@sema-agent/settings-schema 13.0.1 → 14.0.0

package/dist/config-fns.js

@@ -165,8 +165,8 @@ export const DOMAIN_WRITE_ROLE = {
     // entitlement governs who-can-USE-what (models/skills/mcp/budget/runtime caps) per principal — a governance +
     // security surface (budget ceilings, bypass kill-switch) on par with systems. Same raised gate.
     entitlement: "publisher",
-    // prompts (0.10.19, [ref]③/②d): declaration text goes STRAIGHT into the system prompt of
-    // every worker×scenario the binding covers — the same injection surface (and rationale) as skills/mcp,
+    // prompts (0.10.19, [ref]③/②d): the center artifact's overlay text goes STRAIGHT into the system prompt of
+    // every worker×scenario it applies to — the same injection surface (and rationale) as skills/mcp,
     // so the same raised gate. Web-admin had pre-raised this locally per governance precedent; this row is the
     // contract-side source of truth so every consumer of the shared write gate gets publisher, not editor.
     prompts: "publisher",
@@ -969,9 +969,8 @@ export const DOMAIN_READ_FALLBACK = {
     entitlement: "throw",
     execution: "throw",
     projects: "throw",
-    // prompts:内容域(scenarios 同类)——坏形→空默认(=「无 prompts 管理」当年语义,web [1064]②
-    // backfill-empty-default 同口径);fail-closed 由 PUBLISH_MODE 发布闸承担,default 不扩权
-    // (空 bindings=不下发任何内容)。
+    // prompts:内容域(scenarios 同类)——坏形→空默认 `{}`(=「不管提示词」:不下发中心层,引擎用内置);fail-closed 由 PUBLISH_MODE
+    // 发布闸承担,default 不扩权。14.0.0 起墓碑键(`bindings` / `catalog`)也走这一档(读不出 ⇒ 缺省 + domain-defaulted 点名 SS-M10)。
     prompts: "default",
     // limits(0.19.0):THROW —— 本域是成本 / 限流天花板的唯一发布位(11.0.0 起 runtime 域retired)。坏形
     // 降级成空域 = 中央发布的成本/限流天花板整片蒸发,消费方回自己的 env 底(可能宽得多)= 预算轴放权。
@@ -991,7 +990,7 @@ export const DOMAIN_READ_FALLBACK = {
  *  it back would turn every dropped entry into a deletion — read-modify-write faces read the stored document with the document face.
  *
  *  Per-domain rationale:
- *    - models/skills/mcp/plugins/scenarios/systems/collab/prompts: additive capability / content catalogs — a dropped entry is
+ *    - models/skills/mcp/plugins/scenarios/systems/collab: additive capability / content catalogs — a dropped entry is
  *      one capability gone (fail-closed). Inside a surviving entry the same holds: the nested collections these entries carry
  *      are allowlists / scopings (`allowTools`, `scenarios`, `rosters`, `callsWorkers`, …) where one entry fewer only NARROWS,
  *      and the zero-survivor law (never mint an empty collection — several of these read "empty = all") holds at every level.
@@ -1001,7 +1000,11 @@ export const DOMAIN_READ_FALLBACK = {
  *      schema refuses (12.2.1's UNC judgement on `contextItems[].value`) must not take the scope's other projects with it.
  *      Its whenUnreadable stance stays `"throw"` (a ledger that cannot be read at all is never defaulted — see
  *      {@link DOMAIN_READ_FALLBACK}).
- *    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
+ *    - prompts: NONE (14.0.0) — an artifact is digest-bound: a dropped overlay leaves an artifact whose digest no longer holds (the
+      engine refuses the whole candidate it rides in, every domain with it), and a dropped worker artifact substitutes the scope's
+      text for that worker (a replacement, not a narrowing). Its whenUnreadable stance stays `"default"`: unreadable ⇒ `{}` ⇒ no
+      center layer is served (the engine's built-in prompt).
+    - rosters: NONE — a dropped roster makes resolveEffectiveForWorker fall back to the FULL models catalog for that worker
  *      (放权,不许).
