@sema-agent/settings-schema 6.0.0 → 6.2.0

package/dist/types.d.ts

@@ -16,6 +16,12 @@
  * `ENV_NAME` schema (regex) on every `*Env` field — a pasted secret value is rejected, not just discouraged.
  */
 import { z } from "zod";
+/** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
+ *  of that shape: {@link SECRET_LITERAL_RE} is composed from it (anchored, as one of its branches), and
+ *  `redactSecrets` (config-fns) tests it ANYWHERE in a string. It carries spaces, so the token-splitting detector
+ *  {@link containsSecretToken} only sees it at the very start of a string; a PEM behind a newline or a `key: ` prefix
+ *  slipped past (S-712 codex review [high]). Public keys / certificates never match (see above). */
+export declare const PRIVATE_KEY_PEM_HEADER: RegExp;
 export declare const SECRET_LITERAL_RE: RegExp;
 export declare const ENV_NAME: z.ZodEffects<z.ZodString, string, string>;
 /** A NUL byte in a string the consumer feeds to spawn()/fs is a FAIL-OPEN config: it validates+persists here
@@ -416,14 +422,14 @@ export declare const TierBindings: z.ZodObject<{
     flash: z.ZodOptional<z.ZodString>;
     lite: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    ultra?: string | undefined;
     max?: string | undefined;
+    ultra?: string | undefined;
     pro?: string | undefined;
     flash?: string | undefined;
     lite?: string | undefined;
 }, {
-    ultra?: string | undefined;
     max?: string | undefined;
+    ultra?: string | undefined;
     pro?: string | undefined;
     flash?: string | undefined;
     lite?: string | undefined;
@@ -440,14 +446,14 @@ export declare const TierGroup: z.ZodObject<{
         flash: z.ZodOptional<z.ZodString>;
         lite: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
     }, {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -456,8 +462,8 @@ export declare const TierGroup: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     tiers: {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -467,8 +473,8 @@ export declare const TierGroup: z.ZodObject<{
     name: string;
     notes?: string | undefined;
     tiers?: {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -758,14 +764,14 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
             flash: z.ZodOptional<z.ZodString>;
             lite: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
         }, {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -774,8 +780,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -785,8 +791,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -840,8 +846,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     tierGroups: {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -900,8 +906,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -954,8 +960,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     tierGroups: {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -1014,8 +1020,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -7312,13 +7318,13 @@ export declare const McpTransport: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<
      *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
     principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
-    kind: "http";
     url: string;
+    kind: "http";
     headerRefs?: Record<string, string> | undefined;
     principalHeader?: string | undefined;
 }, {
-    kind: "http";
     url: string;
+    kind: "http";
     headerRefs?: Record<string, string> | undefined;
     principalHeader?: string | undefined;
 }>]>;
@@ -7361,13 +7367,13 @@ export declare const McpServerSpec: z.ZodObject<{
          *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
         principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     }, "strip", z.ZodTypeAny, {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     }, {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     }>]>;
@@ -7431,8 +7437,8 @@ export declare const McpServerSpec: z.ZodObject<{
         args?: string[] | undefined;
         envRefs?: Record<string, string> | undefined;
     } | {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     };
@@ -7450,8 +7456,8 @@ export declare const McpServerSpec: z.ZodObject<{
         args?: string[] | undefined;
         envRefs?: Record<string, string> | undefined;
     } | {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     };
@@ -7496,13 +7502,13 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
              *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
             principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         }, "strip", z.ZodTypeAny, {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         }, {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         }>]>;
@@ -7566,8 +7572,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7585,8 +7591,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7612,8 +7618,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7633,8 +7639,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7660,8 +7666,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7681,8 +7687,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7720,11 +7726,11 @@ export declare const PluginSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<
     kind: z.ZodLiteral<"git">;
     url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
 }, "strip", z.ZodTypeAny, {
-    kind: "git";
     url: string;
-}, {
     kind: "git";
+}, {
     url: string;
+    kind: "git";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"marketplace">;
     marketplace: z.ZodString;
@@ -7746,11 +7752,11 @@ export declare const PluginSpec: z.ZodObject<{
         kind: z.ZodLiteral<"git">;
         url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
     }, "strip", z.ZodTypeAny, {
-        kind: "git";
         url: string;
-    }, {
         kind: "git";
+    }, {
         url: string;
+        kind: "git";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"marketplace">;
         marketplace: z.ZodString;
@@ -7775,8 +7781,8 @@ export declare const PluginSpec: z.ZodObject<{
     name: string;
     enabled: boolean;
     source: {
-        kind: "git";
         url: string;
+        kind: "git";
     } | {
         kind: "marketplace";
         marketplace: string;
@@ -7788,8 +7794,8 @@ export declare const PluginSpec: z.ZodObject<{
 }, {
     name: string;
     source: {
-        kind: "git";
         url: string;
+        kind: "git";
     } | {
         kind: "marketplace";
         marketplace: string;
@@ -7809,11 +7815,11 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
             kind: z.ZodLiteral<"git">;
             url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
         }, "strip", z.ZodTypeAny, {
-            kind: "git";
             url: string;
-        }, {
             kind: "git";
+        }, {
             url: string;
+            kind: "git";
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"marketplace">;
             marketplace: z.ZodString;
@@ -7838,8 +7844,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7851,8 +7857,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     }, {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7868,8 +7874,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7883,8 +7889,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     plugins?: {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7900,8 +7906,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7915,8 +7921,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     plugins?: {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -9674,14 +9680,14 @@ export declare const DOMAIN_SCHEMAS: {
                 flash: z.ZodOptional<z.ZodString>;
                 lite: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
             }, {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9690,8 +9696,8 @@ export declare const DOMAIN_SCHEMAS: {
         }, "strip", z.ZodTypeAny, {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9701,8 +9707,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9756,8 +9762,8 @@ export declare const DOMAIN_SCHEMAS: {
         tierGroups: {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9816,8 +9822,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9870,8 +9876,8 @@ export declare const DOMAIN_SCHEMAS: {
         tierGroups: {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9930,8 +9936,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -10199,13 +10205,13 @@ export declare const DOMAIN_SCHEMAS: {
                  *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
                 principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
             }, "strip", z.ZodTypeAny, {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             }, {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             }>]>;
@@ -10269,8 +10275,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10288,8 +10294,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10315,8 +10321,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10336,8 +10342,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10363,8 +10369,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10384,8 +10390,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10408,11 +10414,11 @@ export declare const DOMAIN_SCHEMAS: {
                 kind: z.ZodLiteral<"git">;
                 url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
             }, "strip", z.ZodTypeAny, {
-                kind: "git";
                 url: string;
-            }, {
                 kind: "git";
+            }, {
                 url: string;
+                kind: "git";
             }>, z.ZodObject<{
                 kind: z.ZodLiteral<"marketplace">;
                 marketplace: z.ZodString;
@@ -10437,8 +10443,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10450,8 +10456,8 @@ export declare const DOMAIN_SCHEMAS: {
         }, {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10467,8 +10473,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10482,8 +10488,8 @@ export declare const DOMAIN_SCHEMAS: {
         plugins?: {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10499,8 +10505,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10514,8 +10520,8 @@ export declare const DOMAIN_SCHEMAS: {
         plugins?: {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;

