@sema-agent/settings-schema 2.1.0 → 3.0.1

package/dist/types.d.ts

@@ -125,7 +125,7 @@ export interface ParseTransparentKey {
  * 五行同义散文 ×3,没有任何一处能回答「一共有几个这样的键、分别归谁校验」。那正是「修法给每个新键加一条
  * 特判」的形。这张表把那段理由收成一处:键在这里登记,JSDoc 只留一行指过来。
  *
- * 1.11.0 起整域 all-or-nothing 已按类改成逐条容错(坏条目逐条丢、同域其余条目存活),所以「设形判据
+ * 2.0.0 起整域 all-or-nothing 已按类改成逐条容错(坏条目逐条丢、同域其余条目存活),所以「设形判据
  * 会抹掉整域」这条**理由本身已经弱化** —— 但登记表要回答的问题没变:这些键的形归谁校验。新键要不要
  * 解析透明,按「本包是不是那张形表的属主」判,不再按「怕连坐」判。
  *
@@ -4812,7 +4812,7 @@ export type ExecutionPolicy = z.infer<typeof ExecutionPolicy>;
  *  center mint 端点)统一产 **uuidv7**。36 字符,天然满足 design/142 §1.2 段编码 64 上限。
  *  SINGLE-SOURCE 纪律:本常量是引擎那条正则的**自持镜像**(本仓不带引擎运行时依赖轴),对拍走 dev-only
  *  conformance(never a runtime import,EffectiveKey/coreTypes 先例)。
- *  1.11.0:drift-lock 已建(`test/upstream-drift.test.ts` ③)—— pattern 必须与引擎逐字相同,唯一成文的差是
+ *  2.0.0:drift-lock 已建(`test/upstream-drift.test.ts` ③)—— pattern 必须与引擎逐字相同,唯一成文的差是
  *  flags:本常量刻意**不带** `i`,因为它是登记簿 Record 的**键**,大小写不同的同一个 UUID 会变成两条登记行
  *  (同一 project 双注册);引擎侧是识别语义(读 marker / 找回身份),放宽合理。 */
 export declare const PROJECT_ID_REGEX: RegExp;