  *    - workers: NONE — a dropped worker row reads as "this worker is no longer declared": the reconciler would retire it. The
  *      per-row tolerance this domain does have lives in `readWorkersRows` (rows are HELD with their original, never dropped).
@@ -1024,7 +1027,7 @@ export const DOMAIN_ENTRY_SALVAGE = {
     entitlement: "none",
     execution: "none",
     projects: "salvage",
-    prompts: "salvage",
+    prompts: "none",
     limits: "none",
 };
 /**
@@ -1074,8 +1077,8 @@ export function buildEffective(version, getRaw, updatedAt, onWarning) {
         // execution (0.8.0, S3): plain scope-level parse — MIRRORS governance (no overlay/merge invented here).
         execution: parseOr("execution", getRaw("execution")),
         projects: parseOr("projects", getRaw("projects")),
-        // prompts (0.10.18, [1064]②): content domain(坏形回空默认=「无 prompts 管理」语义;fail-closed 由 PUBLISH_MODE 发布闸承担,
-        // 空 bindings 不下发内容,default 不扩权)。
+        // prompts (0.10.18 起;14.0.0 单轴): content domain(坏形回空默认 `{}` =「不管提示词」;fail-closed 由 PUBLISH_MODE 发布闸承担,
+        // `{}` 不下发中心层,default 不扩权)。
         prompts: parseOr("prompts", getRaw("prompts")),
         limits: parseOr("limits", getRaw("limits")),
     };
@@ -1109,10 +1112,10 @@ export function readEffectiveWire(raw, onWarning) {
     const updatedAt = typeof r.updatedAt === "string" ? r.updatedAt : "";
     // skills redirected to undefined: buildEffective must never see the manifest(it would fail the full-domain
     // schema and "default" it with a FALSE domain-defaulted warning);the manifest is judged separately below.
-    // prompts likewise redirected(#100):on the wire it is web-admin-assembled RESOLVED form(worker lane
-    // strips the bindings storage table — types.ts PromptsConfig 注 [1057]⑤),consumer-validated additive JSON;
-    // the storage-domain schema would swallow it to {bindings:[]} with ZERO warning(zod non-strict 剥键后
-    // "成功")— 3.24.0 起 server 侧 promptsGate 恒败的根因。verbatim,by presence(见 return)。
+    // prompts likewise redirected(#100):on the wire it is the published form `EffectivePromptsWire`(`{schemaVersion: 2, artifact}`,
+    // the one artifact selected for the pulling worker — never the storage shape), judged by the CONSUMER(that shape, then the engine's
+    // verify). The read leg must not parse it with the storage schema: a bad prompts value would be degraded to "absent" here and read
+    // downstream as "the center withdrew its layer" — the consumer's judge refuses it loudly instead. verbatim, by presence(见 return)。
     const built = buildEffective(r.version, (d) => (d === "skills" || d === "prompts" ? undefined : r[d]), updatedAt, onWarning);
     // retired 域名不是 open-world 的未知键:墓碑已在 buildEffective 里判过(带事实 ⇒ 抛),剩下的 `{}` 没有可承运的东西。
     let skills;
@@ -1143,8 +1146,8 @@ export function readEffectiveWire(raw, onWarning) {
     // `Object.fromEntries`,**不是**逐键 `passthrough[k] = v`:后者对 `"__proto__"` 走的是原型 setter
     // (改掉对象的原型,而不是加一个键),fromEntries 走 CreateDataProperty —— 同一条「键就是键」的律。
     const passthrough = Object.fromEntries(Object.entries(r).filter(([k]) => !Object.prototype.hasOwnProperty.call(built, k) && k !== "skills" && !isRetiredDomainName(k)));
-    // prompts:剥掉 buildEffective 恒物化的 {bindings:[]} 底座,按 wire 在场性 verbatim 挂回(#100:
-    // 缺席进缺席出——web-admin worker-lane 闸关是常态形,物化会让消费端「缺席」分支永不可达)。
+    // prompts:剥掉 buildEffective 恒物化的 `{}` 底座,按 wire 在场性 verbatim 挂回(#100:
+    // 缺席进缺席出——发布闸关是常态形,物化会让消费端「缺席」分支永不可达)。
     const { prompts: _promptsMaterialized, ...builtSansPrompts } = built;
     return { ...passthrough, ...builtSansPrompts, skills, ...("prompts" in r ? { prompts: r.prompts } : {}) };
 }

