@sema-ai/registry-core 0.10.3

package/dist/api/scopes.js

@@ -0,0 +1,229 @@
+/**
+ * `api/scopes` — the MULTI-TENANT SCOPE wire contract for the registry (/api/v1/scopes* +
+ * /api/v1/auth/scope). Frozen here so sema-registry (the implementation), the orchestrator, workers and
+ * the sema shell import ONE source of truth — same "契约先行" discipline as `api/auth`.
+ *
+ * THE SCOPE MODEL (normative — the registry implements EXACTLY this):
+ *
+ *  - A **scope** is a tenant boundary: `{id, name, createdAt}`. `id` is a slug (SCOPE_ID_REGEX).
+ *    The reserved id `"global"` (GLOBAL_SCOPE) is the DEFAULT scope: it always exists, is never
+ *    created via the API (ScopeCreateRequest rejects it) and is never deleted.
+ *  - **Membership** is per-scope: `{scopeId, principal, role}` where role is the existing 4-level
+ *    RBAC ladder (viewer < editor < publisher < admin). The SAME principal may be `editor` in scope A
+ *    and `viewer` in scope B.
+ *  - The **instance-level** `users.role` is unchanged and orthogonal: an instance `admin` administers
+ *    ALL scopes — inside any scope their effective role is always `"admin"` (see effectiveScopeRole).
+ *  - The **access JWT** gains an OPTIONAL `scope` claim (SCOPE_CLAIM) binding the token to its active
+ *    scope. A token WITHOUT the claim means `"global"` (tokenScopeOf) — full backward compatibility:
+ *    every pre-scope token keeps working, scoped to global. The refresh token is NOT scope-bound;
+ *    refresh re-mints per resolveTokenScope, and the client re-switches if it wants another scope.
+ *
+ * ENDPOINTS (paths in SCOPES_V1_PATHS / scopeMembersPath):
+ *
+ *   GET    /api/v1/scopes                → ScopesListResponse {scopes:[{id,name,role}]} — the CALLER's
+ *          scopes with their per-scope effective role (instance admin sees ALL scopes, role "admin").
+ *   POST   /api/v1/auth/scope            → switch active scope: ScopeSwitchRequest {scope} →
+ *          ScopeSwitchResponse {access_token, token_type:"Bearer", expires_in, scope, role}; errors are
+ *          OAuth-style OAuthErrorResponse (`invalid_request` = malformed / unknown scope shape,
+ *          `access_denied` = caller is not a member and not an instance admin — canSwitchScope).
+ *          Auth: a valid access token (any scope). Mints a NEW access token bound to `scope`; the
+ *          caller's refresh grant is untouched.
+ *   POST   /api/v1/scopes                → create a scope (instance admin only): ScopeCreateRequest
+ *          {id,name} → ScopeCreateResponse (the created Scope).
+ *   PUT    /api/v1/scopes/{id}/members   → upsert a member (instance admin only): ScopeMemberUpsertRequest
+ *          {principal, role} → ScopeMemberUpsertResponse (the stored membership row).
+ *   DELETE /api/v1/scopes/{id}/members   → remove a member (instance admin only): ScopeMemberDeleteRequest
+ *          {principal} → ScopeMemberDeleteResponse {ok:true} (idempotent — removing a non-member is 200).
+ *
+ * WIRE CASING: /api/v1/auth/scope is part of the OAuth face — snake_case on the wire (access_token,
+ * expires_in), matching `api/auth`. The /api/v1/scopes management face uses this package's camelCase
+ * (createdAt, scopeId) — it is a registry management API, not an OAuth endpoint.
+ *
+ * Pure zod contract + pure decision functions — zero IO, browser-safe. The decision functions
+ * (resolveTokenScope / canSwitchScope / effectiveScopeRole) are THE semantics: the registry
+ * implementation imports and calls these — it must not re-implement them.
