@sema-agent/server 1.310.0 → 1.311.0

package/dist/capabilities/center-prompts.d.ts

@@ -1,31 +1,6 @@
-import { type PromptProvider, type PromptTextDeclaration, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
-export interface EffectiveCenterPrompts {
-    packId: string;
-    contentDigest: string;
-    sections: PromptTextDeclaration[];
-    scenarioOverrides?: Record<string, PromptTextDeclaration[]>;
-}
-export declare function validateCenterPrompts(raw: unknown): {
-    ok: true;
-    value: EffectiveCenterPrompts;
-} | {
-    ok: false;
-    error: string;
-};
-export declare const CORE_ENGINE_VERSION: string;
-export interface PromptsDomainFaces {
-    declarations?: EffectiveCenterPrompts;
-    catalog?: PublishedPromptArtifactEnvelope;
-    identity: string;
-    axes: Array<"declarations" | "catalog">;
-}
-export declare function validatePromptsDomain(raw: unknown): {
-    ok: true;
-    value: PromptsDomainFaces;
-} | {
-    ok: false;
-    error: string;
-};
+import { type PromptProvider, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
+import { type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
+export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION, type EffectiveCenterPrompts, type PromptsDomainFaces } from "../prompts-domain-validate.js";
 export declare function withPromptArtifactBackfill(inner: {
     get(d: string, o: {
         engineVersion: string;

package/dist/capabilities/center-prompts.js

@@ -1,111 +1,6 @@
-import { createHash } from "node:crypto";
-import { createRequire } from "node:module";
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { verifyPromptArtifact } from "@sema-agent/core";
-const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
-const SLOTS = new Set(["identity", "scenario", "behavior"]);
-const HASH_RE = /^sha256:[0-9a-f]{64}$/;
-function declarationIssue(d, where) {
-    if (d === null || typeof d !== "object")
-        return `${where}: declaration is not an object`;
-    const o = d;
-    if (typeof o.id !== "string" || o.id.length === 0 || o.id.length > 128 || !ID_RE.test(o.id))
-        return `${where}: bad id`;
-    if (o.id.startsWith("core/"))
-        return `${where}: id in the reserved core/ namespace`;
-    if (typeof o.slot !== "string" || !SLOTS.has(o.slot))
-        return `${where}: bad slot`;
-    if (typeof o.text !== "string" || o.text.length === 0)
-        return `${where}: text must be a non-empty string`;
-    if (typeof o.contentHash !== "string" || !HASH_RE.test(o.contentHash))
-        return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
-    const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
-    if (o.contentHash !== expected)
-        return `${where}: contentHash does not match sha256(text) — stale or tampered declaration`;
-    return undefined;
-}
-export function validateCenterPrompts(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const p = raw;
-    if (typeof p.packId !== "string" || !/^center:[0-9a-f]{12}$/.test(p.packId))
-        return { ok: false, error: "bad packId form (center:<digest12>)" };
-    if (typeof p.contentDigest !== "string" || !HASH_RE.test(p.contentDigest))
-        return { ok: false, error: "bad contentDigest form" };
-    const arrayIssue = (decls, where) => {
-        if (!Array.isArray(decls))
-            return `${where} is not an array`;
-        if (decls.length === 0)
-            return `${where} is empty (an empty replacement set is not a v1 semantic — omit the key instead)`;
-        const seen = new Set();
-        for (let i = 0; i < decls.length; i++) {
-            const issue = declarationIssue(decls[i], `${where}[${i}]`);
-            if (issue)
-                return issue;
-            const id = decls[i].id;
-            if (seen.has(id))
-                return `${where}[${i}]: duplicate id "${id}" (core composer throws on duplicates)`;
-            seen.add(id);
-        }
-        return undefined;
-    };
-    const sectionsIssue = arrayIssue(p.sections, "sections");
-    if (sectionsIssue)
-        return { ok: false, error: sectionsIssue };
-    if (p.scenarioOverrides !== undefined) {
-        if (p.scenarioOverrides === null || typeof p.scenarioOverrides !== "object" || Array.isArray(p.scenarioOverrides)) {
-            return { ok: false, error: "scenarioOverrides is not an object" };
-        }
-        for (const [name, decls] of Object.entries(p.scenarioOverrides)) {
-            const issue = arrayIssue(decls, `scenarioOverrides[${name}]`);
-            if (issue)
-                return { ok: false, error: issue };
-        }
-    }
-    return { ok: true, value: raw };
-}
-export const CORE_ENGINE_VERSION = (() => {
-    try {
-        const entry = createRequire(import.meta.url).resolve("@sema-agent/core");
-        return JSON.parse(readFileSync(join(dirname(entry), "..", "package.json"), "utf8")).version ?? "0.0.0";
-    }
-    catch {
-        return "0.0.0";
-    }
-})();
-export function validatePromptsDomain(raw) {
-    if (raw === null || typeof raw !== "object")
-        return { ok: false, error: "prompts is not an object" };
-    const w = raw;
-    if (w.schemaVersion === undefined) {
-        const legacy = validateCenterPrompts(raw);
-        if (!legacy.ok)
-            return legacy;
-        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
-    }
-    if (w.schemaVersion !== 1)
-        return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };
-    if (w.declarations === undefined && w.catalog === undefined)
-        return { ok: false, error: "dual-axis prompts carries neither axis (at least one of declarations|catalog required)" };
-    const value = { identity: "", axes: [] };
-    if (w.declarations !== undefined) {
-        const d = validateCenterPrompts(w.declarations);
-        if (!d.ok)
-            return { ok: false, error: `declarations axis: ${d.error}` };
-        value.declarations = d.value;
-        value.axes.push("declarations");
-    }
-    if (w.catalog !== undefined) {
-        const c = verifyPromptArtifact(w.catalog, { engineVersion: CORE_ENGINE_VERSION });
-        if (!c.ok)
-            return { ok: false, error: `catalog axis: ${c.code}: ${c.reason}` };
-        value.catalog = w.catalog;
-        value.axes.push("catalog");
-    }
-    value.identity = `${value.declarations?.contentDigest ?? "-"}+${value.catalog?.artifact.artifactDigest ?? "-"}`;
-    return { ok: true, value };
-}
+import { CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
+export { validateCenterPrompts, validatePromptsDomain, CORE_ENGINE_VERSION } from "../prompts-domain-validate.js";
 export function withPromptArtifactBackfill(inner, fetchRaw, log) {
     const inFlight = new Map();
     return {

