@sema-agent/settings-schema 6.1.0 → 6.2.0

package/CHANGELOG.md

@@ -6,6 +6,122 @@
 > `@sema-agent/registry-core`(更早还曾是 `@sema-ai/registry-core`)。本档 `0.19.0` 以下各节里的
 > 包名是**历史记录**,如实保留不追改。
 
+## 6.2.0 — 2026-09-26 — additive:`ModelRefusalsWire` / `ModelRefusalsSignal` 一处定义 + `readModelRefusals`(S-768;条目两码 / 组拒四码闭集是读方返回型,wire 开放串、读方收窄,心跳字段形坏降缺席 —— 诊断键不打路由)· `isDisclosableIdentity` / `isReportableRefusalName` 导出 · devDep core 2.1.0 → 7.33.1 精确(漂移门 ② 改读运行期 `MODEL_ROLES`,删陈旧豁免)· README / llms-full zod 两实例真话(server / CLI 已在 zod 4;归一 = 7.0.0,S-777)
+
+> 本节全 additive(新导出 / 新可选键),零删零改名。判档口径见 README「发版纪律」:新键 / 新导出 = minor。心跳上的新键
+> 形坏只降为缺席,6.1.0 收下的任何心跳体 6.2.0 照收(见「谁受伤」③)。
+
+### S-768 · 模型拒因信号:闭集码真源 + wire 形 + 一只读口两出口(additive)
+
+`src/fleet.ts`(与 `RestartSignal` 同节)新导出:
+
+- **成因码闭集**(`as const` 元组 + `z.enum` + 型):`MODEL_ENTRY_REFUSAL_CODES = ["config.model_no_brain",
+  "config.model_entry_invalid"]` / `ModelEntryRefusalCode`;`MODEL_PLANE_REFUSAL_CODES = ["config.default_model_missing",
+  "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"]` /
+  `ModelPlaneRefusalCode`。词**逐字**取自引擎(server @ 2aa56fe7:`src/model-entry-refusal.ts:45-56` —— 条目两码 = S-704 逐条判据
+  的两个成因,`config.default_model_missing` = S-705 模型面组拒,`config.model_refused_name_minted` = S-712 不变量组拒;
+  `src/model-route-endpoint.ts:40,42` —— 不变量 `model-route-endpoint` 的两码,模型面 stage 在 `src/config-center/apply-effective.ts:664-665`
+  判);红先文件里的期望字面是抄来的,不从实现派生。**组拒码镜像引擎组拒码表的整族**(发版方裁 1):不按「今天热路径上可达」
+  挑 —— 可达性会变,表不变(`config.gateway_fallback_without_primary` 今天在热路径上实际不可达,同一 env 下 boot 恒先拒,照收)。
+  **真源上移**:此前闭集只活在引擎一侧,中心要穷举就得手抄(C-R75);上移后两边 import 同一份。**谁在加码时编译红**(对抗腿
+  F8 订正首稿「双侧编译红」):按码穷举 `switch` 的读方(中心)必红;生产方只有持**以码为键**的表(对码穷举 `switch` /
+  `Record<码, …>`)才红 —— 只拿 `satisfies` 把自己的码值约束成本包闭集的子集,证明的是「子集」不是「相等」,加码照绿。引擎提货
+  时要留一张以码为键的表。
+- **两个面,刻意分开**(发版方裁 3:失败方向 = 语义方向 —— 这是**诊断**键,集外词 / 形坏绝不能把一台健康实例打成不可路由):
+  · **`ModelRefusalsWire`**(zod)= wire 上走的、心跳存行里存的:`{ entries: record(非空名 → 非空串), plane?: 非空串 }` + 空信号
+  refine —— 只判**形律**,码是开放串;本包版本不认识的码照过(对这个读方是「没说」,存行照存,中心升级本包后同一行读出新码)。
+  · **`ModelRefusalsSignal`**(纯型)= `{ entries: Record<名, ModelEntryRefusalCode>, plane?: ModelPlaneRefusalCode }` =
+  `readModelRefusals` 的返回型;两只 `z.enum` 仍导出,仍是加码时读方的编译红源。
+- **值只码**:引擎侧拒因事实里的上游 `id` / `provider` / 坏字段键 / 拒因句都不上 wire —— `entry_invalid` 行是没人验过的行,
+  `id` / `provider` 可能是坏行原样;句子是散文不是契约;中心要的就是「哪个名、什么码」。
+- **`plane` 单码**(发版方裁 2):一个候选恰一个组拒判决 —— 引擎按固定序判模型面不变量、首个不成立即拒;Runner 换装步的拒
+  没有码,不在本信号射程。**`entries` 与 `plane` 描述同一份最新候选目录**(发版方裁 6):`plane` 在场时即那份被拒的候选
+  (逐条拒因通常就是它没有缺省的原因);组拒期间引擎自己的拒因表不换代、选择通道仍按上一代拒因执行,所以此时 `entries` 读作
+  「这份目录为什么落不了地」,不是「此刻点这些名会被拒」。
+- **在场律同 `RestartSignal`**:在场 ⇔ 至少一条**可报**的拒(名能出门的条目拒,或一个组拒);空信号(`entries` 空且无 `plane`)
+  被形律拒 ——「没有」只有一种拼法(键缺席);键内「没有条目拒」拼作 `entries: {}`(键必在)—— 每层各一种拼法。
+- **`readModelRefusals(body)`** = **一只读口两出口**:传 `/health` 体或已 parse 的公告都行(只读 `modelRefusals` 键)。先按
+  `ModelRefusalsWire` 判形(形不合 / 缺席 / 非对象 / 访问器抛 ⇒ `undefined`,不抛),再按两只闭集收窄:集外 entry 丢、集外
+  `plane` 丢,丢到空 ⇒ `undefined`(与「没说」同渲)。**只答键、不判版本**(发版方裁 4)。与 `readRestartSignal` 共用一只私有
+  读口 `readHealthSignal(health, key, schema)`(`readRestartSignal` 行为逐字不变,6.1.0 的 11 格照绿)。
+- **`InstanceAnnouncement.modelRefusals = ModelRefusalsWire.optional().catch(undefined)`**(`InstanceRegistration` 随 extend 同带):
+  集外码照过;形坏(空信号 / 非串值 / `plane` 数组 …)**降为缺席**,不拒整条心跳(与 `restart` 不同 —— 那一键的形仍门住整行;
+  发版方采纳);键因此可能以 `undefined` 值在场。中心若要给形坏留痕,自己对请求原体的该字段 `ModelRefusalsWire.safeParse`
+  (parse 之前),读法口不替它记。每拍整行重报 ⇒ 不带键的一拍 = 不再有可报的拒,存行整替不合并。**缺席读法 = 读版本,不读
+  缺席**(发版方裁 4,不加能力位,与 server 读 core 新键的约定同形):更早的引擎从不发此键,缺席 = **不可知**;读方看公告上已有的
+  `version`,≥ 首发此键的引擎版本(server 7.103.0,以 server 发布帖为准)才把缺席读成「没有可报的拒」。
+- `/health` 一侧 **`InstanceHealth` 形不动**(passthrough,`modelRefusals` 不入类型;类型化 = 宽读改严判 = major,与
+  `restart` 同一笔 7.0.0 欠账)—— `/health` 上的形律与收窄都由 `readModelRefusals` 执法。
+
+### S-768 · 名筛两只谓词:`isDisclosableIdentity`(B3,原私有改名导出)+ `isReportableRefusalName`(entries 键)(additive)
+
+`src/config-fns.ts` 私有 `isIdentityString(v): v is string` 改名导出为 `isDisclosableIdentity(v: string): boolean`(发版方裁 5:
+留,server 阶段 ② import 它、不复制);判据不变(`redactSecrets(v) === v`;非字符串答 false、不抛 —— 验修轮 N5)。它是「用户写的
+身份串(条目 `name` / `id`)能否原样出门」的**唯一**判据 —— S-712 被丢条目身份今天就由它执法(秘密形 ⇒ 按无名处置:不带,而不是
+打码)。**此前引擎一侧没有这只谓词**(它读的是身份键的缺席;它自己的另一只脱敏器是另一套探测):不导出,引擎只能手抄一行判据或
+改用另一只探测器 —— 同一条律两个判官。签名**刻意不是**类型谓词(对抗腿 F5:谓词形 `v is string` 对一些字符串答 false,调用方
+否定分支里一个 `string` 被收窄成 `never`,tsc 实红);「是不是字符串」由调用点判(`readEntryIdentity` 两处 `typeof … === "string" &&`)。
+
+- **`isReportableRefusalName(name: string): boolean`**(验修轮 N1)=「一个条目名能不能当 `entries` 的键」的**唯一**判据,