package/dist/conformance/derive.js

@@ -8,7 +8,7 @@
  * 显示成 diff。于是「有没有第四条变换没登记」这件事不再靠人回忆 —— 没登记的那条会自己红出来。
  *
  * 变换表(每条写明:动了什么、影响哪几条腿、出处):
- *  · **T1 prompts 物化**(wire):`buildEffective` 恒物化 `prompts: {bindings:[]}`;wire 腿按**在场性**
+ *  · **T1 prompts 物化**(wire):`buildEffective` 恒物化 `prompts`(域缺席 ⇒ `{}`;14.0.0 前是 `{bindings:[]}`);wire 腿按**在场性**
  *    verbatim 挂回(`readEffectiveWire` 的 `"prompts" in r` 判据)—— 缺席进缺席出,且在场时是**未解析的
  *    原文档**。
  *  · **T2 skills 表示**(wire):域形带 `content`,wire 形带 `contentHash`(manifest)。判据 schema 随表示走。
@@ -39,7 +39,7 @@ import { skillContentHash } from "../skills-manifest.js";
 import { DOMAINS, isDomainName } from "../types.js";
 /** 变换表(本文件头注的机器形;`docs/CONFORMANCE.md` 与 `test/conformance-coverage.test.ts` 都读它)。 */
 export const DERIVATION_TRANSFORMS = [
-    { id: "T1-prompts-materialisation", legs: ["wire"], what: "buildEffective 恒物化 prompts:{bindings:[]};wire 按在场性 verbatim 挂回(缺席进缺席出)" },
+    { id: "T1-prompts-materialisation", legs: ["wire"], what: "buildEffective 恒物化 prompts(缺席 ⇒ {});wire 按在场性 verbatim 挂回(缺席进缺席出)" },
     { id: "T2-skills-representation", legs: ["wire"], what: "域形 content ↔ wire 形 contentHash(manifest),判据 schema 随表示走" },
     { id: "T3-non-portable-domains", legs: ["localRoot"], what: "config.d/ 只读 PORTABLE_DOMAINS;其余域取默认 + unread-config-file{non-portable-domain}" },
     { id: "T4-unknown-top-level-key", legs: ["wire", "localRoot"], what: "wire open-world 逐字承运;domains 腿按域名取文档故无声;local 报 unread-config-file{not-a-domain}" },

package/dist/index.d.ts

@@ -36,3 +36,4 @@ export * from "./url-pattern.js";
 export * from "./http-hook-allowlists.js";
 export * from "./mcp-server-policy.js";
 export * from "./ui-language.js";
+export * from "./mcp-request-entry.js";

package/dist/index.js

@@ -36,6 +36,7 @@ export * from "./url-pattern.js"; // 13.0.0 (S-1597): THE URL-list pattern judge
 export * from "./http-hook-allowlists.js"; // 13.0.0 (U3): allowedHttpHookUrls / httpHookAllowedEnvVars — one layer reader + httpHookUrlVerdict / httpHookEnvVarsAllowed (admitted layers INTERSECT; SAFETY_MERGE_SPEC.httpHookAllowlists), pure/browser-safe
 export * from "./mcp-server-policy.js"; // 13.0.0 (U6): mcpServerPolicyVerdict → McpPolicyBlock{name, list, rule, target, written, sources} (structure, no sentence; target judged expanded, echoed only as written), pure/browser-safe
 export * from "./ui-language.js"; // 13.0.0 (S-1592): the UI-language settings fragment (semaUiLanguage, en | zh, category ui, user settings) + readUiLanguage, pure/browser-safe
+export * from "./mcp-request-entry.js"; // 14.0.0: the request-plane MCP entry judges (isUsableWireName / isContentOriginWord / readMcpIdentityHeaders / readRequestMcpTransport + the value-shape describers) — one reading for the service legs and the shell pre-check, pure/browser-safe
 // NOTE: the Node-fs-backed helpers (FileConfigStore + the file editor) are NOT in this barrel — they pull
 // `node:fs`/`node:path` and would break a browser/client bundle that only wants the contract (e.g.
 // web-admin's client components import the zod types through here). Import them from the Node-only

