@sema-ai/registry-core 0.10.3 → 0.10.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +38 -0
  2. package/dist/types.d.ts +462 -5
  3. package/dist/types.d.ts.map +1 -1
  4. package/dist/types.js +73 -1
  5. package/dist/types.js.map +1 -1
  6. package/package.json +1 -1
package/dist/types.d.ts CHANGED
@@ -66,6 +66,36 @@ export declare const ModelCost: z.ZodObject<{
66
66
  cacheRead?: number | undefined;
67
67
  cacheWrite?: number | undefined;
68
68
  }>;
69
+ /** sealed-box 算法标识(v1 唯一取值)。z.literal 钉死:换算法=换值=显式契约演进,不许静默漂移。 */
70
+ export declare const SEALED_BOX_ALG: "libsodium-sealedbox-x25519";
71
+ /** base64 形状底线(标准字母表,可带 padding)。**只校验形状不校验内容**——center 是托管方不是消费方,
72
+ * 解密/解不开是执行侧运行时的事;这里只挡"根本不是 base64"的写入事故。 */
73
+ export declare const BASE64_SHAPE: RegExp;
74
+ /** 接入模型的 sealed-box 托管密文(默认模式「直接贴 key」的存储形态)。
75
+ * - `ciphertext`:crypto_box_seal(plaintextKey, executionPublicKey) 的 base64。sealed box 开销 48 字节,
76
+ * 真实 API key ≤ 几百字节;`.max(8192)` 只防 blob 滥用,不是格式承诺。
77
+ * - `publicKeyId`:加密时用的执行域公钥 id(指向 execution.publicKeys[].publicKeyId)——执行侧凭它选私钥;
78
+ * 轮换后旧密文仍带旧 id,可解性由执行侧留存的旧私钥决定。
79
+ * - **write-only 纪律(消费方约定)**:center 的 GET 面永不回 ciphertext 本体(只回 publicKeyId+设置
80
+ * 时间);密文字段绝不进任何日志。schema 层不执法读面,这是 API 层的契约义务。
81
+ * - **与 `apiKeyEnv` 的互斥语义**:见 ModelEntry.sealedApiKey JSDoc(两者都设 = sealed 优先)。 */
82
+ export declare const SealedApiKey: z.ZodObject<{
83
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
84
+ ciphertext: z.ZodString;
85
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
86
+ publicKeyId: z.ZodString;
87
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
88
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
89
+ }, "strip", z.ZodTypeAny, {
90
+ ciphertext: string;
91
+ publicKeyId: string;
92
+ alg: "libsodium-sealedbox-x25519";
93
+ }, {
94
+ ciphertext: string;
95
+ publicKeyId: string;
96
+ alg: "libsodium-sealedbox-x25519";
97
+ }>;
98
+ export type SealedApiKey = z.infer<typeof SealedApiKey>;
69
99
  export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
70
100
  /** Catalog key + `@name` mention handle (stable, url/word-safe), e.g. "qwen-72b". */
71
101
  name: z.ZodString;
@@ -79,8 +109,30 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
79
109
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
80
110
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
81
111
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
82
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
112
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
113
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
83
114
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
115
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
116
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
117
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
118
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
119
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
120
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
121
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
122
+ ciphertext: z.ZodString;
123
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
124
+ publicKeyId: z.ZodString;
125
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
126
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
127
+ }, "strip", z.ZodTypeAny, {
128
+ ciphertext: string;
129
+ publicKeyId: string;
130
+ alg: "libsodium-sealedbox-x25519";
131
+ }, {
132
+ ciphertext: string;
133
+ publicKeyId: string;
134
+ alg: "libsodium-sealedbox-x25519";
135
+ }>>;
84
136
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
85
137
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
86
138
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -125,6 +177,11 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
125
177
  enabled: boolean;
126
178
  baseUrl?: string | undefined;
127
179
  apiKeyEnv?: string | undefined;
180
+ sealedApiKey?: {
181
+ ciphertext: string;
182
+ publicKeyId: string;
183
+ alg: "libsodium-sealedbox-x25519";
184
+ } | undefined;
128
185
  contextWindow?: number | undefined;
129
186
  maxTokens?: number | undefined;
130
187
  cost?: {
@@ -142,6 +199,11 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
142
199
  api?: "openai-completions" | "anthropic-messages" | undefined;
143
200
  baseUrl?: string | undefined;
144
201
  apiKeyEnv?: string | undefined;
202
+ sealedApiKey?: {
203
+ ciphertext: string;
204
+ publicKeyId: string;
205
+ alg: "libsodium-sealedbox-x25519";
206
+ } | undefined;
145
207
  tier?: "cheap" | "standard" | "premium" | undefined;
146
208
  reasoning?: boolean | undefined;
147
209
  vision?: boolean | undefined;
@@ -169,6 +231,11 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
169
231
  enabled: boolean;
170
232
  baseUrl?: string | undefined;
171
233
  apiKeyEnv?: string | undefined;
234
+ sealedApiKey?: {
235
+ ciphertext: string;
236
+ publicKeyId: string;
237
+ alg: "libsodium-sealedbox-x25519";
238
+ } | undefined;
172
239
  contextWindow?: number | undefined;
173
240
  maxTokens?: number | undefined;
174
241
  cost?: {
@@ -186,6 +253,11 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
186
253
  api?: "openai-completions" | "anthropic-messages" | undefined;
187
254
  baseUrl?: string | undefined;
188
255
  apiKeyEnv?: string | undefined;
256
+ sealedApiKey?: {
257
+ ciphertext: string;
258
+ publicKeyId: string;
259
+ alg: "libsodium-sealedbox-x25519";
260
+ } | undefined;
189
261
  tier?: "cheap" | "standard" | "premium" | undefined;
190
262
  reasoning?: boolean | undefined;
191
263
  vision?: boolean | undefined;
@@ -323,8 +395,30 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
323
395
