@sema-ai/registry-core 0.10.3 → 0.10.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +44 -0
  2. package/dist/types.d.ts +506 -5
  3. package/dist/types.d.ts.map +1 -1
  4. package/dist/types.js +77 -1
  5. package/dist/types.js.map +1 -1
  6. package/package.json +1 -1
package/dist/types.d.ts CHANGED
@@ -66,6 +66,42 @@ export declare const ModelCost: z.ZodObject<{
66
66
  cacheRead?: number | undefined;
67
67
  cacheWrite?: number | undefined;
68
68
  }>;
69
+ /** sealed-box 算法标识(v1 唯一取值)。z.literal 钉死:换算法=换值=显式契约演进,不许静默漂移。 */
70
+ export declare const SEALED_BOX_ALG: "libsodium-sealedbox-x25519";
71
+ /** base64 形状底线(标准字母表,可带 padding)。**只校验形状不校验内容**——center 是托管方不是消费方,
72
+ * 解密/解不开是执行侧运行时的事;这里只挡"根本不是 base64"的写入事故。 */
73
+ export declare const BASE64_SHAPE: RegExp;
74
+ /** 接入模型的 sealed-box 托管密文(默认模式「直接贴 key」的存储形态)。
75
+ * - `ciphertext`:crypto_box_seal(plaintextKey, executionPublicKey) 的 base64。sealed box 开销 48 字节,
76
+ * 真实 API key ≤ 几百字节;`.max(8192)` 只防 blob 滥用,不是格式承诺。
77
+ * - `publicKeyId`:加密时用的执行域公钥 id(指向 execution.publicKeys[].publicKeyId)——执行侧凭它选私钥;
78
+ * 轮换后旧密文仍带旧 id,可解性由执行侧留存的旧私钥决定。
79
+ * - **write-only 纪律(消费方约定)**:center 的 GET 面永不回 ciphertext 本体(只回 publicKeyId+设置
80
+ * 时间);密文字段绝不进任何日志。schema 层不执法读面,这是 API 层的契约义务。
81
+ * - **与 `apiKeyEnv` 的互斥语义**:见 ModelEntry.sealedApiKey JSDoc(两者都设 = sealed 优先)。 */
82
+ export declare const SealedApiKey: z.ZodObject<{
83
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
84
+ ciphertext: z.ZodString;
85
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
86
+ publicKeyId: z.ZodString;
87
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
88
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
89
+ /** 密文设置时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
90
+ * 的 masked GET 面靠它+publicKeyId 展示「已于 X 设置」——密文本体永不回读。optional:执行侧
91
+ * 解密不依赖它,非 center 写面(本地 TOC 手写配置)缺省合法。 */
92
+ setAt: z.ZodOptional<z.ZodString>;
93
+ }, "strip", z.ZodTypeAny, {
94
+ ciphertext: string;
95
+ publicKeyId: string;
96
+ alg: "libsodium-sealedbox-x25519";
97
+ setAt?: string | undefined;
98
+ }, {
99
+ ciphertext: string;
100
+ publicKeyId: string;
101
+ alg: "libsodium-sealedbox-x25519";
102
+ setAt?: string | undefined;
103
+ }>;
104
+ export type SealedApiKey = z.infer<typeof SealedApiKey>;
69
105
  export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
70
106
  /** Catalog key + `@name` mention handle (stable, url/word-safe), e.g. "qwen-72b". */
71
107
  name: z.ZodString;
@@ -79,8 +115,36 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
79
115
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
80
116
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
81
117
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
82
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
118
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
119
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
83
120
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
121
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
122
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
123
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
124
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
125
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
126
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
127
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
128
+ ciphertext: z.ZodString;
129
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
130
+ publicKeyId: z.ZodString;
131
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
132
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
133
+ /** 密文设置时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
134
+ * 的 masked GET 面靠它+publicKeyId 展示「已于 X 设置」——密文本体永不回读。optional:执行侧
135
+ * 解密不依赖它,非 center 写面(本地 TOC 手写配置)缺省合法。 */
136
+ setAt: z.ZodOptional<z.ZodString>;
137
+ }, "strip", z.ZodTypeAny, {
138
+ ciphertext: string;
139
+ publicKeyId: string;
140
+ alg: "libsodium-sealedbox-x25519";
141
+ setAt?: string | undefined;
142
+ }, {
143
+ ciphertext: string;
144
+ publicKeyId: string;
145
+ alg: "libsodium-sealedbox-x25519";
146
+ setAt?: string | undefined;
147
+ }>>;
84
148
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
85
149
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
86
150
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -125,6 +189,12 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
125
189
  enabled: boolean;
126
190
  baseUrl?: string | undefined;
127
191
  apiKeyEnv?: string | undefined;
192
+ sealedApiKey?: {
193
+ ciphertext: string;
194
+ publicKeyId: string;
195
+ alg: "libsodium-sealedbox-x25519";
196
+ setAt?: string | undefined;
197
+ } | undefined;
128
198
  contextWindow?: number | undefined;
129
199
  maxTokens?: number | undefined;
130
200
  cost?: {
@@ -142,6 +212,12 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
142
212
  api?: "openai-completions" | "anthropic-messages" | undefined;
143
213
  baseUrl?: string | undefined;
144
214
  apiKeyEnv?: string | undefined;
215
+ sealedApiKey?: {
216
+ ciphertext: string;
217
+ publicKeyId: string;
218
+ alg: "libsodium-sealedbox-x25519";
219
+ setAt?: string | undefined;
220
+ } | undefined;
145
221
  tier?: "cheap" | "standard" | "premium" | undefined;
146
222
  reasoning?: boolean | undefined;
147
223
  vision?: boolean | undefined;
@@ -169,6 +245,12 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
169
245
  enabled: boolean;
170
246
  baseUrl?: string | undefined;
171
247
  apiKeyEnv?: string | undefined;
248
+ sealedApiKey?: {
249
+ ciphertext: string;
250
+ publicKeyId: string;
251
+ alg: "libsodium-sealedbox-x25519";
252
+ setAt?: string | undefined;
253
+ } | undefined;
172
254
  contextWindow?: number | undefined;
173
255
  maxTokens?: number | undefined;
174
256
  cost?: {
@@ -186,6 +268,12 @@ export declare const ModelEntry: z.ZodEffects<z.ZodObject<{
186
268
  api?: "openai-completions" | "anthropic-messages" | undefined;
187
269
  baseUrl?: string | undefined;
188
270
  apiKeyEnv?: string | undefined;
271
+ sealedApiKey?: {
272
+ ciphertext: string;