package/dist/mcp-request-entry.d.ts

@@ -0,0 +1,93 @@
+/**
+ * 请求面 MCP 条目(一条任务提交体 `mcpServers[i]`)的形判官 —— 14.0.0 起住本包:一只读法,消费方的请求腿 / 中心腿 / 壳的发送前预检都 import 这一份。
+ * 纯函数、浏览器安全(唯一的值依赖是本包自己的内容出处词表)。
+ *
+ * ## 律(一条)
+ * **一条请求面 MCP 条目的每一格「能不能用」只有一只判官。** 此前这些判官是消费方私有的:壳拿不到,只能在发送前披露「判不准、交给服务端」,
+ * 或者自己抄一份 —— 两份判据就是将来漂开的那一份。现在判官在契约包,服务端与壳读同一份,同一条条目在两处同受理 / 同拒、同一个键路径、同一句原因。
+ *
+ * ## 语义是搬来的,不是重写的
+ * 判据与原因句逐字等于消费方 7.131.x 的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
+ * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
+ *
+ * ## 依赖的引擎事实(镜像 + 漂移门)
+ *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
+ *  · 请求面传输形 {@link RequestMcpTransport} = 引擎 MCP 条目的传输形,http 形多一个本包承载的 `assertionHeader`(编译期双向对拍:门 ⑧);
+ *  · 内容出处词表 = {@link MCP_CONTENT_ORIGINS}(已有的镜像,门 ⑥);
+ *  · url 前缀守卫 = `./url-shape` 的 `startsWithHttpScheme`(本包判 URL 的正则只在那一个模块)。
+ *
+ * ## 与配置面的关系(如实)
+ * 配置面的 MCP 条目(`McpServerSpec`,部署声明:凭据只许 env-NAME 引用)与请求面(提交体:可带字面凭据 `env` / `headers`)是两份契约,本模块只管后者。
+ * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
+ * (语义逐字搬),是一项已知待收的分歧。
+ */
+import { type McpContentOrigin } from "./types.js";
+/** 值的**种类**(不回显值本身)。 */
+export declare function describeValueShape(v: unknown): string;
+/** 「不是字符串数组」的种类:数组里混了非串元素说那一句,否则回落到 {@link describeValueShape}。 */
+export declare function describeNotStringArray(v: unknown): string;
+/** 「不是字符串值的对象」的种类:对象里混了非串值说那一句,否则回落到 {@link describeValueShape}。 */
+export declare function describeNotStringRecord(v: unknown): string;
+/** 字符串数组(空数组合法)。 */
+export declare function isStringArray(v: unknown): v is string[];
+/** 字符串值的对象(空对象合法;数组不是)。 */
+export declare function isStringRecord(v: unknown): v is Record<string, string>;
+/** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
+export declare const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/**
+ * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS} 一律不可用。不截断、不规范化 —— 截短一个名字就是**换一个身份**,
+ * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。
+ */
+export declare function isUsableWireName(v: unknown): v is string;
+/** 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或截到 32 字加长度事实 —— 绝不把任意长度的申报串原样回显。 */
+export declare function describeBadWireName(v: unknown): string;
+/**
+ * 在内容出处词表({@link MCP_CONTENT_ORIGINS})内吗。严判:非串与大小写不符(`"LOCAL"`)一律不在 —— 引擎的词是字面量联合、不做规范化;
+ * 替它「宽容一下」等于自造第二份值域语义,而这条轴上宽容的方向恰好是**放宽信任**(把一个写坏的声明读成 `"local"`)。
+ */
+export declare function isContentOriginWord(v: unknown): v is McpContentOrigin;
+/** 坏内容出处值的**可打印**摘要:串 JSON 化、64 字截断加 `…`;非串只说种类。 */
+export declare function describeBadContentOrigin(v: unknown): string;
+/**
+ * 一份 http 传输上两个身份头(`principalHeader` / `assertionHeader`)的读法:字符串才收;**`principalHeader` 胜** —— 它在场(不论值形)时
+ * `assertionHeader` 不收。所以读后的形**结构上不可能同带两键**;同设(一份声明给出两个答案)由调用方在读之前对**原始**传输判(判的是写了什么,不是读后留下什么)。
+ */
+export declare function readMcpIdentityHeaders(transport: Record<string, unknown>): {
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+/** 请求面一条 MCP 条目的传输形:引擎的传输形,http 形多一个承载的 `assertionHeader`(引擎的 http 传输没有这个座;交给引擎之前由消费方剥掉)。 */
+export type RequestMcpTransport = {
+    kind: "stdio";
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+} | {
+    kind: "http";
+    url: string;
+    headers?: Record<string, string>;
+    principalHeader?: string;
+    assertionHeader?: string;
+};
+/** 条目内一处坏形:`path` = 条目内的键路径(`transport.url`),`reason` = 判官的原因句(只说形与词表,不回显值)。 */
+export interface McpEntryKeyIssue {
+    readonly path: string;
+    readonly reason: string;
+}
+/** {@link readRequestMcpTransport} 的结果:`ok:false` = 硬坏形(这条 server 无从挂载);`ok:true` 的 `lost` = 读器**丢掉**的可选子键(server 照挂、少一个声明)。 */
+export type RequestMcpTransportRead = {
+    ok: true;
+    transport: RequestMcpTransport;
+    lost: readonly McpEntryKeyIssue[];
+} | {
+    ok: false;
+    issue: McpEntryKeyIssue;
+};
+/**
+ * 请求面 `transport` 的**唯一读器**:读器投影 transport 用它,发送前 / 受理时的判形读它报的 `lost` —— 同一只函数两个消费点,「读器丢了什么」与「门拒什么」不可能分岔。
+ *  · 硬坏形(`transport` 不是对象 / `kind` 出闭集 / stdio 缺 `command` / http 的 `url` 不是 http(s))⇒ `ok:false`,`path` 是读器点名的键路径;
+ *  · 软坏形(`args` 不是串数组 / `env` `headers` 含非串值 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
+ *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
+ * url 的拒句不回显值:它常规地带凭据(userinfo)。
+ */
+export declare function readRequestMcpTransport(t: unknown): RequestMcpTransportRead;

