@sema-agent/settings-schema 13.0.1 → 14.1.0

package/dist/mcp-request-entry.js

@@ -0,0 +1,266 @@
+/**
+ * 请求面 MCP 条目(一条任务提交体 `mcpServers[i]`)的形判官 —— 14.0.0 起住本包:一只读法,消费方的请求腿 / 中心腿 / 壳的发送前预检都 import 这一份。
+ * 纯函数、浏览器安全(唯一的值依赖是本包自己的内容出处词表)。
+ *
+ * ## 律(一条)
+ * **一条请求面 MCP 条目的每一格「能不能用」只有一只判官。** 此前这些判官是消费方私有的:壳拿不到,只能在发送前披露「判不准、交给服务端」,
+ * 或者自己抄一份 —— 两份判据就是将来漂开的那一份。现在判官在契约包,服务端与壳读同一份,同一条条目在两处同受理 / 同拒、同一个键路径、同一句原因。
+ *
+ * ## 语义是搬来的,不是重写的
+ * 判据与原因句逐字等于消费方请求腿的那一份(钉:`test/mcp-request-entry-14.0.0.test.ts` 逐例搬了消费方既有钉的夹具与期望)。
+ * 本模块只答「这一格的形」;拒绝的整句(条目下标、条目名的回显清洗、收尾句)与「拒还是降级」的后果仍是消费方按自己的腿定的 —— 判据一份,后果按腿分。
+ * 与最初搬来时相比有三处收严,都是收到与消费方请求腿同严、不是新语义,消费方改 import 这一份之后不再各留一份旧判据:申报名判官另判**首尾空白**;
+ * `env` / `headers` 只收**纯数据**的「名 → 串」记录(Map / 类实例 / 自有 `__proto__` 成员不收,交出的是副本);两只回显描述器用消费方的回显口径(剥控制与双向字符、截 64 字、引号形)。
+ *
+ * ## 依赖的引擎事实(镜像 + 漂移门)
+ *  · 申报名的线长界 {@link TOOL_WIRE_NAME_MAX_CHARS} = 引擎同名常量(值级对拍:上游漂移门 ⑧);
+ *  · 请求面传输形 {@link RequestMcpTransport} = 引擎 MCP 条目的传输形,http 形多一个本包承载的 `assertionHeader`(编译期双向对拍:门 ⑧);
+ *  · 内容出处词表 = {@link MCP_CONTENT_ORIGINS}(已有的镜像,门 ⑥);
+ *  · 回显清洗类的双向半场 = 引擎 `BIDI_CONTROL_CHARS`(镜像,逐码点全扫对拍:门 ⑨;本包运行期不依赖引擎);
+ *  · url 前缀守卫 = `./url-shape` 的 `startsWithHttpScheme`(本包判 URL 的正则只在那一个模块)。
+ *
+ * ## 与配置面的关系(如实)
+ * 配置面的 MCP 条目(`McpServerSpec`,部署声明:凭据只许 env-NAME 引用)与请求面(提交体:可带字面凭据 `env` / `headers`)是两份契约,本模块只管后者。
+ * 两份契约对「名」与「url」今天给的判据不同(配置面:名按字符集、url 按 `NON_SECRET_URL`;请求面:名按长度界、url 按 http(s) 前缀),本版刻意不动
+ * (语义逐字搬),是一项已知待收的分歧。
+ */
+import { MCP_CONTENT_ORIGINS } from "./types.js";
+import { startsWithHttpScheme } from "./url-shape.js";
+// ── 值的种类描述(拒句只说「你写的是什么形」,不回显值:值可能带凭据、可能任意长)──────────────────────────────────────
+/** 值的**种类**(不回显值本身)。 */
+export function describeValueShape(v) {
+    if (v === undefined)
+        return "nothing (the key is absent)";
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "an array";
+    if (typeof v === "string")
+        return v.length === 0 ? "an empty string" : `a string of ${v.length} characters`;
+    if (typeof v === "object")
+        return "an object";
+    return `a ${typeof v}`;
+}
+/** 「不是字符串数组」的种类:数组里混了非串元素说那一句,否则回落到 {@link describeValueShape}。 */
+export function describeNotStringArray(v) {
+    return Array.isArray(v) ? "an array with a non-string element" : describeValueShape(v);
+}
+/** 「不是字符串值的对象」的种类:对象里混了非串值说那一句,否则回落到 {@link describeValueShape}。 */
+export function describeNotStringRecord(v) {
+    return isRecord(v) ? "an object with a non-string value" : describeValueShape(v);
+}
+/** 字符串数组(空数组合法)。 */
+export function isStringArray(v) {
+    return Array.isArray(v) && v.every((a) => typeof a === "string");
+}
+/**
+ * 纯数据的「名 → 串」记录(空对象合法;数组、`Map`、类实例、自有 `__proto__` 成员、有非串成员的对象都不是)。与传输读器读 `env` / `headers` 是**同一个**定义
+ * ({@link readPlainStringRecord}):包内没有第二把更宽的尺。
+ */
