@sema-agent/settings-schema 17.1.0 → 18.0.0

package/dist/mcp-request-entry.js

@@ -10,7 +10,7 @@
  * 判据与原因句逐字等于消费方请求腿的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
  * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
  * 与最初搬来时相比有三处收严,都是收到与消费方请求腿同严、不是新语义,消费方改 import 这一份之后不再各留一份旧判据:申报名判官另判**首尾空白**;
- * `env` / `headers` 只收**纯数据**的「名 → 串」记录(Map / 类实例 / 自有 `__proto__` 成员不收,交出的是副本);两只回显描述器用消费方的回显口径(剥控制与双向字符、截 64 字、引号形)。
+ * `env` / `headers` 只收**纯数据**的「名 → 串」记录(Map / 类实例不收;保留成员名 {@link RESERVED_MEMBER_NAMES} 不进副本,交出的是副本);两只回显描述器用消费方的回显口径(剥控制与双向字符、截 64 字、引号形)。
  *
  * ## 依赖的引擎事实(镜像 + 漂移门)
  *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
@@ -31,6 +31,8 @@ import { isJsonArray, isPlainJsonObject, jsonShapeOf } from "./plain-json-object
 import { MCP_CONTENT_ORIGINS } from "./types.js";
 import { RESERVED_MCP_SERVER_NAME_REASON, isReservedMcpServerName } from "./mcp-server-name.js";
 import { startsWithHttpScheme } from "./url-shape.js";
+import { TOOL_WIRE_NAME_MAX_CHARS, hasEdgeWhitespace, isUsableWireName } from "./wire-name.js";
+import { isReservedMemberName } from "./reserved-member-name.js";
 // ── 值的种类描述(拒句只说「你写的是什么形」,不回显值:值可能带凭据、可能任意长)──────────────────────────────────────
 /** 值的**种类词**(不回显值本身):`null` / `array` / `typeof` 词(`object` / `function` / `string` …);读不出的对象 ⇒ 全包唯一的那一句。形状只问座位(总,不抛):两只坏值描述器共用这一只。 */
 function describeKindWord(v) {
@@ -92,15 +94,15 @@ export function isStringArray(v) {
     return captureStringArray(v, "strict") !== undefined;
 }
 /**
- * 纯数据的「名 → 串」记录(空对象合法;数组、`Map`、类实例、自有 `__proto__` 成员、有非串成员的对象都不是)—— 类型守卫,所以是**严归类**:成员经内核的
+ * 纯数据的「名 → 串」记录(空对象合法;数组、`Map`、类实例、有保留名成员({@link isReservedMemberName})、有非串成员的对象都不是)—— 类型守卫,所以是**严归类**:成员经内核的
  * `ownEntriesOf` 读(整容器读的严归类:每个自有串键一份描述符;访问器成员或不可枚举的成员 ⇒ 不是,getter 一次都不调 —— 守卫为真,调用方随后的普通读读到的就是判过的那一份)。
- * 传输读器读 `env` / `headers`({@link readPlainStringRecord})交出去的是**副本**,按宽归类读(不可枚举的成员照读、访问器调一次);值与成员名的判据(是串、不叫 `__proto__`)两边同一条。
+ * 传输读器读 `env` / `headers`({@link readPlainStringRecord})交出去的是**副本**,按宽归类读(不可枚举的成员照读、访问器调一次);值与成员名的判据(是串、不是保留名)两边同一条。
  */
 export function isStringRecord(v) {
     if (!isPlainJsonObject(v))
         return false;
     const entries = ownEntriesOf(v);
-    return entries.ok && entries.value.every(([name, value]) => name !== PLAIN_STRING_RECORD_RESERVED_MEMBER && typeof value === "string");
+    return entries.ok && entries.value.every(([name, value]) => !isReservedMemberName(name) && typeof value === "string");
 }
 // ── 调用方写的串的回显口径 ──────────────────────────────────────────────────────────────────────────
 /** 句子里点名一个值的写法:{@link echoCallerText} 外加一对双引号;内部的引号与反斜杠逐字(不转义)。 */
@@ -108,21 +110,9 @@ function quotedCallerText(text) {
     return `"${echoCallerText(text)}"`;
 }
 // ── 申报名的线长界 ──────────────────────────────────────────────────────────────────────────────────
-/** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
-export const TOOL_WIRE_NAME_MAX_CHARS = 128;
-/**
- * 首尾带空白吗 —— 「空白」就是 `String.prototype.trim` 剥的那一组(ECMAScript 的 WhiteSpace + LineTerminator:空格 / 制表 / 换行 / NBSP / BOM / 全角空格 / 行段分隔符等)。
- * {@link isUsableWireName} 与 {@link describeBadWireName} 共读这一个定义,判与说不会各按各的口径。
- */
-const hasEdgeWhitespace = (v) => v.trim() !== v;
-/**
- * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS}、**首尾带空白**一律不可用。不截断、不 trim、不规范化 —— 截短或剥掉一个名字就是**换一个身份**,
- * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。首尾空白 = 坏名(它不是另一个名字:名字是 `mcp__<server>__<tool>` 的身份片,
- * 带着空白的一端无从与不带的那个对上号);内部空白(`a b`)照旧是合法名,本判官不扩判。
- */
-export function isUsableWireName(v) {
-    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS && !hasEdgeWhitespace(v);
-}
+// 判据住在零依赖叶子 `./wire-name`(18.0.0 搬过去:`./types` 的 `a2a` 对端名也问它,而本模块引 `./types` —— 留在这里会成环);公开名照旧经本模块转出,同一个函数对象。
+export { TOOL_WIRE_NAME_MAX_CHARS, isUsableWireName } from "./wire-name.js";
+export { RESERVED_MEMBER_NAMES, isReservedMemberName } from "./reserved-member-name.js"; // 18.0.0: the one reserved-member-name table (schema guard · this reader · the center-refs resolver)
 /**
  * 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或引号形的回显加原因 —— 绝不把任意长度的申报串原样回显。回显口径见 {@link quotedCallerText}
  * (剥控制与双向字符、截 64 字)。串的原因是:超界 ⇒ `N chars > 128`(N 是送来的原长度,不是剥完的);首尾带空白 ⇒ `leading or trailing whitespace`
@@ -222,7 +212,7 @@ const inheritedIdentityIssue = (key) => ({
  *  · 软坏形(`args` 不是串数组 / `env` `headers` 不是纯数据的串记录 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
  *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
  *  · `env` / `headers` 只收**纯数据**的记录({@link readPlainStringRecord}):必须是朴素 JSON 对象(`./plain-json-object` 的判据;`Map`、`Set`、类实例整张不收),每个自有成员的值都是串;
- *    交出的是**副本**(不是调用方的对象,改原对象不影响读后的形)。名叫 `__proto__` 的成员(JSON 文本铸得出这个自有键,对象字面量写不出)不进副本、单独记进 `lost`。
+ *    交出的是**副本**(不是调用方的对象,改原对象不影响读后的形)。名叫保留名({@link RESERVED_MEMBER_NAMES})的成员不进副本、每个单独记进 `lost`。
  *    坏形的 `lost` 条目带机读位(见 {@link McpEntryKeyIssue})。
  * url 的拒句不回显值:它常规地带凭据(userinfo)。
  */
