harness-dispatch 0.5.0 → 0.6.1

package/dist/config/route-fields.d.ts

@@ -0,0 +1,72 @@
+/**
+ * One field contract shared by every route shape.
+ *
+ * THE DEFECT THIS EXISTS TO RETIRE. `clis:`, `endpoints:` and the legacy
+ * `services:` block each resolved route fields with their own hand-written
+ * list, so a key added to one was easy to forget in the others. That produced
+ * five separate silent-drop defects in one file, each the same shape: a
+ * correctly-spelled, correctly-valued setting written in config and read by
+ * nobody —
+ *
+ *   workspace_policy   honoured for services:/endpoints:, dropped for clis:
+ *   api_keys           honoured for clis:,               dropped for endpoints:
+ *   effective_safety   honoured for clis:/services:,      dropped for endpoints:
+ *   escalate_model     honoured for clis:,               dropped for endpoints:
+ *
+ * These are safety and isolation controls, so "silently absent" means
+ * "silently less restrictive" — a route asked to run `read_only` running with
+ * write access, a route asked to run in an isolated copy running in the user's
+ * repository. Nothing warns, because nothing is wrong with what was written.
+ *
+ * WHY A TABLE RATHER THAN A SHARED FUNCTION. The obvious unification — have
+ * the CLI builder call the endpoint builder's `billingFields()` — is wrong,
+ * and tests/route-field-parity.test.ts says why: the CLI path resolves
+ * `entry.X ?? harnessDefaults.X` against the defaults shipped in
+ * config.default.yaml, and `billingFields(raw)` has no defaults layer at all.
+ * Collapsing them would silently drop the fallback every built-in harness
+ * relies on — trading five silent-drop bugs for a bigger one. A table carries
+ * the defaults layer explicitly: each field says how to parse it AND where its
+ * fallback comes from, and a shape with no defaults (endpoints) simply passes
+ * none.
+ *
+ * WHAT IS DELIBERATELY NOT HERE. Billing identity — provider, surface,
+ * auth_source, billing_kind, paid_usage_possible — resolves differently per
+ * shape for real reasons, not by accident: endpoints infer it from the base
+ * URL (localhost is local_compute), while CLI routes factor in whether an
+ * api_key is present (a key means a metered account exists whatever the
+ * declared kind says). Those stay in their builders. Pretending they are
+ * shared would be the same mistake in the other direction.
+ *
+ * tests/route-field-parity.test.ts still pins every key here against both
+ * shapes. It is no longer the only thing standing between a new field and a
+ * silent drop, but it is what proves this table is actually wired into both.
+ */
+import type { SafetyProfile, ServiceConfig } from "../types.js";
+/**
+ * The subset of a harness's shipped defaults that shared fields fall back to.
+ *
+ * Structural on purpose: `CliDefaults` satisfies it without this module
+ * needing to import config.ts (which imports this one).
+ */
+export type RouteFieldDefaults = Partial<Pick<ServiceConfig, "leaderboardModel" | "thinkingLevel" | "maxOutputTokens" | "maxInputTokens" | "effectiveSafety" | "models" | "modelHint">>;
+/**
+ * `effective_safety` is either one profile for every request, or a per-request
+ * map. Shared by all three shapes; lived in config.ts before this table.
+ */
+export declare function effectiveSafetyFrom(raw: unknown): SafetyProfile | Partial<Record<SafetyProfile, SafetyProfile>> | undefined;
+/** The YAML keys this table owns — used by tests to prove both shapes are wired to it. */
+export declare const SHARED_ROUTE_FIELD_KEYS: readonly string[];
+/**
+ * Resolve every shared field for one route entry.
+ *
+ * A field is emitted only when it resolves to something, so callers can spread
+ * the result over a partially-built ServiceConfig without overwriting anything
+ * with `undefined`.
+ *
+ * @param raw the route entry as written in config.yaml
+ * @param defaults the harness's shipped defaults, for shapes that have them
+ * (`clis:`). Endpoint entries pass nothing — they have no defaults layer, and
+ * inventing one is the mistake this table's header warns about.
+ */
+export declare function resolveSharedRouteFields(raw: Record<string, unknown>, defaults?: RouteFieldDefaults): Partial<ServiceConfig>;
+//# sourceMappingURL=route-fields.d.ts.map

package/dist/config/route-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-fields.d.ts","sourceRoot":"","sources":["../../src/config/route-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAShE;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,IAAI,CACF,aAAa,EACX,kBAAkB,GAClB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,QAAQ,GACR,WAAW,CACd,CACF,CAAC;AA0BF;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,GACX,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,GAAG,SAAS,CAW3E;AAiCD,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAA0C,CAAC;AAEhG;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,QAAQ,CAAC,EAAE,kBAAkB,GAC5B,OAAO,CAAC,aAAa,CAAC,CAQxB"}

package/dist/config/route-fields.js

@@ -0,0 +1,128 @@
+/**
+ * One field contract shared by every route shape.