package/dist/config-lkg.js

@@ -2,7 +2,7 @@ import { promises as fs } from "node:fs";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { randomBytes } from "node:crypto";
-import { validatePromptsDomain } from "./capabilities/center-prompts.js";
+import { validatePromptsDomain } from "./prompts-domain-validate.js";
 export function defaultSkillCacheDir() {
     return join(process.env.SEMA_CONFIG_DIR ?? join(homedir(), ".sema"), "skill-cache");
 }

package/dist/main.js

@@ -988,31 +988,80 @@ async function main() {
         requirePrincipal: config.requirePrincipal,
         warn: (msg, fields) => logger.warn(msg, fields),
     });
+    const workflowModelAllowlist = workflowModelAllowlistFor(config);
+    const selfOrchestrationDeps = config.selfOrchestrationEnabled
+        ? {
+            workflowScriptRunner: config.selfOrchestrationWorkerIsolation
+                ? createWorkerHardenedVmRunner()
+                : createHardenedVmRunner(),
+            workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+            workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
+            workflowScriptStore: (() => {
+                const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
+                return {
+                    scopePartitioned: true,
+                    persist: fileStore.persist.bind(fileStore),
+                    load: fileStore.load.bind(fileStore),
+                    resolveName: (name) => resolveCollabWorkflow(name) ?? fileStore.resolveName?.(name),
+                    list: () => listCollabWorkflows(),
+                };
+            })(),
+            onWorkflowAgentSpawn: workflowAgentRegistry
+                ? (handle) => {
+                    const unregister = workflowAgentRegistry.register(handle);
+                    void Promise.resolve(handle.result()).then(unregister, unregister);
+                }
+                : undefined,
+            workflowLimits: config.workflowSizeGuideline ? { sizeGuideline: config.workflowSizeGuideline } : undefined,
+            workflowGovernanceBaseline: {
+                base: config.workflowAgentsReadOnly ? { handsReadOnly: true } : {},
+                worktreeBase: config.workflowAgentsReadOnly ? { handsReadOnly: false } : undefined,
+                workflowModelAllowlist: workflowModelAllowlist ? workflowModelAllowlist : undefined,
+            },
+            workflowCompletionNotifier: {
+                ...(workflowNotifyGate
+                    ? workflowNotifyGate.buildNotifier()
+                    : { notify: (input) => deliverWorkflowCompletion(input) }),
+                ackServed: async (input) => {
+                    if (!workflowCompletionInbox)
+                        return;
+                    try {
+                        const sid = await resolveServedSession(input, runStore ? (id) => runStore.getRun(id) : undefined);
+                        if (sid) {
+                            await workflowCompletionInbox.markTerminalServed(sid, input.runId);
+                            logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
+                        }
+                    }
+                    catch (err) {
+                        logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
+                    }
+                },
+            },
+        }
+        : {};
     const runnerDeps = {
         promptSource,
-        ...(rosterStore ? { rosterStore } : {}),
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(mailboxStore ? { mailboxStore } : {}),
+        rosterStore: rosterStore ? rosterStore : undefined,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        mailboxStore: mailboxStore ? mailboxStore : undefined,
         brain,
         models: config.models,
         roles: config.roles,
         tiers: config.tiers,
         pricing,
         tracer,
-        ...(config.configProvider === "local" ? { hands: { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } } : {}),
-        ...(outcomeSink
-            ? {
-                onTaskOutcome: (o) => {
-                    metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
-                    void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
-                },
-            }
-            : {}),
-        ...(elicitation ? { onElicit: elicitation.elicit } : {}),
-        ...(question ? { onQuestion: question.question } : {}),
-        ...(toolApproval
-            ? { onAsk: (req, signal) => toolApproval.ask(req, signal) }
-            : {}),
+        hands: config.configProvider === "local" ? { commitCoAuthor: "Sema <noreply@vivi-ai.com>" } : undefined,
+        onTaskOutcome: outcomeSink
+            ? (o) => {
+                metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
+                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
+            }
+            : undefined,
+        onElicit: elicitation ? elicitation.elicit : undefined,
+        onQuestion: question ? question.question : undefined,
+        onAsk: toolApproval
+            ? (req, signal) => toolApproval.ask(req, signal)
+            : undefined,
         autoMode: {
             onBreakerOpen: (info) => {
                 metrics.inc("auto_mode_breaker_open_total");
@@ -1020,84 +1069,32 @@ async function main() {
             },
         },
         sessionStore,
-        ...(memoryEngine ? { memoryBackend: memoryEngine.backend, memoryEngineDir: memoryEngine.root } : {}),
-        ...(memoryEngine
-            ? {
-                onMemoryHarvestReport: (report, info) => {
-                    metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
-                    if (report.patches)
-                        metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
-                    if (report.incident)
-                        logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
-                    if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)
-                        memorySyncRunner.trigger("harvest");
-                },
-            }
-            : {}),
+        memoryBackend: memoryEngine ? memoryEngine.backend : undefined,
+        memoryEngineDir: memoryEngine ? memoryEngine.root : undefined,
+        onMemoryHarvestReport: memoryEngine
+            ? (report, info) => {
+                metrics.inc("memory_harvest_total", { ok: String(report.ok), phase: info.phase, incident: report.incident?.kind ?? "none" });
+                if (report.patches)
+                    metrics.inc("memory_harvest_patches_total", { phase: info.phase }, (report.patches.add ?? 0) + (report.patches.update ?? 0));