+export function isStringRecord(v) {
+    const read = readPlainStringRecord(v);
+    return read.ok && !read.reservedMember;
+}
+function isRecord(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+// ── 调用方写的串的回显口径 ──────────────────────────────────────────────────────────────────────────
+/**
+ * 回显清洗类:C0 控制符 + DEL + 双向控制字符(Unicode `Bidi_Control=Yes` 全集 12 个码点 —— 一个 RLO 能把一行字读反,一个换行能伪造一行日志)。清洗面刻意不含 C1 与
+ * U+2028 / U+2029:加宽是行为变更,要各自的判据。双向这一半的属主是引擎(`BIDI_CONTROL_CHARS`),这里是镜像,由上游漂移门逐码点全扫对拍。
+ */
+const CONTROL_AND_BIDI_STRIP_RE = /[\u0000-\u001f\u007f\u061c\u200e\u200f\u202a-\u202e\u2066-\u2069]/g;
+/** 回显的字符上限(剥完控制与双向字符之后数)。 */
+const CALLER_TEXT_ECHO_MAX_CHARS = 64;
+/** 调用方写的串的回显形(不带引号):剥控制与双向字符 → 超 {@link CALLER_TEXT_ECHO_MAX_CHARS} 字截断加 `…`。拒句 / 告警元数据里的有界回显,串可能任意长、可能带换行。 */
+function echoCallerText(text) {
+    const clean = text.replace(CONTROL_AND_BIDI_STRIP_RE, "");
+    return clean.length > CALLER_TEXT_ECHO_MAX_CHARS ? `${clean.slice(0, CALLER_TEXT_ECHO_MAX_CHARS)}…` : clean;
+}
+/** 句子里点名一个值的写法:{@link echoCallerText} 外加一对双引号;内部的引号与反斜杠逐字(不转义)。 */
+function quotedCallerText(text) {
+    return `"${echoCallerText(text)}"`;
+}
+// ── 申报名的线长界 ──────────────────────────────────────────────────────────────────────────────────
+/** 引擎 `TOOL_WIRE_NAME_MAX_CHARS` 的镜像:一台 MCP server(或 A2A 对端)的申报名会成为线上工具名的命名空间段,引擎对超界名是**拒**(不截断)。 */
+export const TOOL_WIRE_NAME_MAX_CHARS = 128;
+/**
+ * 首尾带空白吗 —— 「空白」就是 `String.prototype.trim` 剥的那一组(ECMAScript 的 WhiteSpace + LineTerminator:空格 / 制表 / 换行 / NBSP / BOM / 全角空格 / 行段分隔符等)。
+ * {@link isUsableWireName} 与 {@link describeBadWireName} 共读这一个定义,判与说不会各按各的口径。
+ */
+const hasEdgeWhitespace = (v) => v.trim() !== v;
+/**
+ * 这个申报名能用吗。严判:非串、空串、超 {@link TOOL_WIRE_NAME_MAX_CHARS}、**首尾带空白**一律不可用。不截断、不 trim、不规范化 —— 截短或剥掉一个名字就是**换一个身份**,
+ * 而被换掉身份的那台 server 上挂的 allowTools / toolFaces 收窄声明会一起对不上号。首尾空白 = 坏名(它不是另一个名字:名字是 `mcp__<server>__<tool>` 的身份片,
+ * 带着空白的一端无从与不带的那个对上号);内部空白(`a b`)照旧是合法名,本判官不扩判。
+ */
+export function isUsableWireName(v) {
+    return typeof v === "string" && v.length > 0 && v.length <= TOOL_WIRE_NAME_MAX_CHARS && !hasEdgeWhitespace(v);
+}
+/**
+ * 坏名的**可打印**摘要(进拒句 / 告警元数据):种类、`empty`,或引号形的回显加原因 —— 绝不把任意长度的申报串原样回显。回显口径见 {@link quotedCallerText}
+ * (剥控制与双向字符、截 64 字)。串的原因是:超界 ⇒ `N chars > 128`(N 是送来的原长度,不是剥完的);首尾带空白 ⇒ `leading or trailing whitespace`
+ * (制表 / 换行这类控制空白在回显里被剥掉,所以看得出是空白靠这个种类词,不靠引号里的样子);两件事并存 ⇒ 一句说全(`N chars > 128, leading or trailing whitespace`)。
+ */
+export function describeBadWireName(v) {
+    if (typeof v !== "string")
+        return v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+    if (v.length === 0)
+        return "empty";
+    const head = quotedCallerText(v);
+    const tooLong = `${v.length} chars > ${TOOL_WIRE_NAME_MAX_CHARS}`;
+    if (!hasEdgeWhitespace(v))
+        return `${head} (${tooLong})`;
