@sema-agent/settings-schema 13.0.0 → 14.0.0

package/conformance/cases/cli01-model-name-nfc-vs-nfd/expected.json

@@ -50,9 +50,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/cli02-control-and-zero-width-chars/expected.json

@@ -63,9 +63,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/cli03-credential-pasted-into-unknown-key/expected.json

@@ -47,9 +47,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/cli04-env-value-with-newline/expected.json

@@ -39,9 +39,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/cli05-long-and-prefix-colliding-names/expected.json

@@ -70,9 +70,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/t01-absent-domain-key-not-null/expected.json

@@ -58,9 +58,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/t03-prototype-name-key-not-swallowed/expected.json

@@ -50,9 +50,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/t04-secret-literal-never-in-warning-value/expected.json

@@ -50,9 +50,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/z01-every-domain-empty-object/expected.json

@@ -39,9 +39,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },
@@ -104,9 +102,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/conformance/cases/z02-every-domain-unknown-key/expected.json

@@ -41,9 +41,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },
@@ -253,9 +251,7 @@
       "projects": {
         "projects": {}
       },
-      "prompts": {
-        "bindings": []
-      },
+      "prompts": {},
       "rosters": {
         "rosters": []
       },

package/dist/config-fns.d.ts

@@ -584,7 +584,7 @@ export declare const DOMAIN_READ_FALLBACK: {
  *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
  *
  *  Per-domain rationale:
- *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability / content catalogs — a dropped entry is
  *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
  *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
  *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
@@ -594,7 +594,11 @@ export declare const DOMAIN_READ_FALLBACK: {
  *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
  *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
  *      {@link DOMAIN_READ_FALLBACK}).
- *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *    - prompts: NONE (14.0.0) — an artifact is digest-bound: a dropped overlay leaves an artifact whose digest no longer holds (the
+      engine refuses the whole candidate it rides in, every domain with it), and a dropped worker artifact substitutes the scope's
+      text for that worker (a replacement, not a narrowing). Its whenUnreadable stance stays `"default"`: unreadable ⇒ `{}` ⇒ no
+      center layer is served (the engine's built-in prompt).
+    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
  *      (放权,不许).
  *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
  *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
@@ -617,7 +621,7 @@ export declare const DOMAIN_ENTRY_SALVAGE: {
     readonly entitlement: "none";
     readonly execution: "none";
     readonly projects: "salvage";
-    readonly prompts: "salvage";
+    readonly prompts: "none";
     readonly limits: "none";
 };
 /** 一个读者向店要文档的口:配置域,以及墓碑表里的retired 域({@link RETIRED_DOMAINS})—— 后者只为让墓碑看见没迁的旧文档。 */