@@ -323,12 +313,8 @@ function snapshotTransport(tr) {
     return { ok: true, value: { kind: "other", value: kind.value } };
 }
 // ── 「名 → 串」记录的读法(`env` / `headers`)────────────────────────────────────────────────────────
-/**
- * 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。
- * 公开,因为读器交出 `reservedMember: true` 时消费方要点名它 —— 名字只在这里定一次。
- */
-export const PLAIN_STRING_RECORD_RESERVED_MEMBER = "__proto__";
-const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${PLAIN_STRING_RECORD_RESERVED_MEMBER}"`;
+/** 保留成员名的原因句(一个名一句;名字取自那一张表 {@link RESERVED_MEMBER_NAMES})。 */
+const reservedMemberFault = (name) => `no member of a declaration may be named "${name}"`;
 /**
  * 「名 → 串」记录读不交(或交时点名保留名)的**原因词**,闭集,三个词、一张表:
  * 整张一词(`not_plain_record`)· 成员级一词(`member_not_string`:值读成了别的种类,或读成员时抛了 —— 句子分说)· 名字级一词(`member_name_reserved`)。
@@ -361,8 +347,8 @@ function notPlainDetail(shape, v) {
  * 读一份「名 → 串」记录 —— **公开读口**:传输读器读 `env` / `headers` 用的就是它,消费方读自己的「名 → 串」记录(中心名册的引用表)调同一只,不抄镜像。从不抛。记录交不交:是朴素 JSON 对象(座位的判据,见 `./plain-json-object`:原型是 `null`,或原型自己的原型是 `null`;纯数据 —— `Map`、`Set`、类实例、建在原型上的记录都不是),
  * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值经内核 `readKey` 读(一份描述符:数据属性取值,访问器调一次,不问 `get` 陷阱;访问器或描述符 trap 抛了同判为坏 —— 词与「值不是串」同是 `member_not_string`,句子说读不出)。
  * 读原型与成员名时代理 trap 抛了 ⇒ 整张不交(读器对调用方递来的任何对象都不抛;`JSON` 存体里不会有代理,这条只落在直接调读器的嵌入方身上)。
- * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫 `__proto__` 的成员不进副本,`reservedMember` 记下它。
- * 名叫 `__proto__` 而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
+ * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫保留名({@link isReservedMemberName})的成员不进副本,`reservedMembers` 记下它们。
+ * 名叫保留名而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
  */
 export function readPlainStringRecord(v) {
     // 形状归座位旁的分类(不在这里再推一遍;座位总 —— 读形状就抛的对象答 `uninspectable`)。成员名的读取(`ownKeys` 陷阱抛)读不出的对象也不是纯数据。
@@ -377,7 +363,7 @@ export function readPlainStringRecord(v) {
     // 累加器是零原型的袋、成员用 `Object.defineProperty` + 零原型描述符写(定义语义,不走 [[Set]]),最后用对象展开(同为定义语义)铸成普通对象:原型上被污染成只读的同名键不让读器抛,
     // 原型上的数字键 setter 吞不掉成员(此前 `entries.push` + `Object.fromEntries` 被继承的数字键 getter / setter 弄抛)
     const members = Object.create(null);
-    let reservedMember = false;
+    const reservedMembers = names.filter(isReservedMemberName); // `filter` 走 CreateDataProperty,不走 [[Set]](继承的数字键 setter 吞不掉)
     for (const name of names) {
         // 成员经内核读(契约见函数头注):一份描述符里取值 —— 数据属性取值、访问器调一次、从不问 Proxy 的 `get` 陷阱;成员在两次读之间被删掉 ⇒ 不是串(不读继承来的值)
         const read = readKey(v, name);
@@ -385,28 +371,25 @@ export function readPlainStringRecord(v) {
         const value = read.presence === "own" ? read.value : undefined;
         if (unreadable || typeof value !== "string") {
             const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
-            const reserved = name === PLAIN_STRING_RECORD_RESERVED_MEMBER;
             // 词:名坏优先(句子里值坏并列说全);名没问题时,读不出与值不是串同词,句子分说
-            const fault = reserved ? "member_name_reserved" : "member_not_string";
+            const fault = isReservedMemberName(name) ? "member_name_reserved" : "member_not_string";
             return {
                 ok: false,
                 fault,
                 member: echoCallerText(name),
-                detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
+                detail: `its member "${echoCallerText(name)}" ${isReservedMemberName(name) ? `is not allowed (${reservedMemberFault(name)}) and its value ${valueFault}` : valueFault}`,
             };
         }
-        if (name === PLAIN_STRING_RECORD_RESERVED_MEMBER)
-            reservedMember = true;
-        else
+        if (!isReservedMemberName(name))
             Object.defineProperty(members, name, dataDescriptor(value));
     }
-    return { ok: true, record: { ...members }, reservedMember };
+    return { ok: true, record: { ...members }, reservedMembers };
 }
 /** 把诊断条目铸成数组:`undefined`(这一处没有诊断)略去。`filter` 的结果走 `CreateDataProperty`,不走 `[[Set]]` —— `lost` 是「门拒什么」的读数,不能被继承的数字键 setter 吞掉。 */
 const issuesOf = (...candidates) => candidates.filter((c) => c !== undefined);
 /**
  * `transport.env` / `transport.headers` 的读法(两键同一只):缺席 ⇒ 缺席;记录不交 ⇒ 一处诊断点名**这个键**(不交的是整张记录;坏在某个成员时句子与 `member` 点名它);
- * 交 ⇒ 纯数据副本,名叫 `__proto__` 的成员单记一处诊断、路径 `<键>.__proto__`。
+ * 交 ⇒ 纯数据副本,名叫保留名的成员每个单记一处诊断、路径 `<键>.<保留名>`。
  */
 function readTransportRecord(path, raw) {
     if (raw === undefined)
@@ -420,6 +403,6 @@ function readTransportRecord(path, raw) {
     }
     return {
         record: read.record,
-        issues: read.reservedMember ? [{ path: `${path}.${PLAIN_STRING_RECORD_RESERVED_MEMBER}`, reason: RESERVED_MEMBER_FAULT, member: PLAIN_STRING_RECORD_RESERVED_MEMBER, fault: "member_name_reserved" }] : [],
+        issues: read.reservedMembers.map((name) => ({ path: `${path}.${name}`, reason: reservedMemberFault(name), member: name, fault: "member_name_reserved" })),
     };
 }