package/dist/mcp-request-entry.js

@@ -0,0 +1,157 @@
+/**
+ * 请求面 MCP 条目(一条任务提交体 `mcpServers[i]`)的形判官 —— 14.0.0 起住本包:一只读法,消费方的请求腿 / 中心腿 / 壳的发送前预检都 import 这一份。
+ * 纯函数、浏览器安全(唯一的值依赖是本包自己的内容出处词表)。
+ *
+ * ## 律(一条)
+ * **一条请求面 MCP 条目的每一格「能不能用」只有一只判官。** 此前这些判官是消费方私有的:壳拿不到,只能在发送前披露「判不准、交给服务端」,
+ * 或者自己抄一份 —— 两份判据就是将来漂开的那一份。现在判官在契约包,服务端与壳读同一份,同一条条目在两处同受理 / 同拒、同一个键路径、同一句原因。
+ *
+ * ## 语义是搬来的,不是重写的
+ * 判据与原因句逐字等于消费方 7.131.x 的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
+ * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
+ *
+ * ## 依赖的引擎事实(镜像 + 漂移门)
+ *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
+ *  · 请求面传输形 {@link RequestMcpTransport} = 引擎 MCP 条目的传输形,http 形多一个本包承载的 `assertionHeader`(编译期双向对拍:门 ⑧);
+ *  · 内容出处词表 = {@link MCP_CONTENT_ORIGINS}(已有的镜像,门 ⑥);
+ *  · url 前缀守卫 = `./url-shape` 的 `startsWithHttpScheme`(本包判 URL 的正则只在那一个模块)。
+ *
+ * ## 与配置面的关系(如实)
+ * 配置面的 MCP 条目(`McpServerSpec`,部署声明:凭据只许 env-NAME 引用)与请求面(提交体:可带字面凭据 `env` / `headers`)是两份契约,本模块只管后者。
+ * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
+ * (语义逐字搬),是一项已知待收的分歧。
+ */
+import { MCP_CONTENT_ORIGINS } from "./types.js";
+import { startsWithHttpScheme } from "./url-shape.js";
+// ── 值的种类描述(拒句只说「你写的是什么形」,不回显值:值可能带凭据、可能任意长)──────────────────────────────────────
+/** 值的**种类**(不回显值本身)。 */
+export function describeValueShape(v) {
+    if (v === undefined)
+        return "nothing (the key is absent)";
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "an array";
+    if (typeof v === "string")
+        return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
+    if (typeof v === "object")
+        return "an object";
+    return `a ${typeof v}`;
+}
+/** 「不是字符串数组」的种类:数组里混了非串元素说那一句,否则回落到 {@link describeValueShape}。 */
+export function describeNotStringArray(v) {
+    return Array.isArray(v) ? "an array with a non-string element" : describeValueShape(v);
+}
+/** 「不是字符串值的对象」的种类:对象里混了非串值说那一句,否则回落到 {@link describeValueShape}。 */
+export function describeNotStringRecord(v) {
+    return isRecord(v) ? "an object with a non-string value" : describeValueShape(v);
+}
+/** 字符串数组(空数组合法)。 */
+export function isStringArray(v) {
+    return Array.isArray(v) && v.every((a) => typeof a === "string");
+}
+/** 字符串值的对象(空对象合法;数组不是)。 */
+export function isStringRecord(v) {
+    return !!v && typeof v === "object" && !Array.isArray(v) && Object.values(v).every((x) => typeof x === "string");
+}
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+// ── 申报名的线长界 ──────────────────────────────────────────────────────────────────────────────────
+/** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
+export const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/**
+ * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS} 一律不可用。不截断、不规范化 —— 截短一个名字就是**换一个身份**,
+ * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。
+ */
+export function isUsableWireName(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS;
+}
+/** 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或截到 32 字加长度事实 —— 绝不把任意长度的申报串原样回显。 */
+export function describeBadWireName(v) {
+    if (typeof v !== "string")
+        return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    if (v.length === 0)
+        return "empty";
+    const head = v.length > 32 ? `${JSON.stringify(v.slice(0, 32))}…` : JSON.stringify(v);
+    return `${head} (${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS})`;
+}
+// ── 内容出处词 ──────────────────────────────────────────────────────────────────────────────────────
+const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
+/**
+ * 在内容出处词表({@link MCP_CONTENT_ORIGINS})内吗。严判:非串与大小写不符(`"LOCAL"`)一律不在 —— 引擎的词是字面量联合、不做规范化;