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
324
396
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
325
397
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
326
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
398
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
399
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
327
400
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
401
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
402
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
403
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
404
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
405
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
406
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
407
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
408
+ ciphertext: z.ZodString;
409
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
410
+ publicKeyId: z.ZodString;
411
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
412
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
413
+ }, "strip", z.ZodTypeAny, {
414
+ ciphertext: string;
415
+ publicKeyId: string;
416
+ alg: "libsodium-sealedbox-x25519";
417
+ }, {
418
+ ciphertext: string;
419
+ publicKeyId: string;
420
+ alg: "libsodium-sealedbox-x25519";
421
+ }>>;
328
422
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
329
423
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
330
424
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -369,6 +463,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
369
463
  enabled: boolean;
370
464
  baseUrl?: string | undefined;
371
465
  apiKeyEnv?: string | undefined;
466
+ sealedApiKey?: {
467
+ ciphertext: string;
468
+ publicKeyId: string;
469
+ alg: "libsodium-sealedbox-x25519";
470
+ } | undefined;
372
471
  contextWindow?: number | undefined;
373
472
  maxTokens?: number | undefined;
374
473
  cost?: {
@@ -386,6 +485,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
386
485
  api?: "openai-completions" | "anthropic-messages" | undefined;
387
486
  baseUrl?: string | undefined;
388
487
  apiKeyEnv?: string | undefined;
488
+ sealedApiKey?: {
489
+ ciphertext: string;
490
+ publicKeyId: string;
491
+ alg: "libsodium-sealedbox-x25519";
492
+ } | undefined;
389
493
  tier?: "cheap" | "standard" | "premium" | undefined;
390
494
  reasoning?: boolean | undefined;
391
495
  vision?: boolean | undefined;
@@ -413,6 +517,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
413
517
  enabled: boolean;
414
518
  baseUrl?: string | undefined;
415
519
  apiKeyEnv?: string | undefined;
520
+ sealedApiKey?: {
521
+ ciphertext: string;
522
+ publicKeyId: string;
523
+ alg: "libsodium-sealedbox-x25519";
524
+ } | undefined;
416
525
  contextWindow?: number | undefined;
417
526
  maxTokens?: number | undefined;
418
527
  cost?: {
@@ -430,6 +539,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
430
539
  api?: "openai-completions" | "anthropic-messages" | undefined;
431
540
  baseUrl?: string | undefined;
432
541
  apiKeyEnv?: string | undefined;
542
+ sealedApiKey?: {
543
+ ciphertext: string;
544
+ publicKeyId: string;
545
+ alg: "libsodium-sealedbox-x25519";
546
+ } | undefined;
433
547
  tier?: "cheap" | "standard" | "premium" | undefined;
434
548
  reasoning?: boolean | undefined;
435
549
  vision?: boolean | undefined;
@@ -542,6 +656,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
542
656
  enabled: boolean;
543
657
  baseUrl?: string | undefined;
544
658
  apiKeyEnv?: string | undefined;
659
+ sealedApiKey?: {
660
+ ciphertext: string;
661
+ publicKeyId: string;
662
+ alg: "libsodium-sealedbox-x25519";
663
+ } | undefined;
545
664
  contextWindow?: number | undefined;
546
665
  maxTokens?: number | undefined;
547
666
  cost?: {
@@ -583,6 +702,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
583
702
  api?: "openai-completions" | "anthropic-messages" | undefined;
584
703
  baseUrl?: string | undefined;
585
704
  apiKeyEnv?: string | undefined;
705
+ sealedApiKey?: {
706
+ ciphertext: string;
707
+ publicKeyId: string;
708
+ alg: "libsodium-sealedbox-x25519";
709
+ } | undefined;
586
710
  tier?: "cheap" | "standard" | "premium" | undefined;
587
711
  reasoning?: boolean | undefined;
588
712
  vision?: boolean | undefined;
@@ -634,6 +758,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
634
758
  enabled: boolean;
635
759
  baseUrl?: string | undefined;
636
760
  apiKeyEnv?: string | undefined;
761
+ sealedApiKey?: {
762
+ ciphertext: string;
763
+ publicKeyId: string;
764
+ alg: "libsodium-sealedbox-x25519";
765
+ } | undefined;
637
766
  contextWindow?: number | undefined;
638
767
  maxTokens?: number | undefined;
639
768
  cost?: {
@@ -675,6 +804,11 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
675
804
  api?: "openai-completions" | "anthropic-messages" | undefined;
676
805
  baseUrl?: string | undefined;
677
806
  apiKeyEnv?: string | undefined;
807
+ sealedApiKey?: {
808
+ ciphertext: string;
809
+ publicKeyId: string;
810
+ alg: "libsodium-sealedbox-x25519";
811
+ } | undefined;
678
812
  tier?: "cheap" | "standard" | "premium" | undefined;
679
813
  reasoning?: boolean | undefined;
680
814
  vision?: boolean | undefined;
@@ -1554,6 +1688,19 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1554
1688
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1555
1689
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1556
1690
  allowObservers: z.ZodOptional<z.ZodBoolean>;
1691
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
1692
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
1693
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
1694
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