+ */
+import { z } from "zod";
+import { USER_ROLES } from "../config-fns.js";
+import { ACCESS_TOKEN_TTL_SECONDS } from "./auth.js";
+// ── constants ────────────────────────────────────────────────────────────────────────────────────────────
+/** The reserved default scope. Always exists; every token without a `scope` claim lives here. */
+export const GLOBAL_SCOPE = "global";
+/** Scope ids that can never be created (or deleted) through the API. */
+export const RESERVED_SCOPE_IDS = [GLOBAL_SCOPE];
+/** Slug shape for scope ids: lowercase alphanumeric + inner dashes, 1–64 chars, no leading/trailing dash. */
+export const SCOPE_ID_REGEX = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+/** The scope endpoints, relative to the registry origin. `members` needs the scope id — use scopeMembersPath. */
+export const SCOPES_V1_PATHS = {
+    /** GET (list) + POST (create). */
+    scopes: "/api/v1/scopes",
+    /** POST — mint a new access token bound to another scope. */
+    authScope: "/api/v1/auth/scope",
+};
+/** The JWT claim carrying the token's active scope. OPTIONAL — absent means GLOBAL_SCOPE (tokenScopeOf). */
+export const SCOPE_CLAIM = "scope";
+/** `/api/v1/scopes/{id}/members` for PUT (upsert) and DELETE (remove). */
+export function scopeMembersPath(scopeId) {
+    return `${SCOPES_V1_PATHS.scopes}/${encodeURIComponent(scopeId)}/members`;
+}
+/** True for ids the API refuses to create/delete ("global"). */
+export function isReservedScopeId(id) {
+    return RESERVED_SCOPE_IDS.includes(id);
+}
+// ── core shapes ──────────────────────────────────────────────────────────────────────────────────────────
+/** A scope id on the wire — slug-validated. (The reserved "global" IS a valid ScopeId: it exists as an
+ *  entity everywhere except the create endpoint.) */
+export const ScopeId = z.string().regex(SCOPE_ID_REGEX, "scope id must be a slug: [a-z0-9-], 1-64 chars, no edge dash");
+/** The per-scope role ladder = the existing instance RBAC ladder (viewer < editor < publisher < admin). */
+export const ScopeRole = z.enum(USER_ROLES);
+/** The scope entity. */
+export const Scope = z
+    .object({
+    id: ScopeId,
+    /** Human display name (non-unique, non-secret). */
+    name: z.string().min(1).max(200),
+    /** Creation time, epoch MILLISECONDS. The reserved "global" scope reports its provisioning time. */
+    createdAt: z.number(),
+})
+    .passthrough();
+/** One membership row: `principal` holds `role` inside `scopeId`. Per-scope — the same principal may
+ *  hold different roles in different scopes. */
+export const ScopeMember = z
+    .object({
+    scopeId: ScopeId,
+    /** The user identity — same principal string the JWT `sub` / x-agent-principal pipeline uses. */
+    principal: z.string().min(1),
+    role: ScopeRole,
+})
+    .passthrough();
+// ── GET /api/v1/scopes ───────────────────────────────────────────────────────────────────────────────────
+/** One list entry: a scope the caller can act in, with the caller's EFFECTIVE role there
+ *  (effectiveScopeRole — instance admins list every scope with role "admin"). */
+export const ScopeListEntry = z
+    .object({
+    id: ScopeId,
+    name: z.string().min(1),
+    role: ScopeRole,
+})
+    .passthrough();
+export const ScopesListResponse = z.object({ scopes: z.array(ScopeListEntry) }).passthrough();
+// ── POST /api/v1/auth/scope (switch active scope — OAuth face, snake_case) ──────────────────────────────
+/** Request: the target scope. Errors: `invalid_request` (malformed), `access_denied` (not a member and
+ *  not an instance admin — canSwitchScope false). */
+export const ScopeSwitchRequest = z
+    .object({
+    scope: ScopeId,
+})
+    .passthrough();
+/** A fresh access token bound to the requested scope (`scope` claim = `scope` field below). The refresh
+ *  grant is untouched — this endpoint never returns a refresh_token. `role` = the caller's effective role
+ *  inside the new scope (effectiveScopeRole). */
+export const ScopeSwitchResponse = z
+    .object({
+    /** RS256 JWT with the `scope` claim set — verify per api/auth-bridge; VerifiedIdentity.scope carries it. */
+    access_token: z.string().min(1),
+    token_type: z.literal("Bearer"),
+    /** Access-token lifetime in seconds (ACCESS_TOKEN_TTL_SECONDS — same mint as api/auth). */
+    expires_in: z.number().int().positive(),
+    scope: ScopeId,
+    role: ScopeRole,
+})
+    .passthrough();
+/** Re-exported convenience: the switch endpoint mints through the SAME exit as api/auth (1h JWT). */
+export const SCOPE_SWITCH_TOKEN_TTL_SECONDS = ACCESS_TOKEN_TTL_SECONDS;
+// ── POST /api/v1/scopes (create — instance admin only) ──────────────────────────────────────────────────
+/** Reserved ids ("global") are rejected AT THE SCHEMA — the default scope pre-exists and is not creatable. */
+export const ScopeCreateRequest = z
+    .object({
+    id: ScopeId.refine((id) => !isReservedScopeId(id), { message: `"${GLOBAL_SCOPE}" is reserved` }),
+    name: z.string().min(1).max(200),
+})
+    .passthrough();
+/** The created scope, as stored. */
+export const ScopeCreateResponse = Scope;
+// ── PUT/DELETE /api/v1/scopes/{id}/members (membership writes — instance admin only) ────────────────────
+/** PUT body — upsert: sets `principal`'s role in the path scope, creating or replacing the row. */
+export const ScopeMemberUpsertRequest = z
+    .object({
+    principal: z.string().min(1),
+    role: ScopeRole,
+})
+    .passthrough();
+/** The stored membership row (scopeId echoes the path). */
+export const ScopeMemberUpsertResponse = ScopeMember;
+/** DELETE body — remove `principal` from the path scope. */
+export const ScopeMemberDeleteRequest = z
+    .object({
+    principal: z.string().min(1),
+})
+    .passthrough();
+/** Idempotent: `{ok:true}` whether or not the principal was a member (no membership disclosure beyond
+ *  what the admin caller already sees). */
+export const ScopeMemberDeleteResponse = z.object({ ok: z.literal(true) }).passthrough();
+/**
+ * THE instance-admin override rule, in one place:
+ *
+ *   **An instance `admin`'s effective role inside ANY scope is always `"admin"`** — regardless of whether
+ *   they hold a membership there or what that membership says. For everyone else the effective role is
+ *   exactly their membership role (`membershipRole`), and `undefined` when they have no membership.