+ * 替它「宽容一下」等于自造第二份值域语义,而这条轴上宽容的方向恰好是**放宽信任**(把一个写坏的声明读成 `"local"`)。
+ */
+export function isContentOriginWord(v) {
+    return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
+}
+/** 坏内容出处值的**可打印**摘要:串 JSON 化、64 字截断加 `…`;非串只说种类。 */
+export function describeBadContentOrigin(v) {
+    const raw = typeof v === "string" ? JSON.stringify(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    return raw.length > 64 ? `${raw.slice(0, 64)}…` : raw;
+}
+// ── 两个身份头 ──────────────────────────────────────────────────────────────────────────────────────
+/**
+ * 一份 http 传输上两个身份头(`principalHeader` / `assertionHeader`)的读法:字符串才收;**`principalHeader` 胜** —— 它在场(不论值形)时
+ * `assertionHeader` 不收。所以读后的形**结构上不可能同带两键**;同设(一份声明给出两个答案)由调用方在读之前对**原始**传输判(判的是写了什么,不是读后留下什么)。
+ */
+export function readMcpIdentityHeaders(transport) {
+    return {
+        ...(typeof transport.principalHeader === "string" ? { principalHeader: transport.principalHeader } : {}),
+        ...(transport.principalHeader === undefined && typeof transport.assertionHeader === "string" ? { assertionHeader: transport.assertionHeader } : {}),
+    };
+}
+const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
+/**
+ * 请求面 `transport` 的**唯一读器**:读器投影 transport 用它,发送前 / 受理时的判形读它报的 `lost` —— 同一只函数两个消费点,「读器丢了什么」与「门拒什么」不可能分岔。
+ *  · 硬坏形(`transport` 不是对象 / `kind` 出闭集 / stdio 缺 `command` / http 的 `url` 不是 http(s))⇒ `ok:false`,`path` 是读器点名的键路径;
+ *  · 软坏形(`args` 不是串数组 / `env` `headers` 含非串值 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
+ *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
+ * url 的拒句不回显值:它常规地带凭据(userinfo)。
+ */
+export function readRequestMcpTransport(t) {
+    if (!t || typeof t !== "object")
+        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
+    const tr = t;
+    const lost = [];
+    if (tr.kind === "stdio") {
+        if (typeof tr.command !== "string" || tr.command.length === 0)
+            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
+        if (tr.args !== undefined && !isStringArray(tr.args))
+            lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
+        if (tr.env !== undefined && !isStringRecord(tr.env))
+            lost.push({ path: "transport.env", reason: `must be an object of string values — got ${describeNotStringRecord(tr.env)}` });
+        return {
+            ok: true,
+            transport: {
+                kind: "stdio",
+                command: tr.command,
+                ...(isStringArray(tr.args) ? { args: tr.args } : {}),
+                ...(isStringRecord(tr.env) ? { env: tr.env } : {}),
+            },
+            lost,
+        };
+    }
+    if (tr.kind === "http") {
+        // http(s) only — never file://, never a bare host (a syntactic guard, not the URL shape judge).
+        if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
+            return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
+        const ids = readMcpIdentityHeaders(tr);
+        if (tr.headers !== undefined && !isStringRecord(tr.headers))
+            lost.push({ path: "transport.headers", reason: `must be an object of string values — got ${describeNotStringRecord(tr.headers)}` });
+        if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
+            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
+        }
+        return {
+            ok: true,
+            transport: {
+                kind: "http",
+                url: tr.url,
+                ...(isStringRecord(tr.headers) ? { headers: tr.headers } : {}),
+                ...ids,
+            },
+            lost,
+        };
+    }
+    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
+}