package/dist/config-fns.js

@@ -165,8 +165,8 @@ export const DOMAIN_WRITE_ROLE = {
     // entitlement governs who-can-USE-what (models/skills/mcp/budget/runtime caps) per principal — a governance +
     // security surface (budget ceilings, bypass kill-switch) on par with systems. Same raised gate.
     entitlement: "publisher",
-    // prompts (0.10.19, [ref]③/②d): declaration text goes STRAIGHT into the system prompt of
-    // every worker×scenario the binding covers — the same injection surface (and rationale) as skills/mcp,
+    // prompts (0.10.19, [ref]③/②d): the center artifact's overlay text goes STRAIGHT into the system prompt of
+    // every worker×scenario it applies to — the same injection surface (and rationale) as skills/mcp,
     // so the same raised gate. Web-admin had pre-raised this locally per governance precedent; this row is the
     // contract-side source of truth so every consumer of the shared write gate gets publisher, not editor.
     prompts: "publisher",
@@ -969,9 +969,8 @@ export const DOMAIN_READ_FALLBACK = {
     entitlement: "throw",
     execution: "throw",
     projects: "throw",
-    // prompts:内容域(scenarios 同类)——坏形→空默认(=「无 prompts 管理」当年语义,web [1064]②
-    // backfill-empty-default 同口径);fail-closed 由 PUBLISH_MODE 发布闸承担,default 不扩权
-    // (空 bindings=不下发任何内容)。
+    // prompts:内容域(scenarios 同类)——坏形→空默认 `{}`(=「不管提示词」:不下发中心层,引擎用内置);fail-closed 由 PUBLISH_MODE
+    // 发布闸承担,default 不扩权。14.0.0 起墓碑键(`bindings` / `catalog`)也走这一档(读不出 ⇒ 缺省 + domain-defaulted 点名 SS-M10)。
     prompts: "default",
     // limits(0.19.0):THROW —— 本域是成本 / 限流天花板的唯一发布位(11.0.0 起 runtime 域retired)。坏形
     // 降级成空域 = 中央发布的成本/限流天花板整片蒸发,消费方回自己的 env 底(可能宽得多)= 预算轴放权。
@@ -991,7 +990,7 @@ export const DOMAIN_READ_FALLBACK = {
  *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
  *
  *  Per-domain rationale:
- *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability / content catalogs — a dropped entry is
  *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
  *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
  *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
@@ -1001,7 +1000,11 @@ export const DOMAIN_READ_FALLBACK = {
  *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
  *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
  *      {@link DOMAIN_READ_FALLBACK}).
- *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *    - prompts: NONE (14.0.0) — an artifact is digest-bound: a dropped overlay leaves an artifact whose digest no longer holds (the
+      engine refuses the whole candidate it rides in, every domain with it), and a dropped worker artifact substitutes the scope's
+      text for that worker (a replacement, not a narrowing). Its whenUnreadable stance stays `"default"`: unreadable ⇒ `{}` ⇒ no
+      center layer is served (the engine's built-in prompt).
+    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
  *      (放权,不许).
  *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
  *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
@@ -1024,7 +1027,7 @@ export const DOMAIN_ENTRY_SALVAGE = {
     entitlement: "none",
     execution: "none",
     projects: "salvage",
-    prompts: "salvage",
+    prompts: "none",
     limits: "none",
 };
 /**
@@ -1074,8 +1077,8 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
         // execution (0.8.0, S3): plain scope-level parse — MIRRORS governance (no overlay/merge invented here).
         execution: parseOr("execution", getRaw("execution")),
         projects: parseOr("projects", getRaw("projects")),
-        // prompts (0.10.18, [1064]②): content domain(坏形回空默认=「无 prompts 管理」语义;fail-closed 由 PUBLISH_MODE 发布闸承担,
-        // 空 bindings 不下发内容,default 不扩权)。
+        // prompts (0.10.18 起;14.0.0 单轴): content domain(坏形回空默认 `{}` =「不管提示词」;fail-closed 由 PUBLISH_MODE 发布闸承担,
+        // `{}` 不下发中心层,default 不扩权)。
         prompts: parseOr("prompts", getRaw("prompts")),
         limits: parseOr("limits", getRaw("limits")),
     };
@@ -1109,10 +1112,10 @@ export function readEffectiveWire(raw, onWarning) {
     const updatedAt = typeof r.updatedAt === "string" ? r.updatedAt : "";
     // skills redirected to undefined: buildEffective must never see the manifest(it would fail the full-domain
     // schema and "default" it with a FALSE domain-defaulted warning);the manifest is judged separately below.
-    // prompts likewise redirected(#100):on the wire it is web-admin-assembled RESOLVED form(worker lane
-    // strips the bindings storage table — types.ts PromptsConfig 注 [1057]⑤),consumer-validated additive JSON;
-    // the storage-domain schema would swallow it to {bindings:[]} with ZERO warning(zod non-strict 剥键后
-    // "成功")— 3.24.0 起 server 侧 promptsGate 恒败的根因。verbatim,by presence(见 return)。
+    // prompts likewise redirected(#100):on the wire it is the published form `EffectivePromptsWire`(`{schemaVersion: 2, artifact}`,
+    // the one artifact selected for the pulling worker — never the storage shape), judged by the CONSUMER(that shape, then the engine's
+    // verify). The read leg must not parse it with the storage schema: a bad prompts value would be degraded to "absent" here and read
+    // downstream as "the center withdrew its layer" — the consumer's judge refuses it loudly instead. verbatim, by presence(见 return)。
     const built = buildEffective(r.version, (d) => (d === "skills" || d === "prompts" ? undefined : r[d]), updatedAt, onWarning);
     // retired 域名不是 open-world 的未知键:墓碑已在 buildEffective 里判过(带事实 ⇒ 抛),剩下的 `{}` 没有可承运的东西。
     let skills;
@@ -1143,8 +1146,8 @@ export function readEffectiveWire(raw, onWarning) {
     // `Object.fromEntries`,**不是**逐键 `passthrough[k] = v`:后者对 `"__proto__"` 走的是原型 setter
     // (改掉对象的原型,而不是加一个键),fromEntries 走 CreateDataProperty —— 同一条「键就是键」的律。
     const passthrough = Object.fromEntries(Object.entries(r).filter(([k]) => !Object.prototype.hasOwnProperty.call(built, k) && k !== "skills" && !isRetiredDomainName(k)));
-    // prompts:剥掉 buildEffective 恒物化的 {bindings:[]} 底座,按 wire 在场性 verbatim 挂回(#100:
-    // 缺席进缺席出——web-admin worker-lane 闸关是常态形,物化会让消费端「缺席」分支永不可达)。
+    // prompts:剥掉 buildEffective 恒物化的 `{}` 底座,按 wire 在场性 verbatim 挂回(#100:
+    // 缺席进缺席出——发布闸关是常态形,物化会让消费端「缺席」分支永不可达)。
     const { prompts: _promptsMaterialized, ...builtSansPrompts } = built;
     return { ...passthrough, ...builtSansPrompts, skills, ...("prompts" in r ? { prompts: r.prompts } : {}) };
 }