+                if (report.incident)
+                    logger.warn("memory_harvest_incident", { kind: report.incident.kind, phase: info.phase });
+                if (memorySyncRunner && report.ok && (report.patches?.add ?? 0) + (report.patches?.update ?? 0) > 0)
+                    memorySyncRunner.trigger("harvest");
+            }
+            : undefined,
         toolResultStore,
-        ...(sessionPolicyStore ? { sessionPolicyStore } : {}),
-        ...(runtimeCapsResolver ? { runtimeCapsResolver } : {}),
-        ...(fileSnapshotStore ? { fileSnapshotStore } : {}),
-        ...(executionEnvFactory ? { executionEnvFactory } : {}),
-        ...(lspManager ? { lspManager } : {}),
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        runtimeCapsResolver: runtimeCapsResolver ? runtimeCapsResolver : undefined,
+        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        executionEnvFactory: executionEnvFactory ? executionEnvFactory : undefined,
+        lspManager: lspManager ? lspManager : undefined,
         onBackgroundChildEvent: fleetBackgroundChildPublisher(fleetBus, (msg, fields) => logger.info(msg, fields)),
-        ...(config.requirePrincipal !== true && !config.projectMemoryDisabled ? { loadProjectMemory: makeLoadProjectMemory({ logger }) } : {}),
-        ...(config.remoteExec?.provider === "host" && config.requirePrincipal !== true && !config.projectMemoryDisabled
-            ? { probeInstructionSources: makeProbeInstructionSources() }
-            : {}),
+        loadProjectMemory: config.requirePrincipal !== true && !config.projectMemoryDisabled ? makeLoadProjectMemory({ logger }) : undefined,
+        probeInstructionSources: config.remoteExec?.provider === "host" && config.requirePrincipal !== true && !config.projectMemoryDisabled
+            ? makeProbeInstructionSources()
+            : undefined,
         hooks: deploymentHooks,
-        ...(config.selfOrchestrationEnabled
-            ? {
-                workflowScriptRunner: config.selfOrchestrationWorkerIsolation
-                    ? createWorkerHardenedVmRunner()
-                    : createHardenedVmRunner(),
-                ...(workflowRunStore ? { workflowRunStore } : {}),
-                ...(workflowJournalStore ? { workflowJournalStore } : {}),
-                workflowScriptStore: (() => {
-                    const fileStore = createFileWorkflowScriptStore(join(config.localDataRoot ?? localRoot, "workflow-scripts"));
-                    return {
-                        scopePartitioned: true,
-                        persist: fileStore.persist.bind(fileStore),
-                        load: fileStore.load.bind(fileStore),
-                        resolveName: (name) => resolveCollabWorkflow(name) ?? fileStore.resolveName?.(name),
-                        list: () => listCollabWorkflows(),
-                    };
-                })(),
-                ...(workflowAgentRegistry
-                    ? {
-                        onWorkflowAgentSpawn: (handle) => {
-                            const unregister = workflowAgentRegistry.register(handle);
-                            void Promise.resolve(handle.result()).then(unregister, unregister);
-                        },
-                    }
-                    : {}),
-                ...(config.workflowSizeGuideline ? { workflowLimits: { sizeGuideline: config.workflowSizeGuideline } } : {}),
-                workflowGovernanceBaseline: {
-                    base: config.workflowAgentsReadOnly ? { handsReadOnly: true } : {},
-                    ...(config.workflowAgentsReadOnly ? { worktreeBase: { handsReadOnly: false } } : {}),
-                    ...((wl) => (wl ? { workflowModelAllowlist: wl } : {}))(workflowModelAllowlistFor(config)),
-                },
-                workflowCompletionNotifier: {
-                    ...(workflowNotifyGate
-                        ? workflowNotifyGate.buildNotifier()
-                        : { notify: (input) => deliverWorkflowCompletion(input) }),
-                    ackServed: async (input) => {
-                        if (!workflowCompletionInbox)
-                            return;
-                        try {
-                            const sid = await resolveServedSession(input, runStore ? (id) => runStore.getRun(id) : undefined);
-                            if (sid) {
-                                await workflowCompletionInbox.markTerminalServed(sid, input.runId);
-                                logger.info("workflow_complete_ack_served", { route: "poll-served", sessionId: sid, runId: input.runId });
-                            }
-                        }
-                        catch (err) {
-                            logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
-                        }
-                    },
-                },
-            }
-            : {}),
+        ...selfOrchestrationDeps,
         onError: (err, ctx) => {
             if (ctx.phase === "degraded") {
                 logger.warn("task_degraded", { sessionId: ctx.sessionId, info: String(err) });
@@ -1335,20 +1332,18 @@ async function main() {
     };
     const scenarioDeps = {
         runner, subRunner, model: "default", skills, repoClient, requirePrincipal: config.requirePrincipal,
-        ...(webSearch ? { webSearch } : {}), metrics, logger, webFetchSummarize,
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(checkpointStore ? { checkpointStore } : {}),
-        ...(ensureChildSessionDurable ? { ensureChildSessionDurable } : {}),
+        webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        checkpointStore: checkpointStore ? checkpointStore : undefined,
+        ensureChildSessionDurable: ensureChildSessionDurable ? ensureChildSessionDurable : undefined,
         oaApiBaseUrl: config.oaApiBaseUrl, oaServiceToken: config.oaServiceToken, oaIssue: config.oaIssue,
         brandIdentity: config.configProvider === "local",
-        ...(sendUserFileToolSpec
-            ? {
-                subagentExtraTools: subagentSendUserFileExtraTools({
-                    spec: sendUserFileToolSpec,
-                    approvalGate: () => ({ deny: config.approvalDeny, require: config.approvalRequire, neverAuto: config.approvalNeverAuto }),
-                }),
-            }
-            : {}),
+        subagentExtraTools: sendUserFileToolSpec
+            ? subagentSendUserFileExtraTools({
+                spec: sendUserFileToolSpec,
+                approvalGate: () => ({ deny: config.approvalDeny, require: config.approvalRequire, neverAuto: config.approvalNeverAuto }),