273
+ publicKeyId: string;
274
+ alg: "libsodium-sealedbox-x25519";
275
+ setAt?: string | undefined;
276
+ } | undefined;
189
277
  tier?: "cheap" | "standard" | "premium" | undefined;
190
278
  reasoning?: boolean | undefined;
191
279
  vision?: boolean | undefined;
@@ -323,8 +411,36 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
323
411
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
324
412
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
325
413
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
326
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
414
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
415
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
327
416
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
417
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
418
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
419
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
420
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
421
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
422
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
423
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
424
+ ciphertext: z.ZodString;
425
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
426
+ publicKeyId: z.ZodString;
427
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
428
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
429
+ /** 密文设置时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
430
+ * 的 masked GET 面靠它+publicKeyId 展示「已于 X 设置」——密文本体永不回读。optional:执行侧
431
+ * 解密不依赖它,非 center 写面(本地 TOC 手写配置)缺省合法。 */
432
+ setAt: z.ZodOptional<z.ZodString>;
433
+ }, "strip", z.ZodTypeAny, {
434
+ ciphertext: string;
435
+ publicKeyId: string;
436
+ alg: "libsodium-sealedbox-x25519";
437
+ setAt?: string | undefined;
438
+ }, {
439
+ ciphertext: string;
440
+ publicKeyId: string;
441
+ alg: "libsodium-sealedbox-x25519";
442
+ setAt?: string | undefined;
443
+ }>>;
328
444
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
329
445
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
330
446
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -369,6 +485,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
369
485
  enabled: boolean;
370
486
  baseUrl?: string | undefined;
371
487
  apiKeyEnv?: string | undefined;
488
+ sealedApiKey?: {
489
+ ciphertext: string;
490
+ publicKeyId: string;
491
+ alg: "libsodium-sealedbox-x25519";
492
+ setAt?: string | undefined;
493
+ } | undefined;
372
494
  contextWindow?: number | undefined;
373
495
  maxTokens?: number | undefined;
374
496
  cost?: {
@@ -386,6 +508,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
386
508
  api?: "openai-completions" | "anthropic-messages" | undefined;
387
509
  baseUrl?: string | undefined;
388
510
  apiKeyEnv?: string | undefined;
511
+ sealedApiKey?: {
512
+ ciphertext: string;
513
+ publicKeyId: string;
514
+ alg: "libsodium-sealedbox-x25519";
515
+ setAt?: string | undefined;
516
+ } | undefined;
389
517
  tier?: "cheap" | "standard" | "premium" | undefined;
390
518
  reasoning?: boolean | undefined;
391
519
  vision?: boolean | undefined;
@@ -413,6 +541,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
413
541
  enabled: boolean;
414
542
  baseUrl?: string | undefined;
415
543
  apiKeyEnv?: string | undefined;
544
+ sealedApiKey?: {
545
+ ciphertext: string;
546
+ publicKeyId: string;
547
+ alg: "libsodium-sealedbox-x25519";
548
+ setAt?: string | undefined;
549
+ } | undefined;
416
550
  contextWindow?: number | undefined;
417
551
  maxTokens?: number | undefined;
418
552
  cost?: {
@@ -430,6 +564,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
430
564
  api?: "openai-completions" | "anthropic-messages" | undefined;
431
565
  baseUrl?: string | undefined;
432
566
  apiKeyEnv?: string | undefined;
567
+ sealedApiKey?: {
568
+ ciphertext: string;
569
+ publicKeyId: string;
570
+ alg: "libsodium-sealedbox-x25519";
571
+ setAt?: string | undefined;
572
+ } | undefined;
433
573
  tier?: "cheap" | "standard" | "premium" | undefined;
434
574
  reasoning?: boolean | undefined;
435
575
  vision?: boolean | undefined;
@@ -542,6 +682,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
542
682
  enabled: boolean;
543
683
  baseUrl?: string | undefined;
544
684
  apiKeyEnv?: string | undefined;
685
+ sealedApiKey?: {
686
+ ciphertext: string;
687
+ publicKeyId: string;
688
+ alg: "libsodium-sealedbox-x25519";
689
+ setAt?: string | undefined;
690
+ } | undefined;
545
691
  contextWindow?: number | undefined;
546
692
  maxTokens?: number | undefined;
547
693
  cost?: {
@@ -583,6 +729,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
583
729
  api?: "openai-completions" | "anthropic-messages" | undefined;
584
730
  baseUrl?: string | undefined;
585
731
  apiKeyEnv?: string | undefined;
732
+ sealedApiKey?: {
733
+ ciphertext: string;
734
+ publicKeyId: string;
735
+ alg: "libsodium-sealedbox-x25519";
736
+ setAt?: string | undefined;
737
+ } | undefined;
586
738
  tier?: "cheap" | "standard" | "premium" | undefined;
587
739
  reasoning?: boolean | undefined;
588
740
  vision?: boolean | undefined;
@@ -634,6 +786,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
634
786
  enabled: boolean;
635
787
  baseUrl?: string | undefined;
636
788
  apiKeyEnv?: string | undefined;
789
+ sealedApiKey?: {
790
+ ciphertext: string;
791
+ publicKeyId: string;
792
+ alg: "libsodium-sealedbox-x25519";
793
+ setAt?: string | undefined;
794
+ } | undefined;
637
795
  contextWindow?: number | undefined;
638
796
  maxTokens?: number | undefined;
639
797
  cost?: {
@@ -675,6 +833,12 @@ export declare const ModelsConfig: z.ZodEffects<z.ZodObject<{
675
833
  api?: "openai-completions" | "anthropic-messages" | undefined;
676
834
  baseUrl?: string | undefined;
677
835
  apiKeyEnv?: string | undefined;
836
+ sealedApiKey?: {
837
+ ciphertext: string;
838
+ publicKeyId: string;
839
+ alg: "libsodium-sealedbox-x25519";
840
+ setAt?: string | undefined;
841
+ } | undefined;
678
842
  tier?: "cheap" | "standard" | "premium" | undefined;