package/dist/types.js

@@ -301,7 +301,7 @@ export const SealedApiKey = z.object({
  * 五行同义散文 ×3,没有任何一处能回答「一共有几个这样的键、分别归谁校验」。那正是「修法给每个新键加一条
  * 特判」的形。这张表把那段理由收成一处:键在这里登记,JSDoc 只留一行指过来。
  *
- * 1.11.0 起整域 all-or-nothing 已按类改成逐条容错(坏条目逐条丢、同域其余条目存活),所以「设形判据
+ * 2.0.0 起整域 all-or-nothing 已按类改成逐条容错(坏条目逐条丢、同域其余条目存活),所以「设形判据
  * 会抹掉整域」这条**理由本身已经弱化** —— 但登记表要回答的问题没变:这些键的形归谁校验。新键要不要
  * 解析透明,按「本包是不是那张形表的属主」判,不再按「怕连坐」判。
  *
@@ -634,7 +634,7 @@ export const ScenarioEntry = z.object({
     // registry field would become an ambiguous precedence channel」):配置域 prompt 单入口=center
     // prompts binding(scenario 维度);引擎 API 层 TaskSpec.systemPrompt 保留(不同层,勿混)。
     // 现网无用户直删;z.object 非 strict ⇒ 存量数据带 prompt 被 strip,parse 不炸。
-    // 落日(1.11.0):本条是**纯墓碑**(零代码,靠 strip 生效),没有要删的兼容码;它留在这里的唯一作用
+    // 落日(2.0.0):本条是**纯墓碑**(零代码,靠 strip 生效),没有要删的兼容码;它留在这里的唯一作用
     // 是让下一个读到这段 schema 的人知道 `prompt` 这个名字曾经在这里、别再铸回来。0.19.0 起存量文档带
     // 它会被 `unknown-keys-dropped` 点名,所以「还有人在写它」是可观察的,不靠记忆。
     enabled: z.boolean().default(true),
@@ -1336,7 +1336,7 @@ export const ExecutionPolicy = z.object({
  *  center mint 端点)统一产 **uuidv7**。36 字符,天然满足 design/142 §1.2 段编码 64 上限。
  *  SINGLE-SOURCE 纪律:本常量是引擎那条正则的**自持镜像**(本仓不带引擎运行时依赖轴),对拍走 dev-only
  *  conformance(never a runtime import,EffectiveKey/coreTypes 先例)。
- *  1.11.0:drift-lock 已建(`test/upstream-drift.test.ts` ③)—— pattern 必须与引擎逐字相同,唯一成文的差是
+ *  2.0.0:drift-lock 已建(`test/upstream-drift.test.ts` ③)—— pattern 必须与引擎逐字相同,唯一成文的差是
  *  flags:本常量刻意**不带** `i`,因为它是登记簿 Record 的**键**,大小写不同的同一个 UUID 会变成两条登记行
  *  (同一 project 双注册);引擎侧是识别语义(读 marker / 找回身份),放宽合理。 */
 export const PROJECT_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "2.1.0",
+  "version": "3.0.1",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
@@ -51,6 +51,11 @@
       "types": "./dist/config-fns.d.ts",
       "default": "./dist/config-fns.js"
     },
+    "./package.json": "./package.json",
+    "./conformance": {
+      "types": "./dist/conformance/index.d.ts",
+      "default": "./dist/conformance/index.js"
+    },
     "./reader": {
       "types": "./dist/reader.d.ts",
       "default": "./dist/reader.js"
@@ -98,14 +103,11 @@
     "./api/scopes": {
       "types": "./dist/api/scopes.d.ts",
       "default": "./dist/api/scopes.js"
-    },
-    "./api/wire": {
-      "types": "./dist/api/wire.d.ts",
-      "default": "./dist/api/wire.js"
     }
   },
   "files": [
     "dist",
+    "conformance",
     "README.md",
     "CHANGELOG.md"
   ],

