@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/blocks/builders.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The typed builders (spec §14.1): one function per block and field,
+ * plus `bind(pointer)` and `tree(root)`. Builders return plain JSON —
+ * there is no runtime besides them.
+ *
+ * Each builder takes its block's props object and returns the block
+ * with the `type` literal stamped in. The literal is spread LAST, so a
+ * stray `type` inside a JavaScript caller's props object can never
+ * override it; TypeScript callers cannot pass one at all (`Props` omits
+ * it). The tree BLOCK builder is exported as `treeBlock`, keeping the
+ * `tree` name for the version-stamping root wrapper.
+ *
+ * `tree(root)` stamps {@link BLOCK_SET_VERSION} from the shared wire
+ * package — the version the SERVER validates against, which is why
+ * extensions import these builders from `@sigrun/sigrun/blocks` (the
+ * host-linked copy, spec §14.1) instead of bundling their own.
+ */
+import type { Binding, Block, CalloutBlock, Card, ChartBlock, ChoiceField, CollectionBlock, ColumnsBlock, DateField, DaterangeField, DatetimeField, DetailsBlock, DiffBlock, FieldsBlock, FileField, FormBlock, GridBlock, ImageBlock, ListField, LogBlock, LongtextField, MarkdownBlock, MeterBlock, NumberField, PageBlock, SectionBlock, SecretField, StackBlock, StatBlock, TextField, ToggleField, Tree, TreeBlock } from "@sigrun/shared/blocks";
+/** One block/field's props: the wire shape minus the `type` literal. */
+type Props<T> = Omit<T, "type">;
+/** `bind("/cards")` → `{ $: "/cards" }` — a pointer into the surface's data model (§4.2). */
+export declare function bind(pointer: string): Binding;
+/** Wrap a root block with the server's block-set version (§4.4). */
+export declare function tree(root: Block): Tree;
+export declare function page(props: Props<PageBlock>): PageBlock;
+export declare function stack(props: Props<StackBlock>): StackBlock;
+export declare function columns(props: Props<ColumnsBlock>): ColumnsBlock;
+export declare function grid(props: Props<GridBlock>): GridBlock;
+export declare function section(props: Props<SectionBlock>): SectionBlock;
+export declare function markdown(props: Props<MarkdownBlock>): MarkdownBlock;
+export declare function fields(props: Props<FieldsBlock>): FieldsBlock;
+export declare function stat(props: Props<StatBlock>): StatBlock;
+export declare function callout(props: Props<CalloutBlock>): CalloutBlock;
+export declare function image(props: Props<ImageBlock>): ImageBlock;
+export declare function chart(props: Props<ChartBlock>): ChartBlock;
+export declare function meter(props: Props<MeterBlock>): MeterBlock;
+export declare function log(props: Props<LogBlock>): LogBlock;
+/** The tree BLOCK builder (§5.3) — `tree` is the root wrapper. */
+export declare function treeBlock(props: Props<TreeBlock>): TreeBlock;
+export declare function diff(props: Props<DiffBlock>): DiffBlock;
+export declare function details(props: Props<DetailsBlock>): DetailsBlock;
+export declare function collection(props: Props<CollectionBlock>): CollectionBlock;
+/** The collection item template (§5.5.1) — a slot bundle, not a block. */
+export declare function card(props: Card): Card;
+export declare function form(props: Props<FormBlock>): FormBlock;
+export declare function text(props: Props<TextField>): TextField;
+export declare function longtext(props: Props<LongtextField>): LongtextField;
+export declare function number(props: Props<NumberField>): NumberField;
+export declare function toggle(props: Props<ToggleField>): ToggleField;
+export declare function choice(props: Props<ChoiceField>): ChoiceField;
+export declare function date(props: Props<DateField>): DateField;
+export declare function datetime(props: Props<DatetimeField>): DatetimeField;
+export declare function daterange(props: Props<DaterangeField>): DaterangeField;
+export declare function secret(props: Props<SecretField>): SecretField;
+export declare function file(props: Props<FileField>): FileField;
+export declare function list(props: Props<ListField>): ListField;
+export {};

package/dist/blocks/images.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Image source rules (spec §11.1): `asset:` paths, `data:` URLs of the
+ * four accepted MIME types (capped at 192 KiB of base64 text), and
+ * `https:` URLs. SVG and AVIF are never accepted (script payload; no
+ * TUI decoder), and `http:` URLs are rejected. The proxy that rewrites
+ * and fetches is U7; this module only validates.