679
843
  reasoning?: boolean | undefined;
680
844
  vision?: boolean | undefined;
@@ -1554,6 +1718,19 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1554
1718
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1555
1719
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1556
1720
  allowObservers: z.ZodOptional<z.ZodBoolean>;
1721
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
1722
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
1723
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
1724
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
1725
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
1726
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
1727
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
1728
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
1729
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
1730
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
1731
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
1732
+ * classifier leg itself. */
1733
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1557
1734
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1558
1735
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1559
1736
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -1566,6 +1743,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1566
1743
  allowWorkflows?: boolean | undefined;
1567
1744
  allowFork?: boolean | undefined;
1568
1745
  allowObservers?: boolean | undefined;
1746
+ autoMode?: boolean | undefined;
1569
1747
  allowUltracode?: boolean | undefined;
1570
1748
  forceDurableGate?: boolean | undefined;
1571
1749
  }, {
@@ -1574,6 +1752,7 @@ export declare const EntitlementRuntimeCaps: z.ZodObject<{
1574
1752
  allowWorkflows?: boolean | undefined;
1575
1753
  allowFork?: boolean | undefined;
1576
1754
  allowObservers?: boolean | undefined;
1755
+ autoMode?: boolean | undefined;
1577
1756
  allowUltracode?: boolean | undefined;
1578
1757
  forceDurableGate?: boolean | undefined;
1579
1758
  }>;
@@ -1680,6 +1859,19 @@ export declare const EntitlementTier: z.ZodObject<{
1680
1859
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1681
1860
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1682
1861
  allowObservers: z.ZodOptional<z.ZodBoolean>;
1862
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
1863
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
1864
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
1865
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
1866
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
1867
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
1868
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
1869
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
1870
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
1871
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
1872
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
1873
+ * classifier leg itself. */
1874
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1683
1875
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1684
1876
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1685
1877
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -1692,6 +1884,7 @@ export declare const EntitlementTier: z.ZodObject<{
1692
1884
  allowWorkflows?: boolean | undefined;
1693
1885
  allowFork?: boolean | undefined;
1694
1886
  allowObservers?: boolean | undefined;
1887
+ autoMode?: boolean | undefined;
1695
1888
  allowUltracode?: boolean | undefined;
1696
1889
  forceDurableGate?: boolean | undefined;
1697
1890
  }, {
@@ -1700,6 +1893,7 @@ export declare const EntitlementTier: z.ZodObject<{
1700
1893
  allowWorkflows?: boolean | undefined;
1701
1894
  allowFork?: boolean | undefined;
1702
1895
  allowObservers?: boolean | undefined;
1896
+ autoMode?: boolean | undefined;
1703
1897
  allowUltracode?: boolean | undefined;
1704
1898
  forceDurableGate?: boolean | undefined;
1705
1899
  }>>;
@@ -1735,6 +1929,7 @@ export declare const EntitlementTier: z.ZodObject<{
1735
1929
  allowWorkflows?: boolean | undefined;
1736
1930
  allowFork?: boolean | undefined;
1737
1931
  allowObservers?: boolean | undefined;
1932
+ autoMode?: boolean | undefined;
1738
1933
  allowUltracode?: boolean | undefined;
1739
1934
  forceDurableGate?: boolean | undefined;
1740
1935
  } | undefined;
@@ -1768,6 +1963,7 @@ export declare const EntitlementTier: z.ZodObject<{
1768
1963
  allowWorkflows?: boolean | undefined;
1769
1964
  allowFork?: boolean | undefined;
1770
1965
  allowObservers?: boolean | undefined;
1966
+ autoMode?: boolean | undefined;
1771
1967
  allowUltracode?: boolean | undefined;
1772
1968
  forceDurableGate?: boolean | undefined;
1773
1969
  } | undefined;
@@ -1989,6 +2185,19 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
1989
2185
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
1990
2186
  * `=== true` opt-in check is orthogonal to that merge polarity. */
1991
2187
  allowObservers: z.ZodOptional<z.ZodBoolean>;
2188
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
2189
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
2190
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
2191
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
2192
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
2193
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
2194
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
2195
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
2196
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
2197
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
2198
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
2199
+ * classifier leg itself. */
2200
+ autoMode: z.ZodOptional<z.ZodBoolean>;
1992
2201
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
1993
2202
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
1994
2203
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -2001,6 +2210,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2001
2210
  allowWorkflows?: boolean | undefined;
2002
2211