+            })
+            : undefined,
     };
     const scenarios = buildScenarios(scenarioDeps);
     const parkedReviveTool = checkpointStore && backgroundAgentStore ? scenarios.default?.({})?.tools.find((t) => t.name === "Agent") : undefined;
@@ -1844,72 +1839,68 @@ async function main() {
         config,
         authorize,
         sessionStoreLabel: config.sessionBackend === "tidb" && backend ? `durable(${backend.kind})` : config.sessionBackend,
-        ...(taskAttachmentStore ? { taskAttachmentStore } : {}),
-        ...(backend && backend.kind !== "local" && !config.snapshotBlobStore
-            ? ((cap) => (cap !== undefined ? { snapshotBlobSqlCapBytes: cap } : {}))(config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
-            : {}),
+        taskAttachmentStore: taskAttachmentStore ? taskAttachmentStore : undefined,
+        snapshotBlobSqlCapBytes: backend && backend.kind !== "local" && !config.snapshotBlobStore
+            ? (config.snapshotBlobSqlMaxBytes ?? (backend.kind === "mysql" ? SQL_BLOB_DEFAULT_MAX_BYTES : undefined))
+            : undefined,
         modelReady: () => modelReadyState.ready,
         scenarioDetails,
-        ...(registryJwtVerifier ? { registryJwtVerifier } : {}),
+        registryJwtVerifier: registryJwtVerifier ? registryJwtVerifier : undefined,
         hookWakeBus,
         runStore,
         fleetBus,
         workflowsCapable,
-        ...(resumeAnchorStore ? { resumeAnchorStore } : {}),
-        ...(approvalExemptionStore ? { approvalExemptionStore } : {}),
-        ...(sessionTitler ? { sessionTitler } : {}),
-        ...(sessionPolicyStore ? { sessionPolicyStore } : {}),
-        ...(fileSnapshotStore ? { fileSnapshotStore } : {}),
-        ...(backend ? { backend } : {}),
-        ...(principalCaps
-            ? { sessionMirrorRuling: async (p) => (await principalCaps.executionRuling(p))?.sessionMirror }
-            : {}),
+        resumeAnchorStore: resumeAnchorStore ? resumeAnchorStore : undefined,
+        approvalExemptionStore: approvalExemptionStore ? approvalExemptionStore : undefined,
+        sessionTitler: sessionTitler ? sessionTitler : undefined,
+        sessionPolicyStore: sessionPolicyStore ? sessionPolicyStore : undefined,
+        fileSnapshotStore: fileSnapshotStore ? fileSnapshotStore : undefined,
+        backend: backend ? backend : undefined,
+        sessionMirrorRuling: principalCaps
+            ? async (p) => (await principalCaps.executionRuling(p))?.sessionMirror
+            : undefined,
         approvalStore,
         checkpointStore,
-        ...(backgroundAgentStore ? { backgroundAgentStore } : {}),
-        ...(parkedReviveTool ? { parkedReviveTool } : {}),
-        ...(parkedReviveInheritedGate ? { parkedReviveInheritedGate } : {}),
+        backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
+        parkedReviveTool: parkedReviveTool ? parkedReviveTool : undefined,
+        parkedReviveInheritedGate: parkedReviveInheritedGate ? parkedReviveInheritedGate : undefined,
         imageIndex,
         imageBakes,
         leaderEndpoint,
-        ...(workflowRunStore ? { workflowRunStore } : {}),
-        ...(workflowJournalStore ? { workflowJournalStore } : {}),
-        ...(workflowAgentRegistry ? { workflowAgentRegistry } : {}),
+        workflowRunStore: workflowRunStore ? workflowRunStore : undefined,
+        workflowJournalStore: workflowJournalStore ? workflowJournalStore : undefined,
+        workflowAgentRegistry: workflowAgentRegistry ? workflowAgentRegistry : undefined,
         subagentSteerRegistry,
         subagentTaskOutput: (handle, access) => backgroundAgentOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleOutput: (handle, access) => taskHandleOutput(defaultTaskRegistry, handle, access, backgroundAgentStore),
         taskHandleStop: (handle, access) => taskHandleStop(defaultTaskRegistry, handle, access, backgroundAgentStore),
-        ...(workflowCompletionInbox ? { workflowCompletionInbox } : {}),
+        workflowCompletionInbox: workflowCompletionInbox ? workflowCompletionInbox : undefined,
         sessionAudit,
         sessionStorage: ownerAware,
-        ...(sessionWatchRegistry
-            ? {
-                sessionWatch: sessionWatchRegistry,
-                sessionEventsMaxConnections: posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000),
-            }
-            : {}),
-        ...(purgeSession ? { purgeSession } : {}),
+        sessionWatch: sessionWatchRegistry ? sessionWatchRegistry : undefined,
+        sessionEventsMaxConnections: sessionWatchRegistry ? posIntEnv(process.env.SESSION_EVENTS_MAX_CONNS, 256, 100_000) : undefined,
+        purgeSession: purgeSession ? purgeSession : undefined,
         instrumentDegenerate,
         planCacheProbe,
         modelUsage: modelUsageTracker,
         promptManifests: promptManifestTracker,
-        ...(elicitation ? { elicitation } : {}),
-        ...(question ? { question } : {}),
-        ...(toolApproval ? { toolApproval } : {}),
-        ...(sendUserFileEmitter ? { sendUserFile: sendUserFileEmitter } : {}),
-        ...(sendFileLedger ? { sendFileLedger } : {}),
+        elicitation: elicitation ? elicitation : undefined,
+        question: question ? question : undefined,
+        toolApproval: toolApproval ? toolApproval : undefined,
+        sendUserFile: sendUserFileEmitter ? sendUserFileEmitter : undefined,
+        sendFileLedger: sendFileLedger ? sendFileLedger : undefined,
         instanceId,
         logger,
         metrics,
         rateLimiter,
         costQuota,
-        ...(fleetLease ? { fleetLease } : {}),
+        fleetLease: fleetLease ? fleetLease : undefined,
         sideQueryAccounting,
-        ...(outcomeSink ? { outcomeSink } : {}),
-        ...(memoryExportBackend ? { memoryExport: (scope) => exportMemoryScope(memoryExportBackend, scope) } : {}),
-        ...(memoryExportBackend && memorySyncCursors
-            ? { memorySync: (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq) }
-            : {}),
+        outcomeSink: outcomeSink ? outcomeSink : undefined,
+        memoryExport: memoryExportBackend ? (scope) => exportMemoryScope(memoryExportBackend, scope) : undefined,
+        memorySync: memoryExportBackend && memorySyncCursors
+            ? (scope, syncReq) => performMemorySync(memoryExportBackend, memorySyncCursors, scope, syncReq)
+            : undefined,
         capabilities: {
             version: serviceVersion(),
             scenarios: Object.keys(scenarios),