package/dist/migration-receipt.d.ts

@@ -6,7 +6,7 @@ import type { REMOTE_EXEC_DOCUMENT } from "./remote-exec.js";
 import type { DomainName, RetiredDomainName } from "./types.js";
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9"];
+export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
 export type OneTimeMigrationId = (typeof ONE_TIME_MIGRATION_IDS)[number];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):

package/dist/migration-receipt.js

@@ -1,6 +1,6 @@
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9"];
+export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):
  *  - `moved`            — 值搬到新位(`to`),义不变;

package/dist/node.d.ts

@@ -9,6 +9,5 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js";
-export * from "./prompts-digest.js";
 export { migrateConfigDirectory, type ConfigDirectoryDocument, type ConfigDirectoryIo, type ConfigDirectoryMigration, type ConfigDirectoryRefusal, type MigrateConfigDirectoryOptions } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js";

package/dist/node.js

@@ -9,7 +9,6 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js"; // R7 self-wake scheduler store — fs binding of the ./scheduler-store contract
-export * from "./prompts-digest.js"; // prompts 下发包的内容摘要(4.0.0 从 scheduler-store-node 搬来 —— 与调度存储无关;出口路径不变)
 // 目录形的一次性迁移(读目录 → 迁 → 整域终判 → 原子写 → 删 retired 域文件)—— 语义只此一处,命令行是它的渲染器、引擎起服调同一只。显式列名:该模块的包内私有件(出门形/拼路径)不外泄。
 export { migrateConfigDirectory } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js"; // 上面那只函数的真 I/O 绑定:node:fs + 本包唯一的原子写器(config-document 模式规则)

package/dist/one-time-migrations.d.ts

@@ -39,7 +39,7 @@ export type StoredDocuments = Readonly<Partial<Record<DomainName | RetiredDomain
 export interface StoredDocumentsMigration {
     /** 迁移后的文档集:没改的文档是**同一引用**;被移除的(retired 域)不在;新建的(例:迁出的 `governance` / `limits`)在。 */
     readonly docs: Readonly<Record<string, unknown>>;
-    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M7 → SS-M4:纯改写步在前,用新 schema 终判的 SS-M4 最后;步内按坐标)。
+    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M10 → SS-M7 → SS-M4:纯改写步在前,用新 schema 终判的 SS-M4 最后;步内按坐标)。
      *  只有 `refused` 的收据 = 什么都没改。 */
     readonly receipts: readonly MigrationReceipt[];
 }

