@sema-ai/registry-core 0.10.3

package/dist/reader.d.ts

@@ -0,0 +1,19 @@
+import type { DomainConfig, DomainName, EffectiveConfig } from "./types.js";
+/**
+ * The MINIMAL read surface a consumer needs to resolve config — a local file source (FileConfigStore), the
+ * TOC desktop, or a test fixture implements this WITHOUT stubbing the ~32 publish/RBAC/worker-status/lifecycle
+ * methods of sema-registry's full ConfigStore.
+ *
+ * sema-registry's fat `ConfigStore` should `extends ConfigReader` (every store impl already has all three
+ * methods, so the extension is satisfied automatically). The signatures here MUST match store.ts exactly
+ * (incl. the `<K extends DomainName>` generic and the `| undefined` on getDomain) or that `extends` fails.
+ */
+export interface ConfigReader {
+    /** The stored payload for a domain, validated; `undefined` if never set. */
+    getDomain<K extends DomainName>(domain: K): Promise<DomainConfig[K] | undefined>;
+    /** All domains merged (defaults for unset) + a monotonic version — what a consumer pulls. */
+    getEffective(): Promise<EffectiveConfig>;
+    /** The current monotonic version ALONE — a cheap read so a conditional poll can short-circuit. */
+    getVersion(): Promise<number>;
+}
+//# sourceMappingURL=reader.d.ts.map

package/dist/reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,4EAA4E;IAC5E,SAAS,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IACjF,6FAA6F;IAC7F,YAAY,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACzC,kGAAkG;IAClG,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B"}

package/dist/reader.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reader.js.map

package/dist/reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.js","sourceRoot":"","sources":["../src/reader.ts"],"names":[],"mappings":""}

package/dist/remote-exec.d.ts

@@ -0,0 +1,275 @@
+/**
+ * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
+ *
+ * Per Clay's decision the exec layer is user-configurable & pluggable. This SCHEMA is a FORWARD-COMPATIBLE
+ * SUPERSET: it carries both the backends sema-server already implements today AND the TOC single-machine
+ * backends Clay added (the service implements those in PHASES — host + e2b first, local/remote-docker
+ * fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
+ *   FLEET (implemented today, sema-server/src/config.ts):
+ *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
+ *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
+ *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
+ *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
+ *   TOC single-machine (Clay; service implements in phases — macOS + Linux first):
+ *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
+ *                     agent). No isolation. macOS/Linux.
+ *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
+ *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
+ * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
+ * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
+ * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ */
+import { z } from "zod";
+export declare const RemoteExecSpec: z.ZodDiscriminatedUnion<"provider", [z.ZodObject<{
+    provider: z.ZodLiteral<"host">;
+    /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ sema-server's resolved
+     *  `workspaceBase` — the adapter runs each task under `<workdir>/ai-agent-host-<id>`.) */
+    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /** Optional writable-path allowlist bounding what the host-exec tools may touch (defence for a TOC box). */
+    allowedPaths: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    /** Shell to spawn (absent = the platform default). */
+    shell: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
+     *  task (mirrors e2b/k8s `timeoutMs`; = sema-server's `commandTimeoutMs`). Absent = adapter default. */
+    commandTimeoutMs: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    provider: "host";
+    workdir?: string | undefined;
+    allowedPaths?: string[] | undefined;
+    shell?: string | undefined;
+    commandTimeoutMs?: number | undefined;
+}, {
+    provider: "host";
+    workdir?: string | undefined;
+    allowedPaths?: string[] | undefined;
+    shell?: string | undefined;
+    commandTimeoutMs?: number | undefined;
+}>, z.ZodObject<{
+    image: z.ZodEffects<z.ZodString, string, string>;
+    memory: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    cpus: z.ZodOptional<z.ZodNumber>;
+    network: z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>;
+    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    provider: z.ZodLiteral<"local-docker">;
+}, "strip", z.ZodTypeAny, {
+    provider: "local-docker";
+    image: string;
+    memory?: string | undefined;
+    workdir?: string | undefined;
+    cpus?: number | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
+    mountPath?: string | undefined;
+}, {
+    provider: "local-docker";
+    image: string;
+    memory?: string | undefined;
+    workdir?: string | undefined;
+    cpus?: number | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
+    mountPath?: string | undefined;