1695
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
1696
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
1697
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
1698
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
1699
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
1700
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
1701
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
1702
+ * classifier leg itself. */
1703
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1557
1704
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1558
1705
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1559
1706
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -1566,6 +1713,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1566
1713
  allowWorkflows?: boolean | undefined;
1567
1714
  allowFork?: boolean | undefined;
1568
1715
  allowObservers?: boolean | undefined;
1716
+ autoMode?: boolean | undefined;
1569
1717
  allowUltracode?: boolean | undefined;
1570
1718
  forceDurableGate?: boolean | undefined;
1571
1719
  }, {
@@ -1574,6 +1722,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1574
1722
  allowWorkflows?: boolean | undefined;
1575
1723
  allowFork?: boolean | undefined;
1576
1724
  allowObservers?: boolean | undefined;
1725
+ autoMode?: boolean | undefined;
1577
1726
  allowUltracode?: boolean | undefined;
1578
1727
  forceDurableGate?: boolean | undefined;
1579
1728
  }>;
@@ -1680,6 +1829,19 @@ export declare const EntitlementTier: z.ZodObject<{
1680
1829
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1681
1830
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1682
1831
  allowObservers: z.ZodOptional<z.ZodBoolean>;
1832
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
1833
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
1834
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
1835
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
1836
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
1837
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
1838
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
1839
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
1840
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
1841
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
1842
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
1843
+ * classifier leg itself. */
1844
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1683
1845
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1684
1846
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1685
1847
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -1692,6 +1854,7 @@ export declare const EntitlementTier: z.ZodObject<{
1692
1854
  allowWorkflows?: boolean | undefined;
1693
1855
  allowFork?: boolean | undefined;
1694
1856
  allowObservers?: boolean | undefined;
1857
+ autoMode?: boolean | undefined;
1695
1858
  allowUltracode?: boolean | undefined;
1696
1859
  forceDurableGate?: boolean | undefined;
1697
1860
  }, {
@@ -1700,6 +1863,7 @@ export declare const EntitlementTier: z.ZodObject<{
1700
1863
  allowWorkflows?: boolean | undefined;
1701
1864
  allowFork?: boolean | undefined;
1702
1865
  allowObservers?: boolean | undefined;
1866
+ autoMode?: boolean | undefined;
1703
1867
  allowUltracode?: boolean | undefined;
1704
1868
  forceDurableGate?: boolean | undefined;
1705
1869
  }>>;
@@ -1735,6 +1899,7 @@ export declare const EntitlementTier: z.ZodObject<{
1735
1899
  allowWorkflows?: boolean | undefined;
1736
1900
  allowFork?: boolean | undefined;
1737
1901
  allowObservers?: boolean | undefined;
1902
+ autoMode?: boolean | undefined;
1738
1903
  allowUltracode?: boolean | undefined;
1739
1904
  forceDurableGate?: boolean | undefined;
1740
1905
  } | undefined;
@@ -1768,6 +1933,7 @@ export declare const EntitlementTier: z.ZodObject<{
1768
1933
  allowWorkflows?: boolean | undefined;
1769
1934
  allowFork?: boolean | undefined;
1770
1935
  allowObservers?: boolean | undefined;
1936
+ autoMode?: boolean | undefined;
1771
1937
  allowUltracode?: boolean | undefined;
1772
1938
  forceDurableGate?: boolean | undefined;
1773
1939
  } | undefined;
@@ -1989,6 +2155,19 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
1989
2155
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1990
2156
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1991
2157
  allowObservers: z.ZodOptional<z.ZodBoolean>;
2158
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
2159
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
2160
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
2161
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
2162
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
2163
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
2164
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
2165
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
2166
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
2167
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
2168
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
2169
+ * classifier leg itself. */
2170
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1992
2171
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1993
2172
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1994
2173
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -2001,6 +2180,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2001
2180
  allowWorkflows?: boolean | undefined;
2002
2181
  allowFork?: boolean | undefined;
2003
2182
  allowObservers?: boolean | undefined;
2183
+ autoMode?: boolean | undefined;
2004
2184
  allowUltracode?: boolean | undefined;
2005
2185