  allowFork?: boolean | undefined;
2003
2212
  allowObservers?: boolean | undefined;
2213
+ autoMode?: boolean | undefined;
2004
2214
  allowUltracode?: boolean | undefined;
2005
2215
  forceDurableGate?: boolean | undefined;
2006
2216
  }, {
@@ -2009,6 +2219,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2009
2219
  allowWorkflows?: boolean | undefined;
2010
2220
  allowFork?: boolean | undefined;
2011
2221
  allowObservers?: boolean | undefined;
2222
+ autoMode?: boolean | undefined;
2012
2223
  allowUltracode?: boolean | undefined;
2013
2224
  forceDurableGate?: boolean | undefined;
2014
2225
  }>>;
@@ -2108,6 +2319,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2108
2319
  allowWorkflows?: boolean | undefined;
2109
2320
  allowFork?: boolean | undefined;
2110
2321
  allowObservers?: boolean | undefined;
2322
+ autoMode?: boolean | undefined;
2111
2323
  allowUltracode?: boolean | undefined;
2112
2324
  forceDurableGate?: boolean | undefined;
2113
2325
  } | undefined;
@@ -2138,6 +2350,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2138
2350
  allowWorkflows?: boolean | undefined;
2139
2351
  allowFork?: boolean | undefined;
2140
2352
  allowObservers?: boolean | undefined;
2353
+ autoMode?: boolean | undefined;
2141
2354
  allowUltracode?: boolean | undefined;
2142
2355
  forceDurableGate?: boolean | undefined;
2143
2356
  } | undefined;
@@ -2241,6 +2454,19 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2241
2454
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
2242
2455
  * `=== true` opt-in check is orthogonal to that merge polarity. */
2243
2456
  allowObservers: z.ZodOptional<z.ZodBoolean>;
2457
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
2458
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
2459
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
2460
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
2461
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
2462
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
2463
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
2464
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
2465
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
2466
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
2467
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
2468
+ * classifier leg itself. */
2469
+ autoMode: z.ZodOptional<z.ZodBoolean>;
2244
2470
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
2245
2471
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
2246
2472
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -2253,6 +2479,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2253
2479
  allowWorkflows?: boolean | undefined;
2254
2480
  allowFork?: boolean | undefined;
2255
2481
  allowObservers?: boolean | undefined;
2482
+ autoMode?: boolean | undefined;
2256
2483
  allowUltracode?: boolean | undefined;
2257
2484
  forceDurableGate?: boolean | undefined;
2258
2485
  }, {
@@ -2261,6 +2488,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2261
2488
  allowWorkflows?: boolean | undefined;
2262
2489
  allowFork?: boolean | undefined;
2263
2490
  allowObservers?: boolean | undefined;
2491
+ autoMode?: boolean | undefined;
2264
2492
  allowUltracode?: boolean | undefined;
2265
2493
  forceDurableGate?: boolean | undefined;
2266
2494
  }>>;
@@ -2296,6 +2524,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2296
2524
  allowWorkflows?: boolean | undefined;
2297
2525
  allowFork?: boolean | undefined;
2298
2526
  allowObservers?: boolean | undefined;
2527
+ autoMode?: boolean | undefined;
2299
2528
  allowUltracode?: boolean | undefined;
2300
2529
  forceDurableGate?: boolean | undefined;
2301
2530
  } | undefined;
@@ -2329,6 +2558,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2329
2558
  allowWorkflows?: boolean | undefined;
2330
2559
  allowFork?: boolean | undefined;
2331
2560
  allowObservers?: boolean | undefined;
2561
+ autoMode?: boolean | undefined;
2332
2562
  allowUltracode?: boolean | undefined;
2333
2563
  forceDurableGate?: boolean | undefined;
2334
2564
  } | undefined;
@@ -2626,6 +2856,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2626
2856
  allowWorkflows?: boolean | undefined;
2627
2857
  allowFork?: boolean | undefined;
2628
2858
  allowObservers?: boolean | undefined;
2859
+ autoMode?: boolean | undefined;
2629
2860
  allowUltracode?: boolean | undefined;
2630
2861
  forceDurableGate?: boolean | undefined;
2631
2862
  } | undefined;
@@ -2698,6 +2929,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2698
2929
  allowWorkflows?: boolean | undefined;
2699
2930
  allowFork?: boolean | undefined;
2700
2931
  allowObservers?: boolean | undefined;
2932
+ autoMode?: boolean | undefined;
2701
2933
  allowUltracode?: boolean | undefined;
2702
2934
  forceDurableGate?: boolean | undefined;
2703
2935
  } | undefined;
@@ -2747,6 +2979,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2747
2979
  allowWorkflows?: boolean | undefined;
2748
2980
  allowFork?: boolean | undefined;
2749
2981
  allowObservers?: boolean | undefined;
2982
+ autoMode?: boolean | undefined;
2750
2983
  allowUltracode?: boolean | undefined;
2751
2984
  forceDurableGate?: boolean | undefined;
2752
2985
  } | undefined;
@@ -2775,6 +3008,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2775
3008
  allowWorkflows?: boolean | undefined;
2776
3009
  allowFork?: boolean | undefined;
2777
3010
  allowObservers?: boolean | undefined;
3011
+ autoMode?: boolean | undefined;
2778
3012
  allowUltracode?: boolean | undefined;
2779
3013
  forceDurableGate?: boolean | undefined;
2780
3014
  } | undefined;
@@ -2868,6 +3102,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2868
3102
  allowWorkflows?: boolean | undefined;
2869
3103
  allowFork?: boolean | undefined;
2870
3104
  allowObservers?: boolean | undefined;
3105
+ autoMode?: boolean | undefined;
2871
3106
  allowUltracode?: boolean | undefined;
2872
3107
  forceDurableGate?: boolean | undefined;
2873
3108
  } | undefined;
@@ -2940,6 +3175,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2940