+}>, z.ZodObject<{
+    /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
+     *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
+     *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
+    dockerHost: z.ZodEffects<z.ZodString, string, string>;
+    /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
+    tlsCertEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    tlsKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    tlsCaEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
+    sshKeyEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    image: z.ZodEffects<z.ZodString, string, string>;
+    memory: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    cpus: z.ZodOptional<z.ZodNumber>;
+    network: z.ZodOptional<z.ZodEnum<["none", "bridge", "host"]>>;
+    workdir: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    provider: z.ZodLiteral<"remote-docker">;
+}, "strip", z.ZodTypeAny, {
+    provider: "remote-docker";
+    image: string;
+    dockerHost: string;
+    memory?: string | undefined;
+    workdir?: string | undefined;
+    cpus?: number | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
+    mountPath?: string | undefined;
+    tlsCertEnv?: string | undefined;
+    tlsKeyEnv?: string | undefined;
+    tlsCaEnv?: string | undefined;
+    sshKeyEnv?: string | undefined;
+}, {
+    provider: "remote-docker";
+    image: string;
+    dockerHost: string;
+    memory?: string | undefined;
+    workdir?: string | undefined;
+    cpus?: number | undefined;
+    network?: "host" | "none" | "bridge" | undefined;
+    mountPath?: string | undefined;
+    tlsCertEnv?: string | undefined;
+    tlsKeyEnv?: string | undefined;
+    tlsCaEnv?: string | undefined;
+    sshKeyEnv?: string | undefined;
+}>, z.ZodObject<{
+    provider: z.ZodLiteral<"e2b">;
+    /** env-NAME holding the E2B API key (service: E2B_API_KEY). NEVER the key. */
+    apiKeyEnv: z.ZodEffects<z.ZodString, string, string>;
+    /** E2B template id (service: E2B_TEMPLATE). */
+    template: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    /** Idle/liveness bound for a command (service: E2B_LIVENESS_MS, the [49] hang-fix). */
+    livenessMs: z.ZodOptional<z.ZodNumber>;
+    allowInternetAccess: z.ZodOptional<z.ZodBoolean>;
+    /** Which of THIS process's env-NAMEs to forward into the sandbox (service: E2B_SANDBOX_ENV, a CSV of NAMEs). */
+    sandboxEnv: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    provider: "e2b";
+    apiKeyEnv: string;
+    template?: string | undefined;
+    timeoutMs?: number | undefined;
+    livenessMs?: number | undefined;
+    allowInternetAccess?: boolean | undefined;
+    sandboxEnv?: string[] | undefined;
+}, {
+    provider: "e2b";
+    apiKeyEnv: string;
+    template?: string | undefined;
+    timeoutMs?: number | undefined;
+    livenessMs?: number | undefined;
+    allowInternetAccess?: boolean | undefined;
+    sandboxEnv?: string[] | undefined;
+}>, z.ZodObject<{
+    provider: z.ZodLiteral<"k8s">;
+    /** Sandbox container image (service: K8S_SANDBOX_IMAGE). Required so a run is reproducible. */
+    image: z.ZodEffects<z.ZodString, string, string>;
+    /** Kube API URL (service: K8S_API_URL); absent → in-cluster service account. NO embedded credentials. */
+    apiUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /** env-NAME holding the kube bearer token (service: K8S_TOKEN). NEVER the token. */
+    tokenEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /** env-NAME holding the base64 CA cert (service: K8S_CA_CERT_B64). NEVER the cert bytes. */
+    caCertEnv: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    insecureTls: z.ZodOptional<z.ZodBoolean>;
+    namespace: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    runtimeClass: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    /** Sandbox pod resource limits (service: K8S_MEMORY / K8S_CPU; adapter defaults 2Gi / 1 cpu). */
+    memory: z.ZodOptional<z.ZodString>;
+    cpu: z.ZodOptional<z.ZodString>;
+    /** Workspace-durable suspend/resume via MinIO/S3 (service: MINIO_*). Creds are env-NAME refs; the sandbox
+     *  only ever sees a presigned URL. accessKeyEnv + secretKeyEnv required to enable (mirrors the service's
+     *  "all three of endpoint/access/secret required" gate). */
+    s3Snapshot: z.ZodOptional<z.ZodObject<{
+        endpoint: z.ZodEffects<z.ZodString, string, string>;
+        bucket: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        accessKeyEnv: z.ZodEffects<z.ZodString, string, string>;
+        secretKeyEnv: z.ZodEffects<z.ZodString, string, string>;
+        region: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        keyPrefix: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        presignTtlSec: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        endpoint: string;
+        accessKeyEnv: string;
+        secretKeyEnv: string;
+        bucket?: string | undefined;
+        region?: string | undefined;
+        keyPrefix?: string | undefined;
+        presignTtlSec?: number | undefined;
+    }, {
+        endpoint: string;
+        accessKeyEnv: string;
+        secretKeyEnv: string;