+ *
+ * `instanceRole` is the instance-level users.role string; only the exact value `"admin"` triggers the
+ * override (publisher/editor/viewer at instance level grant NO cross-scope power).
+ */
+export function effectiveScopeRole(membershipRole, instanceRole) {
+    if (instanceRole === "admin")
+        return "admin";
+    return membershipRole;
+}
+/**
+ * THE token-minting scope decision — which scope (and role claim) a fresh access token binds to, given
+ * the principal's scope memberships and instance role. Deterministic; the registry (Node/Next) imports
+ * and calls this at every mint (device-flow grant AND refresh). NORMATIVE RULES (verbatim, 任务书拍定):
+ *
+ *   1. **唯一成员 scope** — exactly one membership → bind that scope, role = that membership's effective
+ *      role (effectiveScopeRole: instance admin ⇒ "admin").
+ *   2. **多个含 global** — multiple memberships, one of them "global" → bind "global", role = the global
+ *      membership's effective role.
+ *   3. **多个不含 global** — multiple memberships, none "global" → bind the scope whose id is FIRST in
+ *      lexicographic (UTF-16 code-unit) order — deterministic, no wall-clock/insertion-order dependence;
+ *      role = that membership's effective role.
+ *   4. **零成员** — no memberships → `{scope: "global", role: instanceRole}` (the instance role IS the
+ *      role claim, exactly as pre-scope tokens behaved — full backward compatibility).
+ *
+ * Duplicate scopeIds in the input: the entry that sorts first (by scopeId, then by role string) wins —
+ * callers should not pass duplicates, but the function stays deterministic if they do.
+ */
+export function resolveTokenScope(memberships, instanceRole) {
+    if (memberships.length === 0) {
+        return { scope: GLOBAL_SCOPE, role: instanceRole };
+    }
+    const sorted = [...memberships].sort((a, b) => a.scopeId < b.scopeId ? -1 : a.scopeId > b.scopeId ? 1 : a.role < b.role ? -1 : a.role > b.role ? 1 : 0);
+    if (sorted.length === 1) {
+        const only = sorted[0];
+        return { scope: only.scopeId, role: effectiveScopeRole(only.role, instanceRole) ?? only.role };
+    }
+    const global = sorted.find((m) => m.scopeId === GLOBAL_SCOPE);
+    const chosen = global ?? sorted[0];
+    return { scope: chosen.scopeId, role: effectiveScopeRole(chosen.role, instanceRole) ?? chosen.role };
+}
+/**
+ * THE scope-switch authorization decision (POST /api/v1/auth/scope): allowed ⇔ the caller is a MEMBER of
+ * `targetScope` (any role) OR an instance `admin` (who may enter any scope, including ones they are not
+ * a member of — their effective role there is "admin" per effectiveScopeRole). Everyone else →
+ * `access_denied`. Note: "global" gets NO special-case here — a multi-scope user without a global
+ * membership cannot switch to global (their default mint never lands there either, rule 3 above).
+ */
+export function canSwitchScope(memberships, instanceRole, targetScope) {
+    if (instanceRole === "admin")
+        return true;
+    return memberships.some((m) => m.scopeId === targetScope);
+}
+/**
+ * Read the active scope off verified JWT claims: a non-empty string `scope` claim, else GLOBAL_SCOPE.
+ * This is the ONE place the "missing claim = global" backward-compat rule lives — workers and the
+ * registry both call this instead of defaulting ad hoc.