package/dist/plugins/pg-approval-store.js

@@ -1,4 +1,4 @@
-import {} from "./tidb-approval-store.js";
+import { mapRow } from "./tidb-approval-store.js";
 import { pgProtocolJsonStringify } from "./pg-safe-json.js";
 export const PG_APPROVAL_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS approval (
@@ -27,16 +27,6 @@ export async function ensureSchema(pool) {
     for (const stmt of PG_APPROVAL_SCHEMA)
         await pool.query(stmt);
 }
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
-function iso(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : String(v);
-}
 export class PgApprovalStore {
     pool;
     constructor(pool) {
@@ -91,20 +81,4 @@ export class PgApprovalStore {
         return res.rowCount ?? 0;
     }
 }
-function mapRow(r) {
-    return {
-        id: String(r.id),
-        taskId: r.task_id ?? null,
-        sessionId: r.session_id ?? null,
-        owner: r.owner ?? null,
-        scope: r.scope ?? null,
-        toolName: String(r.tool_name),
-        args: parseJson(r.args),
-        status: r.status,
-        reason: r.reason ?? null,
-        decidedBy: r.decided_by ?? null,
-        createdAt: iso(r.created_at),
-        decidedAt: iso(r.decided_at),
-    };
-}
 //# sourceMappingURL=pg-approval-store.js.map

package/dist/plugins/pg-checkpoint-store.js

@@ -2,15 +2,11 @@ import { CheckpointError, validatePendingSteer, checkpointVersionOf, winnerFromO
 import { redactDeep } from "../trace/redact.js";
 import { tokenFingerprint } from "./tidb-checkpoint-store.js";
 import { pgProtocolJsonStringify } from "./pg-safe-json.js";
+import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 const TERMINAL_BACKSTOP_MS = Math.max(60_000, Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) || 30 * 86_400_000);
 const TERMINAL_GRACE_MS = 3_600_000;
 const PG_UNIQUE_VIOLATION = "23505";
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
 function boundedToolInput(args) {
     if (args === undefined)
         return null;

package/dist/plugins/pg-image-bake.js

@@ -1,6 +1,8 @@
 import { uuidv7 } from "@sema-agent/core";
 import { randomBytes } from "node:crypto";
 import { pgSanitizeText, pgSafeJsonStringify, pgHasUnstorable } from "./pg-safe-json.js";
+import { parseJsonOr as parseJson, toIso as iso } from "./sql-row-helpers.js";
+import { mapRow, SELECT_COLS } from "./tidb-image-bake.js";
 export const PG_IMAGE_BAKE_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS image_bake (
      bake_id          VARCHAR(64)  NOT NULL,
@@ -74,60 +76,6 @@ function dupKeyName(err) {
         return "primary";
     return "other";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
-function isoOrNull(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function parseJson(v, fallback) {
-    if (v == null)
-        return fallback;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return fallback;
-    }
-}
-function mapRow(r) {
-    return {
-        bakeId: r.bake_id,
-        profile: r.profile,
-        bands: r.bands == null ? null : parseJson(r.bands, []),
-        baseRef: r.base_ref,
-        push: !!r.push,
-        dryRun: !!r.dry_run,
-        logs: !!r.logs,
-        argv: parseJson(r.argv, []),
-        status: r.status,
-        state: r.state ?? null,
-        digest: r.digest,
-        repo: r.repo,
-        ref: r.ref,
-        indexId: r.index_id,
-        exitCode: r.exit_code === null ? null : Number(r.exit_code),
-        error: r.error,
-        errorCode: r.error_code ?? null,
-        manifestSha: r.manifest_sha,
-        tag: r.tag,
-        idemKey: r.idem_key,
-        ingestSecret: r.ingest_secret,
-        runnerId: r.runner_id,
-        leaseUntil: isoOrNull(r.lease_until),
-        cancelRequested: !!r.cancel_requested,
-        requestedBy: r.requested_by,
-        createdAt: iso(r.created_at),
-        updatedAt: iso(r.updated_at),
-    };
-}
-const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
-    "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
-    "cancel_requested, requested_by, created_at, updated_at";
 export class PgImageBake {
     pool;
     poolName;

package/dist/plugins/pg-image-index.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { pgSafeJsonStringify, pgSanitizeText, pgHasUnstorable, PgUnstorableError } from "./pg-safe-json.js";
-import {} from "./tidb-image-index.js";
+import { mapRow, } from "./tidb-image-index.js";
 export const PG_IMAGE_INDEX_SCHEMA = [
     `CREATE TABLE IF NOT EXISTS sandbox_image_index (
      id                 VARCHAR(64)  NOT NULL,
@@ -37,49 +37,6 @@ export async function ensureSchema(pool) {
 }
 const MAX_LIMIT = 200;
 const DEFAULT_LIMIT = 50;
-function asJson(v, fallback) {
-    if (v === null || v === undefined)
-        return fallback;
-    if (typeof v === "string") {
-        try {
-            return JSON.parse(v);
-        }
-        catch {
-            return fallback;
-        }
-    }
-    return v;
-}
-function iso(v) {
-    if (v === null || v === undefined)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function mapRow(r) {
-    return {
-        id: r.id,
-        profile: r.profile,
-        bands: asJson(r.bands, []),
-        repo: r.repo,
-        tag: r.tag,
-        digest: r.digest,
-        toolchainVersions: asJson(r.toolchain_versions, {}),
-        capabilities: asJson(r.capabilities, {}),
-        podContract: asJson(r.pod_contract, {}),
-        sizeBytes: r.size_bytes === null ? null : Number(r.size_bytes),
-        status: r.status,
-        visibility: r.visibility,
-        tenantId: r.tenant_id,
-        manifestSha: r.manifest_sha,
-        recipeGitSha: r.recipe_git_sha,
-        generatorVersion: r.generator_version,
-        buildDate: iso(r.build_date),
-        supersedes: r.supersedes,
-        signed: !!r.signed,
-        createdAt: iso(r.created_at) ?? new Date(0).toISOString(),
-        updatedAt: iso(r.updated_at) ?? new Date(0).toISOString(),
-    };
-}
 function visibilityClause(viewer, startIdx) {
     if (viewer.operator)
         return { sql: "1=1", params: [], nextIdx: startIdx };