package/dist/conformance/derive.js

@@ -8,7 +8,7 @@
  * 显示成 diff。于是「有没有第四条变换没登记」这件事不再靠人回忆 —— 没登记的那条会自己红出来。
  *
  * 变换表(每条写明:动了什么、影响哪几条腿、出处):
- *  · **T1 prompts 物化**(wire):`buildEffective` 恒物化 `prompts: {bindings:[]}`;wire 腿按**在场性**
+ *  · **T1 prompts 物化**(wire):`buildEffective` 恒物化 `prompts`(域缺席 ⇒ `{}`;14.0.0 前是 `{bindings:[]}`);wire 腿按**在场性**
  *    verbatim 挂回(`readEffectiveWire` 的 `"prompts" in r` 判据)—— 缺席进缺席出,且在场时是**未解析的
  *    原文档**。
  *  · **T2 skills 表示**(wire):域形带 `content`,wire 形带 `contentHash`(manifest)。判据 schema 随表示走。
@@ -39,7 +39,7 @@ import { skillContentHash } from "../skills-manifest.js";
 import { DOMAINS, isDomainName } from "../types.js";
 /** 变换表(本文件头注的机器形;`docs/CONFORMANCE.md` 与 `test/conformance-coverage.test.ts` 都读它)。 */
 export const DERIVATION_TRANSFORMS = [
-    { id: "T1-prompts-materialisation", legs: ["wire"], what: "buildEffective 恒物化 prompts:{bindings:[]};wire 按在场性 verbatim 挂回(缺席进缺席出)" },
+    { id: "T1-prompts-materialisation", legs: ["wire"], what: "buildEffective 恒物化 prompts(缺席 ⇒ {});wire 按在场性 verbatim 挂回(缺席进缺席出)" },
     { id: "T2-skills-representation", legs: ["wire"], what: "域形 content ↔ wire 形 contentHash(manifest),判据 schema 随表示走" },
     { id: "T3-non-portable-domains", legs: ["localRoot"], what: "config.d/ 只读 PORTABLE_DOMAINS;其余域取默认 + unread-config-file{non-portable-domain}" },
     { id: "T4-unknown-top-level-key", legs: ["wire", "localRoot"], what: "wire open-world 逐字承运;domains 腿按域名取文档故无声;local 报 unread-config-file{not-a-domain}" },