package/dist/api/wire.d.ts

@@ -1,60 +0,0 @@
-/**
- * `api/wire` — the ZERO-DEPENDENCY wire subset of the auth/scopes contracts (server AI 接手首车,
- * 2026-07-27,跨仓 candidate 落地):endpoint paths, protocol constants and PURE helper functions,
- * with **no zod import** — so a zero-runtime-dependency client (e.g. `@sema-agent/sdk/registry`) can
- * import these at RUNTIME instead of value-copying them behind a same-source anchor test.
- *
- * ⚠️ 拆分纪律:这里只放**纯**件(常量/纯函数/字面量类型)。zod schema 留在 `api/auth.ts` /
- * `api/scopes.ts`(它们 re-export 本文件 ⇒ 既有导入面字节兼容,谁都不用改)。给本文件加东西前
- * 自问:它 import 了任何东西吗?——答案必须是 no(test/wire-purity 打包门盯着)。
- */
-/** The five auth endpoints, relative to the registry origin. */
-export declare const AUTH_V1_PATHS: {
-    readonly deviceCode: "/api/v1/auth/device/code";
-    readonly deviceToken: "/api/v1/auth/device/token";
-    readonly deviceApprove: "/api/v1/auth/device/approve";
-    readonly tokenRefresh: "/api/v1/auth/token/refresh";
-    readonly logout: "/api/v1/auth/logout";
-};
-/** The RFC 8628 grant_type the device token endpoint requires. */
-export declare const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-/** Minimum seconds between token-endpoint polls (RFC 8628 `interval`); polling faster → `slow_down`. */
-export declare const DEVICE_POLL_INTERVAL_SECONDS = 5;
-/** Device-code handshake lifetime (seconds) — the user has 15 minutes to open /activate and approve. */
-export declare const DEVICE_CODE_TTL_SECONDS: number;
-/** Access-token (RS256 JWT) lifetime in seconds — 1h, re-minted via refresh. */
-export declare const ACCESS_TOKEN_TTL_SECONDS: number;
-/** Refresh-grant lifetime (seconds) — 30d SLIDING: every rotation opens a fresh 30d window. */
-export declare const REFRESH_TOKEN_TTL_SECONDS: number;
-/** Every error code the /api/v1/auth/* endpoints answer (HTTP 400 unless noted). */
-export declare const OAUTH_ERROR_CODES: readonly ["authorization_pending", "slow_down", "expired_token", "access_denied", "invalid_request", "unsupported_grant_type", "invalid_grant", "server_error"];
-export type OAuthErrorCode = (typeof OAUTH_ERROR_CODES)[number];
-/** Handshake states a consent-screen lookup can see. (`approved` rows vanish once exchanged/consumed.)
- *  `denied` is contract-reserved for an explicit deny button (pairs with the `access_denied` poll error);
- *  the shipped M1 store carries pending|approved only — adding deny later is implementation, not schema. */
-export declare const DEVICE_AUTH_STATUSES: readonly ["pending", "approved", "denied"];
-export type DeviceAuthStatus = (typeof DEVICE_AUTH_STATUSES)[number];
-/**
- * Canonicalize a human-typed user code to the wire shape "XXXX-XXXX": uppercase, dashes/spaces optional.
- * null = not a plausible code (wrong length/charset after stripping separators). Same normalization the
- * server applies — run it client-side for instant feedback.
- */
-export declare function normalizeUserCode(input: unknown): string | null;
-/**
- * The RFC 8628 §3.5 poll-loop step: what interval to poll with next, and whether to keep going.
- * - authorization_pending → keep polling at the current interval
- * - slow_down             → keep polling, interval + 5s (the RFC-mandated increment)
- * - anything else         → stop (expired_token/access_denied = terminal; invalid_* = client bug)
- */
-export declare function nextPollInterval(currentIntervalSeconds: number, error: OAuthErrorCode): {
-    continue: boolean;
-    intervalSeconds: number;
-};
-export declare const SCOPES_V1_PATHS: {
-    /** GET (list) + POST (create). */
-    readonly scopes: "/api/v1/scopes";
-    /** POST — mint a new access token bound to another scope. */
-    readonly authScope: "/api/v1/auth/scope";
-};
-/** The JWT claim carrying the token's active scope. OPTIONAL — absent means GLOBAL_SCOPE (tokenScopeOf). */
-export declare const SCOPE_CLAIM = "scope";