+  引擎铸键前只调这一只:① wire schema **自己载得住**这个键(就地拿 `ModelRefusalsWire` 判:空串不过键规则;`__proto__` 被 zod
+  的 record 静默丢掉 —— JSON 解析出的自有属性也丢 —— 载不住;不写名单)∧ ② `isDisclosableIdentity`。首稿把 `__proto__` 写成
+  文字里的第二条律、而 `isDisclosableIdentity("__proto__")` 答 true(验修轮实测)—— 收成一只。住在 `config-fns.ts`:`fleet.ts`
+  被 `types.ts` 引,它再引 `config-fns.ts` 会成环(三种加载序实测无环)。`__proto__` 的丢法另有 characterization 钉。
+- **schema 刻意不复判秘密**:wire 的键只判非空,不跑本谓词 —— 秘密探测器是会变宽的启发式,执法在铸点(引擎);中心展示前可以
+  再过一次同一只谓词(丢,不拒)。
+
+### 仓内两件(发版方追加,不影响发布物的契约面)
+
+- **开发期引擎钉 `@sema-agent/core` ^2.1.0(实装 2.1.0)→ `7.33.1` 精确**(devDependencies,与 server 同钉):上游漂移门 ②③
+  (`test/upstream-drift.test.ts`)与安全合并表词表门(`test/safety-merge-spec.test.ts` 读 `SAFETY_AXIS_VOCABULARY`)此前在对 core 2.1.0
+  (npmjs 发布于 2026-07-29,其后 core 已走到 7.33.1)做「漂移」检查 —— 门是瞎的。**提货当时读数**:门 ③ `PROJECT_ID_REGEX` 三格与安全合并表两格在 7.33.1
+  上绿;**门 ② 两格红** —— 原文「ModelRole 声明里有不是字符串字面量的成分(`typeofMODEL_ROLES[number]`)」:core 7.33.1
+  `dist/core/model-seat.d.ts:42` 把 `ModelRole` 写成 `(typeof MODEL_ROLES)[number]`,门按设计 fail-loud(「上游改了导出形,修这条
+  查找,别删门」)。**发版方裁后落地(阶段 ①c)**:门 ② 的上游词表改读 core **运行期** `MODEL_ROLES`(dev-only import,与门 ③ /
+  安全合并表门同形),删 `.d.ts` 字面量解析腿及其专属变异格(读实现不读文本,C-R24);查找改后门按设计报陈旧豁免 ——
+  「引擎 ModelRole:登记表里有已经不存在的差 —— 陈旧豁免,删掉那几行: expected [ 'consolidate' ] to deeply equal []」(门 ② 两格
+  1 红 / 1 绿)—— 删 `consolidate: ours-only` 登记行(core 7.33.1 已含该词,原理由句自己写明「随开发期引擎升版复核本行」)后 2 / 2 绿;
+  `advisor: upstream-only` 留。core 7.33.1 `MODEL_ROLES` = default / summarize / subagent / team / synthesize / advisor / verifier /
+  classifier / consolidate。
+- **README「zod 单实例」订正为两实例现状**:server / CLI 在 zod 4、config-center 产品仍在 zod 3,zod-4 宿主树里本包的 zod 3 是
+  嵌套的第二实例;跨缝传纯数据、不混两实例的 schema 对象。升 zod 4 归一是本包的一个 major(S-777);本版不动依赖与 peer 段。
+
+### 三问 · 消费方 · 红先 · 复审
+
+- **谁需要** = web-admin KL-35(实例页逐台列「这台拒了哪些条目、为什么」,[8445])+ server 7.103.0(S-768 阶段 ②:一只取值口
+  两出口 —— `/health.modelRefusals` 与心跳 `modelRefusals`;两张码表改 import 本包闭集(并留一张以码为键的表);铸键前调
+  `isReportableRefusalName`,日志 / 拒因句里要不要写出一个名字问 `isDisclosableIdentity`;组拒码当数据带出 —— 引擎的组拒记录
+  只存不变量 id,`model-route-endpoint` 一个 id 两个码,按判决那刻的码)。
+- **谁受伤** = 无(新导出 + 新可选键;`InstanceHealth` 一字不动;`readRestartSignal` / 被丢条目身份行为不变;旧中心收到带
+  `modelRefusals` 的心跳:`InstanceAnnouncement` 是默认 strip 的 `z.object`,键被剥,行为同今)。**风险如实登记**:
+  ① ~~心跳里 `modelRefusals` 形不合 ⇒ 整条心跳 400~~ —— 发版方裁 3 后**不再成立**:形坏降为缺席、集外码照过(对抗腿按 web-admin
+  心跳路由读法实测的「连拒两窗后实例掉出可路由集」这一形,本版已无从触发);② **版本错位**:引擎日后发一个新码(本包下一 minor
+  尾插),装着旧版本包的中心**照收心跳**,只是新码在它那里「没说」,直到中心升级本包;部署序仍建议中心先提货,但不再是补偿
+  手段;③ 判档:6.1.0 收下(剥掉)的任何带 `modelRefusals` 的心跳体,6.2.0 照收 —— 对抗腿 F4 的判档张力(strip 对象加类型化
+  可选键 = 宽读改严判)随之消解。
+- **补偿** = 无旋钮(additive,无需补偿)。
+- **消费方** = server(阶段 ②,如上);web-admin(收键、存 wire 形、经 `readModelRefusals` 渲;缺席按引擎 `version` 分「没有可报的
+  拒 / 不可知」;按码穷举 `switch`;能力显式表态制 @点名);cli n/a;core n/a。
+- **红先**:`test/model-refusals-6.2.0.test.ts` 对 6.1.0 源 **18 红 / 4 绿**(绿 = additive 不带键控制格、restart / ready 负控、
+  `InstanceHealth` 形不动、类型面格(`expectTypeOf`,由 tsc 执法、运行期空跑)),tsc 36 错全在本文件;改源后 22 / 22、tsc 0。
+  B3 两格对 `0d4227d` **2 红** → 24 / 24。复审修复与阶段 ①b 裁定的红先见下(文件现 36 格)。
+- **对抗复审**(独立 opus 腿一轮,只读、不喂结论、沙箱逐条复现;codex 当日额度墙未投):9 条。**真修**:F5(谓词签名,
+  tsc 红先 2 错 → 0)· F8(「双侧编译红」订正)· F2 的「秘密形名下的拒 ⇒ 整键缺席」(在场律改写为「可报的拒」)· F9(公开 d.ts
+  里指向私有函数的 JSDoc、B3 组标题里本仓验不了的断言)· F3 附带的 `__proto__` 键(登记边界 + characterization 钉)。**发版方裁
+  后落地**:F1(组拒码收整族,裁 1)· F3(wire 开放串 + 读方收窄 + 心跳上形坏降为缺席,裁 3)· F2 其余(读版本、不加能力位,
+  裁 4)· F4(随裁 3 消解)。**驳 / 不改**:F6(读口里按谓词丢秘密形键:执法留在铸点)· F7(两层「没有」各一种拼法;`ModelRefusalsWire`
+  是 `ZodEffects`、无 `.shape` / `.extend`,与 `RestartSignal` 的 `ZodObject` 形不同 —— 登记)· F9 命名(`readModelRefusals` 与
+  `readRestartSignal` 不对称:名按派车书;与引擎现有同名常量 / 型撞名:引擎提货时换成 import,阶段 ② 的事)。
+- **验修轮**(同一 opus 腿,只核 `10f4d85..0450c94`,不开新检测面):F5 / F8 修复成立,相对 `10f4d85` 无运行期回归;新 6 条全处置:
+  **N1**(`__proto__` 成了文字里的第二条律 ⇒ 收成一只 `isReportableRefusalName`)· **N5**(`isDisclosableIdentity` 非字符串由答
+  false 变抛 TypeError ⇒ 回到答 false)· **N2 / N3**(组拒期间 `entries` 的读法;无码组拒 —— 裁 1 后已无此类)补进接入档 ·
+  **N4 / N6**(旧签名句、llms-full「= 无拒」、格数)订正。两格红先:对 `0450c94` **2 红 / 26 绿** → 28 / 28。
+- **阶段 ①b · 发版方六裁落地**(每裁一格红先):裁 1 组拒码四码(`0d3a48d` 1 红 → 绿)· 裁 2 `plane` 单码 + 注(`4f924fb` 1 红 →
+  绿)· 裁 3 wire 开放串 + 读方收窄(`c36745c` 12 红 / tsc 3 错 → 绿;本体两格 = 集外码心跳 `success`、收窄读数,其余 10 格是
+  形律格改指 `ModelRefusalsWire`)· 裁 3 附 心跳上形坏降为缺席(`5289ad9` 3 红 → 绿)· 裁 4 读版本不读缺席(`1014997` 1 红 → 绿,
+  另一格「读口不判版本」是控制格,生来绿)· 裁 5 `isDisclosableIdentity` 留(无改动,既有格照绿)· 裁 6 同一份候选目录(`a53ab22`
+  1 红 → 绿)。阶段 ①b 的改动本身未再过复审(复审终止律:一轮 + 一次验修已用完)。
+
 ## 6.1.0 — 2026-09-25 — 四件 additive:`entry-dropped` 身份(S-712)· 中心凭证信封 + 三态判别器(S-698)· `RestartSignal` 一处定义(S-741)· 中心凭证两键名 + 二选一判官(S-742);`redactSecrets` 私钥 PEM 串内任意位置且判在替换前(6.0.0 起三面既有盲点顺带关)
 