+ */
+/** A source that passed the §11.1 rules. */
+export type ImageSourceOk = {
+    ok: true;
+    kind: "asset" | "data" | "https";
+};
+/** A source the §11.1 rules reject. */
+export type ImageSourceErr = {
+    ok: false;
+    message: string;
+};
+/** The result of checking one `src` value. */
+export type ImageSourceResult = ImageSourceOk | ImageSourceErr;
+/**
+ * Check one image `src` against the §11.1 source rules. Bindings
+ * (`{$: …}` objects) are not checked here — their resolved string is,
+ * where the data model holds one (the data-size limit already covers
+ * the byte cost).
+ */
+export declare function checkImageSource(src: string): ImageSourceResult;

package/dist/blocks/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@sigrun/sigrun/blocks` — the extension authoring surface for the
+ * block set (spec §14.1): the typed builders, the wire types, and
+ * `validateTree` (§14.2) so an extension can unit-test its trees
+ * against the same validation the server runs.
+ *
+ * Extensions import this subpath, never a bundled copy: the package is
+ * a `peerDependency: "*"` (see docs/extending.md) and
+ * `@sigrun/sigrun` is a HOST RUNTIME MODULE (src/harness/packages.ts)
+ * — the host links its own running copy into every extension packages
+ * dir, so `tree(...)` always stamps the server's
+ * {@link BLOCK_SET_VERSION}. The `exports` map points here at
+ * `dist/blocks/index.js` (never `src/`), which is what the built
+ * server ships.
+ */
+export * from "./builders.js";
+export { validateTree, validateData, VALID_PLACEMENTS, PLACEMENT_RULES, LIMITS, } from "./validate.js";
+export type { PlacementLimits, PlacementRule, ValidateDataResult, ValidateErr, ValidateOk, ValidateOptions, ValidateResult, ValidationError, } from "./validate.js";
+export { BLOCK_SET_VERSION } from "@sigrun/shared/blocks";
+export type * from "@sigrun/shared/blocks";

package/dist/blocks/limits.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The per-placement size limits of spec §4.5: max blocks per tree, and
+ * max UTF-8 bytes of the serialized JSON for the tree and the data.
+ *
+ * Over a limit the server rejects with `413 surface_too_large` naming
+ * the limit; `validateTree`/`validateData` surface the same error
+ * strings. A collection counts as one block however many items it
+ * binds, and a `data:` image URL counts toward whichever of the tree or
+ * the data holds it (the sizes are measured over the serialized JSON,
+ * so both hold by construction).
+ */
+import type { Placement } from "@sigrun/shared/blocks";
+/** One row of the §4.5 limits table. */
+export interface PlacementLimits {
+    /** Max blocks in one tree (a collection counts as one). */
+    readonly blocks: number;
+    /** Max UTF-8 bytes of the serialized tree JSON. */
+    readonly treeBytes: number;
+    /** Max UTF-8 bytes of the serialized data JSON. */
+    readonly dataBytes: number;
+}
+/** Spec §4.5, one row per placement. */
+export declare const LIMITS: Readonly<Record<Placement, PlacementLimits>>;
+/** UTF-8 byte length of a value's serialized JSON (spec §4.5 sizing). */
+export declare function jsonBytes(value: unknown): number;

package/dist/blocks/placements.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The placement rules of spec §5.7, as data: which blocks, which
+ * collection displays and which form fields each placement allows,
+ * plus the root-block and `page.sidebar` constraints the table carries.