package/dist/node.d.ts

@@ -8,8 +8,11 @@ export * from "./file-store.js";
 export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
+export { readConfigDFileReadingSync, type ConfigDDocumentName, type ConfigDFileReason, type ConfigDReading, type ConfigDRefused } from "./config-d-file.js";
 export * from "./scheduler-store-node.js";
 export { migrateConfigDirectory, migrateConfigDocuments, // 14.5.0:同一段「迁 → 整域终判」的同步口(入参是已有的存量文档,无 io)—— 目录形调的就是它的内核
 type ConfigDirectoryDocument, type ConfigDirectoryIo, type ConfigDirectoryMigration, type ConfigDirectoryRefusal, type ConfigDocumentsMigration, type MigrateConfigDirectoryOptions, type MigrateConfigDocumentsOptions, } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js";
-export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readMigrationMarker, writeEnvModelsDecision, type ConfigRootIo, type EnvModelsDecisionWrite, type EnvModelsMigration, type EnvModelsMint, } from "./config-root-node.js";
+export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readEnvModelsDecisionSync, // 同步孪生:同一个字节读法 / 缺席律 / 答案表(壳在同步具名锁里写模型池要在锁里读决定)
+readMigrationMarker, writeEnvModelsDecision, writeEnvModelsDecisionSync, // 同步孪生:同一份写计划 + 同一对同步原子写原语
+type ConfigRootIo, type EnvModelsDecisionWrite, type EnvModelsMigration, type EnvModelsMint, } from "./config-root-node.js";

package/dist/node.js

@@ -8,10 +8,14 @@ export * from "./file-store.js";
 export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
+// 一份 `config.d/<名>.json` 的读数(缺席 / 在场 / 被拒)的**同步读口**:与包内异步读口同一只纯判、同一个缺席尾(壳在同步具名锁里读 `config.d` 文档用它,不自读文本);纯判本身与异步读口不出门。显式列名。
+export { readConfigDFileReadingSync } from "./config-d-file.js";
 export * from "./scheduler-store-node.js"; // R7 self-wake scheduler store — fs binding of the ./scheduler-store contract
 // 目录形的一次性迁移(读目录 → 迁 → 整域终判 → 原子写 → 删 retired 域文件)—— 语义只此一处,命令行是它的渲染器、引擎起服调同一只。显式列名:该模块的包内私有件(出门形/拼路径)不外泄。
 export { migrateConfigDirectory, migrateConfigDocuments, // 14.5.0:同一段「迁 → 整域终判」的同步口(入参是已有的存量文档,无 io)—— 目录形调的就是它的内核
  } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js"; // 上面那只函数的真 I/O 绑定:node:fs + 本包唯一的原子写器(config-document 模式规则)
-// 配置根上的决定文档(config.env-models.json)与按 id 的运行记录(config.migration.<id>.json)的两只读者、决定文档的唯一写函数(运行记录由迁移独占创建),与一次性迁移 SS-M11 的迁移体(名字与闭集答案表在包根)。显式列名。
-export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readMigrationMarker, writeEnvModelsDecision, } from "./config-root-node.js";
+// 配置根上的决定文档(config.env-models.json)与按 id 的运行记录(config.migration.<id>.json)的两只读者、决定文档的唯一写函数(运行记录由迁移独占创建;决定文档的读写各有同步孪生),与一次性迁移 SS-M11 的迁移体(名字与闭集答案表在包根)。显式列名。
+export { migrateEnvModelsDecision, nodeConfigRootIo, readEnvModelsDecision, readEnvModelsDecisionSync, // 同步孪生:同一个字节读法 / 缺席律 / 答案表(壳在同步具名锁里写模型池要在锁里读决定)
+readMigrationMarker, writeEnvModelsDecision, writeEnvModelsDecisionSync, // 同步孪生:同一份写计划 + 同一对同步原子写原语
+ } from "./config-root-node.js";