+ */
+export function tokenScopeOf(claims) {
+    return typeof claims.scope === "string" && claims.scope.length > 0 ? claims.scope : GLOBAL_SCOPE;
+}
+//# sourceMappingURL=scopes.js.map

package/dist/api/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/api/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,4GAA4G;AAE5G,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,CAAU,CAAC;AAE1D,6GAA6G;AAC7G,MAAM,CAAC,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAEvE,iHAAiH;AACjH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,kCAAkC;IAClC,MAAM,EAAE,gBAAgB;IACxB,6DAA6D;IAC7D,SAAS,EAAE,oBAAoB;CACvB,CAAC;AAEX,4GAA4G;AAC5G,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AAEnC,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,GAAG,eAAe,CAAC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;AAC5E,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,4GAA4G;AAE5G;qDACqD;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,8DAA8D,CAAC,CAAC;AAGxH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,UAAuC,CAAC,CAAC;AAGzE,wBAAwB;AACxB,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,EAAE,EAAE,OAAO;IACX,mDAAmD;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,oGAAoG;IACpG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;gDACgD;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,OAAO,EAAE,OAAO;IAChB,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,4GAA4G;AAE5G;iFACiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,EAAE,EAAE,OAAO;IACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAG9F,2GAA2G;AAE3G;qDACqD;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,KAAK,EAAE,OAAO;CACf,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;;iDAEiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,4GAA4G;IAC5G,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,2FAA2F;IAC3F,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,qGAAqG;AACrG,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAwB,CAAC;AAEvE,2GAA2G;AAE3G,8GAA8G;AAC9G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,YAAY,eAAe,EAAE,CAAC;IAChG,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACjC,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,oCAAoC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAGzC,2GAA2G;AAE3G,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,EAAE,SAAS;CAChB,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,WAAW,CAAC;AAGrD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC;KACD,WAAW,EAAE,CAAC;AAGjB;2CAC2C;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAiBzF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAAoC,EACpC,YAAoB;IAEpB,IAAI,YAAY,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7C,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA4C,EAC5C,YAAoB;IAEpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACxG,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACvG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,WAA4C,EAC5C,YAAoB,EACpB,WAAmB;IAEnB,IAAI,YAAY,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAA2B;IACtD,OAAO,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;AACnG,CAAC"}

package/dist/bundle.d.ts

@@ -0,0 +1,14 @@
+import type { ConfigReader } from "./reader.js";
+import { type DomainName } from "./types.js";
+export type ConfigBundle = Partial<Record<DomainName, unknown>>;
+/** Read the (portable, by default) domains out of any ConfigReader → a bundle object. Absent domains are
+ *  omitted (not defaulted) so a re-import doesn't fabricate domains the source never set. */
+export declare function exportBundle(reader: ConfigReader, domains?: readonly DomainName[]): Promise<ConfigBundle>;
+/** Write a bundle to `<root>/config.d/<domain>.json` — each file atomic + VALIDATED (writeDomainFile parses
+ *  against the domain zod, so a malformed source domain fails loudly rather than writing garbage). Returns the
+ *  domains written. (The TOC owns `<root>`; secrets stay in `<root>/.env`, never in these files.) */
+export declare function writeBundle(root: string, bundle: ConfigBundle): Promise<DomainName[]>;
+/** Read a `<root>/config.d/*.json` bundle → raw domain configs (missing/empty file → omitted). The reverse of
+ *  writeBundle: feed into sema-registry's per-domain PUT to import, or into the resolver to run locally. */
+export declare function readBundle(root: string, domains?: readonly DomainName[]): Promise<ConfigBundle>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/bundle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAEhE;6FAC6F;AAC7F,wBAAsB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,GAAE,SAAS,UAAU,EAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAOjI;AAED;;qGAEqG;AACrG,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAQ3F;AAED;4GAC4G;AAC5G,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,UAAU,EAAqB,GAAG,OAAO,CAAC,YAAY,CAAC,CAsBvH"}

package/dist/bundle.js

@@ -0,0 +1,68 @@
+/**
+ * Round-trip between a config SOURCE (any {@link ConfigReader} — sema-registry's store OR a FileConfigStore)
+ * and a local `config.d/<domain>.json` BUNDLE. This is how a FLEET config seeds a TOC desktop (export → copy
+ * the bundle + set .env → run locally) and how a local bundle seeds sema-registry (readBundle → PUT each domain
+ * via the existing domain API). The bundle = the RAW authorable domain configs; `skills` carry their full
+ * bodies (SkillSpec.content is stored in full — NOT the /effective manifest), so there is no separate
+ * body-bundling step and the round-trip is symmetric.
+ *
+ * Node-only (writeBundle/readBundle touch the filesystem) → imported via `@sema-ai/registry-core/node`.