+        bucket?: string | undefined;
+        region?: string | undefined;
+        keyPrefix?: string | undefined;
+        presignTtlSec?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    provider: "k8s";
+    image: string;
+    cpu?: string | undefined;
+    memory?: string | undefined;
+    mountPath?: string | undefined;
+    timeoutMs?: number | undefined;
+    apiUrl?: string | undefined;
+    tokenEnv?: string | undefined;
+    caCertEnv?: string | undefined;
+    insecureTls?: boolean | undefined;
+    namespace?: string | undefined;
+    runtimeClass?: string | undefined;
+    s3Snapshot?: {
+        endpoint: string;
+        accessKeyEnv: string;
+        secretKeyEnv: string;
+        bucket?: string | undefined;
+        region?: string | undefined;
+        keyPrefix?: string | undefined;
+        presignTtlSec?: number | undefined;
+    } | undefined;
+}, {
+    provider: "k8s";
+    image: string;
+    cpu?: string | undefined;
+    memory?: string | undefined;
+    mountPath?: string | undefined;
+    timeoutMs?: number | undefined;
+    apiUrl?: string | undefined;
+    tokenEnv?: string | undefined;
+    caCertEnv?: string | undefined;
+    insecureTls?: boolean | undefined;
+    namespace?: string | undefined;
+    runtimeClass?: string | undefined;
+    s3Snapshot?: {
+        endpoint: string;
+        accessKeyEnv: string;
+        secretKeyEnv: string;
+        bucket?: string | undefined;
+        region?: string | undefined;
+        keyPrefix?: string | undefined;
+        presignTtlSec?: number | undefined;
+    } | undefined;
+}>, z.ZodObject<{
+    provider: z.ZodLiteral<"ssh">;
+    host: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    port: z.ZodOptional<z.ZodNumber>;
+    username: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+    /** env-NAME holding the SSH private key (service: SSH_PRIVATE_KEY). NEVER the key value. */
+    privateKeyEnv: z.ZodEffects<z.ZodString, string, string>;
+    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    provider: "ssh";
+    host: string;
+    username: string;
+    privateKeyEnv: string;
+    mountPath?: string | undefined;
+    port?: number | undefined;
+}, {
+    provider: "ssh";
+    host: string;
+    username: string;
+    privateKeyEnv: string;
+    mountPath?: string | undefined;
+    port?: number | undefined;
+}>, z.ZodObject<{
+    provider: z.ZodLiteral<"adb">;
+    serial: z.ZodEffects<z.ZodString, string, string>;
+    adbPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    mountPath: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strip", z.ZodTypeAny, {
+    provider: "adb";
+    serial: string;
+    mountPath?: string | undefined;
+    adbPath?: string | undefined;
+}, {
+    provider: "adb";
+    serial: string;
+    mountPath?: string | undefined;
+    adbPath?: string | undefined;
+}>]>;
+export type RemoteExecSpec = z.infer<typeof RemoteExecSpec>;
+//# sourceMappingURL=remote-exec.d.ts.map

package/dist/remote-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-exec.d.ts","sourceRoot":"","sources":["../src/remote-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqBxB,eAAO,MAAM,cAAc;;IAIvB;8FAC0F;;IAE1F,4GAA4G;;IAE5G,sDAAsD;;IAEtD;4GACwG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAaxG;;4EAEwE;;IAmCxE,mEAAmE;;;;IAInE,2FAA2F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAO3F,8EAA8E;;IAE9E,+CAA+C;;;IAG/C,uFAAuF;;;IAGvF,gHAAgH;;;;;;;;;;;;;;;;;;;;IAOhH,+FAA+F;;IAE/F,yGAAyG;;IAEzG,oFAAoF;;IAEpF,4FAA4F;;;;;;;IAO5F,iGAAiG;;;IAGjG;;gEAE4D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsB5D,4FAA4F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAY9F,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/remote-exec.js

@@ -0,0 +1,183 @@
+/**
+ * `remoteExec` — the execution-substrate contract (NET-NEW; not part of DOMAIN_SCHEMAS today).
+ *
+ * Per Clay's decision the exec layer is user-configurable & pluggable. This SCHEMA is a FORWARD-COMPATIBLE
+ * SUPERSET: it carries both the backends sema-server already implements today AND the TOC single-machine
+ * backends Clay added (the service implements those in PHASES — host + e2b first, local/remote-docker
+ * fast-follow). The schema LEADS; runtime support is phased. The discriminator is `provider`:
+ *   FLEET (implemented today, sema-server/src/config.ts):
+ *   - `e2b`           per-task E2B Firecracker VM (isolated, suspendable). The default code-agent worker.
+ *   - `k8s`           per-task Kata pod on our k3s (isolated, NOT suspendable). Self-hosted sandbox lane.
+ *   - `ssh`           a real host over SSH (NOT isolated/suspendable). AI-orchestrated batch deploy.
+ *   - `adb`           a real device over ADB (NOT isolated/suspendable). On-device APP testing.
+ *   TOC single-machine (Clay; service implements in phases — macOS + Linux first):
+ *   - `host`          run tools DIRECTLY on this machine, no container (the TOC default, like a local coding
+ *                     agent). No isolation. macOS/Linux.
+ *   - `local-docker`  containers on THIS machine's docker (isolation for parallel/untrusted fan-out).
+ *   - `remote-docker` a user-specified REMOTE host's docker (offload; isolated).