3175
  allowWorkflows?: boolean | undefined;
2941
3176
  allowFork?: boolean | undefined;
2942
3177
  allowObservers?: boolean | undefined;
3178
+ autoMode?: boolean | undefined;
2943
3179
  allowUltracode?: boolean | undefined;
2944
3180
  forceDurableGate?: boolean | undefined;
2945
3181
  } | undefined;
@@ -2989,6 +3225,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
2989
3225
  allowWorkflows?: boolean | undefined;
2990
3226
  allowFork?: boolean | undefined;
2991
3227
  allowObservers?: boolean | undefined;
3228
+ autoMode?: boolean | undefined;
2992
3229
  allowUltracode?: boolean | undefined;
2993
3230
  forceDurableGate?: boolean | undefined;
2994
3231
  } | undefined;
@@ -3017,6 +3254,7 @@ export declare const EntitlementConfig: z.ZodEffects<z.ZodObject<{
3017
3254
  allowWorkflows?: boolean | undefined;
3018
3255
  allowFork?: boolean | undefined;
3019
3256
  allowObservers?: boolean | undefined;
3257
+ autoMode?: boolean | undefined;
3020
3258
  allowUltracode?: boolean | undefined;
3021
3259
  forceDurableGate?: boolean | undefined;
3022
3260
  } | undefined;
@@ -3121,7 +3359,32 @@ export declare const SessionMirrorPolicy: z.ZodObject<{
3121
3359
  required?: boolean | undefined;
3122
3360
  }>;
3123
3361
  export type SessionMirrorPolicy = z.infer<typeof SessionMirrorPolicy>;
3124
- export declare const ExecutionPolicy: z.ZodObject<{
3362
+ /** 执行域 sealed-box 加密公钥登记(0.10.5,密钥托管线;挂 execution 域=「执行环境的属性」循
3363
+ * sessionMirror 收编先例,零新域)。center **只登记公钥**——私钥由执行侧(service worker/引擎)
3364
+ * 生成并持有,永不上行;浏览器端用这里的公钥 crypto_box_seal 加密模型 key(见 {@link SealedApiKey})。
3365
+ * X25519 公钥恒 32 字节 → base64 恒 43 字符 + "=",regex 钉死(错长度=根本不是 X25519 公钥,写侧
3366
+ * fail-loud 比执行侧解密失败早得多)。 */
3367
+ export declare const ExecutionPublicKey: z.ZodObject<{
3368
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
3369
+ publicKeyId: z.ZodString;
3370
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
3371
+ publicKey: z.ZodString;
3372
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
3373
+ createdAt: z.ZodString;
3374
+ notes: z.ZodOptional<z.ZodString>;
3375
+ }, "strip", z.ZodTypeAny, {
3376
+ publicKeyId: string;
3377
+ publicKey: string;
3378
+ createdAt: string;
3379
+ notes?: string | undefined;
3380
+ }, {
3381
+ publicKeyId: string;
3382
+ publicKey: string;
3383
+ createdAt: string;
3384
+ notes?: string | undefined;
3385
+ }>;
3386
+ export type ExecutionPublicKey = z.infer<typeof ExecutionPublicKey>;
3387
+ export declare const ExecutionPolicy: z.ZodEffects<z.ZodObject<{
3125
3388
  /** true = tasks under this scope MUST run in a sandbox / controlled execution lane (the consuming
3126
3389
  * shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
3127
3390
  required: z.ZodDefault<z.ZodBoolean>;
@@ -3143,6 +3406,28 @@ export declare const ExecutionPolicy: z.ZodObject<{
3143
3406
  engineUrl: string;
3144
3407
  required?: boolean | undefined;
3145
3408
  }>>;
3409
+ /** 执行域 sealed-box 公钥登记表(0.10.5)。**optional 无 default,ABSENT = 未登记**(0.8–0.10 存量
3410
+ * execution 文档字节稳定,sessionMirror 同款零迁移纪律);web 面无已登记公钥时「贴密钥」tab 显示
3411
+ * 引导并回落 env-NAME。多把并存合法(轮换窗口:新密文用新钥,旧密文仍可被旧私钥解)。 */
3412
+ publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
3413
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
3414
+ publicKeyId: z.ZodString;
3415
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
3416
+ publicKey: z.ZodString;
3417
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
3418
+ createdAt: z.ZodString;
3419
+ notes: z.ZodOptional<z.ZodString>;
3420
+ }, "strip", z.ZodTypeAny, {
3421
+ publicKeyId: string;
3422
+ publicKey: string;
3423
+ createdAt: string;
3424
+ notes?: string | undefined;
3425
+ }, {
3426
+ publicKeyId: string;
3427
+ publicKey: string;
3428
+ createdAt: string;
3429
+ notes?: string | undefined;
3430
+ }>, "many">>;
3146
3431
  }, "strip", z.ZodTypeAny, {
3147
3432
  required: boolean;
3148
3433
  allowedLanes: string[];
@@ -3150,6 +3435,38 @@ export declare const ExecutionPolicy: z.ZodObject<{
3150
3435
  required: boolean;
3151
3436
  engineUrl: string;
3152
3437
  } | undefined;
3438
+ publicKeys?: {
3439
+ publicKeyId: string;
3440
+ publicKey: string;
3441
+ createdAt: string;
3442
+ notes?: string | undefined;
3443
+ }[] | undefined;
3444
+ }, {
3445
+ required?: boolean | undefined;
3446
+ allowedLanes?: string[] | undefined;
3447
+ sessionMirror?: {
3448
+ engineUrl: string;
3449
+ required?: boolean | undefined;
3450
+ } | undefined;
3451
+ publicKeys?: {
3452
+ publicKeyId: string;
3453
+ publicKey: string;
3454
+ createdAt: string;
3455
+ notes?: string | undefined;
3456
+ }[] | undefined;
3457
+ }>, {
3458
+ required: boolean;
3459
+ allowedLanes: string[];
3460
+ sessionMirror?: {
3461
+ required: boolean;
3462
+ engineUrl: string;
3463
+ } | undefined;
3464
+ publicKeys?: {
3465
+ publicKeyId: string;
3466
+ publicKey: string;
3467
+ createdAt: string;
3468
+ notes?: string | undefined;
3469
+ }[] | undefined;
3153
3470
  }, {
3154
3471
  required?: boolean | undefined;
3155
3472
  allowedLanes?: string[] | undefined;
@@ -3157,6 +3474,12 @@ export declare const ExecutionPolicy: z.ZodObject<{
3157
3474
  engineUrl: string;
3158
3475
  required?: boolean | undefined;
3159
3476
  } | undefined;
3477
+ publicKeys?: {
3478
+ publicKeyId: string;
3479
+ publicKey: string;
3480
+ createdAt: string;
3481
+ notes?: string | undefined;
3482
+ }[] | undefined;
3160
3483
  }>;
3161
3484
  export type ExecutionPolicy = z.infer<typeof ExecutionPolicy>;
3162
3485
  /** projectId 形状:lowercase 规范 UUID。**宽读严写**([641]②,core 口径):读面/claim 收 generic
@@ -6126,8 +6449,36 @@ export declare const DOMAIN_SCHEMAS: {
6126
6449
  api: z.ZodDefault<z.ZodEnum<["openai-completions", "anthropic-messages"]>>;
6127
6450
  /** Gateway base URL (non-secret). Empty → the service's default gateway for that provider. */
6128
6451
  baseUrl: z.ZodUnion<[z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>, z.ZodLiteral<"">]>;
6129
- /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself. */
6452