 > 本节四件全 additive(新可选键 / 新导出 / 新文件),零删零改名;版号与节标题由发版方写。判档口径见下方「发版纪律」:

package/README.md

@@ -35,9 +35,18 @@ server (the workers), and the client (desktop/CLI) seams. No two copies of the s
   (≤`0.19.0` 发在旧名 `@sema-agent/registry-core` 下,冻结)。
 
 The package is **pure**: zero `next`/`react`/server imports, zero DB drivers. Its only runtime dependency is
-`zod` (a `dependency` pinned `^3.24.0` — the same range the host repos (config-center 产品 / `sema-server` / CLI) use, so
-package managers dedup to a **single shared zod instance**, keeping cross-instance schema validation / `instanceof`
-sound). `npm ls --prod` therefore shows only `zod`. Node built-ins only (`node:crypto`, `node:fs`).
+`zod` (a `dependency` pinned `^3.24.0`, also declared as a `peerDependency` with the same range). `npm ls --prod`
+therefore shows only `zod`. Node built-ins only (`node:crypto`, `node:fs`).
+
+> **zod instances today: two, not one** (corrected in 6.2.0 — this section used to promise a single shared instance).
+> The range was chosen so every host would dedup to one zod, but the hosts have since moved apart: `sema-server` and the
+> CLI depend on zod 4 (`^4.x`), the config-center product (`sema-web-admin`) is still on zod 3. In a zod-4 host the
+> package manager installs this package's own zod 3 NESTED under it — the server tree today has zod 4 at the top level
+> and zod 3 at `node_modules/@sema-agent/settings-schema/node_modules/zod`. There, this package's schemas and the host's
+> are two zod instances: cross the seam with plain data (parse with the schemas / functions this package exports), and
+> never mix schema objects of the two instances (`instanceof ZodError`, composing a host schema with one of ours). Only
+> a zod-3 host (today the config-center product) still dedups to one instance. Moving this package to zod 4 is a major
+> of its own (S-777); 6.2.0 does not touch the dependency or peer range.
 
 ## What's in it
 
@@ -176,7 +185,20 @@ sound). `npm ls --prod` therefore shows only `zod`. Node built-ins only (`node:c
   read stays lenient) and `readRestartSignal(health)` reads `health.restart` against the one shape (`undefined` on
   any mismatch, never throws). Presence is the signal (present ⇔ restart required; no `required` boolean inside).
   A heartbeat re-announces the full row, so one without `restart` means "no longer required". Typing
-  `InstanceHealth.restart` strictly is left for the next major.
+  `InstanceHealth.restart` strictly is left for the next major. **S-768** adds the model-refusals signal the same
+  way (one mint point, two exits, ONE reader): the wire face `ModelRefusalsWire` (`{ entries: { <catalog entry name>:
+  <code> }, plane?: <code> }` with codes as open strings — name → code is the whole wire, no upstream id / provider /
+  field keys / prose) rides the heartbeat as `InstanceAnnouncement.modelRefusals?` and /health (`InstanceHealth` again
+  unchanged); `readModelRefusals(body)` reads either exit and narrows to `ModelRefusalsSignal` — the codes are CLOSED
+  sets owned here, `MODEL_ENTRY_REFUSAL_CODES` (`config.model_no_brain`, `config.model_entry_invalid`) and
+  `MODEL_PLANE_REFUSAL_CODES` (`config.default_model_missing`, `config.model_refused_name_minted`,
+  `config.model_route_endpoint_missing`, `config.gateway_fallback_without_primary`), and a code this package version
+  does not know is dropped ("not said"). It is a diagnostic key, so its failure direction is "not said": an unknown
+  code or a shape violation on the heartbeat never fails the announcement (the key drops to absent). Present ⇔ at
+  least one reportable refusal; absence is read by the announced `version` — an engine that predates the key never
+  sends it (UNKNOWN, not "none"). A name that cannot ride out is left out by the engine, judged by ONE predicate,
+  `isReportableRefusalName` (the wire can carry the key — `__proto__` it cannot — and `isDisclosableIdentity`, the
+  secret-shape rule the dropped-entry identity on read warnings already uses).
 - **Declared-but-unvalidated keys** (`PARSE_TRANSPARENT_KEYS`, 2.0.0): the ONE registry of keys this package
   carries verbatim WITHOUT checking their shape, each row naming who does check it (the engine's ingest side,
   a consumer's projection, or the key's own guard). Today: `models[].extraBody`, `models[].compat` (1.10.0),