package/dist/one-time-migrations.js

@@ -161,6 +161,19 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "the next major after the window: delete the SS-M9 step; the models.default tombstone field stays — its SS-M9 clause goes",
         afterRemoval: "the models.default tombstone field (permanent): a residual key is refused on read and write (the models domain degrades to its default)",
     },
+    {
+        id: "SS-M10",
+        oldForm: "refused",
+        introducedIn: "14.0.0",
+        releasedOn: "2026-10-17",
+        removableAfter: "2026-11-16",
+        rewrites: "prompts: an empty `bindings` array (the default every document carried before 14.0.0 — it served nothing) is removed; a non-empty " +
+            "`bindings` and a `catalog` are refused and kept verbatim — declarations compile to center overlays only through the center's card " +
+            "compiler (republish), and a catalog's digest is the engine's (rebuild it with the engine's buildPromptArtifact)",
+        removal: "the next major after the window: delete the SS-M10 step; the prompts `bindings` / `catalog` tombstone fields stay — their SS-M10 clause goes",
+        afterRemoval: "the prompts `bindings` / `catalog` tombstone fields (permanent): a residual key is refused on read and write (the prompts domain degrades " +
+            "to its default — no center layer is served)",
+    },
     {
         // 一条 wire 位的删码登记,不是数据迁移(id 在 WIRE_RETIREMENT_IDS,不在收据闭集)。
         id: "SS-W1",
@@ -205,6 +218,7 @@ export function migrateStoredDocuments(docs, opts) {
     stepAtMention(out, receipts);
     stepRetiredRoleWords(out, receipts);
     stepModelsDefault(out, receipts);
+    stepPromptsAxes(out, receipts);
     stepUrlFragments(out, receipts);
     stepWorkers6x(out, receipts);
     return { docs: out, receipts };
@@ -749,6 +763,31 @@ function stepModelsDefault(out, receipts) {
     receipts.push(moved("SS-M9", "models", ["default"], { document: "models", path: ["roles", "default"] }));
     out.models = { ...without(doc, "default"), roles: { ...roles, default: { model: name } } };
 }
+// ── SS-M10:prompts 两轴退役 ───────────────────────────────────────────────────────────────────────────
+/** 14.0.0 的 prompts 域只装中心 artifact;13.x 的两轴键是墓碑。迁移只做只认形的那一件:空的 `bindings: []`(13.x 每份文档恒物化的默认值,
+ *  从不下发任何内容)删掉。非空 `bindings` / 不是数组的 `bindings` / `catalog` 一律 refused、原样留着 —— 声明要经中心的卡编译器才编得成
+ *  overlay,catalog 的 digest 是引擎铸的,替运维机械转就是第二个编译器 / 第二个铸点。`prompts` 不是对象 ⇒ 不动(判形是读者的事)。 */
+function stepPromptsAxes(out, receipts) {
+    const doc = out.prompts;
+    if (!isPlainObject(doc))
+        return;
+    let next = doc;
+    if (has(doc, "bindings") && doc.bindings !== undefined) {
+        if (Array.isArray(doc.bindings) && doc.bindings.length === 0) {
+            next = without(next, "bindings");
+            receipts.push(receipt("SS-M10", "prompts", ["bindings"], "dropped-inert"));
+        }
+        else {
+            receipts.push(refused("SS-M10", "prompts", ["bindings"], "declaration bindings compile to center overlays only through the center's card compiler — republish the prompts from the web-admin editor " +
+                "(a local config.d copy was never read by the engine: delete the key)"));
+        }
+    }
+    if (has(doc, "catalog") && doc.catalog !== undefined) {
+        receipts.push(refused("SS-M10", "prompts", ["catalog"], "a v1 catalog cannot be converted (its digest is the engine's) — republish from the web-admin, or rebuild with the engine's buildPromptArtifact"));
+    }
+    if (next !== doc)
+        out.prompts = next;
+}
 // ── SS-M7:URL fragment ────────────────────────────────────────────────────────────────────────────────
 /** SS-M7 走查的文档 → 它的 schema(座位从 schema 派生的那一只来源):配置域按 `DOMAIN_SCHEMAS`,`remote-exec` 按 `RemoteExecSpec`;别的文档没有 URL 座位。 */
 function urlSeatSchemaOf(document) {

package/dist/safety-merge-spec.d.ts

@@ -69,8 +69,8 @@ export type MergeShape = z.infer<typeof MergeShape>;
 export declare const MinTrust: z.ZodEnum<{
     local: "local";
     session: "session";
-    global: "global";
     project: "project";
+    global: "global";
     managed: "managed";
     task: "task";
 }>;
@@ -118,8 +118,8 @@ export declare const MemberAdmission: z.ZodObject<{
     minTrust: z.ZodOptional<z.ZodEnum<{
         local: "local";
         session: "session";
-        global: "global";
         project: "project";
+        global: "global";
         managed: "managed";
         task: "task";
     }>>;
@@ -128,8 +128,8 @@ export declare const MemberAdmission: z.ZodObject<{
         minTrust: z.ZodEnum<{
             local: "local";
             session: "session";
-            global: "global";
             project: "project";
+            global: "global";
             managed: "managed";
             task: "task";
         }>;
@@ -194,8 +194,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
     minTrust: z.ZodEnum<{
         local: "local";
         session: "session";
-        global: "global";
         project: "project";
+        global: "global";
         managed: "managed";
         task: "task";
     }>;
@@ -240,8 +240,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
         minTrust: z.ZodOptional<z.ZodEnum<{
             local: "local";
             session: "session";
-            global: "global";
             project: "project";
+            global: "global";
             managed: "managed";
             task: "task";
         }>>;
@@ -250,8 +250,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
             minTrust: z.ZodEnum<{
                 local: "local";
                 session: "session";
-                global: "global";
                 project: "project";
+                global: "global";
                 managed: "managed";
                 task: "task";
             }>;