+ *
+ * THE DEFECT THIS EXISTS TO RETIRE. `clis:`, `endpoints:` and the legacy
+ * `services:` block each resolved route fields with their own hand-written
+ * list, so a key added to one was easy to forget in the others. That produced
+ * five separate silent-drop defects in one file, each the same shape: a
+ * correctly-spelled, correctly-valued setting written in config and read by
+ * nobody —
+ *
+ *   workspace_policy   honoured for services:/endpoints:, dropped for clis:
+ *   api_keys           honoured for clis:,               dropped for endpoints:
+ *   effective_safety   honoured for clis:/services:,      dropped for endpoints:
+ *   escalate_model     honoured for clis:,               dropped for endpoints:
+ *
+ * These are safety and isolation controls, so "silently absent" means
+ * "silently less restrictive" — a route asked to run `read_only` running with
+ * write access, a route asked to run in an isolated copy running in the user's
+ * repository. Nothing warns, because nothing is wrong with what was written.
+ *
+ * WHY A TABLE RATHER THAN A SHARED FUNCTION. The obvious unification — have
+ * the CLI builder call the endpoint builder's `billingFields()` — is wrong,
+ * and tests/route-field-parity.test.ts says why: the CLI path resolves
+ * `entry.X ?? harnessDefaults.X` against the defaults shipped in
+ * config.default.yaml, and `billingFields(raw)` has no defaults layer at all.
+ * Collapsing them would silently drop the fallback every built-in harness
+ * relies on — trading five silent-drop bugs for a bigger one. A table carries
+ * the defaults layer explicitly: each field says how to parse it AND where its
+ * fallback comes from, and a shape with no defaults (endpoints) simply passes
+ * none.
+ *
+ * WHAT IS DELIBERATELY NOT HERE. Billing identity — provider, surface,
+ * auth_source, billing_kind, paid_usage_possible — resolves differently per
+ * shape for real reasons, not by accident: endpoints infer it from the base
+ * URL (localhost is local_compute), while CLI routes factor in whether an
+ * api_key is present (a key means a metered account exists whatever the
+ * declared kind says). Those stay in their builders. Pretending they are
+ * shared would be the same mistake in the other direction.
+ *
+ * tests/route-field-parity.test.ts still pins every key here against both
+ * shapes. It is no longer the only thing standing between a new field and a
+ * silent drop, but it is what proves this table is actually wired into both.
+ */
+import { normalizeSafetyProfile } from "../safety.js";
+import { confidenceFrom, str, thinkingFrom, workspacePolicyFrom, } from "./coercions.js";
+import { stringArrayFrom } from "./protocol.js";
+/** A number only when it really is one — `int()`/`num()` coerce, and these must not. */
+function numberOnly(raw) {
+    return typeof raw === "number" ? raw : undefined;
+}
+/** Likewise for booleans: an absent flag must stay absent, not become false. */
+function booleanOnly(raw) {
+    return typeof raw === "boolean" ? raw : undefined;
+}
+/**
+ * `effective_safety` is either one profile for every request, or a per-request
+ * map. Shared by all three shapes; lived in config.ts before this table.
+ */
+export function effectiveSafetyFrom(raw) {
+    const single = normalizeSafetyProfile(raw);
+    if (single !== undefined)
+        return single;
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const out = {};
+    for (const [key, value] of Object.entries(raw)) {
+        const requested = normalizeSafetyProfile(key);
+        const floor = normalizeSafetyProfile(value);
+        if (requested !== undefined && floor !== undefined)
+            out[requested] = floor;
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * Every optional field that means the same thing on every route shape.
+ *
+ * Adding a route setting means adding ONE row here (plus its key to
+ * KNOWN_ROUTE_KEYS in validation.ts, which is what catches misspellings) and
+ * it works on `clis:`, `endpoints:` and `services:` at once. That is the whole
+ * point: the old failure mode was a field that existed in one list and not the
+ * others.