  forceDurableGate?: boolean | undefined;
2006
2186
  }, {
@@ -2009,6 +2189,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2009
2189
  allowWorkflows?: boolean | undefined;
2010
2190
  allowFork?: boolean | undefined;
2011
2191
  allowObservers?: boolean | undefined;
2192
+ autoMode?: boolean | undefined;
2012
2193
  allowUltracode?: boolean | undefined;
2013
2194
  forceDurableGate?: boolean | undefined;
2014
2195
  }>>;
@@ -2108,6 +2289,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2108
2289
  allowWorkflows?: boolean | undefined;
2109
2290
  allowFork?: boolean | undefined;
2110
2291
  allowObservers?: boolean | undefined;
2292
+ autoMode?: boolean | undefined;
2111
2293
  allowUltracode?: boolean | undefined;
2112
2294
  forceDurableGate?: boolean | undefined;
2113
2295
  } | undefined;
@@ -2138,6 +2320,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2138
2320
  allowWorkflows?: boolean | undefined;
2139
2321
  allowFork?: boolean | undefined;
2140
2322
  allowObservers?: boolean | undefined;
2323
+ autoMode?: boolean | undefined;
2141
2324
  allowUltracode?: boolean | undefined;
2142
2325
  forceDurableGate?: boolean | undefined;
2143
2326
  } | undefined;
@@ -2241,6 +2424,19 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2241
2424
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
2242
2425
  * `=== true` opt-in check is orthogonal to that merge polarity. */
2243
2426
  allowObservers: z.ZodOptional<z.ZodBoolean>;
2427
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
2428
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
2429
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
2430
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
2431
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
2432
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
2433
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
2434
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
2435
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
2436
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
2437
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
2438
+ * classifier leg itself. */
2439
+ autoMode: z.ZodOptional<z.ZodBoolean>;
2244
2440
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
2245
2441
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
2246
2442
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -2253,6 +2449,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2253
2449
  allowWorkflows?: boolean | undefined;
2254
2450
  allowFork?: boolean | undefined;
2255
2451
  allowObservers?: boolean | undefined;
2452
+ autoMode?: boolean | undefined;
2256
2453
  allowUltracode?: boolean | undefined;
2257
2454
  forceDurableGate?: boolean | undefined;
2258
2455
  }, {
@@ -2261,6 +2458,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2261
2458
  allowWorkflows?: boolean | undefined;
2262
2459
  allowFork?: boolean | undefined;
2263
2460
  allowObservers?: boolean | undefined;
2461
+ autoMode?: boolean | undefined;
2264
2462
  allowUltracode?: boolean | undefined;
2265
2463
  forceDurableGate?: boolean | undefined;
2266
2464
  }>>;
@@ -2296,6 +2494,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2296
2494
  allowWorkflows?: boolean | undefined;
2297
2495
  allowFork?: boolean | undefined;
2298
2496
  allowObservers?: boolean | undefined;
2497
+ autoMode?: boolean | undefined;
2299
2498
  allowUltracode?: boolean | undefined;
2300
2499
  forceDurableGate?: boolean | undefined;
2301
2500
  } | undefined;
@@ -2329,6 +2528,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2329
2528
  allowWorkflows?: boolean | undefined;
2330
2529
  allowFork?: boolean | undefined;
2331
2530
  allowObservers?: boolean | undefined;
2531
+ autoMode?: boolean | undefined;
2332
2532
  allowUltracode?: boolean | undefined;
2333
2533
  forceDurableGate?: boolean | undefined;
2334
2534
  } | undefined;
@@ -2626,6 +2826,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2626
2826
  allowWorkflows?: boolean | undefined;
2627
2827
  allowFork?: boolean | undefined;
2628
2828
  allowObservers?: boolean | undefined;
2829
+ autoMode?: boolean | undefined;
2629
2830
  allowUltracode?: boolean | undefined;
2630
2831
  forceDurableGate?: boolean | undefined;
2631
2832
  } | undefined;
@@ -2698,6 +2899,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2698
2899
  allowWorkflows?: boolean | undefined;
2699
2900
  allowFork?: boolean | undefined;
2700
2901
  allowObservers?: boolean | undefined;
2902
+ autoMode?: boolean | undefined;
2701
2903
  allowUltracode?: boolean | undefined;
2702
2904
  forceDurableGate?: boolean | undefined;
2703
2905
  } | undefined;
@@ -2747,6 +2949,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2747
2949
  allowWorkflows?: boolean | undefined;
2748
2950
  allowFork?: boolean | undefined;
2749
2951
  allowObservers?: boolean | undefined;
2952
+ autoMode?: boolean | undefined;
2750
2953
  allowUltracode?: boolean | undefined;
2751
2954
  forceDurableGate?: boolean | undefined;
2752
2955
  } | undefined;
@@ -2775,6 +2978,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2775
2978
  allowWorkflows?: boolean | undefined;
2776
2979
  allowFork?: boolean | undefined;
2777
2980
  allowObservers?: boolean | undefined;
2981
+ autoMode?: boolean | undefined;
2778
2982
  allowUltracode?: boolean | undefined;
2779
2983
  forceDurableGate?: boolean | undefined;
2780
2984
  } | undefined;
@@ -2868,6 +3072,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2868
3072
  allowWorkflows?: boolean | undefined;
2869
3073
  allowFork?: boolean | undefined;
2870
3074
  allowObservers?: boolean | undefined;
3075
+ autoMode?: boolean | undefined;
2871