+ *
+ * SECRET BOUNDARY (identical to the rest of the contract): every secret VALUE the consumer reads from its own
+ * env (E2B_API_KEY, K8S_TOKEN, SSH_PRIVATE_KEY, MINIO_*, the remote-docker TLS/SSH creds) is carried here as an
+ * env-NAME ref (the `ENV_NAME` regex from types.ts) — NEVER a literal value. The consumer resolves NAME → value
+ * from its own env (service env / k8s secret / the TOC local `.env`), so this package never carries a
+ * credential. This is SCHEMA + secret-as-env-NAME ONLY; the service owns the adapter implementations.
+ */
+import { z } from "zod";
+import { ENV_NAME, K8S_QUANTITY, NON_SECRET_URL, TCP_PORT, containsSecretToken, hasNul, urlQueryFragmentHasSecret } from "./types.js";
+/** A non-empty exec-bound string (an image / path / shell / arg the adapter feeds to spawn()/fs). Rejects a NUL
+ *  byte uniformly — a NUL validates here but makes Node throw at spawn/boot (fail-OPEN → runtime crash). R20. */
+const execStr = z.string().min(1).refine((s) => !hasNul(s), "must not contain a NUL byte");
+/** Container knobs shared by the two docker lanes (local-docker / remote-docker). `network` defaults to
+ *  `none` at the adapter (the safe posture for untrusted code — see DUAL-MODE-DESIGN.md). */
+const DOCKER_FIELDS = {
+    /** Sandbox image (required — a run must be reproducible). */
+    image: execStr,
+    /** docker `--memory` (e.g. "2g"). */
+    memory: execStr.optional(),
+    /** docker `--cpus` (e.g. 1.5). */
+    cpus: z.number().finite().positive().optional(),
+    network: z.enum(["none", "bridge", "host"]).optional(),
+    workdir: execStr.optional(),
+    mountPath: execStr.optional(),
+};
+export const RemoteExecSpec = z.discriminatedUnion("provider", [
+    // ── host: run on THIS machine, no container (TOC default; macOS/Linux). No isolation, no secrets.
+    z.object({
+        provider: z.literal("host"),
+        /** Working ROOT for the agent's tools; absent = the workspace/cwd. (≡ sema-server's resolved
+         *  `workspaceBase` — the adapter runs each task under `<workdir>/ai-agent-host-<id>`.) */
+        workdir: execStr.optional(),
+        /** Optional writable-path allowlist bounding what the host-exec tools may touch (defence for a TOC box). */
+        allowedPaths: z.array(execStr).optional(),
+        /** Shell to spawn (absent = the platform default). */
+        shell: execStr.optional(),
+        /** Per-COMMAND timeout (ms) for the host lane — host is long-lived so this bounds a single exec, not the
+         *  task (mirrors e2b/k8s `timeoutMs`; = sema-server's `commandTimeoutMs`). Absent = adapter default. */
+        commandTimeoutMs: z.number().int().positive().optional(),
+    }),
+    // ── local-docker: containers on this machine's docker (isolated; enables parallel fan-out). No secrets
+    //    (local docker.sock). Service implements this fast-follow after host.
+    z.object({ provider: z.literal("local-docker"), ...DOCKER_FIELDS }),
+    // ── remote-docker: a user-specified remote host's docker. Creds (TLS for tcp://, key for ssh://) are
+    //    env-NAME refs, never bytes. Service implements this fast-follow.
+    z.object({
+        provider: z.literal("remote-docker"),
+        ...DOCKER_FIELDS,
+        /** The remote docker endpoint — a DOCKER_HOST url: `ssh://user@host` or `tcp://host:2376`. A `user@` is OK
+         *  (it's the ssh target, not a secret); an embedded PASSWORD is rejected — credentials go in the env-NAME
+         *  fields below, NEVER in the URL (the secret-as-env-NAME boundary). */
+        dockerHost: z
+            .string()
+            .min(1)
+            .refine((s) => {
+            if (hasNul(s))
+                return false; // a NUL in DOCKER_HOST crashes the adapter at spawn — reject (R20)
+            try {
+                const u = new URL(s);
+                if (u.password)
+                    return false; // a `user@` ssh target is fine; an embedded PASSWORD is not
+                // a secret can also ride in the username (`ssh://sk-live-…@host`) or the query/fragment — scan them
+                // (Round-4 codex). The userinfo password is already rejected above.
+                let user = u.username;
+                try {
+                    user = decodeURIComponent(u.username);
+                }
+                catch {
+                    /* keep raw */
+                }
+                if (user && containsSecretToken(user))
+                    return false;
+                return !urlQueryFragmentHasSecret(u);
+            }
+            catch {
+                // unparseable (e.g. a bare socket path) → reject a `:pw@` userinfo-password pattern AND any
+                // secret-shaped TOKEN anywhere (containsSecretToken tokenizes on URL/query delimiters incl =&, so a
+                // mid-string `/var/run/sk-…` or `socket?token=sk-…` is caught despite the ^-anchored regex). R4/5 codex.