+ */
+const SHARED_ROUTE_FIELDS = [
+    { key: "leaderboard_model", field: "leaderboardModel", parse: str, fromDefaults: (d) => d.leaderboardModel },
+    { key: "thinking_level", field: "thinkingLevel", parse: thinkingFrom, fromDefaults: (d) => d.thinkingLevel },
+    { key: "escalate_model", field: "escalateModel", parse: str },
+    { key: "max_output_tokens", field: "maxOutputTokens", parse: numberOnly, fromDefaults: (d) => d.maxOutputTokens },
+    { key: "max_input_tokens", field: "maxInputTokens", parse: numberOnly, fromDefaults: (d) => d.maxInputTokens },
+    { key: "timeout_ms", field: "timeoutMs", parse: numberOnly },
+    { key: "resource_weight", field: "resourceWeight", parse: numberOnly },
+    // Safety and isolation. Four of the five original silent drops were here.
+    { key: "safety_profile", field: "safetyProfile", parse: normalizeSafetyProfile },
+    { key: "effective_safety", field: "effectiveSafety", parse: effectiveSafetyFrom, fromDefaults: (d) => d.effectiveSafety },
+    { key: "workspace_policy", field: "workspacePolicy", parse: workspacePolicyFrom },
+    // Billing fields that are plain declarations. The INFERRED ones
+    // (provider/surface/auth_source/billing_kind/paid_usage_possible) stay in
+    // the builders — see the header.
+    { key: "allow_paid_usage", field: "allowPaidUsage", parse: booleanOnly },
+    { key: "billing_confidence", field: "billingConfidence", parse: confidenceFrom },
+    { key: "billing_notes", field: "billingNotes", parse: str },
+    { key: "models", field: "models", parse: stringArrayFrom, fromDefaults: (d) => d.models },
+    { key: "model_hint", field: "modelHint", parse: str, fromDefaults: (d) => d.modelHint },
+];
+/** The YAML keys this table owns — used by tests to prove both shapes are wired to it. */
+export const SHARED_ROUTE_FIELD_KEYS = SHARED_ROUTE_FIELDS.map((f) => f.key);
+/**
+ * Resolve every shared field for one route entry.
+ *
+ * A field is emitted only when it resolves to something, so callers can spread
+ * the result over a partially-built ServiceConfig without overwriting anything
+ * with `undefined`.
+ *
+ * @param raw the route entry as written in config.yaml
+ * @param defaults the harness's shipped defaults, for shapes that have them
+ * (`clis:`). Endpoint entries pass nothing — they have no defaults layer, and
+ * inventing one is the mistake this table's header warns about.
+ */
+export function resolveSharedRouteFields(raw, defaults) {
+    const out = {};
+    for (const spec of SHARED_ROUTE_FIELDS) {
+        const declared = spec.parse(raw[spec.key]);
+        const value = declared ?? (defaults !== undefined ? spec.fromDefaults?.(defaults) : undefined);
+        if (value !== undefined)
+            out[spec.field] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=route-fields.js.map

package/dist/config/route-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-fields.js","sourceRoot":"","sources":["../../src/config/route-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EACL,cAAc,EACd,GAAG,EACH,YAAY,EACZ,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAmChD,wFAAwF;AACxF,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAY;IAEZ,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,GAAG,GAAkD,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,SAAS,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,mBAAmB,GAAqB;IAC5C,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE;IAC5G,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE;IAC5G,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE;IAC7D,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE;IACjH,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE;IAC9G,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE;IAC5D,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,UAAU,EAAE;IACtE,0EAA0E;IAC1E,EAAE,GAAG,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,sBAAsB,EAAE;IAChF,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE;IACzH,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACjF,gEAAgE;IAChE,0EAA0E;IAC1E,iCAAiC;IACjC,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE;IACxE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE;IAChF,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE;IAC3D,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IACzF,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE;CACxF,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAsB,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA4B,EAC5B,QAA6B;IAE7B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/F,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,GAA6B,CAAC;AACvC,CAAC"}

package/dist/config/validation.js

@@ -108,7 +108,7 @@ export const KNOWN_ROUTE_KEYS = new Set([
     "name", "harness", "type", "command", "enabled", "model", "models", "model_hint",
     "tier", "weight", "cli_capability", "capabilities", "timeout_ms",
     "max_input_tokens", "max_output_tokens", "thinking_level",
-    "leaderboard_model", "escalate_model", "escalate_on",
+    "leaderboard_model", "escalate_model", "escalate_on", "resource_weight",
     "api_key", "base_url", "protocol", "filter",
     "provider", "surface", "auth_source", "billing_kind", "billing_confidence",
     "billing_notes", "paid_usage_possible", "allow_paid_usage",

package/dist/config/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/config/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,WAAW;IACX,YAAY,EAAE;QACZ,eAAe;QACf,qBAAqB;QACrB,qCAAqC;QACrC,uCAAuC;QACvC,+BAA+B;QAC/B,aAAa;QACb,YAAY;QACZ,SAAS;KACV;IACD,kBAAkB,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC;IACxE,cAAc,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;IAC5D,gBAAgB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;IAC9D,gBAAgB,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;CACtE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,SAAS;IACT,MAAM;IACN,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,wBAAwB;IACxB,kBAAkB;IAClB,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;IAChF,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY;IAChE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB;IACzD,mBAAmB,EAAE,gBAAgB,EAAE,aAAa;IACpD,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IAC3C,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB;IAC1E,eAAe,EAAE,qBAAqB,EAAE,kBAAkB;IAC1D,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB;IACxD,eAAe,EAAE,mBAAmB,EAAE,eAAe;CACtD,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAClC,KAA8B,EAC9B,KAAa,EACb,QAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,kBAAkB,GAAG,yCAAyC;YACpE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAEpF,MAAM,UAAU,uBAAuB,CAAC,GAA4B,EAAE,QAAkB;IACtF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,+DAA+D;gBACnE,gDAAgD,CACnD,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,iCAAiC;QACzE,QAAQ,CAAC,IAAI,CACX,iCAAiC,GAAG,yCAAyC;YAC3E,wBAAwB,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAa,EAAE,QAAkB,EAAE,KAAK,GAAG,EAAE;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE;YAAE,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;IACzF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,GAAG,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CACxB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClF,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5F,YAAY,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,CACrE,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACjF,gFAAgF;YAChF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/config/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,sEAAsE;IACtE,6EAA6E;IAC7E,WAAW;IACX,YAAY,EAAE;QACZ,eAAe;QACf,qBAAqB;QACrB,qCAAqC;QACrC,uCAAuC;QACvC,+BAA+B;QAC/B,aAAa;QACb,YAAY;QACZ,SAAS;KACV;IACD,kBAAkB,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC;IACxE,cAAc,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;IAC5D,gBAAgB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,WAAW,CAAC;IAC9D,gBAAgB,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;CACtE,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,SAAS;IACT,MAAM;IACN,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,WAAW;IACX,aAAa;IACb,qBAAqB;IACrB,wBAAwB;IACxB,kBAAkB;IAClB,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;IAChF,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY;IAChE,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB;IACzD,mBAAmB,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB;IACvE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ;IAC3C,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,oBAAoB;IAC1E,eAAe,EAAE,qBAAqB,EAAE,kBAAkB;IAC1D,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB;IACxD,eAAe,EAAE,mBAAmB,EAAE,eAAe;CACtD,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAClC,KAA8B,EAC9B,KAAa,EACb,QAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACxC,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,kBAAkB,GAAG,yCAAyC;YACpE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAEpF,MAAM,UAAU,uBAAuB,CAAC,GAA4B,EAAE,QAAkB;IACtF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CACX,GAAG,GAAG,+DAA+D;gBACnE,gDAAgD,CACnD,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS,CAAC,iCAAiC;QACzE,QAAQ,CAAC,IAAI,CACX,iCAAiC,GAAG,yCAAyC;YAC3E,wBAAwB,CAAC,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAa,EAAE,QAAkB,EAAE,KAAK,GAAG,EAAE;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE;YAAE,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IACtD,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;IACzF,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,oCAAoC;QACpC,IAAI,GAAG,KAAK,kBAAkB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CACxB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAClF,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC/B,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC5F,YAAY,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,qCAAqC,CACrE,CAAC;YACF,SAAS;QACX,CAAC;QACD,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,GAAG,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACjF,gFAAgF;YAChF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,sBAAsB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;AACH,CAAC"}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAyBH,2EAA2E;AAC3E,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AA+B9D,OAAO,KAAK,EAOV,iBAAiB,EAGjB,YAAY,EAOb,MAAM,YAAY,CAAC;AAsEpB,iKAAiK;AACjK,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAI9D,CAAC;AAQF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKvD,CAAC;AAgrBF,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAwGvB;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,IAAI,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,EACnC,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpD,aAAa,CAkCf"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA6BH,2EAA2E;AAC3E,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AA+B9D,OAAO,KAAK,EAOV,iBAAiB,EAGjB,YAAY,EAOb,MAAM,YAAY,CAAC;AAsEpB,iKAAiK;AACjK,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAI9D,CAAC;AAQF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKvD,CAAC;AA0lBF,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAkHvB;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,IAAI,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,EACnC,IAAI,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GACpD,aAAa,CAkCf"}

package/dist/config.js

@@ -17,12 +17,12 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import yaml from "js-yaml";
 import which from "which";
-import { normalizeSafetyProfile, } from "./safety.js";
 import { inferredPaidUsagePossible } from "./billing.js";
-import { authSourceFrom, billingKindFrom, bool, confidenceFrom, endpointModeFrom, endpointProviderFrom, inferEndpointProvider, int, num, providerFrom, str, surfaceFrom, thinkingFrom, wireProtocolFrom, workspacePolicyFrom, } from "./config/coercions.js";
+import { authSourceFrom, billingKindFrom, bool, endpointModeFrom, endpointProviderFrom, inferEndpointProvider, int, num, providerFrom, str, surfaceFrom, wireProtocolFrom, } from "./config/coercions.js";
 import { warnUnknownRouteKeys, warnUnknownSafetyEnums, warnUnknownTopLevelKeys, } from "./config/validation.js";
 import { parseProtocolFields, protocolFrom, stringArrayFrom } from "./config/protocol.js";
-import { interpolateTree } from "./config/env-interpolation.js";
+import { effectiveSafetyFrom, resolveSharedRouteFields, } from "./config/route-fields.js";
+import { ENV_VAR_RE, interpolateTree } from "./config/env-interpolation.js";
 /**
  * PATH lookups, memoised for the life of the process.