package/dist/hooks-config.d.ts

@@ -20,6 +20,12 @@
  *     that merely spells `PreToolUse` is not a sign. A piece holding a sign is never dropped — dropping it could make a misplaced guard vanish —
  *     the document is rejected instead, wherever the sign sits: outside `hooks`, under an unknown event, in a non-array event value, in a matcher's
  *     or an entry's fields (including fields the contract does not know and would otherwise not carry).
+ *   · `field` — ONE LAW for drops and rejections alike: when the bad piece is a matcher or an entry (an object), `field` is the KEY on it that makes it
+ *     bad — a contract field whose value is wrong, or, for a piece rejected because it holds a guard sign, the member that holds the sign (an unknown
+ *     field the contract would strip; a contract field carrying more than its kind, such as `headers` or `input`; `hooks` for an entry that is itself
+ *     matcher-shaped). Absent only when the piece is not an object — and for the pieces above matchers, which have no fields to name. One piece, one
+ *     `field`: the first wrong contract field, or the first sign in document order; a sign on the piece itself decides before a wrong contract field
+ *     of the same piece does (it is why the piece is rejected rather than dropped).
  *
  * CC 2.1.296 DIVERGENCES (each in the stricter direction — a document CC would load may be rejected here, never the reverse): listed once,
  * in `docs/CC-DIVERGENCE.md` (section "hooks classifier", H1–H7) — the whole-subtree guard-sign scan is the first of them.
@@ -173,7 +179,9 @@ export interface HooksDroppedPiece {
     readonly path: ConfigPath;
     readonly field?: string;
 }
-/** One reason the document was rejected: `path` = the offending piece (for `guard-outside-hooks`: the guard sign itself); `field` as above. */
+/** One reason the document was rejected: `path` = the offending piece (for `guard-outside-hooks`: the guard sign itself); `field` = for a matcher / entry,
+ *  the key on it that makes it bad — the contract field whose value is wrong, or the member that holds a guard sign (see the file header's `field` law);
+ *  absent when the piece is not an object, and for the codes above matchers. */
 export interface HooksRejection {
     readonly code: HooksRejectionCode;
     readonly path: ConfigPath;