+ */
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { writeDomainFile } from "./file-edit.js";
+import { PORTABLE_DOMAINS } from "./file-store.js";
+import { isDomainName } from "./types.js";
+/** Read the (portable, by default) domains out of any ConfigReader → a bundle object. Absent domains are
+ *  omitted (not defaulted) so a re-import doesn't fabricate domains the source never set. */
+export async function exportBundle(reader, domains = PORTABLE_DOMAINS) {
+    const out = {};
+    for (const d of domains) {
+        const v = await reader.getDomain(d);
+        if (v !== undefined)
+            out[d] = v;
+    }
+    return out;
+}
+/** Write a bundle to `<root>/config.d/<domain>.json` — each file atomic + VALIDATED (writeDomainFile parses
+ *  against the domain zod, so a malformed source domain fails loudly rather than writing garbage). Returns the
+ *  domains written. (The TOC owns `<root>`; secrets stay in `<root>/.env`, never in these files.) */
+export async function writeBundle(root, bundle) {
+    const written = [];
+    for (const [d, v] of Object.entries(bundle)) {
+        if (v === undefined)
+            continue;
+        await writeDomainFile(root, d, v);
+        written.push(d);
+    }
+    return written;
+}
+/** Read a `<root>/config.d/*.json` bundle → raw domain configs (missing/empty file → omitted). The reverse of
+ *  writeBundle: feed into sema-registry's per-domain PUT to import, or into the resolver to run locally. */
+export async function readBundle(root, domains = PORTABLE_DOMAINS) {
+    const out = {};
+    await Promise.all(domains.map(async (d) => {
+        if (!isDomainName(d))
+            throw new Error(`"${d}" is not a config domain — refusing to build a config.d path from it (no traversal)`);
+        let text;
+        try {
+            text = await readFile(path.join(root, "config.d", `${d}.json`), "utf8");
+        }
+        catch (e) {
+            if (e.code === "ENOENT")
+                return; // absent file → omit (not fabricated)
+            throw e;
+        }
+        const trimmed = text.trim();
+        if (!trimmed)
+            return;
+        try {
+            out[d] = JSON.parse(trimmed);
+        }
+        catch {
+            throw new Error(`invalid JSON in config.d/${d}.json`); // sanitized: never echo the raw file text
+        }
+    }));
+    return out;
+}
+//# sourceMappingURL=bundle.js.map

package/dist/bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAI3D;6FAC6F;AAC7F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAoB,EAAE,UAAiC,gBAAgB;IACxG,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;qGAEqG;AACrG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,MAAoB;IAClE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,MAAM,eAAe,CAAC,IAAI,EAAE,CAAe,EAAE,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAe,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;4GAC4G;AAC5G,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,UAAiC,gBAAgB;IAC9F,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAClI,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,sCAAsC;YAClG,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC;YACH,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C;QACnG,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config-fns.d.ts

@@ -0,0 +1,236 @@
+/**
+ * Pure config functions + data shapes — LIFTED verbatim out of sema-registry's `store.ts` (the half that
+ * depends only on `./types`, zero app/DB/next coupling). sema-registry re-exports these so its existing
+ * `@/lib/config` importers keep working unchanged (ONE copy of the code, here).
+ *
+ * Two DETERMINISM refactors vs. the original store.ts (so the package is wall-clock-free and a local file
+ * source can produce byte-identical effective config for identical inputs):
+ *   1. `buildEffective(version, getRaw, updatedAt)` — `updatedAt` is now a REQUIRED param (was a
+ *      `new Date().toISOString()` default). Every caller supplies it explicitly.
+ *   2. `emptyEffective()` seeds the epoch (`new Date(0).toISOString()`) instead of the wall clock, matching
+ *      the stores' existing "epoch sentinel" reduce seed.
+ *
+ * The fat `ConfigStore` interface itself STAYS in sema-registry (app-only, ~32 publish/RBAC/worker-status
+ * methods); only the narrow {@link ConfigReader} (reader.ts) is carried here.
+ */
+import type { z } from "zod";
+import { type DomainConfig, type DomainName, type EffectiveConfig } from "./types.js";
+/** Redact secret-shaped tokens from a validation MESSAGE — a zod error echoes the offending value (e.g.