  *
@@ -182,29 +182,22 @@ function topLevelSettings(raw, policyWarnings = []) {
  * KEY or value inside the map is dropped individually — a typo must not
  * silently widen the floor for a request it was meant to restrict.
  */
-function effectiveSafetyFrom(raw) {
-    const single = normalizeSafetyProfile(raw);
-    if (single !== undefined)
-        return single;
-    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
-        return undefined;
-    const out = {};
-    for (const [key, value] of Object.entries(raw)) {
-        const requested = normalizeSafetyProfile(key);
-        const floor = normalizeSafetyProfile(value);
-        if (requested !== undefined && floor !== undefined)
-            out[requested] = floor;
-    }
-    return Object.keys(out).length > 0 ? out : undefined;
-}
+/**
+ * Billing IDENTITY for a route — the part that genuinely differs per shape.
+ *
+ * Everything that means the same thing everywhere (safety_profile,
+ * effective_safety, workspace_policy, billing_notes, models, …) now comes from
+ * resolveSharedRouteFields instead. What is left here is the set the caller
+ * has already inferred per shape: endpoints derive provider/surface/kind from
+ * the base URL, CLI routes derive them from whether an api_key is present.
+ * This function only reads what it is handed.
+ */
 function billingFields(raw) {
     const out = {};
     const provider = providerFrom(raw.provider);
     const surface = surfaceFrom(raw.surface);
     const authSource = authSourceFrom(raw.auth_source);
     const billingKind = billingKindFrom(raw.billing_kind);
-    const billingConfidence = confidenceFrom(raw.billing_confidence);
-    const safetyProfile = normalizeSafetyProfile(raw.safety_profile);
     if (provider !== undefined)
         out.provider = provider;
     if (surface !== undefined)
@@ -213,31 +206,9 @@ function billingFields(raw) {
         out.authSource = authSource;
     if (billingKind !== undefined)
         out.billingKind = billingKind;
-    if (billingConfidence !== undefined)
-        out.billingConfidence = billingConfidence;
     if (typeof raw.paid_usage_possible === "boolean") {
         out.paidUsagePossible = raw.paid_usage_possible;
     }
-    if (typeof raw.allow_paid_usage === "boolean")
-        out.allowPaidUsage = raw.allow_paid_usage;
-    const notes = str(raw.billing_notes);
-    if (notes !== undefined)
-        out.billingNotes = notes;
-    if (safetyProfile !== undefined)
-        out.safetyProfile = safetyProfile;
-    // effective_safety was handled by the `clis:` builder and the legacy
-    // `services:` path but not here, so an `endpoints:` entry declaring it was
-    // silently ignored — the fourth instance of this file's parallel-field-list
-    // defect, and the first one caught by a test rather than by a user or a
-    // reviewer. Practically fail-safe (openai_compatible routes are read_only by
-    // construction, so the ignored value could only have widened them), but the
-    // inconsistency is the bug.
-    const effectiveSafety = effectiveSafetyFrom(raw.effective_safety);
-    if (effectiveSafety !== undefined)
-        out.effectiveSafety = effectiveSafety;
-    const workspacePolicy = workspacePolicyFrom(raw.workspace_policy);
-    if (workspacePolicy !== undefined)
-        out.workspacePolicy = workspacePolicy;
     return out;
 }
 function capsFrom(raw) {
@@ -300,31 +271,11 @@ function buildLegacyConfig(raw) {
             tier: int(svc.tier, 1),
             weight: num(svc.weight, 1.0),
             cliCapability: num(svc.cli_capability, 1.0),
-            ...(str(svc.leaderboard_model) !== undefined
-                ? { leaderboardModel: str(svc.leaderboard_model) }
-                : {}),
-            ...(() => {
-                const t = thinkingFrom(svc.thinking_level);
-                return t !== undefined ? { thinkingLevel: t } : {};
-            })(),
-            ...(str(svc.escalate_model) !== undefined
-                ? { escalateModel: str(svc.escalate_model) }
-                : {}),
             escalateOn: escalateOnFrom(svc.escalate_on),
             capabilities: capsFrom(svc.capabilities),
             ...(() => {
-                // Declared context size drives router.ts's preferLargeContext boost
-                // (not harness name), so a legacy entry that omits these but names
-                // a known harness (e.g. antigravity_cli's 2M context) must still
-                // inherit them — otherwise the boost silently becomes a no-op.