package/dist/plugins/pg-run-store.js

@@ -1,24 +1,10 @@
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { escapeLike } from "./tidb-tool-result-store.js";
 import { pgSafeJsonStringify, pgSanitizeText } from "./pg-safe-json.js";
-function parseJson(v) {
-    if (v == null)
-        return null;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return null;
-    }
-}
+import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "23505";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
 export class PgRunStore {
     pool;
     constructor(pool) {

package/dist/plugins/pg-session-storage.js

@@ -2,16 +2,12 @@ import { emitLeafAdvance } from "../session-leaf-bus.js";
 import { BaseSessionStorage, StoredSession, SessionError, uuidv7, validateEntriesForImport, leafIdAfterEntry, normalizePromptEpoch, } from "@sema-agent/core";
 import { escapeLike } from "./tidb-tool-result-store.js";
 import { pgSafeJsonStringify } from "./pg-safe-json.js";
+import { toIso } from "./sql-row-helpers.js";
 import { classifySyncRelationshipByIds, SyncConflictError, stagingIdFor, STAGING_ID_MARKER, } from "../session-sync.js";
 const STAGING_GC_GRACE_MS = 3_600_000;
 function isDupKey(err) {
     return Boolean(err) && err.code === "23505";
 }
-function toIso(v) {
-    if (v instanceof Date)
-        return v.toISOString();
-    return String(v);
-}
 function parseEntry(p) {
     return (typeof p === "string" ? JSON.parse(p) : p);
 }

package/dist/plugins/sql-row-helpers.d.ts

@@ -0,0 +1,7 @@
+export declare function parseJsonLenient<T>(v: unknown): T | null;
+export declare function parseJsonStrict<T>(v: unknown): T | null;
+export declare function parseJsonOr<T>(v: unknown, fallback: T): T;
+export declare function toIso(v: unknown): string;
+export declare function toIsoOrNull(v: unknown): string | null;
+export declare function normalizeIsoOrNull(v: unknown): string | null;
+//# sourceMappingURL=sql-row-helpers.d.ts.map

package/dist/plugins/sql-row-helpers.js

@@ -0,0 +1,43 @@
+export function parseJsonLenient(v) {
+    if (v == null)
+        return null;
+    if (typeof v !== "string")
+        return v;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return null;
+    }
+}
+export function parseJsonStrict(v) {
+    if (v == null)
+        return null;
+    return (typeof v === "string" ? JSON.parse(v) : v);
+}
+export function parseJsonOr(v, fallback) {
+    if (v == null)
+        return fallback;
+    if (typeof v !== "string")
+        return v;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return fallback;
+    }
+}
+export function toIso(v) {
+    return v instanceof Date ? v.toISOString() : String(v);
+}
+export function toIsoOrNull(v) {
+    if (v == null)
+        return null;
+    return v instanceof Date ? v.toISOString() : String(v);
+}
+export function normalizeIsoOrNull(v) {
+    if (v == null)
+        return null;
+    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
+}
+//# sourceMappingURL=sql-row-helpers.js.map

package/dist/plugins/tidb-approval-store.d.ts

@@ -36,4 +36,5 @@ export declare class TiDBApprovalStore {
     listPendingAll(): Promise<ApprovalRow[]>;
     expireStale(olderThanMs: number): Promise<number>;
 }
+export declare function mapRow(r: Record<string, unknown>): ApprovalRow;
 //# sourceMappingURL=tidb-approval-store.d.ts.map

package/dist/plugins/tidb-approval-store.js

@@ -1,13 +1,4 @@
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
-function iso(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : String(v);
-}
+import { parseJsonStrict as parseJson, toIsoOrNull as iso } from "./sql-row-helpers.js";
 export class TiDBApprovalStore {
     pool;
     constructor(pool) {
@@ -62,7 +53,7 @@ export class TiDBApprovalStore {
         return res.affectedRows;
     }
 }
-function mapRow(r) {
+export function mapRow(r) {
     return {
         id: String(r.id),
         taskId: r.task_id ?? null,

package/dist/plugins/tidb-checkpoint-store.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { CheckpointError, validatePendingSteer, checkpointVersionOf, winnerFromOutcome, summarizeCheckpoint, MAX_SUPPORTED_CHECKPOINT_VERSION } from "@sema-agent/core";
 import { redactDeep } from "../trace/redact.js";
+import { parseJsonStrict as parseJson } from "./sql-row-helpers.js";
 const MAX_TOOL_INPUT_CHARS = 8192;
 export const TERMINAL_BACKSTOP_MS = Math.max(60_000, Number(process.env.APPROVAL_TERMINAL_BACKSTOP_MS) || 30 * 86_400_000);
 export const TERMINAL_GRACE_MS = 3_600_000;
@@ -188,9 +189,4 @@ export class TiDBCheckpointStore {
         return res.affectedRows;
     }
 }
-function parseJson(v) {
-    if (v == null)
-        return null;
-    return (typeof v === "string" ? JSON.parse(v) : v);
-}
 //# sourceMappingURL=tidb-checkpoint-store.js.map