+ *  `received 'sk-live-…'`), so a secret pasted into the WRONG field would leak via the error string. Redacts
+ *  space-spanning auth credentials (`Bearer <token>`) FIRST (the token pass can't see across the space), then
+ *  any secret-shaped run (`%` kept in the run so a percent-encoded secret stays whole for the percent-aware
+ *  containsSecretToken). invariant ①: a secret VALUE never rides an error. R13/R14 (codex). */
+export declare function redactSecrets(text: string): string;
+/** Sanitize a ZodError IN PLACE so no surfaced error (message / `received` / nested `unionErrors`) echoes a
+ *  pasted secret. RECURSES into `unionErrors` (a `z.union` failure nests a ZodError per member — e.g. RoleTarget
+ *  `{model}|{select}`) and redacts string path segments too. The ONE sanitizer every validation entry point
+ *  uses (parseDomain / validateDomain / validateRemoteExec / write*). R14 (codex). */
+export declare function sanitizeZodError(err: z.ZodError): z.ZodError;
+/** Result of a CAS write (sema-registry's `ConfigStore.setDomainsIfUnchanged`): applied (new `version`) or
+ *  rejected because the version moved (`currentVersion` = what it is now, so the caller can re-read + retry). */
+export type CasWriteResult = {
+    ok: true;
+    version: number;
+} | {
+    ok: false;
+    currentVersion: number;
+};
+/** sema-registry's lifecycle bookkeeping for one worker (its OWN clock — design/25 决策3). */
+export interface WorkerLifecycleRecord {
+    name: string;
+    /** when sema-registry FIRST saw this worker — TTL is measured from here. */
+    firstSeenAt: string;
+    /** last time the reverse-proxy saw traffic to it (idle detection). */
+    lastActiveAt?: string;
+}
+/** RBAC roles, hierarchical: viewer < editor < publisher < admin. */
+export type UserRole = "viewer" | "editor" | "publisher" | "admin";
+export declare const ROLE_RANK: Record<UserRole, number>;
+export declare const USER_ROLES: readonly UserRole[];
+/** True if `role` is at least `min` in the hierarchy (e.g. publisher satisfies editor). */
+export declare function roleAtLeast(role: UserRole, min: UserRole): boolean;
+export declare function isRole(v: unknown): v is UserRole;
+/**
+ * Minimum role to WRITE a domain. Default = `editor`; `skills` and `mcp` are raised to `publisher`
+ * because their content goes straight into the agent's system prompt / tool surface — one edit retargets
+ * the prompt of every worker × scenario that loads it (docs/MCP-SKILLS.md §3.3, decision §6 Q3 从严).
+ * Looked up by the [domain] PUT route. Any domain absent here uses {@link DEFAULT_DOMAIN_WRITE_ROLE}.
+ */
+export declare const DEFAULT_DOMAIN_WRITE_ROLE: UserRole;
+export declare const DOMAIN_WRITE_ROLE: Partial<Record<DomainName, UserRole>>;
+/** The minimum role required to write `domain` (the raised gate for skills/mcp, else editor). */
+export declare function domainWriteRole(domain: DomainName): UserRole;
+/** A console user (no secret). */
+export interface User {
+    username: string;
+    role: UserRole;
+    /** True = an SSO user (empty password hash) auto-provisioned from Gitea OAuth — signs in via Gitea only,
+     *  no password. Derived on list (we expose the boolean, never the hash) so /users can distinguish them. */
+    sso?: boolean;
+}
+/** A user with its password hash (login only — never sent to the client). */
+export interface UserAuth extends User {
+    passwordHash: string;
+    /** scrypt hash of the user's API token (NOT the plaintext), or undefined/"" if none. A `Bearer cc_<user>_<rand>`
+     *  is authenticated by scrypt-verifying `<rand>` against this. Set/revoked via `ConfigStore.setUserApiToken`. */
+    apiTokenHash?: string;
+}
+/** Outcome of an atomic `ConfigStore.approvePublish`. */
+export type ApprovePublishResult = {
+    status: "no-pending";
+} | {
+    status: "is-requester";
+} | {
+    status: "approved";
+    approvals: number;
+    required: number;
+} | {
+    status: "published";
+    approvals: number;
+    version: number;
+}
+/** The draft changed since the request was opened — publishing it would release content the approvers
+ *  never reviewed. The pending is cleared; re-request against the current draft. */
+ | {
+    status: "draft-moved";
+    expectedVersion: number;
+    currentVersion: number;
+};
+/** A pending publish awaiting approvals (publish approval workflow). Singleton — the current draft. */
+export interface PendingPublish {
+    requestedBy: string;
+    requestedAt: string;
+    summary?: string;
+    /** The config version this request asks to release — approvals sign off on EXACTLY this draft; the final
+     *  approval refuses (draft-moved) if the version has advanced since. Optional only for legacy rows
+     *  persisted before the field existed (treated as moved — never published). */
+    draftVersion?: number;
+    /** approvers who've signed off (deduped; the requester may not approve their own). */
+    approvals: {
+        user: string;
+        at: string;
+    }[];
+}
+/** A frozen, deliberately-published config release (draft→publish gate, E). */
+export interface PublishedSnapshot {
+    /** the frozen merged config consumers receive in publish mode (carries the version at publish time). */
+    config: EffectiveConfig;
+    /** when it was promoted to published. */
+    publishedAt: string;
+    /** who published it. */
+    publishedBy: string;
+    /** optional release note. */
+    summary?: string;
+    /** MONOTONIC publish counter — increments on EVERY publish INCLUDING a rollback-republish, so it never goes
+     *  backward (unlike `config.version`, which a rollback re-freezes to an OLDER value). The sole ordering/
+     *  freshness authority consumers compare across published snapshots (design CENTER-CONTROL-PLANE R2-S #9 /
+     *  R2-D4). `config.version` stays the CAS/contentHash anchor WITHIN a revision; revision orders ACROSS them. */
+    globalRevision: number;
+}
+/** The empty/defaults effective config at version 0 — what publish mode serves before the first publish.