package/dist/one-time-migrations.js

@@ -138,7 +138,7 @@ export const ONE_TIME_MIGRATIONS = [
         releasedOn: "2026-10-10",
         removableAfter: "2026-11-09",
         rewrites: "every NON_SECRET_URL seat in a domain document (derived from the domain schemas, not listed by hand — today models.models[].baseUrl, " +
-            "mcp.servers[].transport.url, execution.sessionMirror.engineUrl, workers.workers[].coords.gitApiBaseUrl): `#` and everything after it are removed " +
+            "mcp.servers[].transport.url, a2a.peers[].url, a2a.peers[].cardUrl, execution.sessionMirror.engineUrl, workers.workers[].coords.gitApiBaseUrl): `#` and everything after it are removed " +
             "(a fragment never goes on the wire); the same walk covers config.d/remote-exec.json, derived from its schema the same way " +
             "(today the k8s apiUrl and s3Snapshot.endpoint) — the command-line migrate reads and rewrites it as one more document",
         removal: "the next major after the window: delete the SS-M7 step and its schema walk; the NON_SECRET_URL fragment rule loses its SS-M7 clause",

package/dist/portable-domains.d.ts

@@ -12,7 +12,7 @@
  *  同形**。当年 `limits` 域就是这样在单机腿静默丢了一整片限额发布(远端腿同批可用,所以更难看出来)。
  *  今日的兜底:漏登记的文件会被 `FileConfigStore`(`./node`)的 `"unread-config-file"` 警告点名(fail-loud,
  *  见 getEffective),但那只在消费方接了 `onWarning` 时才响 —— **登记仍是第一现场的义务**。 */
-export declare const PORTABLE_DOMAINS: readonly ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits"];
+export declare const PORTABLE_DOMAINS: readonly ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits", "a2a"];
 export type PortableDomain = (typeof PORTABLE_DOMAINS)[number];
 /**
  * 非便携域的**排除理由表**(#282 件5 附带裁定:禁裸排除)。

package/dist/portable-domains.js

@@ -12,7 +12,7 @@
  *  同形**。当年 `limits` 域就是这样在单机腿静默丢了一整片限额发布(远端腿同批可用,所以更难看出来)。
  *  今日的兜底:漏登记的文件会被 `FileConfigStore`(`./node`)的 `"unread-config-file"` 警告点名(fail-loud,
  *  见 getEffective),但那只在消费方接了 `onWarning` 时才响 —— **登记仍是第一现场的义务**。 */
-export const PORTABLE_DOMAINS = ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits"];
+export const PORTABLE_DOMAINS = ["models", "rosters", "skills", "mcp", "plugins", "scenarios", "collab", "governance", "execution", "prompts", "limits", "a2a"];
 /**
  * 非便携域的**排除理由表**(#282 件5 附带裁定:禁裸排除)。
  *

package/dist/remote-exec.d.ts

@@ -12,6 +12,9 @@
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
  *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
+ *   Either:
+ *   - `none`          (18.0.0) no execution environment for the agent's tools — the file form of `REMOTE_EXEC=none`. No fields:
+ *                     there is nothing to configure.
  *
  * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
  * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
@@ -90,5 +93,7 @@ export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<[z.ZodObject<{
     serial: z.ZodString;
     adbPath: z.ZodOptional<z.ZodString>;
     mountPath: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    provider: z.ZodLiteral<"none">;
 }, z.core.$strip>], "provider">;
 export type RemoteExecSpec = z.infer<typeof RemoteExecSpec>;

package/dist/remote-exec.js

@@ -12,6 +12,9 @@
  *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
  *                     agent). No isolation.
  *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
+ *   Either:
+ *   - `none`          (18.0.0) no execution environment for the agent's tools — the file form of `REMOTE_EXEC=none`. No fields:
+ *                     there is nothing to configure.
  *
  * 7.0.0: every `provider` word here is an execution lane word (`EXECUTION_LANE_WORDS`, `execution-lanes.ts` — the ONE
  * vocabulary; `test/execution-lanes-7.0.0.test.ts` pins `provider ⊆ EXECUTION_LANE_WORDS`, at runtime and at compile time).
@@ -147,6 +150,8 @@ export const RemoteExecSpec = z.discriminatedUnion("provider", [
         adbPath: execStr.optional(),
         mountPath: execStr.optional(),
     }),
+    // ── none (18.0.0): no execution environment for the agent's tools (REMOTE_EXEC=none). Zero fields — nothing to configure, no secrets.
+    z.object({ provider: z.literal("none") }),
 ], {
     // A retired lane word as `provider` (no matching discriminator) gets the tombstone's way out; any other miss keeps zod's sentence.
     // `provider` is read from the input's OWN keys (the input is the caller's object: an inherited / polluted `provider` is not the word they wrote; a proxy that cannot be read has no word to refuse)