package/conformance/VERSION

@@ -1 +1 @@
-6.1.0
+6.2.0

package/dist/config-fns.d.ts

@@ -186,6 +186,23 @@ export interface DroppedEntry {
     error: unknown;
     identity?: DroppedEntryIdentity;
 }
+/** 身份串 —— 「一个用户写的身份串(条目的 `name` / `id`)能不能**原样**出门」的**唯一**判据:
+ *  {@link redactSecrets} 原样放行。入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些
+ *  字符串答 false,谓词形会让调用方的否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判
+ *  (运行期收到非字符串照答 false、不抛)。秘密形的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
+ *  与坐标段脱敏、`error` 文案脱敏({@link sanitizeZodError})**同一只**判据:告警面上任何一处用户写的串,要么过这一只
+ *  脱敏器出门,要么(可缺的身份)不出门。两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现:`Bearer` 后接 NBSP
+ *  或短令牌时,旧判据放行、坐标却打码)。
+ *  执法面(同一条律):被丢条目的身份({@link DroppedEntryIdentity},本文件铸);`ModelRefusalsWire` 的 `entries` 键
+ *  (经 {@link isReportableRefusalName},S-768);引擎自己的日志 / 拒因句里要不要写出一个名字,同样问这一只。 */
+export declare function isDisclosableIdentity(v: string): boolean;
+/** S-768 —— 「一个目录条目名能不能当 {@link ModelRefusalsWire} `entries` 的键」的**唯一**判据;引擎铸键前只调这一只,
+ *  不过 ⇒ 按无名处置(不进键、不计数)。两条律的合取,不手抄任何一条:
+ *   ① 这只 schema **自己载得住**这个键 —— 就地拿 schema 判(空串不过键规则;`__proto__` 这类名被 zod 的 record 静默丢掉,
+ *      载不住),不写名单;
+ *   ② {@link isDisclosableIdentity}(秘密形 ⇒ 不出门)。
+ *  非字符串 ⇒ false。住在本文件而不是 `./fleet`:`fleet.ts` 被 `types.ts` 引,它再引本文件会成环。 */
+export declare function isReportableRefusalName(name: string): boolean;
 /** 抢救造成的**下标位移表**:数组字段名 → 该字段压缩后每个位置的**原**下标(`kept[j]` = 压缩后第 j 条
  *  在原文档里的下标)。纯数据,无行为。
  *

package/dist/config-fns.js

@@ -16,6 +16,7 @@
 // zod is a VALUE import here (not just a type): {@link salvageEntries} introspects a domain schema to find
 // its entry collections. zod is this package's one runtime dependency, so this costs nothing new.
 import { z } from "zod";
+import { MODEL_ENTRY_REFUSAL_CODES, ModelRefusalsWire } from "./fleet.js";
 import { DOMAIN_SCHEMAS, GOVERNANCE_MIRROR_KEYS, HOSTS_ARRAY_MAX, HOST_NAME_MAX, InfraCostRates, LimitsConfig, PRIVATE_KEY_PEM_HEADER, SkillsManifestSchema, containsSecretToken } from "./types.js";
 /** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
  *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
@@ -184,10 +185,30 @@ const PLAIN_PATH_SEGMENT = /^(?!(?:0|[1-9]\d*)$)[^."\u0000-\u001f]+$/;
 export function formatConfigPath(p) {
     return p.map((seg) => (typeof seg === "number" ? String(seg) : PLAIN_PATH_SEGMENT.test(seg) ? seg : JSON.stringify(seg))).join(".");
 }
-/** 身份串:字符串,且 {@link redactSecrets} 原样放行 —— 与坐标段脱敏、`error` 文案脱敏({@link sanitizeZodError})
- *  **同一只**判据:告警面上任何一处用户写的串,要么过这一只脱敏器出门,要么(可缺的身份)不出门。两只判据
- *  会在同一条告警里给出两种答案(对抗轮 #2 真复现:`Bearer` 后接 NBSP 或短令牌时,旧判据放行、坐标却打码)。 */
-const isIdentityString = (v) => typeof v === "string" && redactSecrets(v) === v;
+/** 身份串 —— 「一个用户写的身份串(条目的 `name` / `id`)能不能**原样**出门」的**唯一**判据:
+ *  {@link redactSecrets} 原样放行。入参是 `string`、返回 `boolean`,**刻意不是**类型谓词(`v is string`):它对一些
+ *  字符串答 false,谓词形会让调用方的否定分支把一个 `string` 收窄成 `never`;「是不是字符串」由调用点自己判
+ *  (运行期收到非字符串照答 false、不抛)。秘密形的串按**无名**处置(不带,而不是打码:打过码的串不再是身份)。
+ *  与坐标段脱敏、`error` 文案脱敏({@link sanitizeZodError})**同一只**判据:告警面上任何一处用户写的串,要么过这一只
+ *  脱敏器出门,要么(可缺的身份)不出门。两只判据会在同一条告警里给出两种答案(对抗轮 #2 真复现:`Bearer` 后接 NBSP
+ *  或短令牌时,旧判据放行、坐标却打码)。
+ *  执法面(同一条律):被丢条目的身份({@link DroppedEntryIdentity},本文件铸);`ModelRefusalsWire` 的 `entries` 键
+ *  (经 {@link isReportableRefusalName},S-768);引擎自己的日志 / 拒因句里要不要写出一个名字,同样问这一只。 */
+export function isDisclosableIdentity(v) {
+    return typeof v === "string" && redactSecrets(v) === v; // 非字符串(JS / any 调用方)⇒ false,不抛(秘密轴 fail-closed)
+}
+/** S-768 —— 「一个目录条目名能不能当 {@link ModelRefusalsWire} `entries` 的键」的**唯一**判据;引擎铸键前只调这一只,
+ *  不过 ⇒ 按无名处置(不进键、不计数)。两条律的合取,不手抄任何一条:
+ *   ① 这只 schema **自己载得住**这个键 —— 就地拿 schema 判(空串不过键规则;`__proto__` 这类名被 zod 的 record 静默丢掉,
+ *      载不住),不写名单;
+ *   ② {@link isDisclosableIdentity}(秘密形 ⇒ 不出门)。
+ *  非字符串 ⇒ false。住在本文件而不是 `./fleet`:`fleet.ts` 被 `types.ts` 引,它再引本文件会成环。 */
+export function isReportableRefusalName(name) {
+    if (!isDisclosableIdentity(name))
+        return false;
+    const probe = ModelRefusalsWire.safeParse({ entries: { [name]: MODEL_ENTRY_REFUSAL_CODES[0] } });
+    return probe.success && Object.hasOwn(probe.data.entries, name);
+}
 /** 一条被丢条目原文的身份({@link DroppedEntryIdentity} 的**唯一**读法)。只看纯 JSON 对象的**自有数据
  *  属性**;任何反射/陷阱抛错 ⇒ 当作读不出(身份是诊断面的附件,绝不许把抢救拖下水)。 */
 function readEntryIdentity(entry) {
@@ -202,8 +223,8 @@ function readEntryIdentity(entry) {
         const id = own("id");
         const enabled = own("enabled");
         const identity = {
-            ...(isIdentityString(name) ? { name } : {}),
-            ...(isIdentityString(id) ? { id } : {}),
+            ...(typeof name === "string" && isDisclosableIdentity(name) ? { name } : {}),
+            ...(typeof id === "string" && isDisclosableIdentity(id) ? { id } : {}),
             ...(typeof enabled === "boolean" ? { enabled } : {}),
         };
         return Object.keys(identity).length > 0 ? identity : undefined;