+ /** NAME of the env var (in the SERVICE's env) holding this model's API key — never the key itself.
6453
+ * 专家模式(env-NAME 引用,web 面折叠进「高级」);默认模式见 {@link ModelEntry}.sealedApiKey。 */
6130
6454
  apiKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
6455
+ /** sealed-box 托管密文(0.10.5 默认模式「直接贴 key」;形状见 {@link SealedApiKey})。
6456
+ * **互斥语义(两者都设 = sealed 优先)**:`sealedApiKey` 与 `apiKeyEnv` 语义互斥——执行侧注入 env 时
6457
+ * sealed 解密值**压过** apiKeyEnv 引用(用户从专家模式切回默认贴 key 后,残留的 env-NAME 不得抢线)。
6458
+ * 刻意不 schema 层拒双设(拒了=切模式必须先清旧字段,UI/迁移两头找病;优先级裁决比互斥禁令便宜)。
6459
+ * ABSENT = 未托管(纯 env-NAME 现状),零迁移。 */
6460
+ sealedApiKey: z.ZodOptional<z.ZodObject<{
6461
+ /** sealed-box 密文,base64(形状校验 only——内容对 center 永远不透明)。 */
6462
+ ciphertext: z.ZodString;
6463
+ /** 加密所用执行域公钥的 id(execution.publicKeys 登记表的键)。 */
6464
+ publicKeyId: z.ZodString;
6465
+ /** 算法标识,v1 恒为 {@link SEALED_BOX_ALG}。 */
6466
+ alg: z.ZodLiteral<"libsodium-sealedbox-x25519">;
6467
+ /** 密文设置时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律);write-only
6468
+ * 的 masked GET 面靠它+publicKeyId 展示「已于 X 设置」——密文本体永不回读。optional:执行侧
6469
+ * 解密不依赖它,非 center 写面(本地 TOC 手写配置)缺省合法。 */
6470
+ setAt: z.ZodOptional<z.ZodString>;
6471
+ }, "strip", z.ZodTypeAny, {
6472
+ ciphertext: string;
6473
+ publicKeyId: string;
6474
+ alg: "libsodium-sealedbox-x25519";
6475
+ setAt?: string | undefined;
6476
+ }, {
6477
+ ciphertext: string;
6478
+ publicKeyId: string;
6479
+ alg: "libsodium-sealedbox-x25519";
6480
+ setAt?: string | undefined;
6481
+ }>>;
6131
6482
  /** Price/capability tier — fuels core 1.25 `selectModel({ tier })` role resolution. */
6132
6483
  tier: z.ZodDefault<z.ZodEnum<["cheap", "standard", "premium"]>>;
6133
6484
  reasoning: z.ZodDefault<z.ZodBoolean>;
@@ -6172,6 +6523,12 @@ export declare const DOMAIN_SCHEMAS: {
6172
6523
  enabled: boolean;
6173
6524
  baseUrl?: string | undefined;
6174
6525
  apiKeyEnv?: string | undefined;
6526
+ sealedApiKey?: {
6527
+ ciphertext: string;
6528
+ publicKeyId: string;
6529
+ alg: "libsodium-sealedbox-x25519";
6530
+ setAt?: string | undefined;
6531
+ } | undefined;
6175
6532
  contextWindow?: number | undefined;
6176
6533
  maxTokens?: number | undefined;
6177
6534
  cost?: {
@@ -6189,6 +6546,12 @@ export declare const DOMAIN_SCHEMAS: {
6189
6546
  api?: "openai-completions" | "anthropic-messages" | undefined;
6190
6547
  baseUrl?: string | undefined;
6191
6548
  apiKeyEnv?: string | undefined;
6549
+ sealedApiKey?: {
6550
+ ciphertext: string;
6551
+ publicKeyId: string;
6552
+ alg: "libsodium-sealedbox-x25519";
6553
+ setAt?: string | undefined;
6554
+ } | undefined;
6192
6555
  tier?: "cheap" | "standard" | "premium" | undefined;
6193
6556
  reasoning?: boolean | undefined;
6194
6557
  vision?: boolean | undefined;
@@ -6216,6 +6579,12 @@ export declare const DOMAIN_SCHEMAS: {
6216
6579
  enabled: boolean;
6217
6580
  baseUrl?: string | undefined;
6218
6581
  apiKeyEnv?: string | undefined;
6582
+ sealedApiKey?: {
6583
+ ciphertext: string;
6584
+ publicKeyId: string;
6585
+ alg: "libsodium-sealedbox-x25519";
6586
+ setAt?: string | undefined;
6587
+ } | undefined;
6219
6588
  contextWindow?: number | undefined;
6220
6589
  maxTokens?: number | undefined;
6221
6590
  cost?: {
@@ -6233,6 +6602,12 @@ export declare const DOMAIN_SCHEMAS: {
6233
6602
  api?: "openai-completions" | "anthropic-messages" | undefined;
6234
6603
  baseUrl?: string | undefined;
6235
6604
  apiKeyEnv?: string | undefined;
6605
+ sealedApiKey?: {
6606
+ ciphertext: string;
6607
+ publicKeyId: string;
6608
+ alg: "libsodium-sealedbox-x25519";
6609
+ setAt?: string | undefined;
6610
+ } | undefined;
6236
6611
  tier?: "cheap" | "standard" | "premium" | undefined;
6237
6612
  reasoning?: boolean | undefined;
6238
6613
  vision?: boolean | undefined;
@@ -6345,6 +6720,12 @@ export declare const DOMAIN_SCHEMAS: {
6345
6720
  enabled: boolean;
6346
6721
  baseUrl?: string | undefined;
6347
6722
  apiKeyEnv?: string | undefined;
6723
+ sealedApiKey?: {
6724
+ ciphertext: string;
6725
+ publicKeyId: string;
6726
+ alg: "libsodium-sealedbox-x25519";
6727
+ setAt?: string | undefined;
6728
+ } | undefined;
6348
6729
  contextWindow?: number | undefined;
6349
6730
  maxTokens?: number | undefined;
6350
6731
  cost?: {
@@ -6386,6 +6767,12 @@ export declare const DOMAIN_SCHEMAS: {
6386
6767
  api?: "openai-completions" | "anthropic-messages" | undefined;
6387
6768
  baseUrl?: string | undefined;
6388
6769
  apiKeyEnv?: string | undefined;
6770
+ sealedApiKey?: {
6771
+ ciphertext: string;
6772
+ publicKeyId: string;
6773
+ alg: "libsodium-sealedbox-x25519";
6774
+ setAt?: string | undefined;
6775
+ } | undefined;
6389
6776
  tier?: "cheap" | "standard" | "premium" | undefined;
6390
6777
  reasoning?: boolean | undefined;
6391
6778
  vision?: boolean | undefined;
@@ -6437,6 +6824,12 @@ export declare const DOMAIN_SCHEMAS: {
6437
6824
  enabled: boolean;
6438
6825
  baseUrl?: string | undefined;
6439
6826
  apiKeyEnv?: string | undefined;
6827
+ sealedApiKey?: {
6828
+ ciphertext: string;
6829
+ publicKeyId: string;
6830
+ alg: "libsodium-sealedbox-x25519";
6831
+ setAt?: string | undefined;
6832
+ } | undefined;
6440
6833
  contextWindow?: number | undefined;
6441
6834
  maxTokens?: number | undefined;
6442
6835
  cost?: {
@@ -6478,6 +6871,12 @@ export declare const DOMAIN_SCHEMAS: {
6478
6871
  api?: "openai-completions" | "anthropic-messages" | undefined;
6479
6872
  baseUrl?: string | undefined;
6480
6873
  apiKeyEnv?: string | undefined;
6874
+ sealedApiKey?: {
6875
+ ciphertext: string;
6876
+ publicKeyId: string;
6877
+ alg: "libsodium-sealedbox-x25519";
6878
+ setAt?: string | undefined;
6879
+ } | undefined;
6481
6880
  tier?: "cheap" | "standard" | "premium" | undefined;
6482
6881
  reasoning?: boolean | undefined;
6483
6882
  vision?: boolean | undefined;
@@ -8454,6 +8853,19 @@ export declare const DOMAIN_SCHEMAS: {
8454
8853
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
8455
8854
  * `=== true` opt-in check is orthogonal to that merge polarity. */
8456
8855
  allowObservers: z.ZodOptional<z.ZodBoolean>;