package/dist/reserved-member-name.d.ts

@@ -0,0 +1,13 @@
+/**
+ * 包内私有叶子模块(运行期零依赖,浏览器安全;不进 `package.json` 的 exports,主桶经 `./mcp-request-entry` 转出这里的公开名):
+ * **一个名字能不能作「名 → 串」记录的成员名**的唯一判据 —— 原型链上的三个名字永远不能:`__proto__`(按赋值拷贝会变成原型;zod 的 record 读键前先跳过它、不判它的值)、
+ * `constructor` / `prototype`(读方对普通对象做 `obj[名]` 时撞上原型成员)。
+ * 三个读口问它,同一张表、同一个答案:域 schema 的凭据引用集合(`./types` 的 `credentialRefs`:在场 ⇒ 集合坏)· 公开的记录读器(`./mcp-request-entry` 的 `readPlainStringRecord` /
+ * `isStringRecord`,请求面传输的 `env` / `headers` 同读:剔出副本并点名)· 中心引用解析口(`./center-refs`,经记录读器:在场 ⇒ `refs_unreadable`)。
+ * 住在叶子里,是因为 `./types` 与 `./mcp-request-entry` 都要它,而后者反过来引 `./types`。
+ */
+/** 保留成员名,闭集。 */
+export declare const RESERVED_MEMBER_NAMES: readonly ["__proto__", "constructor", "prototype"];
+export type ReservedMemberName = (typeof RESERVED_MEMBER_NAMES)[number];
+/** 这个名字是保留成员名吗(大小写敏感:`Constructor` / `X-Prototype` 不是)。 */
+export declare function isReservedMemberName(name: string): name is ReservedMemberName;

package/dist/reserved-member-name.js

@@ -0,0 +1,14 @@
+/**
+ * 包内私有叶子模块(运行期零依赖,浏览器安全;不进 `package.json` 的 exports,主桶经 `./mcp-request-entry` 转出这里的公开名):
+ * **一个名字能不能作「名 → 串」记录的成员名**的唯一判据 —— 原型链上的三个名字永远不能:`__proto__`(按赋值拷贝会变成原型;zod 的 record 读键前先跳过它、不判它的值)、
+ * `constructor` / `prototype`(读方对普通对象做 `obj[名]` 时撞上原型成员)。
+ * 三个读口问它,同一张表、同一个答案:域 schema 的凭据引用集合(`./types` 的 `credentialRefs`:在场 ⇒ 集合坏)· 公开的记录读器(`./mcp-request-entry` 的 `readPlainStringRecord` /
+ * `isStringRecord`,请求面传输的 `env` / `headers` 同读:剔出副本并点名)· 中心引用解析口(`./center-refs`,经记录读器:在场 ⇒ `refs_unreadable`)。
+ * 住在叶子里,是因为 `./types` 与 `./mcp-request-entry` 都要它,而后者反过来引 `./types`。
+ */
+/** 保留成员名,闭集。 */
+export const RESERVED_MEMBER_NAMES = ["__proto__", "constructor", "prototype"];
+/** 这个名字是保留成员名吗(大小写敏感:`Constructor` / `X-Prototype` 不是)。 */
+export function isReservedMemberName(name) {
+    return RESERVED_MEMBER_NAMES.includes(name);
+}

package/dist/retired-envs.js

@@ -75,6 +75,8 @@ export const RETIRED_ENVS = [
     ["HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED", "replaced", negativeAliasWhy("HOST_EXEC_SPOOL_DISABLED", "HOST_EXEC_SPOOL_ENABLED")],
     // 无人值守腿的模式旋钮退役:这些腿的答集是常量,不是旋钮。
     ["UNATTENDED_PERMISSION_MODE", "since server 7.109.0 the unattended legs (leader workers and their repair legs, run-local, and their durable resumes) always run permissionMode \"default\" with an approver that answers by ask class: a machine answers only \"ordinary\" asks, and every other class goes to the leg's approver seat (run-local's terminal prompt) or parks / is refused — there is no mode to choose", "removed"],
+    // 执行车道总开关:每个部署都点名自己的车道之后它恒真(「点名了没有」只剩一个答者 REMOTE_EXEC),留着 = 两个键答一个问题;「没有执行环境」也是一个声明(REMOTE_EXEC=none)。
+    ["REQUIRE_EXECUTION_LANE", "REMOTE_EXEC", "replaced", "every deployment names its execution lane; REMOTE_EXEC=none declares one with no execution environment"],
 ];
 // 冻结:拿到导出的人改不了拒启判据(读拒句的与投影 wire 的是同一个数组对象)。
 for (const row of RETIRED_ENVS)

package/dist/secret-refs.d.ts

@@ -18,7 +18,7 @@ export interface EnvRef {
     envName: string;
     refs: EnvRefUse[];
 }
-/** Every env-NAME referenced across models / workers / mcp, grouped + sorted by name.
+/** Every env-NAME referenced across models / workers / mcp / a2a, grouped + sorted by name.
  *  (integrations domain DELETED in 0.6.0 — OA/Gitea coordinates ride worker.env/secretEnv, EXPERT-REDESIGN §9.) */
 export declare function collectEnvRefs(eff: EffectiveConfig): EnvRef[];
 /**