package/dist/hooks-config.js

@@ -20,6 +20,12 @@
  *     that merely spells `PreToolUse` is not a sign. A piece holding a sign is never dropped — dropping it could make a misplaced guard vanish —
  *     the document is rejected instead, wherever the sign sits: outside `hooks`, under an unknown event, in a non-array event value, in a matcher's
  *     or an entry's fields (including fields the contract does not know and would otherwise not carry).
+ *   · `field` — ONE LAW for drops and rejections alike: when the bad piece is a matcher or an entry (an object), `field` is the KEY on it that makes it
+ *     bad — a contract field whose value is wrong, or, for a piece rejected because it holds a guard sign, the member that holds the sign (an unknown
+ *     field the contract would strip; a contract field carrying more than its kind, such as `headers` or `input`; `hooks` for an entry that is itself
+ *     matcher-shaped). Absent only when the piece is not an object — and for the pieces above matchers, which have no fields to name. One piece, one
+ *     `field`: the first wrong contract field, or the first sign in document order; a sign on the piece itself decides before a wrong contract field
+ *     of the same piece does (it is why the piece is rejected rather than dropped).
  *
  * CC 2.1.296 DIVERGENCES (each in the stricter direction — a document CC would load may be rejected here, never the reverse): listed once,
  * in `docs/CC-DIVERGENCE.md` (section "hooks classifier", H1–H7) — the whole-subtree guard-sign scan is the first of them.
@@ -214,6 +220,12 @@ function hookGuardSignIn(root, rootPath, place) {
     }
     return undefined;
 }
+/** The key of the object piece at `at` that holds `sign` (a coordinate at or below `at`, as {@link hookGuardSignIn} reports it): the first segment
+ *  below `at`; `hooks` when the sign IS the piece itself (a matcher-shaped object — its `hooks` member is what makes it one). */
+function hookSignKeyOf(at, sign) {
+    const key = sign[at.length];
+    return key === undefined ? "hooks" : String(key);
+}
 /** Does `value` fit the field kind `base` (the kind without its `?`)? */
 function hookFieldFits(base, value) {
     switch (base) {
@@ -279,27 +291,22 @@ function hookMatcherRead(matcher, at, guardEvent, reject, drop) {
         return undefined;
     }
     const entries = Object.hasOwn(matcher, "hooks") ? matcher.hooks : undefined;
-    // a sign at the matcher level: a guard-event key on the matcher itself, or anywhere in its fields other than a well-formed entry list
-    let matcherSign = hookGuardKeyOf(matcher) !== undefined;
-    for (const key of Object.keys(matcher)) {
-        if (matcherSign)
-            break;
-        if (key === "hooks" && Array.isArray(entries))
-            continue;
-        matcherSign = hookGuardSignIn(matcher[key], [...at, key], "other") !== undefined;
-    }
-    if (matcherSign) {
-        reject("guard-matcher-invalid", at);
+    // a sign at the matcher level: a guard-event key on the matcher itself, or anywhere in its fields other than a well-formed entry list;
+    // the member that holds the first one (document order — the order hookGuardSignIn reports) is the rejection's `field`
+    const signField = hookGuardKeyOf(matcher) ??
+        Object.keys(matcher).find((key) => !(key === "hooks" && Array.isArray(entries)) && hookGuardSignIn(matcher[key], [...at, key], "other") !== undefined);
+    if (signField !== undefined) {
+        reject("guard-matcher-invalid", at, signField);
         return undefined;
     }
     const entrySigns = [];
     if (Array.isArray(entries))
         for (let j = 0; j < entries.length; j++)
-            entrySigns.push(hookGuardSignIn(entries[j], [...at, "hooks", j], "other") !== undefined);
+            entrySigns.push(hookGuardSignIn(entries[j], [...at, "hooks", j], "other"));
     const name = Object.hasOwn(matcher, "matcher") ? matcher.matcher : undefined;
     const badField = name !== undefined && typeof name !== "string" ? "matcher" : !Array.isArray(entries) ? "hooks" : undefined;
     if (badField !== undefined || !Array.isArray(entries)) {
-        if (guardEvent || entrySigns.includes(true))
+        if (guardEvent || entrySigns.some((sign) => sign !== undefined))
             reject("guard-matcher-invalid", at, badField);
         else
             drop("matcher-invalid", at, badField);
@@ -308,8 +315,9 @@ function hookMatcherRead(matcher, at, guardEvent, reject, drop) {
     const kept = [];
     for (let j = 0; j < entries.length; j++) {
         const where = [...at, "hooks", j];
-        if (entrySigns[j]) {
-            reject("guard-entry-invalid", where);
+        const sign = entrySigns[j];
+        if (sign !== undefined) {
+            reject("guard-entry-invalid", where, hookIsRecord(entries[j]) ? hookSignKeyOf(where, sign) : undefined);
             continue;
         }
         const read = hookEntryRead(entries[j]);

package/dist/index.d.ts

@@ -36,3 +36,4 @@ export * from "./url-pattern.js";
 export * from "./http-hook-allowlists.js";
 export * from "./mcp-server-policy.js";
 export * from "./ui-language.js";
+export * from "./mcp-request-entry.js";