8856
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
8857
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
8858
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
8859
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
8860
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
8861
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
8862
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
8863
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
8864
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
8865
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
8866
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
8867
+ * classifier leg itself. */
8868
+ autoMode: z.ZodOptional<z.ZodBoolean>;
8457
8869
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
8458
8870
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
8459
8871
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -8466,6 +8878,7 @@ export declare const DOMAIN_SCHEMAS: {
8466
8878
  allowWorkflows?: boolean | undefined;
8467
8879
  allowFork?: boolean | undefined;
8468
8880
  allowObservers?: boolean | undefined;
8881
+ autoMode?: boolean | undefined;
8469
8882
  allowUltracode?: boolean | undefined;
8470
8883
  forceDurableGate?: boolean | undefined;
8471
8884
  }, {
@@ -8474,6 +8887,7 @@ export declare const DOMAIN_SCHEMAS: {
8474
8887
  allowWorkflows?: boolean | undefined;
8475
8888
  allowFork?: boolean | undefined;
8476
8889
  allowObservers?: boolean | undefined;
8890
+ autoMode?: boolean | undefined;
8477
8891
  allowUltracode?: boolean | undefined;
8478
8892
  forceDurableGate?: boolean | undefined;
8479
8893
  }>>;
@@ -8573,6 +8987,7 @@ export declare const DOMAIN_SCHEMAS: {
8573
8987
  allowWorkflows?: boolean | undefined;
8574
8988
  allowFork?: boolean | undefined;
8575
8989
  allowObservers?: boolean | undefined;
8990
+ autoMode?: boolean | undefined;
8576
8991
  allowUltracode?: boolean | undefined;
8577
8992
  forceDurableGate?: boolean | undefined;
8578
8993
  } | undefined;
@@ -8603,6 +9018,7 @@ export declare const DOMAIN_SCHEMAS: {
8603
9018
  allowWorkflows?: boolean | undefined;
8604
9019
  allowFork?: boolean | undefined;
8605
9020
  allowObservers?: boolean | undefined;
9021
+ autoMode?: boolean | undefined;
8606
9022
  allowUltracode?: boolean | undefined;
8607
9023
  forceDurableGate?: boolean | undefined;
8608
9024
  } | undefined;
@@ -8706,6 +9122,19 @@ export declare const DOMAIN_SCHEMAS: {
8706
9122
  * center wins). On compose across bundles, `false` (deny) still wins — see RUNTIME_CAP_STRICT; core's
8707
9123
  * `=== true` opt-in check is orthogonal to that merge polarity. */
8708
9124
  allowObservers: z.ZodOptional<z.ZodBoolean>;
9125
+ /** Per-principal ARM switch for the auto-mode CLASSIFIER (core 1.276 批2 seam `RuntimeCaps.autoMode`, 板
9126
+ * [672]④/[682]① — a surviving permission `ask` is routed to the small-model security classifier before any
9127
+ * human/durable resolution). ⚠️ Same INVERTED consumption polarity as `allowObservers`: core is `=== true`
9128
+ * explicit opt-in, default OFF — this key is the ENABLE line, not just a ceiling. Three-state semantics
9129
+ * (ABSENT ≠ false): ABSENT = center says nothing → key NOT emitted on the wire (core stays the SOLE default
9130
+ * source — never backfill absence into an explicit verdict); `true` = explicitly arm the classifier for this
9131
+ * principal (a no-op on a deployment without a wired classify leg — the capability gate lives in core);
9132
+ * `false` = explicit org deny. On compose across bundles `false` (deny) wins — see RUNTIME_CAP_STRICT;
9133
+ * core's `=== true` opt-in check is orthogonal to that merge polarity. DIVISION OF LABOR vs
9134
+ * {@link allowAutoMode}: `allowAutoMode` is the 准入 may-I ceiling on the USER-facing auto permission mode
9135
+ * (shell/settings face, tighten-only); `autoMode` is center's 部署 arm decision for the server-side
9136
+ * classifier leg itself. */
9137
+ autoMode: z.ZodOptional<z.ZodBoolean>;
8709
9138
  allowUltracode: z.ZodOptional<z.ZodBoolean>;
8710
9139
  /** Force this principal's run onto durable-approval (per-tool gate) — center's fleet-wide handle for CC-faithful
8711
9140
  * per-tool interception (K-3, core [318] confirmed it consumes this). Polarity is INVERTED vs the allow* caps:
@@ -8718,6 +9147,7 @@ export declare const DOMAIN_SCHEMAS: {
8718
9147
  allowWorkflows?: boolean | undefined;
8719
9148
  allowFork?: boolean | undefined;
8720
9149
  allowObservers?: boolean | undefined;
9150
+ autoMode?: boolean | undefined;
8721
9151
  allowUltracode?: boolean | undefined;
8722
9152
  forceDurableGate?: boolean | undefined;
8723
9153
  }, {
@@ -8726,6 +9156,7 @@ export declare const DOMAIN_SCHEMAS: {
8726
9156
  allowWorkflows?: boolean | undefined;
8727
9157
  allowFork?: boolean | undefined;
8728
9158
  allowObservers?: boolean | undefined;
9159
+ autoMode?: boolean | undefined;
8729
9160
  allowUltracode?: boolean | undefined;
8730
9161
  forceDurableGate?: boolean | undefined;
8731
9162
  }>>;
@@ -8761,6 +9192,7 @@ export declare const DOMAIN_SCHEMAS: {
8761
9192
  allowWorkflows?: boolean | undefined;
8762
9193
  allowFork?: boolean | undefined;
8763
9194
  allowObservers?: boolean | undefined;
9195
+ autoMode?: boolean | undefined;
8764
9196
  allowUltracode?: boolean | undefined;
8765
9197
  forceDurableGate?: boolean | undefined;
8766
9198
  } | undefined;
@@ -8794,6 +9226,7 @@ export declare const DOMAIN_SCHEMAS: {
8794
9226
  allowWorkflows?: boolean | undefined;
8795
9227
  allowFork?: boolean | undefined;
8796
9228
  allowObservers?: boolean | undefined;
9229
+ autoMode?: boolean | undefined;
8797
9230
  allowUltracode?: boolean | undefined;
8798
9231
  forceDurableGate?: boolean | undefined;
8799
9232
  } | undefined;
@@ -9091,6 +9524,7 @@ export declare const DOMAIN_SCHEMAS: {
9091
9524
  allowWorkflows?: boolean | undefined;
9092
9525
  allowFork?: boolean | undefined;
9093
9526
  allowObservers?: boolean | undefined;
9527
+ autoMode?: boolean | undefined;
9094
9528