+ *
+ * `validateTree` walks a tree against these rules; the tests pin the
+ * table's literal cells so this data cannot drift from the spec.
+ */
+/** One row of the §5.7 table. */
+export interface PlacementRule {
+    /** Blocks allowed anywhere in the tree. */
+    readonly blocks: ReadonlySet<string>;
+    /** The only legal root block type, when the placement pins it. */
+    readonly rootBlock?: "page" | "form";
+    /** Whether a root `page` may carry `sidebar` (panel: no). */
+    readonly pageSidebar: boolean;
+    /** Collection displays allowed (`undefined`: all five). */
+    readonly collectionDisplays?: readonly string[];
+    /** Field types allowed in `form` blocks. */
+    readonly fields: ReadonlySet<string>;
+}
+/** The placement names, kept local so this module has no imports. */
+type PlacementName = "view" | "panel" | "settings" | "chat" | "interaction" | "ambient";
+/** Spec §5.7, one row per placement. */
+export declare const PLACEMENT_RULES: Readonly<Record<PlacementName, PlacementRule>>;
+export {};

package/dist/blocks/schema.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The typebox wire schemas for every block and field (spec §5/§6.1),
+ * each compiled once into its own `Validator` (spec §14.2 validation).
+ *
+ * Design notes:
+ * - Schemas are the wire contract, so they deliberately do NOT set
+ *   `additionalProperties: false`: unknown props pass through and
+ *   channels ignore them (the block-set version governs what exists).
+ * - `Tone`, `IconName` and `Format` are enums/patterns built from the
+ *   shared constants; an unknown icon name fails here, at the icon
+ *   prop's own path.
+ * - Bindable props are `Union([literal, Binding])` throughout; the
+ *   literal-ness of STRUCTURAL props (`display`, `groups`, `reorder`,
+ *   `mode`, field `name`s, `columns`, handler names) is enforced by the
+ *   second walk in `validate.ts`, not the schema, so the error can say
+ *   "must be a literal" instead of an anyOf mismatch.
+ * - Child slots (`children`, `sidebar`, `main`, `detail`,
+ *   `columns[].block`, `collection.item`, `form` children, a field's
+ *   `list.item`, `page.switcher`, a bulk action's `form.root`) are
+ *   deliberately loose here (any object): `validate.ts` walks the tree
+ *   and validates every child node against ITS compiled validator, so
+ *   one broken block is one precise error instead of a union mismatch
+ *   per sibling branch.
+ * - `Compile` (typebox/compile) builds each validator; its errors are
+ *   read from `instancePath`, relative to the node the validator ran
+ *   against.
+ */
+import type { Validator } from "typebox/compile";
+/** One compiled validator per block type, keyed by its `type` literal. */
+export declare const BLOCK_VALIDATORS: ReadonlyMap<string, Validator>;
+/** One compiled validator per field type, keyed by its `type` literal. */
+export declare const FIELD_VALIDATORS: ReadonlyMap<string, Validator>;
+/** The compiled validator for `Action` objects (spec §6.1). */
+export declare const ACTION_VALIDATOR: Validator;
+/** The compiled validator for action buttons (spec §6.1). */
+export declare const ACTION_BUTTON_VALIDATOR: Validator;
+/** The compiled validator for a collection's card template (spec §5.5.1). */
+export declare const CARD_VALIDATOR: Validator;

package/dist/blocks/schema.js

@@ -307,7 +307,10 @@ const MeterBlock = Type.Object({
 const LogBlock = Type.Object({
     ...BlockBase,
     type: Type.Literal("log"),
-    lines: Type.Ref("Binding"),
+    // Literal lines are legal (ambient placement requires them — the
+    // ambient envelope carries no data document); placements that resolve
+    // bindings keep the binding form.