+    return `${head} (${v.length > TOOL_WIRE_NAME_MAX_CHARS ? `${tooLong}, ` : ""}leading or trailing whitespace)`;
+}
+// ── 内容出处词 ──────────────────────────────────────────────────────────────────────────────────────
+const CONTENT_ORIGIN_WORDS = new Set(MCP_CONTENT_ORIGINS);
+/**
+ * 在内容出处词表({@link MCP_CONTENT_ORIGINS})内吗。严判:非串与大小写不符(`"LOCAL"`)一律不在 —— 引擎的词是字面量联合、不做规范化;
+ * 替它「宽容一下」等于自造第二份值域语义,而这条轴上宽容的方向恰好是**放宽信任**(把一个写坏的声明读成 `"local"`)。
+ */
+export function isContentOriginWord(v) {
+    return typeof v === "string" && CONTENT_ORIGIN_WORDS.has(v);
+}
+/** 坏内容出处值的**可打印**摘要:串 ⇒ 引号形的回显({@link quotedCallerText}:剥控制与双向字符、截 64 字);非串只说种类。 */
+export function describeBadContentOrigin(v) {
+    return typeof v === "string" ? quotedCallerText(v) : v === null ? "null" : Array.isArray(v) ? "array" : typeof v;
+}
+// ── 两个身份头 ──────────────────────────────────────────────────────────────────────────────────────
+/**
+ * 一份 http 传输上两个身份头(`principalHeader` / `assertionHeader`)的读法:字符串才收;**`principalHeader` 胜** —— 它在场(不论值形)时
+ * `assertionHeader` 不收。所以读后的形**结构上不可能同带两键**;同设(一份声明给出两个答案)由调用方在读之前对**原始**传输判(判的是写了什么,不是读后留下什么)。
+ */
+export function readMcpIdentityHeaders(transport) {
+    return {
+        ...(typeof transport.principalHeader === "string" ? { principalHeader: transport.principalHeader } : {}),
+        ...(transport.principalHeader === undefined && typeof transport.assertionHeader === "string" ? { assertionHeader: transport.assertionHeader } : {}),
+    };
+}
+const transportBad = (path, reason) => ({ ok: false, issue: { path, reason } });
+/**
+ * 请求面 `transport` 的**唯一读器**:读器投影 transport 用它,发送前 / 受理时的判形读它报的 `lost` —— 同一只函数两个消费点,「读器丢了什么」与「门拒什么」不可能分岔。
+ *  · 硬坏形(`transport` 不是对象 / `kind` 出闭集 / stdio 缺 `command` / http 的 `url` 不是 http(s))⇒ `ok:false`,`path` 是读器点名的键路径;
+ *  · 软坏形(`args` 不是串数组 / `env` `headers` 不是纯数据的串记录 / `principalHeader` 非串)⇒ 读器**丢这个键**(重放存量提交体时的升级前读法),并把它记进 `lost`
+ *    (受理新提交的门据它响亮拒)。`assertionHeader` 不在 `lost` 里:两个身份头的键组合与 `assertionHeader` 的值形由调用方在读之前对原始传输判。
+ *  · `env` / `headers` 只收**纯数据**的记录({@link readPlainStringRecord}):原型必须是 `Object.prototype` 或 `null`(`Map`、`Set`、类实例整张不收),每个自有成员的值都是串;
+ *    交出的是**副本**(不是调用方的对象,改原对象不影响读后的形)。名叫 `__proto__` 的成员(JSON 文本铸得出这个自有键,对象字面量写不出)不进副本、单独记进 `lost`。
+ *    坏形的 `lost` 条目带机读位(见 {@link McpEntryKeyIssue})。
+ * url 的拒句不回显值:它常规地带凭据(userinfo)。
+ */
+export function readRequestMcpTransport(t) {
+    if (!t || typeof t !== "object")
+        return transportBad("transport", `must be an object with a "kind" of "stdio" or "http" — got ${describeValueShape(t)}`);
+    const tr = t;
+    const lost = [];
+    if (tr.kind === "stdio") {
+        if (typeof tr.command !== "string" || tr.command.length === 0)
+            return transportBad("transport.command", `must be a non-empty string (the command to run) — got ${describeValueShape(tr.command)}`);