+                if (/:[^/@]+@/.test(s))
+                    return false;
+                if (containsSecretToken(s))
+                    return false;
+                try {
+                    return !containsSecretToken(decodeURIComponent(s)); // also catch percent-encoded secrets
+                }
+                catch {
+                    return true; // malformed %-escape → the raw scan above already passed
+                }
+            }
+        }, "no credentials in dockerHost (password / secret-shaped user/query/fragment) — put them in the env-NAME fields (sshKeyEnv / tls*Env)"),
+        /** env-NAMEs for a tcp+TLS endpoint (NEVER the cert/key bytes). */
+        tlsCertEnv: ENV_NAME.optional(),
+        tlsKeyEnv: ENV_NAME.optional(),
+        tlsCaEnv: ENV_NAME.optional(),
+        /** env-NAME for the SSH private key when dockerHost is `ssh://…` (NEVER the key value). */
+        sshKeyEnv: ENV_NAME.optional(),
+    }),
+    // ── e2b: the user's E2B account (service provider "e2b"; REMOTE_EXEC=e2b + E2B_API_KEY).
+    z.object({
+        provider: z.literal("e2b"),
+        /** env-NAME holding the E2B API key (service: E2B_API_KEY). NEVER the key. */
+        apiKeyEnv: ENV_NAME,
+        /** E2B template id (service: E2B_TEMPLATE). */
+        template: execStr.optional(),
+        timeoutMs: z.number().int().positive().optional(),
+        /** Idle/liveness bound for a command (service: E2B_LIVENESS_MS, the [49] hang-fix). */
+        livenessMs: z.number().int().positive().optional(),
+        allowInternetAccess: z.boolean().optional(),
+        /** Which of THIS process's env-NAMEs to forward into the sandbox (service: E2B_SANDBOX_ENV, a CSV of NAMEs). */
+        sandboxEnv: z.array(ENV_NAME).optional(),
+    }),
+    // ── k8s: per-task Kata pod (service provider "k8s"; REMOTE_EXEC=k8s + K8S_SANDBOX_IMAGE).
+    z.object({
+        provider: z.literal("k8s"),
+        /** Sandbox container image (service: K8S_SANDBOX_IMAGE). Required so a run is reproducible. */
+        image: execStr,
+        /** Kube API URL (service: K8S_API_URL); absent → in-cluster service account. NO embedded credentials. */
+        apiUrl: NON_SECRET_URL.optional(),
+        /** env-NAME holding the kube bearer token (service: K8S_TOKEN). NEVER the token. */
+        tokenEnv: ENV_NAME.optional(),
+        /** env-NAME holding the base64 CA cert (service: K8S_CA_CERT_B64). NEVER the cert bytes. */
+        caCertEnv: ENV_NAME.optional(),
+        insecureTls: z.boolean().optional(),
+        namespace: execStr.optional(),
+        runtimeClass: execStr.optional(),
+        mountPath: execStr.optional(),
+        timeoutMs: z.number().int().positive().optional(),
+        /** Sandbox pod resource limits (service: K8S_MEMORY / K8S_CPU; adapter defaults 2Gi / 1 cpu). */
+        memory: K8S_QUANTITY.optional(),
+        cpu: K8S_QUANTITY.optional(),
+        /** Workspace-durable suspend/resume via MinIO/S3 (service: MINIO_*). Creds are env-NAME refs; the sandbox
+         *  only ever sees a presigned URL. accessKeyEnv + secretKeyEnv required to enable (mirrors the service's
+         *  "all three of endpoint/access/secret required" gate). */
+        s3Snapshot: z
+            .object({
+            endpoint: NON_SECRET_URL, // S3/MinIO endpoint — creds go in accessKeyEnv/secretKeyEnv, never the URL
+            bucket: execStr.optional(),
+            accessKeyEnv: ENV_NAME,
+            secretKeyEnv: ENV_NAME,
+            region: execStr.optional(),
+            keyPrefix: execStr.optional(),
+            presignTtlSec: z.number().int().positive().optional(),
+        })
+            .optional(),
+    }),
+    // ── ssh: a real host over SSH (service provider "ssh"; REMOTE_EXEC=ssh + SSH_HOST/SSH_USER/SSH_PRIVATE_KEY).
+    z.object({
+        provider: z.literal("ssh"),
+        // host + username are persisted to config.d/remote-exec.json — scan for a secret-shaped literal, same as the
+        // remote-docker dockerHost scans its embedded ssh user (a secret must go in privateKeyEnv, not the login). R14.
+        host: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh host — credentials go in privateKeyEnv"),
+        port: TCP_PORT.optional(),
+        username: execStr.refine((s) => !containsSecretToken(s), "no secret literal in ssh username — credentials go in privateKeyEnv"),
+        /** env-NAME holding the SSH private key (service: SSH_PRIVATE_KEY). NEVER the key value. */
+        privateKeyEnv: ENV_NAME,
+        mountPath: execStr.optional(),
+    }),
+    // ── adb: a real device over ADB (service provider "adb"; REMOTE_EXEC=adb + ADB_SERIAL). No secrets.