+    lines: Type.Union([Type.Ref("Binding"), Type.Array(Type.Ref("JsonValue"))]),
     follow: Type.Optional(Type.Boolean()),
     wrap: Type.Optional(Type.Boolean()),
     tones: Type.Optional(Type.Record(Type.String(), Type.Ref("Tone"))),
@@ -374,7 +377,10 @@ const BulkAction = Type.Object({
 const CollectionBlock = Type.Object({
     ...BlockBase,
     type: Type.Literal("collection"),
-    items: Type.Ref("Binding"),
+    // Literal rows are legal (ambient placement requires them — the
+    // ambient envelope carries no data document); placements that resolve
+    // bindings keep the binding form.
+    items: Type.Union([Type.Ref("Binding"), Type.Array(Type.Ref("JsonValue"))]),
     item: AnyObject,
     display: Type.Unsafe({
         type: "string",
@@ -445,6 +451,7 @@ const NumberField = Type.Object({
 const ToggleField = Type.Object({
     ...FieldBase,
     type: Type.Literal("toggle"),
+    default: Type.Optional(Type.Boolean()),
 });
 const ChoiceField = Type.Object({
     ...FieldBase,

package/dist/blocks/validate.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `validateTree` (spec §14.2): every error with its JSON path and a
+ * plain message.
+ *
+ * Two passes:
+ * 1. The compiled typebox validators (`schema.ts`) check each node's
+ *    shape: the walk descends the tree, finds every block, field,
+ *    action, button and card template, and runs the matching compiled
+ *    validator against it. Instance paths (relative to the node) join
+ *    the walk's path, so one broken block is one precise error
+ *    (`root.main[2].text`), never a union mismatch per sibling.
+ * 2. The same walk checks what schemas cannot express: placements
+ *    (§5.7), the literal-ness of structural props (§4.2), handler names
+ *    (§6.1), relative bindings outside item templates (§4.2), ids
+ *    (§4.1), `turn` outside chat (§6.2), `open` schemes (§6.1), image
+ *    sources (§11.1), limits (§4.5), and the ambient one-line rule
+ *    (§9.2).
+ */
+import { type Placement, type Tree } from "@sigrun/shared/blocks";
+export { PLACEMENT_RULES } from "./placements.js";
+export { LIMITS } from "./limits.js";
+export type { PlacementRule } from "./placements.js";
+export type { PlacementLimits } from "./limits.js";
+/** The placements the block set defines (spec §3). */
+export declare const VALID_PLACEMENTS: readonly Placement[];
+/** One validation error: where and what (spec §14.2). */
+export interface ValidationError {
+    path: string;
+    message: string;
+}
+/** Options for `validateTree`. */
+export interface ValidateOptions {
+    placement: Placement;
+    /**
+     * The surface's `actions` map keys (spec §6.1); when given, every
+     * handler-name prop must be in it. When omitted (chat), handler
+     * names are free labels.
+     */
+    handlers?: ReadonlySet<string>;
+    /** The server's block-set version; a mismatched tree is rejected (§4.4). */
+    serverV?: number;
+    /** For ambient trees: which `place` renders this body (§9.2 one-line rule). */
+    ambientPlace?: "status" | "footer" | "panel";
+}
+/** The ok result of `validateTree`: the tree, narrowed to the wire type. */
+export interface ValidateOk {
+    ok: true;
+    tree: Tree;
+}
+/** The failure result: every error found, each with its path. */
+export interface ValidateErr {
+    ok: false;
+    errors: ValidationError[];
+}
+/** `validateTree`'s result. */
+export type ValidateResult = ValidateOk | ValidateErr;
+/** The result of `validateData`. */
+export type ValidateDataResult = {
+    ok: true;
+} | {
+    ok: false;
+    errors: ValidationError[];
+};
+/**
+ * Validate a block tree against a placement (spec §14.2). Returns every
+ * error with its JSON path; on success, the narrowed tree.
+ */
+export declare function validateTree(tree: unknown, opts: ValidateOptions): ValidateResult;
+/**
+ * Validate a surface's data object: a JSON object within the placement's
+ * data-size limit (spec §4.5).