+        if (tr.args !== undefined && !isStringArray(tr.args))
+            lost.push({ path: "transport.args", reason: `must be an array of strings — got ${describeNotStringArray(tr.args)}` });
+        const env = readTransportRecord("transport.env", tr.env, lost);
+        return {
+            ok: true,
+            transport: {
+                kind: "stdio",
+                command: tr.command,
+                ...(isStringArray(tr.args) ? { args: tr.args } : {}),
+                ...(env !== undefined ? { env } : {}),
+            },
+            lost,
+        };
+    }
+    if (tr.kind === "http") {
+        // http(s) only — never file://, never a bare host (a syntactic guard, not the URL shape judge).
+        if (typeof tr.url !== "string" || !startsWithHttpScheme(tr.url))
+            return transportBad("transport.url", "must be an absolute http(s) URL (put credentials in transport.headers, never in the URL)");
+        const ids = readMcpIdentityHeaders(tr);
+        const headers = readTransportRecord("transport.headers", tr.headers, lost);
+        if (tr.principalHeader !== undefined && ids.principalHeader === undefined) {
+            lost.push({ path: "transport.principalHeader", reason: `must be a string (the HTTP header NAME the end-user principal is injected into) — got ${describeValueShape(tr.principalHeader)}` });
+        }
+        return {
+            ok: true,
+            transport: {
+                kind: "http",
+                url: tr.url,
+                ...(headers !== undefined ? { headers } : {}),
+                ...ids,
+            },
+            lost,
+        };
+    }
+    return transportBad("transport.kind", `must be "stdio" or "http" — got ${describeValueShape(tr.kind)}`);
+}
+// ── 「名 → 串」记录的读法(`env` / `headers`)────────────────────────────────────────────────────────
+/** 引擎的声明收据不收的成员名(core `mcp-server-spec`:按赋值拷贝它会变成原型):JSON 文本铸得出这个**自有**键,对象字面量写不出。 */
+const RESERVED_MEMBER_NAME = "__proto__";
+const RESERVED_MEMBER_FAULT = `no member of a declaration may be named "${RESERVED_MEMBER_NAME}"`;
+/**
+ * 读一份「名 → 串」记录。记录交不交:是对象(不是数组 / `null`),原型是 `Object.prototype` 或 `null`(纯数据:`Map`、`Set`、类实例、建在原型上的记录都不是),
+ * 且每个成员的值都是串。成员 = `Object.getOwnPropertyNames` 的每一个名字(不可枚举的也算 —— 引擎的收据按全部自有属性名读),值按属性描述读:数据属性取值,访问器调一次(访问器或描述 trap 抛了同判为坏)。
+ * 读原型与成员名时代理 trap 抛了 ⇒ 整张不交(读器对调用方递来的任何对象都不抛;`JSON` 存体里不会有代理,这条只落在直接调读器的嵌入方身上)。
+ * 交出去的是副本(原型 `Object.prototype`、成员全可枚举),调用方的对象不被交出去、也不被改;名叫 `__proto__` 的成员不进副本,`reservedMember` 记下它。
+ * 名叫 `__proto__` 而值也坏的成员,句子一次说全两件事(名坏在前、值坏并列):调用方照值改完再撞第二条是两步才改对。
+ */
+function readPlainStringRecord(v) {
+    if (v === null || typeof v !== "object" || Array.isArray(v))