3076
  allowUltracode?: boolean | undefined;
2872
3077
  forceDurableGate?: boolean | undefined;
2873
3078
  } | undefined;
@@ -2940,6 +3145,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2940
3145
  allowWorkflows?: boolean | undefined;
2941
3146
  allowFork?: boolean | undefined;
2942
3147
  allowObservers?: boolean | undefined;
3148
+ autoMode?: boolean | undefined;
2943
3149
  allowUltracode?: boolean | undefined;
2944
3150
  forceDurableGate?: boolean | undefined;
2945
3151
  } | undefined;
@@ -2989,6 +3195,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2989
3195
  allowWorkflows?: boolean | undefined;
2990
3196
  allowFork?: boolean | undefined;
2991
3197
  allowObservers?: boolean | undefined;
3198
+ autoMode?: boolean | undefined;
2992
3199
  allowUltracode?: boolean | undefined;
2993
3200
  forceDurableGate?: boolean | undefined;
2994
3201
  } | undefined;
@@ -3017,6 +3224,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
3017
3224
  allowWorkflows?: boolean | undefined;
3018
3225
  allowFork?: boolean | undefined;
3019
3226
  allowObservers?: boolean | undefined;
3227
+ autoMode?: boolean | undefined;
3020
3228
  allowUltracode?: boolean | undefined;
3021
3229
  forceDurableGate?: boolean | undefined;
3022
3230
  } | undefined;
@@ -3121,7 +3329,32 @@ export declare const SessionMirrorPolicy: z.ZodObject<{
3121
3329
  required?: boolean | undefined;
3122
3330
  }>;
3123
3331
  export type SessionMirrorPolicy = z.infer<typeof SessionMirrorPolicy>;
3124
- export declare const ExecutionPolicy: z.ZodObject<{
3332
+ /** 执行域 sealed-box 加密公钥登记(0.10.5,密钥托管线;挂 execution 域=「执行环境的属性」循
3333
+ * sessionMirror 收编先例,零新域)。center **只登记公钥**——私钥由执行侧(service worker/引擎)
3334
+ * 生成并持有,永不上行;浏览器端用这里的公钥 crypto_box_seal 加密模型 key(见 {@link SealedApiKey})。
3335
+ * X25519 公钥恒 32 字节 → base64 恒 43 字符 + "=",regex 钉死(错长度=根本不是 X25519 公钥,写侧
3336
+ * fail-loud 比执行侧解密失败早得多)。 */
3337
+ export declare const ExecutionPublicKey: z.ZodObject<{
3338
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
3339
+ publicKeyId: z.ZodString;
3340
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
3341
+ publicKey: z.ZodString;
3342
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
3343
+ createdAt: z.ZodString;
3344
+ notes: z.ZodOptional<z.ZodString>;
3345
+ }, "strip", z.ZodTypeAny, {
3346
+ publicKeyId: string;
3347
+ publicKey: string;
3348
+ createdAt: string;
3349
+ notes?: string | undefined;
3350
+ }, {
3351
+ publicKeyId: string;
3352
+ publicKey: string;
3353
+ createdAt: string;
3354
+ notes?: string | undefined;
3355
+ }>;
3356
+ export type ExecutionPublicKey = z.infer<typeof ExecutionPublicKey>;
3357
+ export declare const ExecutionPolicy: z.ZodEffects<z.ZodObject<{
3125
3358
  /** true = tasks under this scope MUST run in a sandbox / controlled execution lane (the consuming
3126
3359
  * shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
3127
3360
  required: z.ZodDefault<z.ZodBoolean>;
@@ -3143,6 +3376,28 @@ export declare const ExecutionPolicy: z.ZodObject<{
3143
3376
  engineUrl: string;
3144
3377
  required?: boolean | undefined;
3145
3378
  }>>;
3379
+ /** 执行域 sealed-box 公钥登记表(0.10.5)。**optional 无 default,ABSENT = 未登记**(0.8–0.10 存量
3380
+ * execution 文档字节稳定,sessionMirror 同款零迁移纪律);web 面无已登记公钥时「贴密钥」tab 显示
3381
+ * 引导并回落 env-NAME。多把并存合法(轮换窗口:新密文用新钥,旧密文仍可被旧私钥解)。 */
3382
+ publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
3383
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
3384
+ publicKeyId: z.ZodString;
3385
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
3386
+ publicKey: z.ZodString;
3387
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
3388
+ createdAt: z.ZodString;
3389
+ notes: z.ZodOptional<z.ZodString>;
3390
+ }, "strip", z.ZodTypeAny, {
3391
+ publicKeyId: string;
3392
+ publicKey: string;
3393
+ createdAt: string;
3394
+ notes?: string | undefined;
3395
+ }, {
3396
+ publicKeyId: string;
3397
+ publicKey: string;
3398
+ createdAt: string;
3399
+ notes?: string | undefined;
3400
+ }>, "many">>;
3146
3401
  }, "strip", z.ZodTypeAny, {
3147
3402
  required: boolean;
3148
3403
  allowedLanes: string[];
@@ -3150,6 +3405,38 @@ export declare const ExecutionPolicy: z.ZodObject<{
3150
3405
  required: boolean;
3151
3406
  engineUrl: string;
3152
3407
  } | undefined;
3408
+ publicKeys?: {
3409
+ publicKeyId: string;
3410
+ publicKey: string;
3411
+ createdAt: string;
3412
+ notes?: string | undefined;
3413
+ }[] | undefined;
3414
+ }, {
3415
+ required?: boolean | undefined;
3416
+ allowedLanes?: string[] | undefined;
3417
+ sessionMirror?: {
3418
+ engineUrl: string;
3419
+ required?: boolean | undefined;
3420
+ } | undefined;
3421
+ publicKeys?: {
3422
+ publicKeyId: string;
3423
+ publicKey: string;
3424
+ createdAt: string;
3425
+ notes?: string | undefined;
3426
+ }[] | undefined;
3427
+ }>, {
3428
+ required: boolean;
3429
+ allowedLanes: string[];
3430
+ sessionMirror?: {
3431
+ required: boolean;
3432
+ engineUrl: string;
3433
+ } | undefined;
3434
+ publicKeys?: {
3435
+ publicKeyId: string;
3436
+ publicKey: string;
3437
+ createdAt: string;
3438
+ notes?: string | undefined;
3439
+ }[] | undefined;
3153
3440
  }, {
3154
3441
  required?: boolean | undefined;
3155
3442
  allowedLanes?: string[] | undefined;
@@ -3157,6 +3444,12 @@ export declare const ExecutionPolicy: z.ZodObject<{
3157
3444
  engineUrl: string;
3158
3445
  required?: boolean | undefined;
3159
3446
  } | undefined;
3447
+ publicKeys?: {
3448
+ publicKeyId: string;
3449
+ publicKey: string;
3450
+ createdAt: string;
3451
+ notes?: string | undefined;
3452
+ }[] | undefined;
3160
3453
  }>;
3161
3454
  export type ExecutionPolicy = z.infer<typeof ExecutionPolicy>;
3162