+ */
+export declare function validateData(data: unknown, placement: Placement): ValidateDataResult;

package/dist/blocks/validate.js

@@ -142,9 +142,22 @@ function checkActionButtons(ctx, buttons, path) {
         checkAction(ctx, button.action, joinPath(bPath, "action"));
     });
 }
-/** Relative `./` bindings are legal only inside a card template (§4.2). */
+/**
+ * Bindings outside a card template (§4.2): relative `./` bindings are
+ * legal only inside an item template. In the AMBIENT placement, every
+ * binding (absolute or relative) outside an item template is rejected —
+ * the ambient envelope carries no data document, so a bound prop has
+ * nothing to resolve against and renders blank (the 2026-10-24 ruling's
+ * items rule, extended to every bindable prop).
+ */
 function checkBinding(ctx, binding, path) {
-    if (!ctx.itemTemplate && binding.$.startsWith("./")) {
+    if (ctx.itemTemplate)
+        return;
+    if (ctx.placement === "ambient") {
+        push(ctx, joinPath(path, "$"), `ambient surfaces carry literal content only (binding "${binding.$}" outside a collection item template)`);
+        return;
+    }
+    if (binding.$.startsWith("./")) {
         push(ctx, joinPath(path, "$"), `relative binding "${binding.$}" is only valid inside a collection item template`);
     }
 }
@@ -152,10 +165,12 @@ function checkBinding(ctx, binding, path) {
  * Any relative `./` binding on this node (§4.2): every prop value is
  * scanned — the binding-only props (`items`, `lines`, `nodes`, `rows`,
  * `series[].data`, `submitLabel`, `copy.text`) bind just like the
- * bindable literals, so a hardcoded prop list would miss them. Absolute
- * `/` bindings stay legal everywhere; relative ones only inside item
- * templates. `skip` names props whose own walk already reported (the
- * structural literals above carry their more precise message).
+ * bindable literals, so a hardcoded prop list would miss them. Outside
+ * ambient, absolute `/` bindings stay legal everywhere and relative
+ * ones only inside item templates; in ambient, every binding outside an
+ * item template fails (checkBinding). `skip` names props whose own walk
+ * already reported (the structural literals above carry their more
+ * precise message).
  */
 function checkNodeRelativeBindings(ctx, node, path, skip) {
     if (ctx.itemTemplate)
@@ -282,6 +297,35 @@ function checkBlock(ctx, node, path, rootDepth) {
         checkSchema(ctx, validator, node, path);
     // collection-specific rules
     if (type === "collection") {
+        // Controller ruling (2026-10-24): bindings are OUT of ambient
+        // placement — the ambient envelope carries no data document, so a
+        // bound `items` has nothing to resolve against. Literal rows only.
+        // (Reversible: extending the envelope with a data slot remains open.)
+        if (ctx.placement === "ambient" && isBinding(node.items)) {
+            // checkBinding's ambient branch fires for this prop too; the
+            // more specific collection wording wins, so skip `items` below.
+            push(ctx, joinPath(path, "items"), "ambient collections carry literal rows (items must not be a binding)");
+        }
+        // Ambient: bindables nested inside structural props are still
+        // bound nowhere (the no-data-document ruling). `groups`/`columns`
+        // sit in the structural skip set, so the generic binding walk
+        // never reaches their `title`/`label` bindables — walk them here.
+        if (ctx.placement === "ambient") {
+            const nestedBindables = [
+                ["groups", "title"],
+                ["columns", "label"],
+            ];
+            for (const [listProp, leafProp] of nestedBindables) {
+                const list = node[listProp];
+                if (!Array.isArray(list))
+                    continue;
+                list.forEach((entry, i) => {
+                    if (isRec(entry) && isBinding(entry[leafProp])) {
+                        checkBinding(ctx, entry[leafProp], joinPath(joinPath(joinPath(path, listProp), String(i)), leafProp));
+                    }
+                });
+            }
+        }
         const display = node.display;
         if (typeof display === "string" &&
             rules.collectionDisplays &&
@@ -350,9 +394,14 @@ function checkBlock(ctx, node, path, rootDepth) {
         if (!check.ok)
             push(ctx, joinPath(path, "src"), check.message);
     }
-    // bindable props: every relative `./` binding on the node (§4.2)
+    // bindable props: every relative `./` binding on the node (§4.2).