-                const v = typeof svc.max_output_tokens === "number" ? svc.max_output_tokens : harnessDefaults?.maxOutputTokens;
-                return v !== undefined ? { maxOutputTokens: v } : {};
-            })(),
-            ...(() => {
-                const v = typeof svc.max_input_tokens === "number" ? svc.max_input_tokens : harnessDefaults?.maxInputTokens;
-                return v !== undefined ? { maxInputTokens: v } : {};
-            })(),
-            ...(() => {
+                // Billing IDENTITY only — the rest of the named harness's defaults
+                // reach this entry through resolveSharedRouteFields below.
                 if (!harnessDefaults)
                     return {};
                 return {
@@ -337,30 +288,19 @@ function buildLegacyConfig(raw) {
                     ...(harnessDefaults.paidUsagePossible !== undefined
                         ? { paidUsagePossible: harnessDefaults.paidUsagePossible }
                         : {}),
-                    ...(harnessDefaults.effectiveSafety !== undefined
-                        ? { effectiveSafety: harnessDefaults.effectiveSafety }
-                        : {}),
-                    ...(harnessDefaults.models !== undefined ? { models: harnessDefaults.models } : {}),
-                    ...(harnessDefaults.modelHint !== undefined
-                        ? { modelHint: harnessDefaults.modelHint }
-                        : {}),
                 };
             })(),
             ...billingFields(svc),
-            ...(() => {
-                const effectiveSafety = effectiveSafetyFrom(svc.effective_safety);
-                return effectiveSafety !== undefined ? { effectiveSafety } : {};
-            })(),
-            ...(() => {
-                const models = stringArrayFrom(svc.models);
-                return models !== undefined ? { models } : {};
-            })(),
-            ...(() => {
-                const modelHint = str(svc.model_hint);
-                return modelHint !== undefined ? { modelHint } : {};
-            })(),
+            // The same table the `clis:` and `endpoints:` builders use. This shape
+            // previously read the shared keys through billingFields() plus four
+            // hand-written blocks, which is how it ended up with a DIFFERENT set
+            // again: it inherited maxInput/OutputTokens, effectiveSafety, models and
+            // modelHint from the named harness but not leaderboardModel or
+            // thinkingLevel, so `services: { x: { harness: antigravity_cli } }`
+            // silently lost its scoring key and its thinking level. Passing the
+            // defaults through one table fixes that too.
+            ...resolveSharedRouteFields(svc, harnessDefaults),
             ...endpointFields(svc, type, str(svc.base_url)),
-            ...(typeof svc.timeout_ms === "number" ? { timeoutMs: svc.timeout_ms } : {}),
             ...(() => {
                 // Falls back to the named harness's built-in default protocol (if
                 // any) when this legacy-format entry doesn't declare its own —
@@ -416,31 +356,13 @@ function buildCliServiceConfig(name, defaults, override, apiKeys, warnings = [])
         weight: num(override.weight, 1.0),
         tier: int(override.tier, defaults.tier),
         cliCapability: num(override.cli_capability, defaults.cliCapability),
-        leaderboardModel: str(override.leaderboard_model) ?? defaults.leaderboardModel,
-        ...(() => {
-            const overrideThinking = thinkingFrom(override.thinking_level);
-            if (overrideThinking !== undefined)
-                return { thinkingLevel: overrideThinking };
-            if (defaults.thinkingLevel !== undefined) {
-                return { thinkingLevel: defaults.thinkingLevel };
-            }
-            return {};
-        })(),
-        ...(str(override.escalate_model) !== undefined
-            ? { escalateModel: str(override.escalate_model) }
-            : {}),
         escalateOn: escalateOnFrom(override.escalate_on),
         capabilities: caps,
-        ...(() => {
-            const m = override.max_output_tokens;
-            const v = typeof m === "number" ? m : defaults.maxOutputTokens;
-            return v !== undefined ? { maxOutputTokens: v } : {};
-        })(),
-        ...(() => {
-            const m = override.max_input_tokens;
-            const v = typeof m === "number" ? m : defaults.maxInputTokens;
-            return v !== undefined ? { maxInputTokens: v } : {};
-        })(),
+        // Every field that means the same thing on every route shape, resolved
+        // from ONE table against this harness's shipped defaults. Spread early so
+        // the shape-specific resolutions below (billing identity, which depends on
+        // whether an api_key is present) still win.