+ *  Seeds the epoch (`new Date(0)`) so it's deterministic (the wall-clock default was the original store.ts
+ *  non-determinism — see the file header). */
+export declare function emptyEffective(): EffectiveConfig;
+/** Validate + fill defaults for a domain payload (or the schema's empty default when absent/invalid). */
+export declare function parseDomain<K extends DomainName>(domain: K, raw: unknown): DomainConfig[K];
+/**
+ * Shared GC predicate for worker-status rows (F10) — keeps memory/sqlite/tidb identical. Given the rows'
+ * `{name, updatedAt}` and the GC options, returns the names to prune (A: not in `keepNames`; B: older than
+ * `ttlMs`). Pass neither selector → prunes nothing (guards against a wipe-all). See `ConfigStore.gcWorkerStatuses`.
+ */
+export declare function statusRowsToPrune(rows: {
+    name: string;
+    updatedAt: string;
+}[], opts: {
+    keepNames?: string[];
+    ttlMs?: number;
+    now?: Date;
+}): string[];
+/**
+ * Merge every domain into the effective config a consumer pulls. Shared by all store impls.
+ * `updatedAt` is REQUIRED (the determinism refactor — the original store.ts defaulted it to the wall clock,
+ * which made `emptyEffective`/the memory store non-deterministic). Every caller now supplies it explicitly.
+ */
+/** Lift the governance trio out of a LEGACY runtime doc (pre-0.6 stored runtime carried autonomy/commandPolicy/
+ *  approvalRequire). Used as the governance domain's read fallback when governance was NEVER set — so a 0.5
+ *  store upgrades with zero data migration and zero gate loss. An explicitly-set governance domain WINS
+ *  (its absence-of-a-key then means "center not managing", never "fall back to legacy runtime"). */
+export declare function legacyGovernanceFromRuntime(rawRuntime: unknown): unknown;
+/** A warning emitted by {@link buildEffective} when it clamps/degrades instead of throwing (0.8.1). Callers
+ *  route it to their audit stream; omitting the callback keeps the resilience but drops the telemetry. */
+export type EffectiveReadWarning = {
+    domain: "hosts";
+    kind: "hosts-grandfathered";
+    droppedNames: string[];
+    truncatedFrom?: number;
+} | {
+    domain: DomainName;
+    kind: "domain-defaulted";
+    error: unknown;
+};
+/** Per-domain READ-corruption policy (0.8.1) — what buildEffective does when a stored domain no longer parses.
+ *  `"default"` = degrade to the schema default + warn (safe: the default only REMOVES capability, fail-closed).
+ *  `"throw"` = keep fail-loud (defaulting would LOOSEN gates or destructively apply — worse than an outage,
+ *  consumers fail-static on last-good). A `satisfies Record<DomainName,…>` forces every FUTURE domain to make
+ *  this call explicitly (compile error until it's classified). Per-domain rationale:
+ *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability catalogs — empty = the
+ *      capability disappears (fail-closed), no gate is lost.
+ *    - hosts: empty registry = no auto-placement targets (availability-only); self-registration re-lands
+ *      entries as approved:false = 待批 (fail-closed). Plus the precise grandfather clamp runs FIRST.
+ *    - rosters: THROW — a lost roster makes resolveEffectiveForWorker fall back to the FULL models catalog
+ *      ("global(fallback)"), silently WIDENING every restricted worker's model access. 放权,不许.
+ *    - workers: THROW — an empty fleet spec would make the reconciler RETIRE every managed worker
+ *      (destructive apply — far worse than a read outage).
+ *    - runtime: THROW — defaulting drops centrally-published rate/cost ceilings = unbounded spend (fail-open
+ *      on the budget axis).
+ *    - governance: THROW — defaulting drops autonomy/commandPolicy/approvalRequire = the consumer falls back
+ *      to env/defaults with the operator's guardrails silently gone. 放权,不许.
+ *    - entitlement: THROW — defaulting drops the org kill-switch/budget ceilings/tier restrictions for every
+ *      principal. 放权,不许.
+ *    - execution: THROW — defaulting flips required:true (sandbox mandate) back to false. 放权,不许.
+ *      (0.10.1: sessionMirror rides the SAME stance — defaulting would evaporate an org's required:true
+ *      mirror mandate = 审计面静默放权; the shared rationale is exactly WHY it was收编 here, not a new domain.)