+    z.object({
+        provider: z.literal("adb"),
+        serial: execStr,
+        adbPath: execStr.optional(),
+        mountPath: execStr.optional(),
+    }),
+]);
+//# sourceMappingURL=remote-exec.js.map

package/dist/remote-exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-exec.js","sourceRoot":"","sources":["../src/remote-exec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEtI;iHACiH;AACjH,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;AAE3F;6FAC6F;AAC7F,MAAM,aAAa,GAAG;IACpB,6DAA6D;IAC7D,KAAK,EAAE,OAAO;IACd,qCAAqC;IACrC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC1B,kCAAkC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtD,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IAC7D,mGAAmG;IACnG,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3B;kGAC0F;QAC1F,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC3B,4GAA4G;QAC5G,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QACzC,sDAAsD;QACtD,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE;QACzB;gHACwG;QACxG,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACzD,CAAC;IAEF,wGAAwG;IACxG,0EAA0E;IAC1E,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC;IAEnE,sGAAsG;IACtG,sEAAsE;IACtE,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QACpC,GAAG,aAAa;QAChB;;gFAEwE;QACxE,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,MAAM,CACL,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,mEAAmE;YAChG,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrB,IAAI,CAAC,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC,CAAC,4DAA4D;gBAC1F,oGAAoG;gBACpG,oEAAoE;gBACpE,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACpD,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,4FAA4F;gBAC5F,oGAAoG;gBACpG,yGAAyG;gBACzG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACrC,IAAI,mBAAmB,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzC,IAAI,CAAC;oBACH,OAAO,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qCAAqC;gBAC3F,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,yDAAyD;gBACxE,CAAC;YACH,CAAC;QACH,CAAC,EACD,qIAAqI,CACtI;QACH,mEAAmE;QACnE,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAC/B,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAC9B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAC7B,2FAA2F;QAC3F,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE;KAC/B,CAAC;IAEF,0FAA0F;IAC1F,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,8EAA8E;QAC9E,SAAS,EAAE,QAAQ;QACnB,+CAA+C;QAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,uFAAuF;QACvF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC3C,gHAAgH;QAChH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;IAEF,2FAA2F;IAC3F,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,+FAA+F;QAC/F,KAAK,EAAE,OAAO;QACd,yGAAyG;QACzG,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE;QACjC,oFAAoF;QACpF,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAC7B,4FAA4F;QAC5F,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACnC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC7B,YAAY,EAAE,OAAO,CAAC,QAAQ,EAAE;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,iGAAiG;QACjG,MAAM,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC/B,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE;QAC5B;;oEAE4D;QAC5D,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,QAAQ,EAAE,cAAc,EAAE,2EAA2E;YACrG,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC1B,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC1B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;YAC7B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;SACtD,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;IAEF,8GAA8G;IAC9G,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,6GAA6G;QAC7G,gHAAgH;QAChH,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,iEAAiE,CAAC;QACvH,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,qEAAqE,CAAC;QAC/H,4FAA4F;QAC5F,aAAa,EAAE,QAAQ;QACvB,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;KAC9B,CAAC;IAEF,qGAAqG;IACrG,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;KAC9B,CAAC;CACH,CAAC,CAAC"}

package/dist/resolve-roster.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Per-worker roster resolution (docs/MULTI-ROSTER.md). Turns the GLOBAL effective config + a worker name
+ * into THAT worker's effective config: its `models` domain is the roster's view (model subset + role-map +
+ * @-allowlist override), everything else stays global. The `rosters` domain is control-plane-only and is
+ * always stripped from the wire payload (no /effective consumer reads it).
+ *
+ * Pure (no I/O) → unit-testable. Tolerant of dangling refs (unknown worker / missing roster → global
+ * fallback); strict referential integrity is enforced at PUT time (the [domain] route), not here.