package/dist/plugins/tidb-image-bake.d.ts

@@ -63,6 +63,37 @@ export interface BakeTerminal {
     manifestSha?: string | null;
     tag?: string | null;
 }
+export interface BakeRow {
+    bake_id: string;
+    profile: string;
+    bands: unknown;
+    base_ref: string | null;
+    push: number;
+    dry_run: number;
+    logs: number;
+    argv: unknown;
+    status: string;
+    state: string | null;
+    digest: string | null;
+    repo: string | null;
+    ref: string | null;
+    index_id: string | null;
+    exit_code: number | string | null;
+    error: string | null;
+    error_code: string | null;
+    manifest_sha: string | null;
+    tag: string | null;
+    idem_key: string | null;
+    ingest_secret: string | null;
+    runner_id: string | null;
+    lease_until: Date | string | null;
+    cancel_requested: number;
+    requested_by: string | null;
+    created_at: Date | string;
+    updated_at: Date | string;
+}
+export declare function mapRow(r: BakeRow): BakeRecord;
+export declare const SELECT_COLS: string;
 export declare class TiDBImageBake {
     private readonly pool;
     private readonly poolName;

package/dist/plugins/tidb-image-bake.js

@@ -1,5 +1,6 @@
 import { uuidv7 } from "@sema-agent/core";
 import { randomBytes } from "node:crypto";
+import { parseJsonOr as parseJson, toIso as iso, normalizeIsoOrNull as isoOrNull } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "ER_DUP_ENTRY";
 }
@@ -11,27 +12,7 @@ function dupKeyName(err) {
         return "primary";
     return "other";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
-function isoOrNull(v) {
-    if (v == null)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function parseJson(v, fallback) {
-    if (v == null)
-        return fallback;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return fallback;
-    }
-}
-function mapRow(r) {
+export function mapRow(r) {
     return {
         bakeId: r.bake_id,
         profile: r.profile,
@@ -62,7 +43,7 @@ function mapRow(r) {
         updatedAt: iso(r.updated_at),
     };
 }
-const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
+export const SELECT_COLS = "bake_id, profile, bands, base_ref, push, dry_run, logs, argv, status, state, digest, repo, ref, index_id, " +
     "exit_code, error, error_code, manifest_sha, tag, idem_key, ingest_secret, runner_id, lease_until, " +
     "cancel_requested, requested_by, created_at, updated_at";
 export class TiDBImageBake {

package/dist/plugins/tidb-image-index.d.ts

@@ -51,6 +51,30 @@ export interface ImageListFilter extends ImageViewer {
     limit?: number;
     cursor?: string;
 }
+export interface ImageRow {
+    id: string;
+    profile: string;
+    bands: unknown;
+    repo: string;
+    tag: string;
+    digest: string;
+    toolchain_versions: unknown;
+    capabilities: unknown;
+    pod_contract: unknown;
+    size_bytes: number | string | null;
+    status: string;
+    visibility: string;
+    tenant_id: string | null;
+    manifest_sha: string | null;
+    recipe_git_sha: string | null;
+    generator_version: string | null;
+    build_date: Date | string | null;
+    supersedes: string | null;
+    signed: number;
+    created_at: Date | string;
+    updated_at: Date | string;
+}
+export declare function mapRow(r: ImageRow): ImageIndexEntry;
 export declare class TiDBImageIndex {
     private readonly pool;
     constructor(pool: Pool);

package/dist/plugins/tidb-image-index.js

@@ -1,25 +1,8 @@
 import { createHash } from "node:crypto";
+import { parseJsonOr as asJson, normalizeIsoOrNull as iso } from "./sql-row-helpers.js";
 const MAX_LIMIT = 200;
 const DEFAULT_LIMIT = 50;
-function asJson(v, fallback) {
-    if (v === null || v === undefined)
-        return fallback;
-    if (typeof v === "string") {
-        try {
-            return JSON.parse(v);
-        }
-        catch {
-            return fallback;
-        }
-    }
-    return v;
-}
-function iso(v) {
-    if (v === null || v === undefined)
-        return null;
-    return v instanceof Date ? v.toISOString() : new Date(v).toISOString();
-}
-function mapRow(r) {
+export function mapRow(r) {
     return {
         id: r.id,
         profile: r.profile,

package/dist/plugins/tidb-run-store.js

@@ -1,23 +1,9 @@
 import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
 import { escapeLike } from "./tidb-tool-result-store.js";
-function parseJson(v) {
-    if (v == null)
-        return null;
-    if (typeof v !== "string")
-        return v;
-    try {
-        return JSON.parse(v);
-    }
-    catch {
-        return null;
-    }
-}
+import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "ER_DUP_ENTRY";
 }
-function iso(v) {
-    return v instanceof Date ? v.toISOString() : String(v);
-}
 export class TiDBRunStore {
     pool;
     constructor(pool) {

package/dist/plugins/tidb-session-storage.js

@@ -1,13 +1,9 @@
 import { emitLeafAdvance } from "../session-leaf-bus.js";
 import { BaseSessionStorage, SessionError, leafIdAfterEntry, normalizePromptEpoch, } from "@sema-agent/core";
+import { toIso } from "./sql-row-helpers.js";
 function isDupKey(err) {
     return Boolean(err) && err.code === "ER_DUP_ENTRY";
 }
-function toIso(v) {
-    if (v instanceof Date)
-        return v.toISOString();
-    return String(v);
-}
 export class TiDBSessionStorage extends BaseSessionStorage {
     pool;
     sessionId;