package/dist/secret-refs.js

@@ -1,4 +1,4 @@
-/** Every env-NAME referenced across models / workers / mcp, grouped + sorted by name.
+/** Every env-NAME referenced across models / workers / mcp / a2a, grouped + sorted by name.
  *  (integrations domain DELETED in 0.6.0 — OA/Gitea coordinates ride worker.env/secretEnv, EXPERT-REDESIGN §9.) */
 export function collectEnvRefs(eff) {
     const map = new Map();
@@ -33,6 +33,10 @@ export function collectEnvRefs(eff) {
         for (const [key, envName] of Object.entries(refs ?? {}))
             add(envName, "mcp", `server "${s.name}" ${kind}.${key}`);
     }
+    // 18.0.0: an A2A peer's header references are env-NAMEs the reading side must provide, like an http MCP server's.
+    for (const p of eff.a2a.peers)
+        for (const [key, envName] of Object.entries(p.headerRefs ?? {}))
+            add(envName, "a2a", `peer "${p.name}" headerRefs.${key}`);
     return [...map.entries()].map(([envName, refs]) => ({ envName, refs })).sort((a, b) => a.envName.localeCompare(b.envName));
 }
 /**

package/dist/settings-units.d.ts

@@ -75,6 +75,9 @@ export declare function unitTighten(unit: SettingsUnitName, member?: string): Ti
  * are `"manual"` ⇒ `"default"` (permissionMode) and `"disable"` ⇒ `true` (kill-switches); `"bypassPermissions"` is `launch_only`.
  * The last step of every reading is the unit comparator's own domain: whatever reads, compares (file header).
  * Addressing is {@link unitTighten}'s (same RangeErrors: a `members` unit needs a declared member, …).
+ * `unreadable` on a `member` / `members` unit is NOT absence, and the reading carries no direction: what the caller does with it depends on the member's
+ * `memberAdmission(category, member).direction` (`loosen` ⇒ may be dropped, loudly; `tighten` ⇒ must be kept and answered strictest on its own surface) —
+ * see WHEN A MEMBER DOES NOT READ in the file header.
  */
 export declare function readSettingsUnit(unit: SettingsUnitName, raw: unknown, member?: string): {
     readonly ok: true;

package/dist/settings-units.js

@@ -38,6 +38,21 @@
  * owner, the comparator; a reading only adds what it needs on top (non-empty list elements, the hooks judge, …). So a value the
  * shape half accepts but the comparator cannot place — a hooks document the hooks judge loads while a key it strips hides data
  * nested deeper than `MAX_HASH_DEPTH`, or an `undefined` — is `unreadable`, never "read but not comparable".
+ * WHEN A MEMBER DOES NOT READ (the disposition law). On a `member` / `members` unit, `unreadable` is NOT absence: absence is "the document does
+ * not set this member", `unreadable` is "the document sets it, in a form the contract cannot place". The two facts a caller needs to dispose of
+ * it are already tables, and neither is carried by the reading (a reading has no `direction`: a `whole` unit has no direction source, so the field
+ * could only be optional and every consumer would still branch on its absence — and it would be a second reader of a member row's `direction`):
+ * the member's direction is `memberAdmission(category, member).direction`, and the category's failure direction is `SAFETY_MERGE_SPEC[category].fail`.
+ * For a member of a category whose `fail` is `closed` (today every category that declares members: `permissions`, `sandboxNetwork`, `killSwitches`):
+ *  · a `loosen` member — the caller MAY drop it (dropping grants less), loudly: it says which member of which layer was dropped and why;
+ *  · a `tighten` member — the caller must NOT drop it and must NOT read it as absent: it keeps the member and answers on ITS surface with the
+ *    strictest answer it has (the rules surface refuses every call it cannot place; a kill-switch counts as ON; a sandbox switch takes its strict
+ *    pole), because dropping a tighten member reads a restriction its author wrote — in a form the contract cannot place — as no restriction at all;
+ *    the contract cannot tell what it was meant to forbid, and the strictest answer is the only one that cannot be looser than what the author meant.
+ * The package enforces nothing here (the surfaces are the consumers'); what it pins is that both inputs exist for every such member and that every
+ * out-of-domain value reads `unreadable` without throwing. Not covered, and not settled here: the `whole` units (`permissionMode`, `additionalDirectories`,
+ * `hooks`, `env`, `model`, `outputStyle`) have no direction column; whether "unreadable = absent" closes for them depends on the order of the
+ * unit's own value domain, which is a design question of its own.
  * The env DOCUMENT's literal grammar (boolean words, csv + empty-set sentinel, a "≤ 0 means off" cap) is not here: it belongs to
  * the engine's env catalog, whose one implementation is the server's.
  */
@@ -165,6 +180,9 @@ function shapedReading(unit, row, rule, raw) {
  * are `"manual"` ⇒ `"default"` (permissionMode) and `"disable"` ⇒ `true` (kill-switches); `"bypassPermissions"` is `launch_only`.
  * The last step of every reading is the unit comparator's own domain: whatever reads, compares (file header).
  * Addressing is {@link unitTighten}'s (same RangeErrors: a `members` unit needs a declared member, …).
+ * `unreadable` on a `member` / `members` unit is NOT absence, and the reading carries no direction: what the caller does with it depends on the member's
+ * `memberAdmission(category, member).direction` (`loosen` ⇒ may be dropped, loudly; `tighten` ⇒ must be kept and answered strictest on its own surface) —
+ * see WHEN A MEMBER DOES NOT READ in the file header.
  */
 export function readSettingsUnit(unit, raw, member) {
     const t = unitTarget(unit, member);