+    // `items` joins the skip set in ambient so the collection-specific
+    // message above stays the single error at its path.
     const structural = STRUCTURAL_LITERALS[type] ?? [];
-    checkNodeRelativeBindings(ctx, node, path, new Set(structural));
+    const skip = new Set(structural);
+    if (type === "collection" && ctx.placement === "ambient")
+        skip.add("items");
+    checkNodeRelativeBindings(ctx, node, path, skip);
     // onActivate carries an Action (§6.1): same rules as button actions
     if (node.onActivate !== undefined) {
         checkAction(ctx, node.onActivate, joinPath(path, "onActivate"));

package/dist/cli.js

@@ -49,6 +49,12 @@ import { Writable } from "node:stream";
 import { resolveStoreRoots, writeFileAtomic } from "./harness/stores.js";
 import { openIdentityStores } from "./harness/identity/index.js";
 import { pathToFileURL } from "node:url";
+import { effectiveMethods, loadConfig } from "./config.js";
+import { probeIsolation, runHelperProbe, selfTestHelper } from "./sandbox/availability.js";
+import { SettingsStore } from "./harness/settings.js";
+import { resolveHelper } from "./sandbox/helper.js";
+import { selfPackageRoot } from "./harness/packages.js";
+import { createAdmissionGuard } from "./harness/identity/users.js";
 import { serve } from "./serve.js";
 import { ACCENT_NAMES, PALETTE_NAMES, isAccentName, isPaletteName, } from "@sigrun/shared/themes";
 export const USAGE_TEXT = `usage: sigrun [--user <name>]
@@ -643,7 +649,7 @@ async function runProviderCommand(parsed, env, io, fetchImpl, readSecret) {
  *   secret exists only at create time);
  * - `token revoke` fails loud on an unknown id.
  */
-async function runIdentityCommand(parsed, env, io) {
+async function runIdentityCommand(parsed, env, io, isolationProbe) {
     const stores = openIdentityStores(resolveStoreRoots(env));
     if (parsed.command === "token") {
         switch (parsed.sub) {
@@ -679,6 +685,24 @@ async function runIdentityCommand(parsed, env, io) {
     }
     switch (parsed.sub) {
         case "add": {
+            const config = loadConfig(env, new SettingsStore({ dir: defaultConfigDir(env) }).read());
+            const coreRoot = selfPackageRoot();
+            const isolation = await isolationProbe({
+                platform: process.platform,
+                helper: coreRoot === undefined ? undefined : resolveHelper(env, coreRoot),
+                runProbe: runHelperProbe,
+                selfTest: selfTestHelper,
+            });
+            const methods = effectiveMethods(config.auth, "127.0.0.1");
+            stores.users.configureAdmission({
+                firstWorkspace: config.workspace.path,
+                admit: createAdmissionGuard({
+                    isolation,
+                    mode: config.isolation.mode,
+                    methods,
+                    proxySecretHeader: config.auth.proxy.secretHeader,
+                }),
+            });
             await stores.users.add({
                 user: parsed.user,
                 admin: parsed.admin ?? false,
@@ -850,7 +874,7 @@ export async function cliMain(argv, env = process.env, deps, io = {
             case "token":
             case "user": {
                 // The identity commands (Task 7): stores directly, server or not.
-                return await runIdentityCommand(parsed, env, io);
+                return await runIdentityCommand(parsed, env, io, realDeps.probeIsolation ?? probeIsolation);
             }
             case "provider": {
                 // The provider commands (release 0.1 Task 2b): API clients over

package/dist/config.js

@@ -148,6 +148,7 @@ export const DEFAULT_PROVIDER_REFRESH_MINUTES = 15;
  * defaulted — they exist only when env provides them.