+ *    - projects: THROW — defaulting evaporates the whole identity ledger: once the S4 worker gate ships,
+ *      every `proj:*` derivation fails-fast (全租户记忆面停摆 — consumers fail-static on last-good is
+ *      strictly better); WORSE, the claim write face is read-modify-write — reading a defaulted-empty
+ *      ledger and writing it back would CLOBBER existing registrations down to one entry (data loss,
+ *      one layer beyond the rosters "放权" rationale). */
+export declare const DOMAIN_READ_FALLBACK: {
+    readonly models: "default";
+    readonly rosters: "throw";
+    readonly skills: "default";
+    readonly mcp: "default";
+    readonly plugins: "default";
+    readonly scenarios: "default";
+    readonly systems: "default";
+    readonly collab: "default";
+    readonly workers: "throw";
+    readonly hosts: "default";
+    readonly runtime: "throw";
+    readonly governance: "throw";
+    readonly entitlement: "throw";
+    readonly execution: "throw";
+    readonly projects: "throw";
+};
+/** Result of {@link grandfatherHostsRead}. `raw` is the (possibly clamped) document to parse; when NOTHING
+ *  was clamped it is the ORIGINAL reference — well-formed data stays byte-identical through the read path. */
+export interface GrandfatherHostsReadResult {
+    raw: unknown;
+    /** Host names DROPPED because they exceed HOST_NAME_MAX (63) — truncating would forge a NEW identity that
+     *  matches no ORCH_HOST_ID (and could collide into the duplicate-name refine), so the entry is skipped whole. */
+    droppedNames: string[];
+    /** Set when the hosts array (after drops) exceeded HOSTS_ARRAY_MAX (1024) and was sliced — the pre-slice length. */
+    truncatedFrom?: number;
+}
+/** READ-path grandfather clamp for the 0.8.0 hosts tightening (0.8.1, S3 M-1). Clamps ONLY the two bounds
+ *  0.8.0 added (name > 63 → drop the entry; array > 1024 → slice) so 0.7-era legal stored data keeps reading;
+ *  everything else (regex, types, duplicates) is left for parseDomain — this is a targeted grandfather, not a
+ *  lenient parser. PURE + idempotent; returns the ORIGINAL reference when nothing exceeds the bounds. */
+export declare function grandfatherHostsRead(raw: unknown): GrandfatherHostsReadResult;
+export declare function buildEffective(version: number, getRaw: (d: DomainName) => unknown, updatedAt: string, onWarning?: (w: EffectiveReadWarning) => void): EffectiveConfig;
+/** [599]③ 档位组→引擎单表的唯一解析点(0.9.0)。返回 ACTIVE 档位组的绑定表(剔除未绑档),即 core
+ *  `RunnerDeps.tiers` 要吃的那张单表——组切换=center 换这张表下发,零新引擎机制。无 active 组/未命中/
+ *  组内一档未绑 → `undefined`(引擎档位层恒惰性,与「未配 tiers」逐字同义)。消费方(center /effective
+ *  投影、service applyEffective 接线)都走这一个函数,不要各自解析。 */
+export declare function resolveActiveTiers(models: Pick<DomainConfig["models"], "tierGroups" | "activeTierGroup">): Record<string, string> | undefined;
+//# sourceMappingURL=config-fns.d.ts.map

package/dist/config-fns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-fns.d.ts","sourceRoot":"","sources":["../src/config-fns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAA+F,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnL;;;;+FAI+F;AAC/F,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;sFAGsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAgB5D;AAED;iHACiH;AACjH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnG,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AACnE,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAoD,CAAC;AACpG,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAA+C,CAAC;AAC1F,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAElE;AACD,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,QAAQ,CAEhD;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAmB,CAAC;AAC5D,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAqBnE,CAAC;AACF,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAE5D;AAED,kCAAkC;AAClC,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf;+GAC2G;IAC3G,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AACD,6EAA6E;AAC7E,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB;qHACiH;IACjH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,yDAAyD;AACzD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,YAAY,CAAA;CAAE,GACxB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC7D;oFACoF;GAClF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,uGAAuG;AACvG,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;mFAE+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3C;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,wGAAwG;IACxG,MAAM,EAAE,eAAe,CAAC;IACxB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,6BAA6B;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;oHAGgH;IAChH,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;8CAE8C;AAC9C,wBAAgB,cAAc,IAAI,eAAe,CAEhD;AAED,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAY1F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,EAC3C,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GACzD,MAAM,EAAE,CAOV;AAED;;;;GAIG;AACH;;;oGAGoG;AACpG,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,CAMxE;AAcD;0GAC0G;AAC1G,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,qBAAqB,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;wDA0BwD;AACxD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;CAgB2B,CAAC;AAE7D;8GAC8G;AAC9G,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,OAAO,CAAC;IACb;qHACiH;IACjH,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oHAAoH;IACpH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;yGAGyG;AACzG,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,0BAA0B,CAqB7E;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,UAAU,KAAK,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,oBAAoB,KAAK,IAAI,GAAG,eAAe,CAkDrK;AAED;;;mDAGmD;AACnD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAO7I"}