+        return { ok: false, fault: "not_plain_record", detail: v === null ? "got null" : Array.isArray(v) ? "got an array" : `got a ${typeof v}` };
+    let proto;
+    let names;
+    try {
+        proto = Object.getPrototypeOf(v);
+        names = Object.getOwnPropertyNames(v);
+    }
+    catch {
+        // 代理的 trap 抛了:读不出原型与成员名的对象不是纯数据。读器不抛出去 —— 重放存量提交体的腿被一次抛错砖死比整键不交糟,而「整键不交」是响亮的(进 `lost`)。
+        return { ok: false, fault: "not_plain_record", detail: "got an object that could not be inspected (a proxy trap threw)" };
+    }
+    if (proto !== Object.prototype && proto !== null) {
+        return { ok: false, fault: "not_plain_record", detail: "got an object that is not plain data (a class instance, a Map, process.env, or a record built on a prototype; copy it into a plain object)" };
+    }
+    const record = {};
+    let reservedMember = false;
+    for (const name of names) {
+        let value;
+        let unreadable = false;
+        try {
+            const d = Object.getOwnPropertyDescriptor(v, name);
+            value = d === undefined ? undefined : Object.hasOwn(d, "value") ? d.value : d.get === undefined ? undefined : Reflect.apply(d.get, v, []);
+        }
+        catch {
+            unreadable = true;
+        }
+        if (unreadable || typeof value !== "string") {
+            const valueFault = unreadable ? "could not be read (its getter threw)" : `must be a string — got ${describeValueShape(value)}`;
+            const reserved = name === RESERVED_MEMBER_NAME;
+            return {
+                ok: false,
+                fault: reserved ? "member_name_reserved" : "member_not_string",
+                member: echoCallerText(name),
+                detail: `its member "${echoCallerText(name)}" ${reserved ? `is not allowed (${RESERVED_MEMBER_FAULT}) and its value ${valueFault}` : valueFault}`,
+            };
+        }
+        if (name === RESERVED_MEMBER_NAME)
+            reservedMember = true;
+        else
+            record[name] = value;
+    }
+    return { ok: true, record, reservedMember };
+}
+/**
+ * `transport.env` / `transport.headers` 的读法(两键同一只):缺席 ⇒ 缺席;记录不交 ⇒ `lost` 一处点名**这个键**(不交的是整张记录;坏在某个成员时句子与 `member` 点名它);
+ * 交 ⇒ 纯数据副本,名叫 `__proto__` 的成员在 `lost` 里单记一处、路径 `<键>.__proto__`。
+ */
+function readTransportRecord(path, raw, lost) {
+    if (raw === undefined)
+        return undefined;
+    const read = readPlainStringRecord(raw);
+    if (!read.ok) {
+        lost.push({ path, reason: `must be a plain object of string values — ${read.detail}`, ...(read.member !== undefined ? { member: read.member } : {}), fault: read.fault });
+        return undefined;
+    }
+    if (read.reservedMember)
+        lost.push({ path: `${path}.${RESERVED_MEMBER_NAME}`, reason: RESERVED_MEMBER_FAULT, member: RESERVED_MEMBER_NAME, fault: "member_name_reserved" });
+    return read.record;
+}