package/dist/types.d.ts

@@ -1428,17 +1428,9 @@ export declare const WorkerSpec: z.ZodObject<{
     runtime: z.ZodObject<{
         execution: z.ZodOptional<z.ZodObject<{
             lane: z.ZodOptional<z.ZodNever>;
-            lanes: z.ZodArray<z.ZodEnum<{
-                host: "host";
-                e2b: "e2b";
-                k8s: "k8s";
-                ssh: "ssh";
-                adb: "adb";
-                "local-docker": "local-docker";
-                device: "device";
-            }>>;
+            lanes: z.ZodPreprocess<z.ZodPipe<z.ZodUnknown, z.ZodTransform<("none" | "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device")[], unknown>>, unknown>;
             coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-            secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+            secretRefs: z.ZodPrefault<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
         }, z.core.$strip>>;
         store: z.ZodOptional<z.ZodObject<{
             backend: z.ZodEnum<{
@@ -1492,7 +1484,7 @@ export declare const WorkerSpec: z.ZodObject<{
         tidbPasswordEnv: z.ZodOptional<z.ZodNever>;
     }, z.core.$strip>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    secretEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    secretEnv: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
     recreateNonce: z.ZodOptional<z.ZodString>;
     lifecycle: z.ZodOptional<z.ZodObject<{
         kind: z.ZodDefault<z.ZodEnum<{
@@ -1597,17 +1589,9 @@ export declare const WorkersConfig: z.ZodObject<{
         runtime: z.ZodObject<{
             execution: z.ZodOptional<z.ZodObject<{
                 lane: z.ZodOptional<z.ZodNever>;
-                lanes: z.ZodArray<z.ZodEnum<{
-                    host: "host";
-                    e2b: "e2b";
-                    k8s: "k8s";
-                    ssh: "ssh";
-                    adb: "adb";
-                    "local-docker": "local-docker";
-                    device: "device";
-                }>>;
+                lanes: z.ZodPreprocess<z.ZodPipe<z.ZodUnknown, z.ZodTransform<("none" | "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device")[], unknown>>, unknown>;
                 coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-                secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                secretRefs: z.ZodPrefault<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
             }, z.core.$strip>>;
             store: z.ZodOptional<z.ZodObject<{
                 backend: z.ZodEnum<{
@@ -1661,7 +1645,7 @@ export declare const WorkersConfig: z.ZodObject<{
             tidbPasswordEnv: z.ZodOptional<z.ZodNever>;
         }, z.core.$strip>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        secretEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        secretEnv: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
         recreateNonce: z.ZodOptional<z.ZodString>;
         lifecycle: z.ZodOptional<z.ZodObject<{
             kind: z.ZodDefault<z.ZodEnum<{
@@ -1844,15 +1828,28 @@ export declare const SkillsManifestSchema: z.ZodObject<{
         contentHash: z.ZodString;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/**
+ * 18.0.0 —— **凭据引用集合不可部分抢救**(按 schema 身份的集合)。成员是「名 → 宿主 env-NAME」的凭据引用 Record:mcp 的 `envRefs` / `headerRefs`
+ * (a2a 对端的 `headerRefs` 复用后者,因此同在)、车道块的 `secretRefs` 与 worker 的 `secretEnv`。逐条抢救(`salvageEntries`)走到成员**不下钻**、把它当一个值判:
+ * 集合里任一键 / 值坏形 ⇒ 它所属的那一条条目整条 `entry-dropped`,兄弟条目保留。理由:丢掉一条坏引用不是「更窄」,而是让条目带着**一半凭据**活下来 ——
+ * 拨一个远端服务 / 智能体时错误的失败方向(读方对「任一引用的 env 缺席」本来就整条跳过,同一个方向)。
+ * 既有读数只变一处:直接对 `WorkersConfig` 调 `salvageEntries` 时,`secretEnv` 带坏引用的 worker 由「只丢那一条引用、worker 存活」变「整条丢」
+ * (各域读数不变:workers 域不逐条抢救;mcp 的两只住在传输判别联合里,走查不进联合;车道块住在不是集合的 `runtime` 对象里)
+ * —— 由 17.2.0 包的真读数逐行对拍钉住(`test/atomic-salvage-18.0.0.test.ts`,改了读数的那一行逐行登记)。别的集合字段(allowTools / scenarios / allowSkills …)照旧逐条抢救:丢坏元素只会更窄。
+ * 成员读键按自有属性名判:`__proto__` / `constructor` / `prototype` 任一在场 ⇒ 集合坏 ⇒ 条目整条丢(见 `credentialRefs`;zod 的 record 读键前跳过 `__proto__`、不判它的值)。
+ * 新的凭据引用集合必须复用这几只 schema 或由 `credentialRefs` 铸出并登记进这里(按身份判,换一只「形一样」的新 schema 不算成员)。
+ * 登记的是剥掉包装之后的那只 `record`(与抢救走查同一只读法 `unwrapSchema`)。
+ */
+export declare const ATOMIC_SALVAGE: ReadonlySet<z.ZodType>;
 export declare const McpTransport: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"stdio">;
     command: z.ZodString;
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    envRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    envRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"http">;
     url: z.ZodString;
-    headerRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
     principalHeader: z.ZodOptional<z.ZodString>;
     assertionHeader: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "kind">;
@@ -1870,11 +1867,11 @@ export declare const McpServerSpec: z.ZodObject<{
         kind: z.ZodLiteral<"stdio">;
         command: z.ZodString;
         args: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        envRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        envRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"http">;
         url: z.ZodString;
-        headerRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
         principalHeader: z.ZodOptional<z.ZodString>;
         assertionHeader: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>], "kind">;
@@ -1905,11 +1902,11 @@ export declare const McpConfig: z.ZodObject<{
             kind: z.ZodLiteral<"stdio">;
             command: z.ZodString;
             args: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            envRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            envRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