package/dist/fleet.d.ts

@@ -81,6 +81,106 @@ export type RestartSignal = z.infer<typeof RestartSignal>;
  * Presence law: only `restart` counts; the top-level `restartRequired` boolean the server also ships is not read.
  */
 export declare function readRestartSignal(health: unknown): RestartSignal | undefined;
+/**
+ * The model-refusal cause codes (S-768) — CLOSED sets, owned HERE, never a hand-copied second list. Adding a code is
+ * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a center), and
+ * a producer only where it holds a table KEYED BY the code (an exhaustive `switch` over the code, or a
+ * `Record<ModelEntryRefusalCode, …>`) — a producer table that merely `satisfies` these codes as values proves a subset,
+ * not equality, and stays green.
+ *
+ *  - {@link MODEL_ENTRY_REFUSAL_CODES} — why ONE catalog entry is not served on this host (the other entries keep serving):
+ *    `config.model_no_brain` — the entry's provider rides a brain this host has not mounted;
+ *    `config.model_entry_invalid` — the entry does not match the `ModelEntry` shape (dropped by the read, or re-judged at
+ *    the engine's own second boundary).
+ *  - {@link MODEL_PLANE_REFUSAL_CODES} — why the model plane of the catalog the engine was handed was refused AS A GROUP
+ *    (the engine keeps serving the model plane it had). This set mirrors the engine's group-refusal code TABLE as a
+ *    whole family — never picked by which invariant is reachable on the hot path today (reachability moves, the table
+ *    does not):
+ *    `config.default_model_missing` — the candidate has no default model;
+ *    `config.model_refused_name_minted` — a refused entry's name would be re-minted onto another entry by the
+ *    tier / alias expansion (or the dropped-entry carrier cannot prove it would not be);
+ *    `config.model_route_endpoint_missing` — an openai-compatible route of the candidate resolves to no endpoint;
+ *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary.
+ *    Source (engine): the first two in `src/model-entry-refusal.ts`, the last two in `src/model-route-endpoint.ts:40,42`
+ *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`).
+ */
+export declare const MODEL_ENTRY_REFUSAL_CODES: readonly ["config.model_no_brain", "config.model_entry_invalid"];
+export declare const ModelEntryRefusalCode: z.ZodEnum<["config.model_no_brain", "config.model_entry_invalid"]>;
+export type ModelEntryRefusalCode = z.infer<typeof ModelEntryRefusalCode>;
+export declare const MODEL_PLANE_REFUSAL_CODES: readonly ["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"];
+export declare const ModelPlaneRefusalCode: z.ZodEnum<["config.default_model_missing", "config.model_refused_name_minted", "config.model_route_endpoint_missing", "config.gateway_fallback_without_primary"]>;
+export type ModelPlaneRefusalCode = z.infer<typeof ModelPlaneRefusalCode>;
+/**
+ * "This instance does not serve part (or all) of the model catalog it was handed" — the engine's OWN per-host verdict
+ * (S-768), defined ONCE for both exits that carry it: the fleet heartbeat ({@link InstanceAnnouncement}`.modelRefusals`)
+ * and GET /health (`modelRefusals`; {@link InstanceHealth} keeps carrying it untyped, as it does `restart`). One mint point,
+ * two exits, ONE reader for both: {@link readModelRefusals}.
+ *
+ * Two faces, split on purpose — the failure direction must match the meaning (this is a DIAGNOSTIC key; an unknown word
+ * in it must never make a healthy instance unroutable):
+ *  - {@link ModelRefusalsWire} — what rides the wire and what a stored heartbeat row holds: the SHAPE law only, codes as
+ *    open non-empty strings. A code this package version does not know passes (it is "not said" to this reader, and the
+ *    stored row still carries it for a reader that is upgraded later).
+ *  - {@link ModelRefusalsSignal} — what {@link readModelRefusals} returns: the wire narrowed to the closed sets above (an
+ *    unknown entry code or plane code is dropped; narrowed to nothing ⇒ `undefined`, rendered like "not said"). The
+ *    closed-set types stay the compile-time red source for readers when a code is added.
+ *
+ * The wire shape:
+ *  - `entries` — catalog entry NAME → its code. The value is ONLY the code, on purpose: the engine's refusal fact also
+ *    holds the upstream `id`, the `provider` word, the bad field keys and an operator sentence, and none of them rides
+ *    here — an `entry_invalid` row is by definition one nothing validated, so its `id` / `provider` may be whatever the
+ *    broken row held, and the sentence is prose, not contract. "Which name, which reason" is the whole wire. A name that
+ *    cannot ride out is treated as NAMELESS — the engine leaves it out of this map entirely (not keyed, not counted). The
+ *    ONE predicate is `isReportableRefusalName(name)` (main barrel): this schema can carry the key (non-empty; `__proto__`
+ *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (not secret-shaped — the rule the
+ *    dropped-entry identity on read warnings already uses). A producer calls it before keying; this schema deliberately
+ *    does not re-judge secrecy (see the 6.2.0 notes).
+ *  - `plane` — present ⇔ the model plane of the latest catalog the engine was handed was refused as a group (the engine
+ *    keeps serving the model plane it had); ONE code, never a list — one candidate has exactly one group verdict (the
+ *    engine judges the group invariants in a fixed order and stops at the first that fails; a refusal from the Runner
+ *    swap step carries no code and is outside this signal).
+ *  - `entries` and `plane` describe the same latest candidate catalog — the one the engine was handed last; with `plane`
+ *    present, that is the refused candidate (its per-entry verdicts are usually why it has no default). The engine does
+ *    not swap its own refusal table while the group stays refused (its selection channels still refuse by the previous
+ *    generation), so with `plane` present read `entries` as "why this catalog cannot land", not "what a pick is refused
+ *    right now".
+ *
+ * PRESENCE is the signal (same law as {@link RestartSignal}): present ⇔ at least one reportable refusal (an entry refusal
+ * under a name that rides out, or a group refusal). An empty signal (no entries and no `plane`) is refused by the shape
+ * law — "none" has exactly one spelling, the absent key. Inside, "no entry refusals" is spelled `entries: {}` (the key is
+ * required) — one spelling at each level.
+ */
+export declare const ModelRefusalsWire: z.ZodEffects<z.ZodObject<{
+    entries: z.ZodRecord<z.ZodString, z.ZodString>;
+    plane: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    entries: Record<string, string>;
+    plane?: string | undefined;
+}, {
+    entries: Record<string, string>;
+    plane?: string | undefined;
+}>, {
+    entries: Record<string, string>;
+    plane?: string | undefined;
+}, {
+    entries: Record<string, string>;
+    plane?: string | undefined;
+}>;
+export type ModelRefusalsWire = z.infer<typeof ModelRefusalsWire>;
+/** {@link ModelRefusalsWire} narrowed to the closed code sets — the return type of {@link readModelRefusals}. */
+export type ModelRefusalsSignal = {
+    entries: Record<string, ModelEntryRefusalCode>;
+    plane?: ModelPlaneRefusalCode;
+};
+/**
+ * The ONE reader of the model-refusals signal, for BOTH exits: pass a /health body or a parsed
+ * {@link InstanceAnnouncement} — it reads the `modelRefusals` key of whatever it is given. Shape mismatch, a missing key, a
+ * non-object body, even a throwing accessor ⇒ `undefined` — never throws. Then it narrows to the closed sets: an unknown
+ * entry code drops that entry, an unknown plane code drops `plane`; narrowed to nothing ⇒ `undefined`. So `undefined`
+ * means "nothing this reader can say"; whether that is "none" or "unknown" depends on whether the engine reports this key
+ * at all — it answers the key only and never judges the engine's version (see {@link InstanceAnnouncement}`.modelRefusals`).
+ */
+export declare function readModelRefusals(body: unknown): ModelRefusalsSignal | undefined;
 /** The `/health` self-description every orchestrator reads (shipped shape, server 1.96.0). Liveness and
  *  readiness are deliberately SPLIT: `status` stays ok while draining (the process is alive); routability is
  *  `isReadyForTraffic`. Unknown fields pass through — health is a self-description, not a closed record. */
@@ -150,6 +250,32 @@ export declare const InstanceAnnouncement: z.ZodObject<{
         version: number;
         since: number;
     }>>;
+    /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
+     *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
+     *  directly: the field is the open wire form, the reader narrows to the closed sets). Every heartbeat re-announces the
+     *  full row, so a later heartbeat WITHOUT it means "no reportable refusals any more" (the stored row is replaced, never
+     *  merged). Reading absence: from an engine that reports this key, absent = none reportable; an engine that predates
+     *  the key never sends it, so there absence is UNKNOWN, not "none" — tell the two apart by the announced `version`.
+     *  Failure direction = meaning direction (this is a diagnostic key): a code this package version does not know passes
+     *  (it is "not said" to the reader), and a value that breaks the {@link ModelRefusalsWire} shape law is dropped to
+     *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
+     *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
+    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        entries: z.ZodRecord<z.ZodString, z.ZodString>;
+        plane: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }>, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }>>>;
 }, "strip", z.ZodTypeAny, {
     draining: boolean;
     version: string;
@@ -163,6 +289,10 @@ export declare const InstanceAnnouncement: z.ZodObject<{
         version: number;
         since: number;
     } | undefined;
+    modelRefusals?: {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    } | undefined;
 }, {
     version: string;
     instanceId: string;
@@ -175,6 +305,7 @@ export declare const InstanceAnnouncement: z.ZodObject<{
         version: number;
         since: number;
     } | undefined;
+    modelRefusals?: unknown;
     heartbeatMs?: number | undefined;
 }>;
 export type InstanceAnnouncement = z.infer<typeof InstanceAnnouncement>;
@@ -223,6 +354,32 @@ export declare const InstanceRegistration: z.ZodObject<{
         version: number;
         since: number;
     }>>;
+    /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
+     *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
+     *  directly: the field is the open wire form, the reader narrows to the closed sets). Every heartbeat re-announces the
+     *  full row, so a later heartbeat WITHOUT it means "no reportable refusals any more" (the stored row is replaced, never
+     *  merged). Reading absence: from an engine that reports this key, absent = none reportable; an engine that predates
+     *  the key never sends it, so there absence is UNKNOWN, not "none" — tell the two apart by the announced `version`.
+     *  Failure direction = meaning direction (this is a diagnostic key): a code this package version does not know passes
+     *  (it is "not said" to the reader), and a value that breaks the {@link ModelRefusalsWire} shape law is dropped to
+     *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
+     *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
+    modelRefusals: z.ZodCatch<z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        entries: z.ZodRecord<z.ZodString, z.ZodString>;
+        plane: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }>, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }, {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    }>>>;
 } & {
     registeredMs: z.ZodNumber;
     lastSeenMs: z.ZodNumber;
@@ -242,6 +399,10 @@ export declare const InstanceRegistration: z.ZodObject<{
         version: number;
         since: number;
     } | undefined;
+    modelRefusals?: {
+        entries: Record<string, string>;
+        plane?: string | undefined;
+    } | undefined;
     observedReady?: boolean | undefined;
 }, {
     version: string;
@@ -257,6 +418,7 @@ export declare const InstanceRegistration: z.ZodObject<{
         version: number;
         since: number;
     } | undefined;
+    modelRefusals?: unknown;
     heartbeatMs?: number | undefined;
     observedReady?: boolean | undefined;
 }>;