+ */
+import type { EffectiveConfig, EffectiveWire, ModelRole, RoleTarget, RosterEntry } from "./types.js";
+/** primaryModel 标记喂的角色族(§3/[546])。 */
+export declare const ROSTER_PRIMARY_ROLES: readonly ["default", "team", "synthesize"];
+/** cheapModel 标记喂的角色族(§3/[546])。 */
+export declare const ROSTER_CHEAP_ROLES: readonly ["subagent", "summarize"];
+/** 把 roster 的主/cheap 角色标记派生成 roles 片段(PURE)。显式 roster.roles 逐角色盖过它;它盖过全局
+ *  models.roles(合并点见 {@link resolveEffectiveForWorker})。wire 形状不变——service 零改仍兼容,
+ *  收敛后直接读标记亦可(effective 的 rosters 域不上 wire,标记经此物化进 models.roles)。 */
+export declare function rosterMarkerRoles(r: Pick<RosterEntry, "primaryModel" | "cheapModel">): Partial<Record<ModelRole, RoleTarget>>;
+export interface ResolvedEffective {
+    /** The wire payload: `models` resolved for the worker, `rosters` stripped, `skills` shipped as a manifest. */
+    config: EffectiveWire;
+    /** Diagnostic: the roster name applied, or "global" / "global(fallback)". Surfaced as the X-Roster header. */
+    rosterLabel: string;
+    /** Quoted ETag. Global path = `"v<version>"` (today's behaviour). Scoped path = content hash (excludes
+     *  version/updatedAt) so an unrelated roster change at a new version doesn't churn this worker's cache. */
+    etag: string;
+}
+export declare function resolveEffectiveForWorker(eff: EffectiveConfig, worker: string | null | undefined): ResolvedEffective;
+//# sourceMappingURL=resolve-roster.d.ts.map

package/dist/resolve-roster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-roster.d.ts","sourceRoot":"","sources":["../src/resolve-roster.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAgB,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASnH,sCAAsC;AACtC,eAAO,MAAM,oBAAoB,4CAA4E,CAAC;AAC9G,oCAAoC;AACpC,eAAO,MAAM,kBAAkB,oCAAoE,CAAC;AAEpG;;qEAEqE;AACrE,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,GAAG,YAAY,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAK7H;AAED,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,MAAM,EAAE,aAAa,CAAC;IACtB,8GAA8G;IAC9G,WAAW,EAAE,MAAM,CAAC;IACpB;+GAC2G;IAC3G,IAAI,EAAE,MAAM,CAAC;CACd;AA4BD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,iBAAiB,CAuDpH"}

package/dist/resolve-roster.js

@@ -0,0 +1,105 @@
+import { stableHash } from "./hash.js";
+import { toSkillsManifest } from "./skills-manifest.js";
+// ── 主/cheap 角色标记语义(0.6.3, E3/[546]/[548]②)────────────────────────────────
+// service 现有 ModelRoles 口径:default/team/synthesize→主、subagent/summarize→cheap。`verifier` 刻意
+// 不派生(unset→core 的 default 兜底链,与 service 语义一致)。常量导出=单一语义源,service 收敛小单与
+// center 表单同源引用,别第二份。
+/** primaryModel 标记喂的角色族(§3/[546])。 */
+export const ROSTER_PRIMARY_ROLES = ["default", "team", "synthesize"];
+/** cheapModel 标记喂的角色族(§3/[546])。 */
+export const ROSTER_CHEAP_ROLES = ["subagent", "summarize"];
+/** 把 roster 的主/cheap 角色标记派生成 roles 片段(PURE)。显式 roster.roles 逐角色盖过它;它盖过全局
+ *  models.roles(合并点见 {@link resolveEffectiveForWorker})。wire 形状不变——service 零改仍兼容,
+ *  收敛后直接读标记亦可(effective 的 rosters 域不上 wire,标记经此物化进 models.roles)。 */
+export function rosterMarkerRoles(r) {
+    const out = {};
+    if (r.primaryModel)
+        for (const role of ROSTER_PRIMARY_ROLES)
+            out[role] = { model: r.primaryModel };
+    if (r.cheapModel)
+        for (const role of ROSTER_CHEAP_ROLES)
+            out[role] = { model: r.cheapModel };
+    return out;
+}
+/** Per-roster targeting (v2): keep items whose `rosters` is empty (= all rosters) or includes `rosterName`.
+ *  `rosterName: null` = the unscoped/global pull → no filtering (ship all). */
+function forRoster(items, rosterName) {
+    if (!rosterName)
+        return items;
+    return items.filter((it) => !it.rosters?.length || it.rosters.includes(rosterName));
+}
+/** Shape the wire payload: swap in the resolved `models`, empty the control-plane-only `rosters` domain
+ *  (never shipped on the wire), ship `skills` as a manifest (content → contentHash), and filter
+ *  skills + mcp by the worker's roster (`rosterName: null` on the global path = no filter).
+ *  (The `access` domain was deleted outright in 0.6.0 — its strip here went with it, EXPERT-REDESIGN §9.
+ *  `runtime` rides the wire as {@link EffectiveConfig}'s RuntimeWire — limit residue + governance mirror
+ *  (双写过渡, §5) — built upstream in buildEffective; nothing to reshape here.) */
+function shipped(eff, models, rosterName) {
+    return {
+        ...eff,
+        models,
+        rosters: { rosters: [] },
+        // entitlement is per-PRINCIPAL governance (every subject's tier/budget/caps) — control-plane only. A worker
+        // pull must NEVER see it (privacy + size); the per-principal view is served separately via /effective?principal=.