3455
  /** projectId 形状:lowercase 规范 UUID。**宽读严写**([641]②,core 口径):读面/claim 收 generic
@@ -6126,8 +6419,30 @@ export declare const DOMAIN_SCHEMAS: {
6126
6419
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
6127
6420
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
6128
6421
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
6129
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
6422
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
6423
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
6130
6424
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6425
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
6426
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
6427
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
6428
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
6429
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
6430
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
6431
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
6432
+ ciphertext: z.ZodString;
6433
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
6434
+ publicKeyId: z.ZodString;
6435
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
6436
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
6437
+ }, "strip", z.ZodTypeAny, {
6438
+ ciphertext: string;
6439
+ publicKeyId: string;
6440
+ alg: "libsodium-sealedbox-x25519";
6441
+ }, {
6442
+ ciphertext: string;
6443
+ publicKeyId: string;
6444
+ alg: "libsodium-sealedbox-x25519";
6445
+ }>>;
6131
6446
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
6132
6447
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
6133
6448
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -6172,6 +6487,11 @@ export declare const DOMAIN_SCHEMAS: {
6172
6487
  enabled: boolean;
6173
6488
  baseUrl?: string | undefined;
6174
6489
  apiKeyEnv?: string | undefined;
6490
+ sealedApiKey?: {
6491
+ ciphertext: string;
6492
+ publicKeyId: string;
6493
+ alg: "libsodium-sealedbox-x25519";
6494
+ } | undefined;
6175
6495
  contextWindow?: number | undefined;
6176
6496
  maxTokens?: number | undefined;
6177
6497
  cost?: {
@@ -6189,6 +6509,11 @@ export declare const DOMAIN_SCHEMAS: {
6189
6509
  api?: "openai-completions" | "anthropic-messages" | undefined;
6190
6510
  baseUrl?: string | undefined;
6191
6511
  apiKeyEnv?: string | undefined;
6512
+ sealedApiKey?: {
6513
+ ciphertext: string;
6514
+ publicKeyId: string;
6515
+ alg: "libsodium-sealedbox-x25519";
6516
+ } | undefined;
6192
6517
  tier?: "cheap" | "standard" | "premium" | undefined;
6193
6518
  reasoning?: boolean | undefined;
6194
6519
  vision?: boolean | undefined;
@@ -6216,6 +6541,11 @@ export declare const DOMAIN_SCHEMAS: {
6216
6541
  enabled: boolean;
6217
6542
  baseUrl?: string | undefined;
6218
6543
  apiKeyEnv?: string | undefined;
6544
+ sealedApiKey?: {
6545
+ ciphertext: string;
6546
+ publicKeyId: string;
6547
+ alg: "libsodium-sealedbox-x25519";
6548
+ } | undefined;
6219
6549
  contextWindow?: number | undefined;
6220
6550
  maxTokens?: number | undefined;
6221
6551
  cost?: {
@@ -6233,6 +6563,11 @@ export declare const DOMAIN_SCHEMAS: {
6233
6563
  api?: "openai-completions" | "anthropic-messages" | undefined;
6234
6564
  baseUrl?: string | undefined;
6235
6565
  apiKeyEnv?: string | undefined;
6566
+ sealedApiKey?: {
6567
+ ciphertext: string;
6568
+ publicKeyId: string;
6569
+ alg: "libsodium-sealedbox-x25519";
6570
+ } | undefined;
6236
6571
  tier?: "cheap" | "standard" | "premium" | undefined;
6237
6572
  reasoning?: boolean | undefined;
6238
6573
  vision?: boolean | undefined;
@@ -6345,6 +6680,11 @@ export declare const DOMAIN_SCHEMAS: {
6345
6680
  enabled: boolean;
6346
6681
  baseUrl?: string | undefined;
6347
6682
  apiKeyEnv?: string | undefined;
6683
+ sealedApiKey?: {
6684
+ ciphertext: string;
6685
+ publicKeyId: string;
6686
+ alg: "libsodium-sealedbox-x25519";
6687
+ } | undefined;
6348
6688
  contextWindow?: number | undefined;
6349
6689
  maxTokens?: number | undefined;
6350
6690
  cost?: {
@@ -6386,6 +6726,11 @@ export declare const DOMAIN_SCHEMAS: {
6386
6726
  api?: "openai-completions" | "anthropic-messages" | undefined;
6387
6727
  baseUrl?: string | undefined;
6388
6728
  apiKeyEnv?: string | undefined;
6729
+ sealedApiKey?: {
6730
+ ciphertext: string;
6731
+ publicKeyId: string;
6732
+ alg: "libsodium-sealedbox-x25519";
6733
+ } | undefined;
6389
6734
  tier?: "cheap" | "standard" | "premium" | undefined;
6390
6735
  reasoning?: boolean | undefined;
6391
6736
  vision?: boolean | undefined;
@@ -6437,6 +6782,11 @@ export declare const DOMAIN_SCHEMAS: {
6437
6782
  enabled: boolean;
6438
6783
  baseUrl?: string | undefined;
6439
6784
  apiKeyEnv?: string | undefined;
6785
+ sealedApiKey?: {
6786
+ ciphertext: string;
6787
+ publicKeyId: string;
6788
+ alg: "libsodium-sealedbox-x25519";
6789
+ } | undefined;
6440
6790
  contextWindow?: number | undefined;
6441
6791
  maxTokens?: number | undefined;
6442
6792
  cost?: {
@@ -6478,6 +6828,11 @@ export declare const DOMAIN_SCHEMAS: {
6478
6828
  api?: "openai-completions" | "anthropic-messages" | undefined;
6479
6829
  baseUrl?: string | undefined;
6480
6830
  apiKeyEnv?: string | undefined;
6831
+ sealedApiKey?: {
6832
+ ciphertext: string;
6833
+ publicKeyId: string;
6834
+ alg: "libsodium-sealedbox-x25519";
6835
+ } | undefined;
6481
6836
  tier?: "cheap" | "standard" | "premium" | undefined;
6482
6837
  reasoning?: boolean | undefined;
6483
6838
  vision?: boolean | undefined;
@@ -8454,6 +8809,19 @@ export declare const DOMAIN_SCHEMAS: {
8454
8809
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
8455
8810
  * `=== true` opt-in check is orthogonal to that merge polarity. */