  allowUltracode?: boolean | undefined;
9095
9529
  forceDurableGate?: boolean | undefined;
9096
9530
  } | undefined;
@@ -9163,6 +9597,7 @@ export declare const DOMAIN_SCHEMAS: {
9163
9597
  allowWorkflows?: boolean | undefined;
9164
9598
  allowFork?: boolean | undefined;
9165
9599
  allowObservers?: boolean | undefined;
9600
+ autoMode?: boolean | undefined;
9166
9601
  allowUltracode?: boolean | undefined;
9167
9602
  forceDurableGate?: boolean | undefined;
9168
9603
  } | undefined;
@@ -9212,6 +9647,7 @@ export declare const DOMAIN_SCHEMAS: {
9212
9647
  allowWorkflows?: boolean | undefined;
9213
9648
  allowFork?: boolean | undefined;
9214
9649
  allowObservers?: boolean | undefined;
9650
+ autoMode?: boolean | undefined;
9215
9651
  allowUltracode?: boolean | undefined;
9216
9652
  forceDurableGate?: boolean | undefined;
9217
9653
  } | undefined;
@@ -9240,6 +9676,7 @@ export declare const DOMAIN_SCHEMAS: {
9240
9676
  allowWorkflows?: boolean | undefined;
9241
9677
  allowFork?: boolean | undefined;
9242
9678
  allowObservers?: boolean | undefined;
9679
+ autoMode?: boolean | undefined;
9243
9680
  allowUltracode?: boolean | undefined;
9244
9681
  forceDurableGate?: boolean | undefined;
9245
9682
  } | undefined;
@@ -9333,6 +9770,7 @@ export declare const DOMAIN_SCHEMAS: {
9333
9770
  allowWorkflows?: boolean | undefined;
9334
9771
  allowFork?: boolean | undefined;
9335
9772
  allowObservers?: boolean | undefined;
9773
+ autoMode?: boolean | undefined;
9336
9774
  allowUltracode?: boolean | undefined;
9337
9775
  forceDurableGate?: boolean | undefined;
9338
9776
  } | undefined;
@@ -9405,6 +9843,7 @@ export declare const DOMAIN_SCHEMAS: {
9405
9843
  allowWorkflows?: boolean | undefined;
9406
9844
  allowFork?: boolean | undefined;
9407
9845
  allowObservers?: boolean | undefined;
9846
+ autoMode?: boolean | undefined;
9408
9847
  allowUltracode?: boolean | undefined;
9409
9848
  forceDurableGate?: boolean | undefined;
9410
9849
  } | undefined;
@@ -9454,6 +9893,7 @@ export declare const DOMAIN_SCHEMAS: {
9454
9893
  allowWorkflows?: boolean | undefined;
9455
9894
  allowFork?: boolean | undefined;
9456
9895
  allowObservers?: boolean | undefined;
9896
+ autoMode?: boolean | undefined;
9457
9897
  allowUltracode?: boolean | undefined;
9458
9898
  forceDurableGate?: boolean | undefined;
9459
9899
  } | undefined;
@@ -9482,6 +9922,7 @@ export declare const DOMAIN_SCHEMAS: {
9482
9922
  allowWorkflows?: boolean | undefined;
9483
9923
  allowFork?: boolean | undefined;
9484
9924
  allowObservers?: boolean | undefined;
9925
+ autoMode?: boolean | undefined;
9485
9926
  allowUltracode?: boolean | undefined;
9486
9927
  forceDurableGate?: boolean | undefined;
9487
9928
  } | undefined;
@@ -9546,7 +9987,7 @@ export declare const DOMAIN_SCHEMAS: {
9546
9987
  }[] | undefined;
9547
9988
  } | undefined;
9548
9989
  }>;
9549
- readonly execution: z.ZodObject<{
9990
+ readonly execution: z.ZodEffects<z.ZodObject<{
9550
9991
  /** true = tasks under this scope MUST run in a sandbox / controlled execution lane (the consuming
9551
9992
  * shell locks sandbox-enabled by policy; user settings can't turn it off — CC 同款语义). */
9552
9993
  required: z.ZodDefault<z.ZodBoolean>;
@@ -9568,6 +10009,28 @@ export declare const DOMAIN_SCHEMAS: {
9568
10009
  engineUrl: string;
9569
10010
  required?: boolean | undefined;
9570
10011
  }>>;
10012
+ /** 执行域 sealed-box 公钥登记表(0.10.5)。**optional 无 default,ABSENT = 未登记**(0.8–0.10 存量
10013
+ * execution 文档字节稳定,sessionMirror 同款零迁移纪律);web 面无已登记公钥时「贴密钥」tab 显示
10014
+ * 引导并回落 env-NAME。多把并存合法(轮换窗口:新密文用新钥,旧密文仍可被旧私钥解)。 */
10015
+ publicKeys: z.ZodOptional<z.ZodArray<z.ZodObject<{
10016
+ /** 公钥 id(密文的 publicKeyId 指向此键;登记表内唯一)。 */
10017
+ publicKeyId: z.ZodString;
10018
+ /** X25519 公钥,base64(32 字节 → 恒 44 字符含 padding)。 */
10019
+ publicKey: z.ZodString;
10020
+ /** 登记时刻(ISO)。center 写面 server 端盖章(projects.registeredAt 同款纪律)。 */
10021
+ createdAt: z.ZodString;
10022
+ notes: z.ZodOptional<z.ZodString>;
10023
+ }, "strip", z.ZodTypeAny, {
10024
+ publicKeyId: string;
10025
+ publicKey: string;
10026
+ createdAt: string;
10027
+ notes?: string | undefined;
10028
+ }, {
10029
+ publicKeyId: string;
10030
+ publicKey: string;
10031
+ createdAt: string;
10032
+ notes?: string | undefined;
10033
+ }>, "many">>;
9571
10034
  }, "strip", z.ZodTypeAny, {
9572
10035
  required: boolean;
9573
10036
  allowedLanes: string[];
@@ -9575,6 +10038,12 @@ export declare const DOMAIN_SCHEMAS: {
9575
10038
  required: boolean;
9576
10039
  engineUrl: string;
9577
10040
  } | undefined;
10041
+ publicKeys?: {
10042
+ publicKeyId: string;
10043
+ publicKey: string;
10044
+ createdAt: string;
10045
+ notes?: string | undefined;
10046
+ }[] | undefined;
9578
10047
  }, {
9579
10048
  required?: boolean | undefined;
9580
10049
  allowedLanes?: string[] | undefined;
@@ -9582,6 +10051,38 @@ export declare const DOMAIN_SCHEMAS: {
9582
10051
  engineUrl: string;
9583
10052
  required?: boolean | undefined;
9584
10053
  } | undefined;
10054
+ publicKeys?: {
10055
+ publicKeyId: string;
10056
+ publicKey: string;
10057
+ createdAt: string;
10058
+ notes?: string | undefined;
10059
+ }[] | undefined;
10060
+ }>, {
10061
+ required: boolean;
10062
+ allowedLanes: string[];
10063
+ sessionMirror?: {
10064
+ required: boolean;
10065
+ engineUrl: string;
10066
+ } | undefined;
10067
+ publicKeys?: {
10068
+ publicKeyId: string;
10069
+ publicKey: string;
10070
+ createdAt: string;
10071
+ notes?: string | undefined;
10072
+ }[] | undefined;
10073
+ }, {
10074
+ required?: boolean | undefined;
10075
+ allowedLanes?: string[] | undefined;
10076
+ sessionMirror?: {
10077
+ engineUrl: string;
10078
+ required?: boolean | undefined;
10079
+ } | undefined;
10080
+ publicKeys?: {
10081
+ publicKeyId: string;
10082
+ publicKey: string;
10083
+ createdAt: string;
10084
+ notes?: string | undefined;
10085
+ }[] | undefined;
9585
10086
  }>;
9586
10087
  readonly projects: z.ZodEffects<z.ZodObject<{
9587
10088
  /** 键=projectId({@link PROJECT_ID_REGEX},generic lowercase UUID——宽读);tenant 半边=center