  */
 export const DEFAULT_AUTH = {
+    sessionDays: 30,
     methods: undefined,
     proxy: {
         trustedProxies: [],
@@ -323,6 +324,40 @@ function parseDev(env) {
         return false;
     throw new Error(`SIGRUN_DEV must be "true" or "false" (or 1/0), got ${JSON.stringify(raw)}`);
 }
+/** Parse `SIGRUN_ISOLATION`; unset/empty lets the file/default tier apply. */
+function parseIsolationMode(env) {
+    const raw = env.SIGRUN_ISOLATION;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const mode = raw.trim().toLowerCase();
+    if (mode === "auto" || mode === "always" || mode === "off")
+        return mode;
+    throw new Error(`SIGRUN_ISOLATION must be "auto", "always", or "off", got ${JSON.stringify(raw)}`);
+}
+function parseIsolation(env, server) {
+    return {
+        mode: parseIsolationMode(env) ?? server?.mode ?? "auto",
+        osUsers: server?.osUsers ?? false,
+        workerIdleMinutes: server?.workerIdleMinutes ?? 10,
+    };
+}
+/**
+ * Parse `SIGRUN_SUPERVISED` (UI-blocks U4 Task 2, spec §13.3): the
+ * `parseDev` grammar exactly ("true"/"false"/1/0, strict otherwise —
+ * the env contract is the deploy's promise that a restart policy exists,
+ * so a fuzzy parse would lie about the failure mode).
+ */
+function parseSupervised(env) {
+    const raw = env.SIGRUN_SUPERVISED;
+    if (raw === undefined || raw === "")
+        return undefined;
+    const lowered = raw.trim().toLowerCase();
+    if (lowered === "true" || lowered === "1")
+        return true;
+    if (lowered === "false" || lowered === "0")
+        return false;
+    throw new Error(`SIGRUN_SUPERVISED must be "true" or "false" (or 1/0), got ${JSON.stringify(raw)}`);
+}
 /**
  * Parse `SIGRUN_AUTH`: a csv of `token`/`proxy` (order preserved,
  * duplicates dropped), `none` ALONE as the empty list (authentication
@@ -398,6 +433,7 @@ function parseAuth(env, server) {
     const token = env.SIGRUN_API_TOKEN?.trim() || undefined;
     const secret = env.SIGRUN_PROXY_SECRET?.trim() || undefined;
     return {
+        sessionDays: server?.sessionDays ?? DEFAULT_AUTH.sessionDays,
         methods,
         proxy: {
             trustedProxies,
@@ -730,11 +766,15 @@ export function resolvedServerSection(config) {
         proxySection !== undefined ||
         config.auth.adminGroups.length > 0 ||
         config.auth.allowedHosts !== undefined ||
-        config.auth.allowedOrigins !== undefined
+        config.auth.allowedOrigins !== undefined ||
+        config.auth.sessionDays !== DEFAULT_AUTH.sessionDays
         ? {
             ...(config.auth.methods === undefined
                 ? {}
                 : { methods: [...config.auth.methods] }),
+            ...(config.auth.sessionDays === DEFAULT_AUTH.sessionDays
+                ? {}
+                : { sessionDays: config.auth.sessionDays }),
             ...(proxySection === undefined ? {} : { proxy: proxySection }),
             ...(config.auth.adminGroups.length > 0
                 ? { adminGroups: [...config.auth.adminGroups] }
@@ -765,6 +805,7 @@ export function resolvedServerSection(config) {
         ...(webui === undefined ? {} : { webui }),
         compaction: { ...config.compaction },
         memorySeam: { ...config.memorySeam },
+        isolation: { ...config.isolation },
         providers: { ...config.providers },
         ...(auth === undefined ? {} : { auth }),
         ...(metrics === undefined ? {} : { metrics }),
@@ -803,6 +844,7 @@ export function resolvedServerSection(config) {
  * | `SIGRUN_IDLE_THRESHOLD` | `memorySeam.idleThresholdMs` |
  * | `SIGRUN_WORKER_DEADLINE` | `memorySeam.workerDeadlineMs` |