8456
8811
  allowObservers: z.ZodOptional<z.ZodBoolean>;
8812
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
8813
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
8814
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
8815
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
8816
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
8817
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
8818
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
8819
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
8820
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
8821
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
8822
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
8823
+ * classifier leg itself. */
8824
+ autoMode: z.ZodOptional<z.ZodBoolean>;
8457
8825
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
8458
8826
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
8459
8827
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -8466,6 +8834,7 @@ export declare const DOMAIN_SCHEMAS: {
8466
8834
  allowWorkflows?: boolean | undefined;
8467
8835
  allowFork?: boolean | undefined;
8468
8836
  allowObservers?: boolean | undefined;
8837
+ autoMode?: boolean | undefined;
8469
8838
  allowUltracode?: boolean | undefined;
8470
8839
  forceDurableGate?: boolean | undefined;
8471
8840
  }, {
@@ -8474,6 +8843,7 @@ export declare const DOMAIN_SCHEMAS: {
8474
8843
  allowWorkflows?: boolean | undefined;
8475
8844
  allowFork?: boolean | undefined;
8476
8845
  allowObservers?: boolean | undefined;
8846
+ autoMode?: boolean | undefined;
8477
8847
  allowUltracode?: boolean | undefined;
8478
8848
  forceDurableGate?: boolean | undefined;
8479
8849
  }>>;
@@ -8573,6 +8943,7 @@ export declare const DOMAIN_SCHEMAS: {
8573
8943
  allowWorkflows?: boolean | undefined;
8574
8944
  allowFork?: boolean | undefined;
8575
8945
  allowObservers?: boolean | undefined;
8946
+ autoMode?: boolean | undefined;
8576
8947
  allowUltracode?: boolean | undefined;
8577
8948
  forceDurableGate?: boolean | undefined;
8578
8949
  } | undefined;
@@ -8603,6 +8974,7 @@ export declare const DOMAIN_SCHEMAS: {
8603
8974
  allowWorkflows?: boolean | undefined;
8604
8975
  allowFork?: boolean | undefined;
8605
8976
  allowObservers?: boolean | undefined;
8977
+ autoMode?: boolean | undefined;
8606
8978
  allowUltracode?: boolean | undefined;
8607
8979
  forceDurableGate?: boolean | undefined;
8608
8980
  } | undefined;
@@ -8706,6 +9078,19 @@ export declare const DOMAIN_SCHEMAS: {
8706
9078
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
8707
9079
  * `=== true` opt-in check is orthogonal to that merge polarity. */
8708
9080
  allowObservers: z.ZodOptional<z.ZodBoolean>;
9081
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
9082
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
9083
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
9084
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
9085
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
9086
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
9087
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
9088
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
9089
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
9090
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
9091
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
9092
+ * classifier leg itself. */
9093
+ autoMode: z.ZodOptional<z.ZodBoolean>;
8709
9094
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
8710
9095
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
8711
9096
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -8718,6 +9103,7 @@ export declare const DOMAIN_SCHEMAS: {
8718
9103
  allowWorkflows?: boolean | undefined;
8719
9104
  allowFork?: boolean | undefined;
8720
9105
  allowObservers?: boolean | undefined;
9106
+ autoMode?: boolean | undefined;
8721
9107
  allowUltracode?: boolean | undefined;
8722
9108
  forceDurableGate?: boolean | undefined;
8723
9109
  }, {
@@ -8726,6 +9112,7 @@ export declare const DOMAIN_SCHEMAS: {
8726
9112
  allowWorkflows?: boolean | undefined;
8727
9113
  allowFork?: boolean | undefined;
8728
9114
  allowObservers?: boolean | undefined;
9115
+ autoMode?: boolean | undefined;
8729
9116
  allowUltracode?: boolean | undefined;
8730
9117
  forceDurableGate?: boolean | undefined;
8731
9118
  }>>;
@@ -8761,6 +9148,7 @@ export declare const DOMAIN_SCHEMAS: {
8761
9148
  allowWorkflows?: boolean | undefined;
8762
9149
  allowFork?: boolean | undefined;
8763
9150
  allowObservers?: boolean | undefined;
9151
+ autoMode?: boolean | undefined;
8764
9152
  allowUltracode?: boolean | undefined;
8765
9153
  forceDurableGate?: boolean | undefined;
8766
9154
  } | undefined;
@@ -8794,6 +9182,7 @@ export declare const DOMAIN_SCHEMAS: {
8794
9182
  allowWorkflows?: boolean | undefined;
8795
9183
  allowFork?: boolean | undefined;
8796
9184
  allowObservers?: boolean | undefined;
9185
+ autoMode?: boolean | undefined;
8797
9186
  allowUltracode?: boolean | undefined;
8798
9187
  forceDurableGate?: boolean | undefined;
8799
9188
  } | undefined;
@@ -9091,6 +9480,7 @@ export declare const DOMAIN_SCHEMAS: {
9091
9480
  allowWorkflows?: boolean | undefined;
9092
9481
  allowFork?: boolean | undefined;
9093
9482
  allowObservers?: boolean | undefined;
9483
+ autoMode?: boolean | undefined;
9094
9484
  allowUltracode?: boolean | undefined;
9095
9485
  forceDurableGate?: boolean | undefined;
9096
9486
  } | undefined;
@@ -9163,6 +9553,7 @@ export declare const DOMAIN_SCHEMAS: {
9163
9553
  allowWorkflows?: boolean | undefined;
9164
9554
  allowFork?: boolean | undefined;
9165
9555
  allowObservers?: boolean | undefined;