package/dist/index.js

@@ -36,6 +36,7 @@ export * from "./url-pattern.js"; // 13.0.0 (S-1597): THE URL-list pattern judge
 export * from "./http-hook-allowlists.js"; // 13.0.0 (U3): allowedHttpHookUrls / httpHookAllowedEnvVars — one layer reader + httpHookUrlVerdict / httpHookEnvVarsAllowed (admitted layers INTERSECT; SAFETY_MERGE_SPEC.httpHookAllowlists), pure/browser-safe
 export * from "./mcp-server-policy.js"; // 13.0.0 (U6): mcpServerPolicyVerdict → McpPolicyBlock{name, list, rule, target, written, sources} (structure, no sentence; target judged expanded, echoed only as written), pure/browser-safe
 export * from "./ui-language.js"; // 13.0.0 (S-1592): the UI-language settings fragment (semaUiLanguage, en | zh, category ui, user settings) + readUiLanguage, pure/browser-safe
+export * from "./mcp-request-entry.js"; // 14.0.0: the request-plane MCP entry judges (isUsableWireName / isContentOriginWord / readMcpIdentityHeaders / readRequestMcpTransport + the value-shape describers) — one reading for the service legs and the shell pre-check, pure/browser-safe
 // NOTE: the Node-fs-backed helpers (FileConfigStore + the file editor) are NOT in this barrel — they pull
 // `node:fs`/`node:path` and would break a browser/client bundle that only wants the contract (e.g.
 // web-admin's client components import the zod types through here). Import them from the Node-only