package/dist/prompts-domain-validate.d.ts

@@ -0,0 +1,29 @@
+import { type PromptTextDeclaration, type PublishedPromptArtifactEnvelope } from "@sema-agent/core";
+export interface EffectiveCenterPrompts {
+    packId: string;
+    contentDigest: string;
+    sections: PromptTextDeclaration[];
+    scenarioOverrides?: Record<string, PromptTextDeclaration[]>;
+}
+export declare function validateCenterPrompts(raw: unknown): {
+    ok: true;
+    value: EffectiveCenterPrompts;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const CORE_ENGINE_VERSION: string;
+export interface PromptsDomainFaces {
+    declarations?: EffectiveCenterPrompts;
+    catalog?: PublishedPromptArtifactEnvelope;
+    identity: string;
+    axes: Array<"declarations" | "catalog">;
+}
+export declare function validatePromptsDomain(raw: unknown): {
+    ok: true;
+    value: PromptsDomainFaces;
+} | {
+    ok: false;
+    error: string;
+};
+//# sourceMappingURL=prompts-domain-validate.d.ts.map

package/dist/prompts-domain-validate.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { verifyPromptArtifact } from "@sema-agent/core";
+const ID_RE = /^[a-z0-9][a-z0-9/._-]*$/;
+const SLOTS = new Set(["identity", "scenario", "behavior"]);
+const HASH_RE = /^sha256:[0-9a-f]{64}$/;
+function declarationIssue(d, where) {
+    if (d === null || typeof d !== "object")
+        return `${where}: declaration is not an object`;
+    const o = d;
+    if (typeof o.id !== "string" || o.id.length === 0 || o.id.length > 128 || !ID_RE.test(o.id))
+        return `${where}: bad id`;
+    if (o.id.startsWith("core/"))
+        return `${where}: id in the reserved core/ namespace`;
+    if (typeof o.slot !== "string" || !SLOTS.has(o.slot))
+        return `${where}: bad slot`;
+    if (typeof o.text !== "string" || o.text.length === 0)
+        return `${where}: text must be a non-empty string`;
+    if (typeof o.contentHash !== "string" || !HASH_RE.test(o.contentHash))
+        return `${where}: contentHash is required (sha256:<64hex> — the epoch declaration axis needs it for byte-level change detection)`;
+    const expected = `sha256:${createHash("sha256").update(o.text).digest("hex")}`;
+    if (o.contentHash !== expected)
+        return `${where}: contentHash does not match sha256(text) — stale or tampered declaration`;
+    return undefined;
+}
+export function validateCenterPrompts(raw) {
+    if (raw === null || typeof raw !== "object")
+        return { ok: false, error: "prompts is not an object" };
+    const p = raw;
+    if (typeof p.packId !== "string" || !/^center:[0-9a-f]{12}$/.test(p.packId))
+        return { ok: false, error: "bad packId form (center:<digest12>)" };
+    if (typeof p.contentDigest !== "string" || !HASH_RE.test(p.contentDigest))
+        return { ok: false, error: "bad contentDigest form" };
+    const arrayIssue = (decls, where) => {
+        if (!Array.isArray(decls))
+            return `${where} is not an array`;
+        if (decls.length === 0)
+            return `${where} is empty (an empty replacement set is not a v1 semantic — omit the key instead)`;
+        const seen = new Set();
+        for (let i = 0; i < decls.length; i++) {
+            const issue = declarationIssue(decls[i], `${where}[${i}]`);
+            if (issue)
+                return issue;
+            const id = decls[i].id;
+            if (seen.has(id))
+                return `${where}[${i}]: duplicate id "${id}" (core composer throws on duplicates)`;
+            seen.add(id);
+        }
+        return undefined;
+    };
+    const sectionsIssue = arrayIssue(p.sections, "sections");
+    if (sectionsIssue)
+        return { ok: false, error: sectionsIssue };
+    if (p.scenarioOverrides !== undefined) {
+        if (p.scenarioOverrides === null || typeof p.scenarioOverrides !== "object" || Array.isArray(p.scenarioOverrides)) {
+            return { ok: false, error: "scenarioOverrides is not an object" };
+        }
+        for (const [name, decls] of Object.entries(p.scenarioOverrides)) {
+            const issue = arrayIssue(decls, `scenarioOverrides[${name}]`);
+            if (issue)
+                return { ok: false, error: issue };
+        }
+    }
+    return { ok: true, value: raw };
+}
+export const CORE_ENGINE_VERSION = (() => {
+    try {
+        const entry = createRequire(import.meta.url).resolve("@sema-agent/core");
+        return JSON.parse(readFileSync(join(dirname(entry), "..", "package.json"), "utf8")).version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+})();
+export function validatePromptsDomain(raw) {
+    if (raw === null || typeof raw !== "object")
+        return { ok: false, error: "prompts is not an object" };
+    const w = raw;
+    if (w.schemaVersion === undefined) {
+        const legacy = validateCenterPrompts(raw);
+        if (!legacy.ok)
+            return legacy;
+        return { ok: true, value: { declarations: legacy.value, identity: `${legacy.value.contentDigest}+-`, axes: ["declarations"] } };
+    }
+    if (w.schemaVersion !== 1)
+        return { ok: false, error: `unsupported prompts schemaVersion ${String(w.schemaVersion)}` };
+    if (w.declarations === undefined && w.catalog === undefined)
+        return { ok: false, error: "dual-axis prompts carries neither axis (at least one of declarations|catalog required)" };
+    const value = { identity: "", axes: [] };
+    if (w.declarations !== undefined) {
+        const d = validateCenterPrompts(w.declarations);
+        if (!d.ok)
+            return { ok: false, error: `declarations axis: ${d.error}` };
+        value.declarations = d.value;
+        value.axes.push("declarations");
+    }
+    if (w.catalog !== undefined) {
+        const c = verifyPromptArtifact(w.catalog, { engineVersion: CORE_ENGINE_VERSION });
+        if (!c.ok)
+            return { ok: false, error: `catalog axis: ${c.code}: ${c.reason}` };
+        value.catalog = w.catalog;
+        value.axes.push("catalog");
+    }
+    value.identity = `${value.declarations?.contentDigest ?? "-"}+${value.catalog?.artifact.artifactDigest ?? "-"}`;
+    return { ok: true, value };
+}
+//# sourceMappingURL=prompts-domain-validate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "1.310.0",
+  "version": "1.311.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",