+        entitlement: { tiers: [], subjects: [], groupBindings: [], budgetGroups: [] },
+        skills: toSkillsManifest({ skills: forRoster(eff.skills.skills, rosterName) }),
+        mcp: { servers: forRoster(eff.mcp.servers, rosterName) },
+    };
+}
+export function resolveEffectiveForWorker(eff, worker) {
+    if (!worker) {
+        return { config: shipped(eff, eff.models, null), rosterLabel: "global", etag: `"v${eff.version}"` };
+    }
+    const w = eff.workers.workers.find((x) => x.name === worker);
+    const roster = w?.roster ? eff.rosters.rosters.find((r) => r.name === w.roster) : undefined;
+    if (!roster) {
+        // unknown worker / worker without a roster / dangling roster ref → global fallback (diagnosable).
+        return { config: shipped(eff, eff.models, null), rosterLabel: "global(fallback)", etag: `"v${eff.version}"` };
+    }
+    const allow = roster.models.length ? new Set(roster.models) : null; // empty roster.models = full catalog
+    const resolvedModels = allow ? eff.models.models.filter((m) => allow.has(m.name)) : eff.models.models;
+    // Defence-in-depth: the shipped @-allowlist must only name models actually in this worker's
+    // set — otherwise a roster that restricts `models` but keeps a stale allowlist ships an inconsistent config.
+    // Validation also blocks this at PUT, but filter here so resolution is self-consistent regardless. Keep
+    // `undefined` (no override + no global) as-is = "all enabled models are @-mentionable".
+    const finalNames = new Set(resolvedModels.map((m) => m.name));
+    const srcAllowlist = roster.atModelAllowlist ?? eff.models.atModelAllowlist;
+    // Same defence for `roles` as for the @-allowlist (the MORE load-bearing one — roles drive real model
+    // selection, not just @-mention). A `{model}`-form role pointing at a model NOT in this worker's set (an
+    // inherited global default under a `models` subset, or a stale role after a catalog deletion — PUT does no
+    // dependent re-validation) would otherwise ship a DANGLING role on the wire → the worker resolves that role
+    // to a non-existent model. Drop it → the consumer's core fallback (unset role → default) kicks in.
+    // `{select}`-form (capability-based) roles name no model → kept.
+    // Per-role merge (roster overrides global PER ROLE) — NOT a whole-map replace. The types promise "unset
+    // roster roles fall back to global models.roles per role"; a whole-map `??` silently dropped the global
+    // `subagent`/`team`/… when a roster set only `default`. Round-3 fix (codex). Then drop any dangling {model}.
+    // 0.6.3: marker-derived roles (primaryModel/cheapModel, [546] semantics) sit BETWEEN global and explicit
+    // roster.roles — global < markers < explicit per-role. Markers are subset-validated at PUT; a stale marker
+    // after a catalog change still falls through the dangling-{model} drop below (defence-in-depth).
+    const srcRoles = { ...eff.models.roles, ...rosterMarkerRoles(roster), ...(roster.roles ?? {}) };
+    const roles = Object.fromEntries(Object.entries(srcRoles).filter(([, t]) => !(t && "model" in t) || finalNames.has(t.model)));
+    // @-allowlist: drop names not in this worker's model set (consistency) — BUT if a NON-EMPTY allowlist would
+    // filter to EMPTY (the worker exposes none of the allowlisted models), DON'T ship `[]`: empty means "ALL
+    // @-mentionable" (contract, types.ts), which would INVERT the admin's restriction into permissive. Keep the
+    // source instead — the consumer also gates on model membership, so nothing the worker lacks becomes
+    // mentionable; the restriction is preserved (a dangling allowlist name simply never matches). Round-5 (codex).
+    const filteredAllow = srcAllowlist?.filter((n) => finalNames.has(n));
+    // 档位组(0.9.0):直通 + 逐档悬空-drop(照上面 roles 的 dangling-{model} drop 先例)——roster 收窄后
+    // 组内绑到本 worker 模型集之外的档剔除,引擎侧「未绑档沿链降档 fail-open」接手([604]),与 roles
+    // drop→core fallback 同构。组名/active 选择不动(组是 center 侧抽象,per-worker 只影响绑定可见性)。
+    const tierGroups = eff.models.tierGroups.map((g) => ({
+        ...g,
+        tiers: Object.fromEntries(Object.entries(g.tiers).filter(([, m]) => typeof m !== "string" || finalNames.has(m))),
+    }));
+    const models = {
+        models: resolvedModels,
+        roles,
+        atModelAllowlist: srcAllowlist && srcAllowlist.length > 0 && filteredAllow && filteredAllow.length === 0 ? srcAllowlist : filteredAllow,
+        tierGroups,
+        activeTierGroup: eff.models.activeTierGroup,
+    };
+    const config = shipped(eff, models, roster.name);
+    const { version: _v, updatedAt: _u, ...content } = config;
+    return { config, rosterLabel: roster.name, etag: `"${stableHash(content)}"` };
+}
+//# sourceMappingURL=resolve-roster.js.map