+        ...resolveSharedRouteFields(override, defaults),
         provider: providerFrom(override.provider) ?? defaults.provider,
         surface: surfaceFrom(override.surface) ?? defaults.surface,
         authSource: authSourceFrom(override.auth_source) ?? (apiKey ? "api_key" : defaults.authSource),
@@ -472,47 +394,7 @@ function buildCliServiceConfig(name, defaults, override, apiKeys, warnings = [])
                         : defaults.paidUsagePossible;
             return paidUsagePossible !== undefined ? { paidUsagePossible } : {};
         })(),
-        ...(typeof override.allow_paid_usage === "boolean"
-            ? { allowPaidUsage: override.allow_paid_usage }
-            : {}),
-        ...(() => {
-            const c = confidenceFrom(override.billing_confidence);
-            return c !== undefined ? { billingConfidence: c } : {};
-        })(),
-        ...(() => {
-            const notes = str(override.billing_notes);
-            return notes !== undefined ? { billingNotes: notes } : {};
-        })(),
-        ...(() => {
-            const safetyProfile = normalizeSafetyProfile(override.safety_profile);
-            return safetyProfile !== undefined ? { safetyProfile } : {};
-        })(),
-        ...(() => {
-            // `clis:` entries never read this. It was handled for `services:` and
-            // `endpoints:` (both go through billingFields, which this builder does
-            // not call), so `workspace_policy: copy` on the primary, documented way
-            // to define a route was silently dropped and the route fell back to
-            // shared_locked — the LESS isolated default, with no warning, because
-            // the value itself is perfectly valid. The fail-open enum check added
-            // earlier cannot catch this: the key is right and the value is right;
-            // nothing was reading it.
-            const workspacePolicy = workspacePolicyFrom(override.workspace_policy);
-            return workspacePolicy !== undefined ? { workspacePolicy } : {};
-        })(),
-        ...(() => {
-            const effectiveSafety = effectiveSafetyFrom(override.effective_safety) ?? defaults.effectiveSafety;
-            return effectiveSafety !== undefined ? { effectiveSafety } : {};
-        })(),
-        ...(() => {
-            const models = stringArrayFrom(override.models) ?? defaults.models;
-            return models !== undefined ? { models } : {};
-        })(),
-        ...(() => {
-            const modelHint = str(override.model_hint) ?? defaults.modelHint;
-            return modelHint !== undefined ? { modelHint } : {};
-        })(),
         ...endpointFields(override, "cli", str(override.base_url)),
-        ...(typeof override.timeout_ms === "number" ? { timeoutMs: override.timeout_ms } : {}),
         ...(() => {
             // Falls back to this harness's built-in default (if any) when no
             // override is given, or when the override is malformed — protocolFrom
@@ -608,6 +490,53 @@ function addClis(services, raw, apiKeys, warnings) {
         services[name] = buildCliServiceConfig(name, defaults, entry, apiKeys, warnings);
     }
 }
+/**
+ * `api_key: ${VAR}` references keyed by route name, read from the RAW tree
+ * before interpolation.
+ *
+ * envRefs cannot cover this case. It maps a resolved value back to the
+ * reference that produced it, and an UNSET variable resolves to "" — which
+ * every unset variable shares, so the map would hand one route another route's
+ * variable name. interpolateEnv skips empty resolutions for exactly that
+ * reason.
+ *
+ * The consequence was silent: `configure --yes --force` run in a shell that
+ * had not exported the variable emitted the route with no `api_key` line at
+ * all, overwriting a correct config with one whose key was simply gone. Keyed
+ * by route name, which is unique per shape and is what configure has in hand.