package/dist/types.js

@@ -26,7 +26,13 @@ import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (sched
 // — a PUBLIC KEY / CERTIFICATE is NOT a secret and must NOT be flagged (PRINCIPAL_JWT_PUBKEYS lives in env).
 // 0.1.32: this is the root fix for the public-key false-positive — replaces the 0.1.31 name-based exemption,
 // which review flagged as a bypass (a private key misnamed `*_PUBKEY` skipped scanning entirely).
-export const SECRET_LITERAL_RE = /^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\s|basic\s|eyJ[A-Za-z0-9_-]{10,}\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|-----BEGIN[A-Z0-9 ]*PRIVATE KEY)/i;
+/** A private-key PEM header (`-----BEGIN [RSA |EC |OPENSSH |ENCRYPTED ]PRIVATE KEY`), unanchored — the ONE definition
+ *  of that shape: {@link SECRET_LITERAL_RE} is composed from it (anchored, as one of its branches), and
+ *  `redactSecrets` (config-fns) tests it ANYWHERE in a string. It carries spaces, so the token-splitting detector
+ *  {@link containsSecretToken} only sees it at the very start of a string; a PEM behind a newline or a `key: ` prefix
+ *  slipped past (S-712 codex review [high]). Public keys / certificates never match (see above). */
+export const PRIVATE_KEY_PEM_HEADER = /-----BEGIN[A-Z0-9 ]*PRIVATE KEY/i;
+export const SECRET_LITERAL_RE = new RegExp(`^(sk-|gh[opus]_|github_pat_|xox[baprse]-|xapp-|bearer\\s|basic\\s|eyJ[A-Za-z0-9_-]{10,}\\.|AKIA[0-9A-Z]{12,}|AIza[0-9A-Za-z_-]{20,}|${PRIVATE_KEY_PEM_HEADER.source})`, "i");
 // 所有 *Env / *tokenEnv 字段的值是宿主机 env 变量的 NAME（不是值）。合法 env 变量名 + 拒绝 secret 形状的值（AKIA…
 // 这类是合法 env-NAME 字符集却是密钥）—— "只存 env-NAME、绝不存 secret 值" 由 SCHEMA 保证。Round-5。
 export const ENV_NAME = z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "6.0.0",
+  "version": "6.2.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
@@ -128,7 +128,7 @@
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\""
   },
   "devDependencies": {
-    "@sema-agent/core": "^2.1.0",
+    "@sema-agent/core": "7.33.1",
     "@types/node": "^22.10.0",
     "esbuild": "^0.21.5",
     "typescript": "^5.7.0",