package/dist/migration-receipt.d.ts

@@ -6,7 +6,7 @@ import type { REMOTE_EXEC_DOCUMENT } from "./remote-exec.js";
 import type { DomainName, RetiredDomainName } from "./types.js";
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9"];
+export declare const ONE_TIME_MIGRATION_IDS: readonly ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
 export type OneTimeMigrationId = (typeof ONE_TIME_MIGRATION_IDS)[number];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):

package/dist/migration-receipt.js

@@ -1,6 +1,6 @@
 /** 本版登记的一次性**数据**迁移 id(闭集;每个 id 在 `ONE_TIME_MIGRATIONS` 登记表里恰一行)。收据只许这些 id —— 同表登记的 wire 删码位
  *  (`WIRE_RETIREMENT_IDS`,`./one-time-migrations`)不改任何存储形,铸不出收据,不在本集。 */
-export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9"];
+export const ONE_TIME_MIGRATION_IDS = ["SS-M1", "SS-M2", "SS-M3", "SS-M4", "SS-M5", "SS-M6", "SS-M7", "SS-M8", "SS-M9", "SS-M10"];
 /**
  * 一条收据说迁移**对一个坐标做了什么**(闭集,每词一义):
  *  - `moved`            — 值搬到新位(`to`),义不变;

package/dist/node.d.ts

@@ -9,6 +9,5 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js";
-export * from "./prompts-digest.js";
 export { migrateConfigDirectory, type ConfigDirectoryDocument, type ConfigDirectoryIo, type ConfigDirectoryMigration, type ConfigDirectoryRefusal, type MigrateConfigDirectoryOptions } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js";

package/dist/node.js

@@ -9,7 +9,6 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js"; // R7 self-wake scheduler store — fs binding of the ./scheduler-store contract
-export * from "./prompts-digest.js"; // prompts 下发包的内容摘要(4.0.0 从 scheduler-store-node 搬来 —— 与调度存储无关;出口路径不变)
 // 目录形的一次性迁移(读目录 → 迁 → 整域终判 → 原子写 → 删 retired 域文件)—— 语义只此一处,命令行是它的渲染器、引擎起服调同一只。显式列名:该模块的包内私有件(出门形/拼路径)不外泄。
 export { migrateConfigDirectory } from "./config-dir-migration.js";
 export { nodeConfigDirectoryIo } from "./config-dir-io.js"; // 上面那只函数的真 I/O 绑定:node:fs + 本包唯一的原子写器(config-document 模式规则)

package/dist/one-time-migrations.d.ts

@@ -39,7 +39,7 @@ export type StoredDocuments = Readonly<Partial<Record<DomainName | RetiredDomain
 export interface StoredDocumentsMigration {
     /** 迁移后的文档集:没改的文档是**同一引用**;被移除的(retired 域)不在;新建的(例:迁出的 `governance` / `limits`)在。 */
     readonly docs: Readonly<Record<string, unknown>>;
-    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M7 → SS-M4:纯改写步在前,用新 schema 终判的 SS-M4 最后;步内按坐标)。
+    /** 逐条收据(步序 SS-M1 → SS-M2 → SS-M5 → SS-M6 → SS-M8 → SS-M9 → SS-M10 → SS-M7 → SS-M4:纯改写步在前,用新 schema 终判的 SS-M4 最后;步内按坐标)。
      *  只有 `refused` 的收据 = 什么都没改。 */
     readonly receipts: readonly MigrationReceipt[];
 }