         }, z.core.$strip>, z.ZodObject<{
             kind: z.ZodLiteral<"http">;
             url: z.ZodString;
-            headerRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
             principalHeader: z.ZodOptional<z.ZodString>;
             assertionHeader: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>], "kind">;
@@ -1934,6 +1931,32 @@ export declare const McpConfig: z.ZodObject<{
     }, z.core.$strip>>>;
 }, z.core.$strip>;
 export type McpConfig = z.infer<typeof McpConfig>;
+/** 一个常驻出站 A2A 对端。 */
+export declare const A2aPeerSpec: z.ZodObject<{
+    name: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+    url: z.ZodString;
+    cardUrl: z.ZodOptional<z.ZodString>;
+    headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
+    principalHeader: z.ZodOptional<z.ZodString>;
+    allowSkills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    scenarios: z.ZodPrefault<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type A2aPeerSpec = z.infer<typeof A2aPeerSpec>;
+/** `a2a` 域:常驻出站 A2A 对端名册。空 / 缺席 = 不拨任何对端。对端名唯一(重名拒,同 mcp)。 */
+export declare const A2aConfig: z.ZodObject<{
+    peers: z.ZodPrefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+        url: z.ZodString;
+        cardUrl: z.ZodOptional<z.ZodString>;
+        headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
+        principalHeader: z.ZodOptional<z.ZodString>;
+        allowSkills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        scenarios: z.ZodPrefault<z.ZodArray<z.ZodString>>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type A2aConfig = z.infer<typeof A2aConfig>;
 /** A plugin/marketplace ORIGIN string: **https only**(contract freeze [ref] tightening-① /
  *  [1366]①,0.10.23 单真源修:此前这条规则只落在 web UI 层的表单校验,API 直写仍放行任意形——
  *  同一条规则两处真源,API 这处敞了 8 天)。`ssh:`/`scp 形`/`git:`/`file:`/裸 `http:`/`owner/repo`
@@ -2509,11 +2532,11 @@ export declare const DOMAIN_SCHEMAS: {
                 kind: z.ZodLiteral<"stdio">;
                 command: z.ZodString;
                 args: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                envRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                envRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
             }, z.core.$strip>, z.ZodObject<{
                 kind: z.ZodLiteral<"http">;
                 url: z.ZodString;
-                headerRefs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
                 principalHeader: z.ZodOptional<z.ZodString>;
                 assertionHeader: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>], "kind">;
@@ -2677,17 +2700,9 @@ export declare const DOMAIN_SCHEMAS: {
             runtime: z.ZodObject<{
                 execution: z.ZodOptional<z.ZodObject<{
                     lane: z.ZodOptional<z.ZodNever>;
-                    lanes: z.ZodArray<z.ZodEnum<{
-                        host: "host";
-                        e2b: "e2b";
-                        k8s: "k8s";
-                        ssh: "ssh";
-                        adb: "adb";
-                        "local-docker": "local-docker";
-                        device: "device";
-                    }>>;
+                    lanes: z.ZodPreprocess<z.ZodPipe<z.ZodUnknown, z.ZodTransform<("none" | "host" | "e2b" | "k8s" | "ssh" | "adb" | "local-docker" | "device")[], unknown>>, unknown>;
                     coords: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
-                    secretRefs: z.ZodPrefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    secretRefs: z.ZodPrefault<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
                 }, z.core.$strip>>;
                 store: z.ZodOptional<z.ZodObject<{
                     backend: z.ZodEnum<{
@@ -2741,7 +2756,7 @@ export declare const DOMAIN_SCHEMAS: {
                 tidbPasswordEnv: z.ZodOptional<z.ZodNever>;
             }, z.core.$strip>;
             env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-            secretEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            secretEnv: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
             recreateNonce: z.ZodOptional<z.ZodString>;
             lifecycle: z.ZodOptional<z.ZodObject<{
                 kind: z.ZodDefault<z.ZodEnum<{
@@ -3083,6 +3098,18 @@ export declare const DOMAIN_SCHEMAS: {
         runStaleSec: z.ZodOptional<z.ZodNumber>;
         toolResultTtlSec: z.ZodOptional<z.ZodNumber>;
     }, z.core.$loose>;
+    readonly a2a: z.ZodObject<{
+        peers: z.ZodPrefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
+            url: z.ZodString;
+            cardUrl: z.ZodOptional<z.ZodString>;
+            headerRefs: z.ZodOptional<z.ZodPreprocess<z.ZodRecord<z.ZodString, z.ZodString>, unknown>>;
+            principalHeader: z.ZodOptional<z.ZodString>;
+            allowSkills: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            scenarios: z.ZodPrefault<z.ZodArray<z.ZodString>>;
+            enabled: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
 };
 export type DomainName = keyof typeof DOMAIN_SCHEMAS;
 export type DomainConfig = {
@@ -3130,6 +3157,8 @@ export interface EffectiveConfig {
     /** cost/限流族的热更新发布位(0.19.0,消费方 #322 批1)。域缺席 ⇒ `{}`(每一键都 ABSENT =
      *  web-admin 不管 ⇒ 消费方回 env 底);11.0.0 起五个限额键的唯一位。 */
     limits: LimitsConfig;
+    /** 常驻出站 A2A 对端名册(18.0.0)。域缺席 ⇒ `{ peers: [] }`(缺席 ≡ 空表:不拨任何对端);header 值只以 env-NAME 引用出现,读方从自己的环境取值。 */
+    a2a: A2aConfig;
 }
 /** One provenance source in a key's resolution trail. Two orthogonal axes: the TOC file LAYER, or the TOB
  *  PRINCIPAL dimension. `applied:false` + `reason` mark a source whose attempt was REJECTED by the monotone