+ */
+function collectApiKeyRefs(parsed) {
+    const refs = new Map();
+    const note = (name, value) => {
+        if (typeof name === "string" && typeof value === "string" && ENV_VAR_RE.test(value)) {
+            refs.set(name, value);
+        }
+    };
+    for (const key of ["clis", "endpoints"]) {
+        const list = parsed[key];
+        if (!Array.isArray(list))
+            continue;
+        for (const entry of list) {
+            if (entry !== null && typeof entry === "object") {
+                const e = entry;
+                note(e.name, e.api_key);
+            }
+        }
+    }
+    for (const key of ["services", "api_keys"]) {
+        const block = parsed[key];
+        if (block === null || typeof block !== "object")
+            continue;
+        for (const [name, entry] of Object.entries(block)) {
+            if (key === "api_keys")
+                note(name, entry);
+            else if (entry !== null && typeof entry === "object") {
+                note(name, entry.api_key);
+            }
+        }
+    }
+    return refs;
+}
 function collectApiKeys(raw) {
     const apiKeys = {};
     const rawApiKeys = (raw.api_keys ?? {});
@@ -669,16 +598,6 @@ function addEndpoints(services, raw, apiKeys, warnings = []) {
             weight: num(ep.weight, 0.6),
             tier: int(ep.tier, 3),
             cliCapability: num(ep.cli_capability, 1.0),
-            ...(str(ep.leaderboard_model) !== undefined
-                ? { leaderboardModel: str(ep.leaderboard_model) }
-                : {}),
-            // escalate_on was honoured here and escalate_model was not — the fifth
-            // instance of this file's parallel-field-list defect, and the second
-            // found by review rather than by the parity test, which pins 16 shared
-            // keys and did not include this one. It does now.
-            ...(str(ep.escalate_model) !== undefined
-                ? { escalateModel: str(ep.escalate_model) }
-                : {}),
             escalateOn: escalateOnFrom(ep.escalate_on),
             capabilities: capsFrom(ep.capabilities),
             ...billingFields({
@@ -695,21 +614,10 @@ function addEndpoints(services, raw, apiKeys, warnings = []) {
                 billing_confidence: ep.billing_confidence ?? (inferEndpointProvider(baseUrl) === "custom" ? undefined : "documented"),
             }),
             ...endpointFields(ep, "openai_compatible", baseUrl),
-            ...(typeof ep.timeout_ms === "number" ? { timeoutMs: ep.timeout_ms } : {}),
-            ...(typeof ep.max_output_tokens === "number" ? { maxOutputTokens: ep.max_output_tokens } : {}),
-            ...(typeof ep.max_input_tokens === "number" ? { maxInputTokens: ep.max_input_tokens } : {}),
-            ...(() => {
-                const t = thinkingFrom(ep.thinking_level);
-                return t !== undefined ? { thinkingLevel: t } : {};
-            })(),
-            ...(() => {
-                const models = stringArrayFrom(ep.models);
-                return models !== undefined ? { models } : {};
-            })(),
-            ...(() => {
-                const modelHint = str(ep.model_hint);
-                return modelHint !== undefined ? { modelHint } : {};
-            })(),
+            // No defaults argument: an endpoint has no harness whose shipped
+            // defaults it could fall back to. That absence is exactly why the CLI
+            // path could not simply reuse billingFields() — see route-fields.ts.
+            ...resolveSharedRouteFields(ep),
         };
         services[name] = svc;
     }
@@ -728,11 +636,17 @@ export async function loadConfig(path, opts = {}) {
     let raw = {};
     const unsetEnvVars = new Set();
     const envRefs = new Map();
+    const apiKeyRefs = new Map();
     if (path) {
         try {
             const text = await fs.readFile(path, "utf-8");
             const parsed = yaml.load(text);
             if (parsed && typeof parsed === "object") {
+                // Before interpolation: an unset ${VAR} is indistinguishable from
+                // every other unset ${VAR} once it has resolved to "".
+                for (const [name, ref] of collectApiKeyRefs(parsed)) {
+                    apiKeyRefs.set(name, ref);
+                }
                 raw = interpolateTree(parsed, unsetEnvVars, envRefs);
             }
         }
@@ -777,7 +691,11 @@ export async function loadConfig(path, opts = {}) {
         if (enumWarnings.length > 0) {
             legacyCfg.configWarnings = [...(legacyCfg.configWarnings ?? []), ...enumWarnings];
         }
-        const withRefs = envRefs.size > 0 ? { ...legacyCfg, envRefs } : legacyCfg;
+        const withRefs = {
+            ...legacyCfg,
+            ...(envRefs.size > 0 ? { envRefs } : {}),
+            ...(apiKeyRefs.size > 0 ? { apiKeyRefs } : {}),
+        };
         if (envVarWarning !== undefined) {
             return { ...withRefs, configWarnings: [...(withRefs.configWarnings ?? []), envVarWarning] };
         }
@@ -815,6 +733,7 @@ export async function loadConfig(path, opts = {}) {
         disabled,
         ...topLevelSettings(raw, warnings),
         ...(envRefs.size > 0 ? { envRefs } : {}),
+        ...(apiKeyRefs.size > 0 ? { apiKeyRefs } : {}),
         ...(warnings.length > 0 ? { configWarnings: warnings } : {}),
     };
     return cfg;