  * | `SIGRUN_QUEUE_MAX` | `memorySeam.queueMax` |
+ * | `SIGRUN_ISOLATION` | `isolation.mode` |
  * | `SIGRUN_PROVIDER_REFRESH_MINUTES` | `providers.refreshIntervalMinutes` |
  * | `SIGRUN_BACKUP_*` | `backup` |
  * | `SIGRUN_MAX_UPLOAD_BYTES` | `maxUploadBytes` |
@@ -859,6 +901,9 @@ export function envServerSection(env) {
     });
     if (memorySeam !== undefined)
         section.memorySeam = memorySeam;
+    const isolationMode = parseIsolationMode(env);
+    if (isolationMode !== undefined)
+        section.isolation = { mode: isolationMode };
     const refreshIntervalMinutes = parseNonNegativeIntEnv(env, PROVIDER_REFRESH_MINUTES_ENV);
     if (refreshIntervalMinutes !== undefined) {
         section.providers = { refreshIntervalMinutes };
@@ -877,6 +922,12 @@ export function envServerSection(env) {
     const dev = parseDev(env);
     if (dev !== undefined)
         section.dev = dev;
+    // The supervised flag (§13.3) — the same bootstrap rule as dev:
+    // projected only when the env var is SET (a defaulted flag is never
+    // persisted; the deploy's restart posture is env intent, not state).
+    const supervised = parseSupervised(env);
+    if (supervised !== undefined)
+        section.supervised = supervised;
     return section;
 }
 /**
@@ -950,8 +1001,18 @@ export function effectiveServerSection(env, fileServer, config) {
         "memorySeam",
         "queueMax",
     ]);
+    emit("auth.sessionDays", config.auth.sessionDays, ["auth", "sessionDays"]);
+    emit("isolation.mode", config.isolation.mode, ["isolation", "mode"]);
+    emit("isolation.osUsers", config.isolation.osUsers, ["isolation", "osUsers"]);
+    emit("isolation.workerIdleMinutes", config.isolation.workerIdleMinutes, [
+        "isolation",
+        "workerIdleMinutes",
+    ]);
     emit("providers.refreshIntervalMinutes", config.providers.refreshIntervalMinutes, ["providers", "refreshIntervalMinutes"]);
     emit("dev", config.dev, ["dev"]);
+    // U4 §13.3: the supervised posture rides the effective block too —
+    // the settings surface's restart affordance reads one place.
+    emit("supervised", config.supervised, ["supervised"]);
     if (config.backup?.target === "path") {
         emit("backup.path", config.backup.path, ["backup", "path"]);
         emit("backup.staleAfterHours", config.backupStaleAfterHours, ["backup", "staleAfterHours"]);
@@ -1093,6 +1154,7 @@ export function loadConfig(env, settingsFile) {
         backupStaleAfterHours: server?.backup?.staleAfterHours ?? DEFAULT_BACKUP_STALE_AFTER_HOURS,
         compaction: parseCompaction(env, server?.compaction),
         memorySeam: parseMemorySeam(env, server?.memorySeam),
+        isolation: parseIsolation(env, server?.isolation),
         providers: {
             refreshIntervalMinutes: parseRefreshIntervalMinutes(env, server?.providers?.refreshIntervalMinutes),
         },
@@ -1101,6 +1163,10 @@ export function loadConfig(env, settingsFile) {
         // The development flag (§14.2/§14.4): strict env parse over the
         // file's `server.dev`, default false.
         dev: parseDev(env) ?? server?.dev ?? false,
+        // The supervised posture (§13.3): env over file over false. Only
+        // the chart and compose set the env; a file-set flag serves a
+        // hand-rolled systemd/supervisord deploy (same restart promise).
+        supervised: parseSupervised(env) ?? server?.supervised ?? false,
         // The jobs default timezone (§8.2): env over file over the process
         // TZ, validated loud (a bad name would otherwise crash the scheduler
         // at evaluation time instead of failing boot).