9556
+ autoMode?: boolean | undefined;
9166
9557
  allowUltracode?: boolean | undefined;
9167
9558
  forceDurableGate?: boolean | undefined;
9168
9559
  } | undefined;
@@ -9212,6 +9603,7 @@ export declare const DOMAIN_SCHEMAS: {
9212
9603
  allowWorkflows?: boolean | undefined;
9213
9604
  allowFork?: boolean | undefined;
9214
9605
  allowObservers?: boolean | undefined;
9606
+ autoMode?: boolean | undefined;
9215
9607
  allowUltracode?: boolean | undefined;
9216
9608
  forceDurableGate?: boolean | undefined;
9217
9609
  } | undefined;
@@ -9240,6 +9632,7 @@ export declare const DOMAIN_SCHEMAS: {
9240
9632
  allowWorkflows?: boolean | undefined;
9241
9633
  allowFork?: boolean | undefined;
9242
9634
  allowObservers?: boolean | undefined;
9635
+ autoMode?: boolean | undefined;
9243
9636
  allowUltracode?: boolean | undefined;
9244
9637
  forceDurableGate?: boolean | undefined;
9245
9638
  } | undefined;
@@ -9333,6 +9726,7 @@ export declare const DOMAIN_SCHEMAS: {
9333
9726
  allowWorkflows?: boolean | undefined;
9334
9727
  allowFork?: boolean | undefined;
9335
9728
  allowObservers?: boolean | undefined;
9729
+ autoMode?: boolean | undefined;
9336
9730
  allowUltracode?: boolean | undefined;
9337
9731
  forceDurableGate?: boolean | undefined;
9338
9732
  } | undefined;
@@ -9405,6 +9799,7 @@ export declare const DOMAIN_SCHEMAS: {
9405
9799
  allowWorkflows?: boolean | undefined;
9406
9800
  allowFork?: boolean | undefined;
9407
9801
  allowObservers?: boolean | undefined;
9802
+ autoMode?: boolean | undefined;
9408
9803
  allowUltracode?: boolean | undefined;
9409
9804
  forceDurableGate?: boolean | undefined;
9410
9805
  } | undefined;
@@ -9454,6 +9849,7 @@ export declare const DOMAIN_SCHEMAS: {
9454
9849
  allowWorkflows?: boolean | undefined;
9455
9850
  allowFork?: boolean | undefined;
9456
9851
  allowObservers?: boolean | undefined;
9852
+ autoMode?: boolean | undefined;
9457
9853
  allowUltracode?: boolean | undefined;
9458
9854
  forceDurableGate?: boolean | undefined;
9459
9855
  } | undefined;
@@ -9482,6 +9878,7 @@ export declare const DOMAIN_SCHEMAS: {
9482
9878
  allowWorkflows?: boolean | undefined;
9483
9879
  allowFork?: boolean | undefined;
9484
9880
  allowObservers?: boolean | undefined;
9881
+ autoMode?: boolean | undefined;
9485
9882
  allowUltracode?: boolean | undefined;
9486
9883
  forceDurableGate?: boolean | undefined;
9487
9884
  } | undefined;
@@ -9546,7 +9943,7 @@ export declare const DOMAIN_SCHEMAS: {
9546
9943
  }[] | undefined;
9547
9944
  } | undefined;
9548
9945
  }>;
9549
- readonly execution: z.ZodObject<{
9946
+ readonly execution: z.ZodEffects<z.ZodObject<{
9550
9947
  /** true = tasks under this scope MUST run in a sandbox / controlled execution lane (the consuming
9551
9948
  * shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
9552
9949
  required: z.ZodDefault<z.ZodBoolean>;
@@ -9568,6 +9965,28 @@ export declare const DOMAIN_SCHEMAS: {
9568
9965
  engineUrl: string;
9569
9966
  required?: boolean | undefined;
9570
9967
  }>>;
9968
+ /** 执行域 sealed-box 公钥登记表(0.10.5)。**optional 无 default,ABSENT = 未登记**(0.8–0.10 存量
9969
+ * execution 文档字节稳定,sessionMirror 同款零迁移纪律);web 面无已登记公钥时「贴密钥」tab 显示
9970
+ * 引导并回落 env-NAME。多把并存合法(轮换窗口:新密文用新钥,旧密文仍可被旧私钥解)。 */
9971
+ publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
9972
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
9973
+ publicKeyId: z.ZodString;
9974
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
9975
+ publicKey: z.ZodString;
9976
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
9977
+ createdAt: z.ZodString;
9978
+ notes: z.ZodOptional<z.ZodString>;
9979
+ }, "strip", z.ZodTypeAny, {
9980
+ publicKeyId: string;
9981
+ publicKey: string;
9982
+ createdAt: string;
9983
+ notes?: string | undefined;
9984
+ }, {
9985
+ publicKeyId: string;
9986
+ publicKey: string;
9987
+ createdAt: string;
9988
+ notes?: string | undefined;
9989
+ }>, "many">>;
9571
9990
  }, "strip", z.ZodTypeAny, {
9572
9991
  required: boolean;
9573
9992
  allowedLanes: string[];
@@ -9575,6 +9994,12 @@ export declare const DOMAIN_SCHEMAS: {
9575
9994
  required: boolean;
9576
9995
  engineUrl: string;
9577
9996
  } | undefined;
9997
+ publicKeys?: {
9998
+ publicKeyId: string;
9999
+ publicKey: string;
10000
+ createdAt: string;
10001
+ notes?: string | undefined;
10002
+ }[] | undefined;
9578
10003
  }, {
9579
10004
  required?: boolean | undefined;
9580
10005
  allowedLanes?: string[] | undefined;
@@ -9582,6 +10007,38 @@ export declare const DOMAIN_SCHEMAS: {
9582
10007
  engineUrl: string;
9583
10008
  required?: boolean | undefined;
9584
10009
  } | undefined;
10010
+ publicKeys?: {
10011
+ publicKeyId: string;
10012
+ publicKey: string;
10013
+ createdAt: string;
10014
+ notes?: string | undefined;
10015
+ }[] | undefined;
10016
+ }>, {
10017
+ required: boolean;
10018
+ allowedLanes: string[];
10019
+ sessionMirror?: {
10020
+ required: boolean;
10021
+ engineUrl: string;
10022
+ } | undefined;
10023
+ publicKeys?: {
10024
+ publicKeyId: string;
10025
+ publicKey: string;
10026
+ createdAt: string;
10027
+ notes?: string | undefined;
10028
+ }[] | undefined;
10029
+ }, {
10030
+ required?: boolean | undefined;
10031
+ allowedLanes?: string[] | undefined;
10032
+ sessionMirror?: {
10033
+ engineUrl: string;
10034
+ required?: boolean | undefined;
10035
+ } | undefined;
10036
+ publicKeys?: {
10037
+ publicKeyId: string;
10038
+ publicKey: string;
10039
+ createdAt: string;
10040
+ notes?: string | undefined;
10041
+ }[] | undefined;
9585
10042
  }>;
9586
10043
  readonly projects: z.ZodEffects<z.ZodObject<{
9587
10044
  /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=center