package/dist/mcp-request-entry.d.ts

@@ -0,0 +1,93 @@
+/**
+ * 请求面 MCP 条目(一条任务提交体 `mcpServers[i]`)的形判官 —— 14.0.0 起住本包:一只读法,消费方的请求腿 / 中心腿 / 壳的发送前预检都 import 这一份。
+ * 纯函数、浏览器安全(唯一的值依赖是本包自己的内容出处词表)。
+ *
+ * ## 律(一条)
+ * **一条请求面 MCP 条目的每一格「能不能用」只有一只判官。** 此前这些判官是消费方私有的:壳拿不到,只能在发送前披露「判不准、交给服务端」,
+ * 或者自己抄一份 —— 两份判据就是将来漂开的那一份。现在判官在契约包,服务端与壳读同一份,同一条条目在两处同受理 / 同拒、同一个键路径、同一句原因。
+ *
+ * ## 语义是搬来的,不是重写的
+ * 判据与原因句逐字等于消费方 7.131.x 的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
+ * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
+ *
+ * ## 依赖的引擎事实(镜像 + 漂移门)
+ *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
+ *  · 请求面传输形 {@link RequestMcpTransport} = 引擎 MCP 条目的传输形,http 形多一个本包承载的 `assertionHeader`(编译期双向对拍:门 ⑧);
+ *  · 内容出处词表 = {@link MCP_CONTENT_ORIGINS}(已有的镜像,门 ⑥);
+ *  · url 前缀守卫 = `./url-shape` 的 `startsWithHttpScheme`(本包判 URL 的正则只在那一个模块)。
+ *
+ * ## 与配置面的关系(如实)
+ * 配置面的 MCP 条目(`McpServerSpec`,部署声明:凭据只许 env-NAME 引用)与请求面(提交体:可带字面凭据 `env` / `headers`)是两份契约,本模块只管后者。
+ * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
+ * (语义逐字搬),是一项已知待收的分歧。
+ */
+import { type McpContentOrigin } from "./types.js";
+/** 值的**种类**(不回显值本身)。 */
+export declare function describeValueShape(v: unknown): string;
+/** 「不是字符串数组」的种类:数组里混了非串元素说那一句,否则回落到 {@link describeValueShape}。 */
+export declare function describeNotStringArray(v: unknown): string;
+/** 「不是字符串值的对象」的种类:对象里混了非串值说那一句,否则回落到 {@link describeValueShape}。 */
+export declare function describeNotStringRecord(v: unknown): string;
+/** 字符串数组(空数组合法)。 */
+export declare function isStringArray(v: unknown): v is string[];
+/** 字符串值的对象(空对象合法;数组不是)。 */
+export declare function isStringRecord(v: unknown): v is Record<string, string>;
+/** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
+export declare const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/**
+ * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS} 一律不可用。不截断、不规范化 —— 截短一个名字就是**换一个身份**,
+ * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。
+ */
+export declare function isUsableWireName(v: unknown): v is string;
+/** 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或截到 32 字加长度事实 —— 绝不把任意长度的申报串原样回显。 */
+export declare function describeBadWireName(v: unknown): string;
+/**
+ * 在内容出处词表({@link MCP_CONTENT_ORIGINS})内吗。严判:非串与大小写不符(`"LOCAL"`)一律不在 —— 引擎的词是字面量联合、不做规范化;
+ * 替它「宽容一下」等于自造第二份值域语义,而这条轴上宽容的方向恰好是**放宽信任**(把一个写坏的声明读成 `"local"`)。
+ */
+export declare function isContentOriginWord(v: unknown): v is McpContentOrigin;
+/** 坏内容出处值的**可打印**摘要:串 JSON 化、64 字截断加 `…`;非串只说种类。 */
+export declare function describeBadContentOrigin(v: unknown): string;
+/**
+ * 一份 http 传输上两个身份头(`principalHeader` / `assertionHeader`)的读法:字符串才收;**`principalHeader` 胜** —— 它在场(不论值形)时
+ * `assertionHeader` 不收。所以读后的形**结构上不可能同带两键**;同设(一份声明给出两个答案)由调用方在读之前对**原始**传输判(判的是写了什么,不是读后留下什么)。
+ */
+export declare function readMcpIdentityHeaders(transport: Record<string, unknown>): {
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+/** 请求面一条 MCP 条目的传输形:引擎的传输形,http 形多一个承载的 `assertionHeader`(引擎的 http 传输没有这个座;交给引擎之前由消费方剥掉)。 */
+export type RequestMcpTransport = {
+    kind: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+} | {
+    kind: "http";
+    url: string;
+    headers?: Record<string, string>;
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+/** 条目内一处坏形:`path` = 条目内的键路径(`transport.url`),`reason` = 判官的原因句(只说形与词表,不回显值)。 */
+export interface McpEntryKeyIssue {
+    readonly path: string;
+    readonly reason: string;
+}
+/** {@link readRequestMcpTransport} 的结果:`ok:false` = 硬坏形(这条 server 无从挂载);`ok:true` 的 `lost` = 读器**丢掉**的可选子键(server 照挂、少一个声明)。 */
+export type RequestMcpTransportRead = {
+    ok: true;
+    transport: RequestMcpTransport;
+    lost: readonly McpEntryKeyIssue[];
+} | {
+    ok: false;
+    issue: McpEntryKeyIssue;
+};
+/**
+ * 请求面 `transport` 的**唯一读器**:读器投影 transport 用它,发送前 / 受理时的判形读它报的 `lost` —— 同一只函数两个消费点,「读器丢了什么」与「门拒什么」不可能分岔。
+ *  · 硬坏形(`transport` 不是对象 / `kind` 出闭集 / stdio 缺 `command` / http 的 `url` 不是 http(s))⇒ `ok:false`,`path` 是读器点名的键路径;
+ *  · 软坏形(`args` 不是串数组 / `env` `headers` 含非串值 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
+ *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
+ * url 的拒句不回显值:它常规地带凭据(userinfo)。
+ */
+export declare function readRequestMcpTransport(t: unknown): RequestMcpTransportRead;