credential.js";
 export * from "./web-admin-session-url.js";
@@ -40,3 +45,5 @@ export * from "./mcp-server-policy.js";
 export * from "./ui-language.js";
 export * from "./control-and-bidi.js";
 export * from "./mcp-request-entry.js";
+export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js";
+export * from "./center-refs.js";

package/dist/index.js

@@ -7,6 +7,9 @@ export * from "./execution-lanes.js"; // 7.0.0 M-R2: the ONE lane / store vocabu
 export * from "./url-shape.js"; // 11.0.0: THE URL shape judge (httpUrlFlaws / httpUrlRule / isHierarchicalUrl), pure/browser-safe
 export * from "./url-credential.js"; // 14.5.0: THE "does this URL carry a credential" judge (findUrlCredential / findUrlUserinfo / URL_CREDENTIAL_REASONS / CREDENTIAL_PARAM_NAMES …), pure/browser-safe
 export * from "./default-model.js"; // 11.0.0: THE catalog-default resolver (roles.default → active tier ladder → fallback), pure/browser-safe
+export { catalogManagesModelPlane, enabledEntryCount } from "./catalog-manages.js"; // THE "does this models document manage the model plane" judge (raw half: at least one entry not explicitly disabled) + the log count it is derived from, pure/browser-safe
+export { DEFAULT_MODEL_KEY, ENV_MODEL_TABLE_KEYS, buildEnvModelBaseline, envModelTableDeclared, envModelTableWriteRefusal, mintedCheapId, planEnvModelTableWrite, readEnvModelSlots, } from "./env-model-table.js"; // the env model table (MODEL_ID / MODEL_CHEAP_ID) read once: readEnvModelSlots / envModelTableDeclared / buildEnvModelBaseline + the writer's plan planEnvModelTableWrite (receipt by id, confirmKey) + envModelTableWriteRefusal, pure/browser-safe (named: the env snapshot helper stays package-private)
+export { CONFIG_ROOT_DOCUMENTS, ENV_MODELS_DECISIONS, ENV_MODELS_DOCUMENT, ROOT_DOCUMENT_UNREADABLE_REASONS, envModelsDecisionTag } from "./config-root-documents.js"; // the config-root documents (config.env-models.json + the per-id migration marker config.migration.<id>.json): names + closed answer tables + the one tagged identity of a decision reading (envModelsDecisionTag); the readers / writer are in ./node
 export * from "./loopback.js"; // 11.0.0: the two「本机」predicates (auth relaxation — narrow / connection routing — wide), pure/browser-safe
 export * from "./hash.js";
 export * from "./sha256.js";
@@ -29,6 +32,8 @@ export * from "./api/auth-bridge.js"; // 鉴权桥 contract: worker verifies web
 export * from "./api/scopes.js"; // multi-tenant scope contract: /api/v1/scopes* + /api/v1/auth/scope wire shapes + THE minting/switch decision functions (resolveTokenScope / canSwitchScope / effectiveScopeRole / readTokenScope) — web-admin imports these, never re-implements
 export * from "./api/pull-token.js"; // scope-bound token FORM + minting rule (one rule, token families are data: WORKER_PULL_TOKEN) + claimed-binding reader + verifier (re-mint + constant-time compare), pure-JS HMAC-SHA256, browser-safe
 export * from "./api/feedback.js"; // /bug report wire contract: FeedbackSubmitRequest (POST body) + FeedbackWire / FeedbackListResponse + the two caps, pure/browser-safe
+export * from "./api/credentials.js"; // 14.7.0: the credential port's `sandbox_git` wire (barrel only, no subpath): SandboxGitCredentialRequest / CredentialHandleAnswer / CredentialResolveRequest / SandboxGitCredentialAnswer (per-origin SandboxGitOriginAnswer) / SandboxGitCredentialRefusal + the three word tables (SANDBOX_GIT_ORIGIN_VERDICTS → _STATES / _REASONS, SANDBOX_GIT_REFUSALS → _ERRORS, SANDBOX_GIT_PERMANENCE), pure/browser-safe
+export * from "./sandbox-git.js"; // 14.7.0: the sandbox git plane's origin form (isSandboxGitOrigin — a string equal to its own WHATWG origin) + the `sandboxGit` effective-config block (SandboxGitConfig: origins ≤ 16, each { origin, connectUrl }), pure/browser-safe
 export * from "./web-admin-env.js"; // WEB_ADMIN_ENV — every env name an engine reads to reach web-admin (one table; a leaf module), pure/browser-safe
 export * from "./web-admin-credential.js"; // S-698 web-admin credential FILE contract: WebAdminCredentialEnvelope (user-session envelope, strict) + parseWebAdminCredentialFile (bare / envelope / unreadable — the one discrimination law) + judgeWebAdminCredentialDeclaration(env, credential) (pick-exactly-one over the credential's WEB_ADMIN_ENV pair; WEB_ADMIN_CREDENTIALS = access | assertion), pure/browser-safe
 export * from "./web-admin-session-url.js"; // webAdminSessionUrl(webBaseUrl, { worker, sessionId }) — THE web-admin session link template (<webBaseUrl>/chat?agent=<worker>&session=<sessionId>) + parseWebAdminSessionUrl(link) its paired reader, pure/browser-safe
@@ -40,6 +45,8 @@ export * from "./mcp-server-policy.js"; // 13.0.0 (U6): mcpServerPolicyVerdict
 export * from "./ui-language.js"; // 13.0.0 (S-1592): the UI-language settings fragment (semaUiLanguage, en | zh, category ui, user settings) + readUiLanguage, pure/browser-safe
 export * from "./control-and-bidi.js"; // the one-line echo strip set (C0 + DEL + the 12 Bidi_Control code points) — CONTROL_AND_BIDI_CHARS (the class, as regex source text) + stripControlAndBidi / hasControlOrBidi, pure/browser-safe
 export * from "./mcp-request-entry.js"; // 14.0.0: the request-plane MCP entry judges (isUsableWireName / isContentOriginWord / readMcpIdentityHeaders / readRequestMcpTransport + the value-shape describers) — one reading for the service legs and the shell pre-check, pure/browser-safe
+export { REMOTE_MCP_SERVER_NAME_PREFIX } from "./mcp-server-name.js"; // the MCP server-name prefix reserved for the remote MCP servers a device executor offers (mount name = prefix + the executor's server name); the predicate and its sentence stay package-private — the request plane's MCP name judges (isUsableMcpServerName / describeBadMcpServerName) read them; the config plane's McpServerSpec.name accepts the prefix (refusing it would be a validation tightening — a major), pure/browser-safe
+export * from "./center-refs.js"; // resolveCenterRefs(refs, lookup) — THE center-roster reference resolver: one verdict word per member (missing_name / not_a_string / read_threw, CENTER_REF_FAULTS), one whole verdict (resolved / unresolved / refs_unreadable, CENTER_REFS_VERDICTS); the refs record is read by the public readPlainStringRecord, the lookup is the caller's, it reads no process.env; pure/browser-safe
 // NOTE: the Node-fs-backed helpers (FileConfigStore + the file editor) are NOT in this barrel — they pull
 // `node:fs`/`node:path` and would break a browser/client bundle that only wants the contract (e.g.
 // web-admin's client components import the zod types through here). Import them from the Node-only