package/dist/fleet.js

@@ -62,21 +62,129 @@ export const RestartSignal = z.object({
     since: z.number().int().nonnegative(),
 });
 /**
- * The /health exit of {@link RestartSignal}: `health.restart` judged against the one shape. Shape mismatch, a missing
- * key, a non-object body, even a throwing accessor ⇒ `undefined` — never throws (a probe must not die on one odd body).
- * Presence law: only `restart` counts; the top-level `restartRequired` boolean the server also ships is not read.
+ * The ONE /health reader behind every engine-owned signal ({@link readRestartSignal}, {@link readModelRefusals}): `health[key]`
+ * judged against that signal's one shape. Shape mismatch, a missing key, a non-object body, even a throwing accessor ⇒
+ * `undefined` — never throws (a probe must not die on one odd body).
  */
-export function readRestartSignal(health) {
+function readHealthSignal(health, key, schema) {
     try {
         if (health === null || typeof health !== "object" || Array.isArray(health))
             return undefined;
-        const parsed = RestartSignal.safeParse(health.restart);
+        const parsed = schema.safeParse(health[key]);
         return parsed.success ? parsed.data : undefined;
     }
     catch {
         return undefined;
     }
 }
+/**
+ * The /health exit of {@link RestartSignal}: `health.restart` judged against the one shape. Shape mismatch, a missing
+ * key, a non-object body, even a throwing accessor ⇒ `undefined` — never throws (a probe must not die on one odd body).
+ * Presence law: only `restart` counts; the top-level `restartRequired` boolean the server also ships is not read.
+ */
+export function readRestartSignal(health) {
+    return readHealthSignal(health, "restart", RestartSignal);
+}
+/**
+ * The model-refusal cause codes (S-768) — CLOSED sets, owned HERE, never a hand-copied second list. Adding a code is
+ * one edit in this file; who goes red at compile time: a reader that switches on the code exhaustively (a center), and
+ * a producer only where it holds a table KEYED BY the code (an exhaustive `switch` over the code, or a
+ * `Record<ModelEntryRefusalCode, …>`) — a producer table that merely `satisfies` these codes as values proves a subset,
+ * not equality, and stays green.
+ *
+ *  - {@link MODEL_ENTRY_REFUSAL_CODES} — why ONE catalog entry is not served on this host (the other entries keep serving):
+ *    `config.model_no_brain` — the entry's provider rides a brain this host has not mounted;
+ *    `config.model_entry_invalid` — the entry does not match the `ModelEntry` shape (dropped by the read, or re-judged at
+ *    the engine's own second boundary).
+ *  - {@link MODEL_PLANE_REFUSAL_CODES} — why the model plane of the catalog the engine was handed was refused AS A GROUP
+ *    (the engine keeps serving the model plane it had). This set mirrors the engine's group-refusal code TABLE as a
+ *    whole family — never picked by which invariant is reachable on the hot path today (reachability moves, the table
+ *    does not):
+ *    `config.default_model_missing` — the candidate has no default model;
+ *    `config.model_refused_name_minted` — a refused entry's name would be re-minted onto another entry by the
+ *    tier / alias expansion (or the dropped-entry carrier cannot prove it would not be);
+ *    `config.model_route_endpoint_missing` — an openai-compatible route of the candidate resolves to no endpoint;
+ *    `config.gateway_fallback_without_primary` — fallback gateways are declared without a primary.
+ *    Source (engine): the first two in `src/model-entry-refusal.ts`, the last two in `src/model-route-endpoint.ts:40,42`
+ *    (invariant `model-route-endpoint`, judged by the model-plane stage in `src/config-center/apply-effective.ts:664-665`).
+ */
+export const MODEL_ENTRY_REFUSAL_CODES = ["config.model_no_brain", "config.model_entry_invalid"];
+export const ModelEntryRefusalCode = z.enum(MODEL_ENTRY_REFUSAL_CODES);
+export const MODEL_PLANE_REFUSAL_CODES = [
+    "config.default_model_missing",
+    "config.model_refused_name_minted",
+    "config.model_route_endpoint_missing",
+    "config.gateway_fallback_without_primary",
+];
+export const ModelPlaneRefusalCode = z.enum(MODEL_PLANE_REFUSAL_CODES);
+/**
+ * "This instance does not serve part (or all) of the model catalog it was handed" — the engine's OWN per-host verdict
+ * (S-768), defined ONCE for both exits that carry it: the fleet heartbeat ({@link InstanceAnnouncement}`.modelRefusals`)
+ * and GET /health (`modelRefusals`; {@link InstanceHealth} keeps carrying it untyped, as it does `restart`). One mint point,
+ * two exits, ONE reader for both: {@link readModelRefusals}.
+ *
+ * Two faces, split on purpose — the failure direction must match the meaning (this is a DIAGNOSTIC key; an unknown word
+ * in it must never make a healthy instance unroutable):
+ *  - {@link ModelRefusalsWire} — what rides the wire and what a stored heartbeat row holds: the SHAPE law only, codes as
+ *    open non-empty strings. A code this package version does not know passes (it is "not said" to this reader, and the
+ *    stored row still carries it for a reader that is upgraded later).
+ *  - {@link ModelRefusalsSignal} — what {@link readModelRefusals} returns: the wire narrowed to the closed sets above (an
+ *    unknown entry code or plane code is dropped; narrowed to nothing ⇒ `undefined`, rendered like "not said"). The
+ *    closed-set types stay the compile-time red source for readers when a code is added.
+ *
+ * The wire shape:
+ *  - `entries` — catalog entry NAME → its code. The value is ONLY the code, on purpose: the engine's refusal fact also
+ *    holds the upstream `id`, the `provider` word, the bad field keys and an operator sentence, and none of them rides
+ *    here — an `entry_invalid` row is by definition one nothing validated, so its `id` / `provider` may be whatever the
+ *    broken row held, and the sentence is prose, not contract. "Which name, which reason" is the whole wire. A name that
+ *    cannot ride out is treated as NAMELESS — the engine leaves it out of this map entirely (not keyed, not counted). The
+ *    ONE predicate is `isReportableRefusalName(name)` (main barrel): this schema can carry the key (non-empty; `__proto__`