package/dist/api/wire.js

@@ -1,89 +0,0 @@
-/**
- * `api/wire` — the ZERO-DEPENDENCY wire subset of the auth/scopes contracts (server AI 接手首车,
- * 2026-07-27,跨仓 candidate 落地):endpoint paths, protocol constants and PURE helper functions,
- * with **no zod import** — so a zero-runtime-dependency client (e.g. `@sema-agent/sdk/registry`) can
- * import these at RUNTIME instead of value-copying them behind a same-source anchor test.
- *
- * ⚠️ 拆分纪律:这里只放**纯**件(常量/纯函数/字面量类型)。zod schema 留在 `api/auth.ts` /
- * `api/scopes.ts`(它们 re-export 本文件 ⇒ 既有导入面字节兼容,谁都不用改)。给本文件加东西前
- * 自问:它 import 了任何东西吗?——答案必须是 no(test/wire-purity 打包门盯着)。
- */
-// ── auth: endpoint paths + protocol constants(api/auth.ts 原件,shipped values 冻结)─────────────────
-/** The five auth endpoints, relative to the registry origin. */
-export const AUTH_V1_PATHS = {
-    deviceCode: "/api/v1/auth/device/code",
-    deviceToken: "/api/v1/auth/device/token",
-    deviceApprove: "/api/v1/auth/device/approve",
-    tokenRefresh: "/api/v1/auth/token/refresh",
-    logout: "/api/v1/auth/logout",
-};
-/** The RFC 8628 grant_type the device token endpoint requires. */
-export const DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
-/** Minimum seconds between token-endpoint polls (RFC 8628 `interval`); polling faster → `slow_down`. */
-export const DEVICE_POLL_INTERVAL_SECONDS = 5;
-/** Device-code handshake lifetime (seconds) — the user has 15 minutes to open /activate and approve. */
-export const DEVICE_CODE_TTL_SECONDS = 15 * 60;
-/** Access-token (RS256 JWT) lifetime in seconds — 1h, re-minted via refresh. */
-export const ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
-/** Refresh-grant lifetime (seconds) — 30d SLIDING: every rotation opens a fresh 30d window. */
-export const REFRESH_TOKEN_TTL_SECONDS = 30 * 24 * 60 * 60;
-/** Every error code the /api/v1/auth/* endpoints answer (HTTP 400 unless noted). */
-export const OAUTH_ERROR_CODES = [
-    /** device/token: the user has not approved (or denied) the handshake yet — keep polling. */
-    "authorization_pending",
-    /** device/token: polling faster than `interval` — RFC 8628 §3.5: ADD 5 seconds to the interval. */
-    "slow_down",
-    /** device/token: handshake expired, unknown, or already exchanged — restart the flow.
-     *  (Deliberately covers "never existed": the server does not disclose handshake existence.) */
-    "expired_token",
-    /** device/token: the user explicitly denied the handshake — stop polling, do not restart silently. */
-    "access_denied",
-    /** any endpoint: malformed body / missing required field / wrong content type. */
-    "invalid_request",
-    /** device/token: grant_type is not DEVICE_GRANT_TYPE. */
-    "unsupported_grant_type",
-    /** token/refresh + device/approve: unknown / expired / revoked / replayed token or code — no detail. */
-    "invalid_grant",
-    /** SSO not configured on the registry (HTTP 503) — a deployment problem, not a client one. */
-    "server_error",
-];
-/** Handshake states a consent-screen lookup can see. (`approved` rows vanish once exchanged/consumed.)
- *  `denied` is contract-reserved for an explicit deny button (pairs with the `access_denied` poll error);
- *  the shipped M1 store carries pending|approved only — adding deny later is implementation, not schema. */
-export const DEVICE_AUTH_STATUSES = ["pending", "approved", "denied"];
-// ── auth: pure client-side helpers(api/auth.ts 原件)────────────────────────────────────────────────────
-/**
- * Canonicalize a human-typed user code to the wire shape "XXXX-XXXX": uppercase, dashes/spaces optional.
- * null = not a plausible code (wrong length/charset after stripping separators). Same normalization the
- * server applies — run it client-side for instant feedback.
- */
-export function normalizeUserCode(input) {
-    if (typeof input !== "string")
-        return null;
-    const raw = input.toUpperCase().replace(/[\s-]/g, "");
-    if (!/^[A-Z0-9]{8}$/.test(raw))
-        return null;
-    return `${raw.slice(0, 4)}-${raw.slice(4)}`;
-}
-/**
- * The RFC 8628 §3.5 poll-loop step: what interval to poll with next, and whether to keep going.
- * - authorization_pending → keep polling at the current interval
- * - slow_down             → keep polling, interval + 5s (the RFC-mandated increment)
- * - anything else         → stop (expired_token/access_denied = terminal; invalid_* = client bug)
- */
-export function nextPollInterval(currentIntervalSeconds, error) {
-    if (error === "authorization_pending")
-        return { continue: true, intervalSeconds: currentIntervalSeconds };
-    if (error === "slow_down")
-        return { continue: true, intervalSeconds: currentIntervalSeconds + 5 };
-    return { continue: false, intervalSeconds: currentIntervalSeconds };
-}
-// ── scopes: endpoint paths + claim(api/scopes.ts 原件)─────────────────────────────────────────────────
-export const SCOPES_V1_PATHS = {
-    /** GET (list) + POST (create). */
-    scopes: "/api/v1/scopes",
-    /** POST — mint a new access token bound to another scope. */
-    authScope: "/api/v1/auth/scope",
-};
-/** The JWT claim carrying the token's active scope. OPTIONAL — absent means GLOBAL_SCOPE (tokenScopeOf). */
-export const SCOPE_CLAIM = "scope";