@sema-agent/settings-schema 7.0.0 → 8.0.0

package/dist/types.js

@@ -20,7 +20,7 @@ import { MAX_EXTRA_BODY_DEPTH } from "./hash.js"; // reconcile the extraBody dep
 import { DispatchPolicy } from "./fleet.js"; // WorkerSpec.fleet.dispatch (scheduling framework D3)
 import { carriesUserinfo, percentLayers } from "./secret-scan.js"; // package-private normalization + the userinfo judgement (not in the barrel)
 import { EXECUTION_LANES, EXECUTION_LANE_WORDS, MEMORY_ENGINE_BACKENDS, SESSION_BACKENDS, STORE_BACKENDS } from "./execution-lanes.js"; // 7.0.0 M-R2: the lane / store vocabulary (one exported table)
-import { LANE_ENV_OWNER, laneEnvSeat, laneRowOf } from "./execution-lane-index.js"; // package-private indexes derived from that table (not in the barrel)
+import { LANE_ENV_OWNER, MIGRATION_SIGNPOST, isMigratableEnvKey, laneEnvSeat, laneRowOf } from "./execution-lane-index.js"; // package-private indexes derived from that table (not in the barrel)
 // COARSE, best-effort literal-secret SHAPE detector (NOT exhaustive — the real boundary is the env-NAME schema
 // on structured fields). Rejected in free-form value fields (worker `env`, model `extraBody`), URL components,
 // AND as an env-NAME value (an AWS key id is a valid env-NAME charset yet is a secret VALUE, not a NAME). Case-
@@ -1575,6 +1575,15 @@ const RESERVED_ENV_FIELD = Object.freeze({
 /** 结构化 WorkerSpec 字段已经产出的 env 名 —— 通用 `env` / `secretEnv` 逃生口**不许**设它们(用专属字段)。由
  *  `RESERVED_ENV_FIELD`(名 → 唯一写位)的键派生;增删理由见那张表的头注。 */
 export const RESERVED_WORKER_ENV = new Set(Object.keys(RESERVED_ENV_FIELD));
+/**
+ * 保留名被 `env` / `secretEnv` 逃生口设置时的拒因:点名键 + 它的唯一写位。句尾恒是「set it via <字段>」(下游按它抽归属字段,不动)。
+ * **迁移指路只有一条规则(7.0.1)**:这个键「旧形 ⇒ 迁移能搬」({@link isMigratableEnvKey},与迁移自己识别的键集同一只谓词)就在键名后
+ * 带 {@link MIGRATION_SIGNPOST};搬不了的保留名(`PORT` / `MODEL_*` / `MYSQL_*` …)不带 —— 指一条跑了也没用的命令比不指更糟。
+ */
+function reservedKeyMessage(slot, key) {
+    const signpost = isMigratableEnvKey(key) ? ` (${MIGRATION_SIGNPOST})` : "";
+    return `${slot} cannot set reserved key "${key}"${signpost} — set it via ${RESERVED_ENV_FIELD[key]}`;
+}
 // ── 7.0.0 M-R2:`runtime.execution` / `runtime.store` 两个结构块 ─────────────────────────────────────────────
 // 词表只有一个正本(`execution-lanes.ts` 的导出表):本包写闸(`WorkerSpec.safeParse`)、中心渲染器、引擎起服三处读同一张表。
 // 拒因都在 zod issue 里(`path` 指到要改的字段、`message` 带出路)—— schema 本身是唯一判据,不另导出拒因函数。
@@ -1692,7 +1701,7 @@ function retiredWorkerFieldIssues(raw, ctx) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 path: [parent, key],
-                message: `${parent}.${key} was removed in 7.0.0 (now ${now}) — run the one-time migration before reading this document: migrateWorkersDomain(doc) ahead of parseDomain, or \`settings-schema migrate-workers <file>\``,
+                message: `${parent}.${key} was removed in 7.0.0 (now ${now}) — ${MIGRATION_SIGNPOST}`,
             });
         }
     }
@@ -1798,7 +1807,7 @@ const WorkerSpecObject = z.object({
         .superRefine((rec, ctx) => {
         for (const [k, v] of Object.entries(rec)) {
             if (RESERVED_WORKER_ENV.has(k))
-                ctx.addIssue({ code: "custom", message: `env cannot set reserved key "${k}" — set it via ${RESERVED_ENV_FIELD[k]}` });
+                ctx.addIssue({ code: "custom", message: reservedKeyMessage("env", k) });
             // 0.1.32: NO name exemption — a PUBLIC key is allowed because SECRET_LITERAL_RE now only flags PRIVATE keys
             // (root fix), so a literal private key / token in env (ANY name, incl `*_PUBKEY`) is still rejected.
             if (containsSecretToken(v))
@@ -1817,7 +1826,7 @@ const WorkerSpecObject = z.object({
         .superRefine((rec, ctx) => {
         for (const k of Object.keys(rec))
             if (RESERVED_WORKER_ENV.has(k))
-                ctx.addIssue({ code: "custom", message: `secretEnv cannot set reserved key "${k}" — set it via ${RESERVED_ENV_FIELD[k]}` });
+                ctx.addIssue({ code: "custom", message: reservedKeyMessage("secretEnv", k) });
     })
         .optional(),
     /** Opaque recreate trigger (hash-INCLUDED): bump it to force the reconciler to recreate the worker — e.g. to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/settings-schema",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "Sema settings schema — pure config contract (zod domains + effective-config + roster resolution + ref-integrity + remoteExec) shared by sema-registry, sema-server, and the TOC desktop/CLI. One source of truth. (Renamed at 1.0.0 from @sema-agent/registry-core — name and docs only, no behavior change; note the range moves 0.19.0 -> 1.0.0, so a dependency must become ^1.0.0. The old names @sema-agent/registry-core <=0.19.0 and @sema-ai/registry-core remain published, frozen, for migration.)",
   "type": "module",
   "license": "BUSL-1.1",
@@ -131,6 +131,7 @@
     "drift:cc": "node scripts/extract-cc-hook-events.mjs",
     "conformance:bless": "node scripts/gen-conformance.mjs",
     "conformance:historical": "node scripts/conformance-historical.mjs",
+    "api:surface": "node scripts/api-surface.mjs",
     "prepare": "npm run build",
     "prepublishOnly": "npm run build && npm run test",
     "publish:npm": "npm publish --access public --@sema-agent:registry=https://registry.npmjs.org/ --\"//registry.npmjs.org/:_authToken=${NPM_TOKEN}\""