+ *    is silently dropped by the record, so it cannot) AND `isDisclosableIdentity(name)` (not secret-shaped — the rule the
+ *    dropped-entry identity on read warnings already uses). A producer calls it before keying; this schema deliberately
+ *    does not re-judge secrecy (see the 6.2.0 notes).
+ *  - `plane` — present ⇔ the model plane of the latest catalog the engine was handed was refused as a group (the engine
+ *    keeps serving the model plane it had); ONE code, never a list — one candidate has exactly one group verdict (the
+ *    engine judges the group invariants in a fixed order and stops at the first that fails; a refusal from the Runner
+ *    swap step carries no code and is outside this signal).
+ *  - `entries` and `plane` describe the same latest candidate catalog — the one the engine was handed last; with `plane`
+ *    present, that is the refused candidate (its per-entry verdicts are usually why it has no default). The engine does
+ *    not swap its own refusal table while the group stays refused (its selection channels still refuse by the previous
+ *    generation), so with `plane` present read `entries` as "why this catalog cannot land", not "what a pick is refused
+ *    right now".
+ *
+ * PRESENCE is the signal (same law as {@link RestartSignal}): present ⇔ at least one reportable refusal (an entry refusal
+ * under a name that rides out, or a group refusal). An empty signal (no entries and no `plane`) is refused by the shape
+ * law — "none" has exactly one spelling, the absent key. Inside, "no entry refusals" is spelled `entries: {}` (the key is
+ * required) — one spelling at each level.
+ */
+export const ModelRefusalsWire = z
+    .object({
+    entries: z.record(z.string().min(1), z.string().min(1)),
+    plane: z.string().min(1).optional(),
+})
+    .refine((s) => Object.keys(s.entries).length > 0 || s.plane !== undefined, {
+    message: "an empty model-refusals signal is not a signal — omit the key instead (absent ⇔ no reportable refusals)",
+});
+const isModelEntryRefusalCode = (c) => MODEL_ENTRY_REFUSAL_CODES.includes(c);
+const isModelPlaneRefusalCode = (c) => MODEL_PLANE_REFUSAL_CODES.includes(c);
+/**
+ * The ONE reader of the model-refusals signal, for BOTH exits: pass a /health body or a parsed
+ * {@link InstanceAnnouncement} — it reads the `modelRefusals` key of whatever it is given. Shape mismatch, a missing key, a
+ * non-object body, even a throwing accessor ⇒ `undefined` — never throws. Then it narrows to the closed sets: an unknown
+ * entry code drops that entry, an unknown plane code drops `plane`; narrowed to nothing ⇒ `undefined`. So `undefined`
+ * means "nothing this reader can say"; whether that is "none" or "unknown" depends on whether the engine reports this key
+ * at all — it answers the key only and never judges the engine's version (see {@link InstanceAnnouncement}`.modelRefusals`).
+ */
+export function readModelRefusals(body) {
+    const wire = readHealthSignal(body, "modelRefusals", ModelRefusalsWire);
+    if (wire === undefined)
+        return undefined;
+    const entries = Object.fromEntries(Object.entries(wire.entries).filter((e) => isModelEntryRefusalCode(e[1])));
+    const plane = wire.plane !== undefined && isModelPlaneRefusalCode(wire.plane) ? wire.plane : undefined;
+    if (Object.keys(entries).length === 0 && plane === undefined)
+        return undefined;
+    return plane === undefined ? { entries } : { entries, plane };
+}
 /** The `/health` self-description every orchestrator reads (shipped shape, server 1.96.0). Liveness and
  *  readiness are deliberately SPLIT: `status` stays ok while draining (the process is alive); routability is
  *  `isReadyForTraffic`. Unknown fields pass through — health is a self-description, not a closed record. */
@@ -93,6 +201,7 @@ export const InstanceHealth = z
     // UNTYPED on purpose — typing `restart` here would turn today's lenient read into a strict one (a /health body with
     // an odd `restart` would stop parsing), which is a MAJOR by this package's release rules. Read it with
     // {@link readRestartSignal}. Typing it on this schema is an item for the next major.
+    // S-768: `modelRefusals` rides the passthrough untyped for the same reason — read it with {@link readModelRefusals}.
 })
     .passthrough();
 /** Readiness = the routability predicate (k8s readiness probe, gateway health filter, shell seam switch). */
@@ -126,6 +235,17 @@ export const InstanceAnnouncement = z.object({
      *  Every heartbeat re-announces the full row, so a later heartbeat WITHOUT it means "no longer required" — the
      *  stored row ({@link InstanceRegistration}) is replaced, never merged. */
     restart: RestartSignal.optional(),
+    /** S-768: present ⇔ this instance has at least one reportable model refusal — the SAME {@link ModelRefusalsWire} /health
+     *  carries, minted by the same getter; read it with {@link readModelRefusals}`(announcement)` (never off this field
+     *  directly: the field is the open wire form, the reader narrows to the closed sets). Every heartbeat re-announces the
+     *  full row, so a later heartbeat WITHOUT it means "no reportable refusals any more" (the stored row is replaced, never
+     *  merged). Reading absence: from an engine that reports this key, absent = none reportable; an engine that predates
+     *  the key never sends it, so there absence is UNKNOWN, not "none" — tell the two apart by the announced `version`.
+     *  Failure direction = meaning direction (this is a diagnostic key): a code this package version does not know passes
+     *  (it is "not said" to the reader), and a value that breaks the {@link ModelRefusalsWire} shape law is dropped to
+     *  ABSENT (`.catch`) — it never fails the announcement, so it can never make a healthy instance unroutable (unlike
+     *  `restart`, whose shape still gates the row). The key may then be present with the value `undefined`. */
+    modelRefusals: ModelRefusalsWire.optional().catch(undefined),
 });
 /** Explicit goodbye (stop signal handler) — removes the row immediately instead of waiting out staleness. */
 export const InstanceDeregistration = z.object({

package/dist/types.d.ts

@@ -422,14 +422,14 @@ export declare const TierBindings: z.ZodObject<{
     flash: z.ZodOptional<z.ZodString>;
     lite: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    ultra?: string | undefined;
     max?: string | undefined;
+    ultra?: string | undefined;
     pro?: string | undefined;
     flash?: string | undefined;
     lite?: string | undefined;
 }, {
-    ultra?: string | undefined;
     max?: string | undefined;
+    ultra?: string | undefined;
     pro?: string | undefined;
     flash?: string | undefined;
     lite?: string | undefined;
@@ -446,14 +446,14 @@ export declare const TierGroup: z.ZodObject<{
         flash: z.ZodOptional<z.ZodString>;
         lite: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
     }, {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -462,8 +462,8 @@ export declare const TierGroup: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     tiers: {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -473,8 +473,8 @@ export declare const TierGroup: z.ZodObject<{
     name: string;
     notes?: string | undefined;
     tiers?: {
-        ultra?: string | undefined;
         max?: string | undefined;
+        ultra?: string | undefined;
         pro?: string | undefined;
         flash?: string | undefined;
         lite?: string | undefined;
@@ -764,14 +764,14 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
             flash: z.ZodOptional<z.ZodString>;
             lite: z.ZodOptional<z.ZodString>;
         }, "strip", z.ZodTypeAny, {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
         }, {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -780,8 +780,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -791,8 +791,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -846,8 +846,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     tierGroups: {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -906,8 +906,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -960,8 +960,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
     tierGroups: {
         name: string;
         tiers: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -1020,8 +1020,8 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         notes?: string | undefined;
         tiers?: {
-            ultra?: string | undefined;
             max?: string | undefined;
+            ultra?: string | undefined;
             pro?: string | undefined;
             flash?: string | undefined;
             lite?: string | undefined;
@@ -7318,13 +7318,13 @@ export declare const McpTransport: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<
      *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
     principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
 }, "strip", z.ZodTypeAny, {
-    kind: "http";
     url: string;
+    kind: "http";
     headerRefs?: Record<string, string> | undefined;
     principalHeader?: string | undefined;
 }, {
-    kind: "http";
     url: string;
+    kind: "http";
     headerRefs?: Record<string, string> | undefined;
     principalHeader?: string | undefined;
 }>]>;
@@ -7367,13 +7367,13 @@ export declare const McpServerSpec: z.ZodObject<{
          *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
         principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     }, "strip", z.ZodTypeAny, {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     }, {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     }>]>;
@@ -7437,8 +7437,8 @@ export declare const McpServerSpec: z.ZodObject<{
         args?: string[] | undefined;
         envRefs?: Record<string, string> | undefined;
     } | {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     };
@@ -7456,8 +7456,8 @@ export declare const McpServerSpec: z.ZodObject<{
         args?: string[] | undefined;
         envRefs?: Record<string, string> | undefined;
     } | {
-        kind: "http";
         url: string;
+        kind: "http";
         headerRefs?: Record<string, string> | undefined;
         principalHeader?: string | undefined;
     };
@@ -7502,13 +7502,13 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
              *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
             principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         }, "strip", z.ZodTypeAny, {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         }, {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         }>]>;
@@ -7572,8 +7572,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7591,8 +7591,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7618,8 +7618,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7639,8 +7639,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7666,8 +7666,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7687,8 +7687,8 @@ export declare const McpConfig: z.ZodEffects<z.ZodObject<{
             args?: string[] | undefined;
             envRefs?: Record<string, string> | undefined;
         } | {
-            kind: "http";
             url: string;
+            kind: "http";
             headerRefs?: Record<string, string> | undefined;
             principalHeader?: string | undefined;
         };
@@ -7726,11 +7726,11 @@ export declare const PluginSource: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<
     kind: z.ZodLiteral<"git">;
     url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
 }, "strip", z.ZodTypeAny, {
-    kind: "git";
     url: string;
-}, {
     kind: "git";
+}, {
     url: string;
+    kind: "git";
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"marketplace">;
     marketplace: z.ZodString;
@@ -7752,11 +7752,11 @@ export declare const PluginSpec: z.ZodObject<{
         kind: z.ZodLiteral<"git">;
         url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
     }, "strip", z.ZodTypeAny, {
-        kind: "git";
         url: string;
-    }, {
         kind: "git";
+    }, {
         url: string;
+        kind: "git";
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"marketplace">;
         marketplace: z.ZodString;
@@ -7781,8 +7781,8 @@ export declare const PluginSpec: z.ZodObject<{
     name: string;
     enabled: boolean;
     source: {
-        kind: "git";
         url: string;
+        kind: "git";
     } | {
         kind: "marketplace";
         marketplace: string;
@@ -7794,8 +7794,8 @@ export declare const PluginSpec: z.ZodObject<{
 }, {
     name: string;
     source: {
-        kind: "git";
         url: string;
+        kind: "git";
     } | {
         kind: "marketplace";
         marketplace: string;
@@ -7815,11 +7815,11 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
             kind: z.ZodLiteral<"git">;
             url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
         }, "strip", z.ZodTypeAny, {
-            kind: "git";
             url: string;
-        }, {
             kind: "git";
+        }, {
             url: string;
+            kind: "git";
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"marketplace">;
             marketplace: z.ZodString;
@@ -7844,8 +7844,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7857,8 +7857,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     }, {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7874,8 +7874,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7889,8 +7889,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     plugins?: {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7906,8 +7906,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
         name: string;
         enabled: boolean;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -7921,8 +7921,8 @@ export declare const PluginsConfig: z.ZodEffects<z.ZodObject<{
     plugins?: {
         name: string;
         source: {
-            kind: "git";
             url: string;
+            kind: "git";
         } | {
             kind: "marketplace";
             marketplace: string;
@@ -9680,14 +9680,14 @@ export declare const DOMAIN_SCHEMAS: {
                 flash: z.ZodOptional<z.ZodString>;
                 lite: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
             }, {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9696,8 +9696,8 @@ export declare const DOMAIN_SCHEMAS: {
         }, "strip", z.ZodTypeAny, {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9707,8 +9707,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9762,8 +9762,8 @@ export declare const DOMAIN_SCHEMAS: {
         tierGroups: {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9822,8 +9822,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9876,8 +9876,8 @@ export declare const DOMAIN_SCHEMAS: {
         tierGroups: {
             name: string;
             tiers: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -9936,8 +9936,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             notes?: string | undefined;
             tiers?: {
-                ultra?: string | undefined;
                 max?: string | undefined;
+                ultra?: string | undefined;
                 pro?: string | undefined;
                 flash?: string | undefined;
                 lite?: string | undefined;
@@ -10205,13 +10205,13 @@ export declare const DOMAIN_SCHEMAS: {
                  *  env-NAME ref (no secret). Empty → the worker forwards no principal (server sees an anonymous call). */
                 principalHeader: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
             }, "strip", z.ZodTypeAny, {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             }, {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             }>]>;
@@ -10275,8 +10275,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10294,8 +10294,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10321,8 +10321,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10342,8 +10342,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10369,8 +10369,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10390,8 +10390,8 @@ export declare const DOMAIN_SCHEMAS: {
                 args?: string[] | undefined;
                 envRefs?: Record<string, string> | undefined;
             } | {
-                kind: "http";
                 url: string;
+                kind: "http";
                 headerRefs?: Record<string, string> | undefined;
                 principalHeader?: string | undefined;
             };
@@ -10414,11 +10414,11 @@ export declare const DOMAIN_SCHEMAS: {
                 kind: z.ZodLiteral<"git">;
                 url: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>, string, string>;
             }, "strip", z.ZodTypeAny, {
-                kind: "git";
                 url: string;
-            }, {
                 kind: "git";
+            }, {
                 url: string;
+                kind: "git";
             }>, z.ZodObject<{
                 kind: z.ZodLiteral<"marketplace">;
                 marketplace: z.ZodString;
@@ -10443,8 +10443,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10456,8 +10456,8 @@ export declare const DOMAIN_SCHEMAS: {
         }, {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10473,8 +10473,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10488,8 +10488,8 @@ export declare const DOMAIN_SCHEMAS: {
         plugins?: {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10505,8 +10505,8 @@ export declare const DOMAIN_SCHEMAS: {
             name: string;
             enabled: boolean;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;
@@ -10520,8 +10520,8 @@ export declare const DOMAIN_SCHEMAS: {
         plugins?: {
             name: string;
             source: {
-                kind: "git";
                 url: string;
+                kind: "git";
             } | {
                 kind: "marketplace";
                 marketplace: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "6.1.0",
+  "version": "6.2.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
@@ -128,7 +128,7 @@
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\""
   },
   "devDependencies": {
-    "@sema-agent/core": "^2.1.0",
+    "@sema-agent/core": "7.33.1",
     "@types/node": "^22.10.0",
     "esbuild": "^0.21.5",
     "typescript": "^5.7.0",