package/dist/one-time-migrations.js

@@ -161,6 +161,19 @@ export const ONE_TIME_MIGRATIONS = [
         removal: "the next major after the window: delete the SS-M9 step; the models.default tombstone field stays — its SS-M9 clause goes",
         afterRemoval: "the models.default tombstone field (permanent): a residual key is refused on read and write (the models domain degrades to its default)",
     },
+    {
+        id: "SS-M10",
+        oldForm: "refused",
+        introducedIn: "14.0.0",
+        releasedOn: "2026-10-17",
+        removableAfter: "2026-11-16",
+        rewrites: "prompts: an empty `bindings` array (the default every document carried before 14.0.0 — it served nothing) is removed; a non-empty " +
+            "`bindings` and a `catalog` are refused and kept verbatim — declarations compile to center overlays only through the center's card " +
+            "compiler (republish), and a catalog's digest is the engine's (rebuild it with the engine's buildPromptArtifact)",
+        removal: "the next major after the window: delete the SS-M10 step; the prompts `bindings` / `catalog` tombstone fields stay — their SS-M10 clause goes",
+        afterRemoval: "the prompts `bindings` / `catalog` tombstone fields (permanent): a residual key is refused on read and write (the prompts domain degrades " +
+            "to its default — no center layer is served)",
+    },
     {
         // 一条 wire 位的删码登记,不是数据迁移(id 在 WIRE_RETIREMENT_IDS,不在收据闭集)。
         id: "SS-W1",
@@ -205,6 +218,7 @@ export function migrateStoredDocuments(docs, opts) {
     stepAtMention(out, receipts);
     stepRetiredRoleWords(out, receipts);
     stepModelsDefault(out, receipts);
+    stepPromptsAxes(out, receipts);
     stepUrlFragments(out, receipts);
     stepWorkers6x(out, receipts);
     return { docs: out, receipts };
@@ -749,6 +763,31 @@ function stepModelsDefault(out, receipts) {
     receipts.push(moved("SS-M9", "models", ["default"], { document: "models", path: ["roles", "default"] }));
     out.models = { ...without(doc, "default"), roles: { ...roles, default: { model: name } } };
 }
+// ── SS-M10:prompts 两轴退役 ───────────────────────────────────────────────────────────────────────────
+/** 14.0.0 的 prompts 域只装中心 artifact;13.x 的两轴键是墓碑。迁移只做只认形的那一件:空的 `bindings: []`(13.x 每份文档恒物化的默认值,
+ *  从不下发任何内容)删掉。非空 `bindings` / 不是数组的 `bindings` / `catalog` 一律 refused、原样留着 —— 声明要经中心的卡编译器才编得成
+ *  overlay,catalog 的 digest 是引擎铸的,替运维机械转就是第二个编译器 / 第二个铸点。`prompts` 不是对象 ⇒ 不动(判形是读者的事)。 */
+function stepPromptsAxes(out, receipts) {
+    const doc = out.prompts;
+    if (!isPlainObject(doc))
+        return;
+    let next = doc;
+    if (has(doc, "bindings") && doc.bindings !== undefined) {
+        if (Array.isArray(doc.bindings) && doc.bindings.length === 0) {
+            next = without(next, "bindings");
+            receipts.push(receipt("SS-M10", "prompts", ["bindings"], "dropped-inert"));
+        }
+        else {
+            receipts.push(refused("SS-M10", "prompts", ["bindings"], "declaration bindings compile to center overlays only through the center's card compiler — republish the prompts from the web-admin editor " +
+                "(a local config.d copy was never read by the engine: delete the key)"));
+        }
+    }
+    if (has(doc, "catalog") && doc.catalog !== undefined) {
+        receipts.push(refused("SS-M10", "prompts", ["catalog"], "a v1 catalog cannot be converted (its digest is the engine's) — republish from the web-admin, or rebuild with the engine's buildPromptArtifact"));
+    }
+    if (next !== doc)
+        out.prompts = next;
+}
 // ── SS-M7:URL fragment ────────────────────────────────────────────────────────────────────────────────
 /** SS-M7 走查的文档 → 它的 schema(座位从 schema 派生的那一只来源):配置域按 `DOMAIN_SCHEMAS`,`remote-exec` 按 `RemoteExecSpec`;别的文档没有 URL 座位。 */
 function urlSeatSchemaOf(document) {

package/dist/safety-merge-spec.d.ts

@@ -69,8 +69,8 @@ export type MergeShape = z.infer<typeof MergeShape>;
 export declare const MinTrust: z.ZodEnum<{
     local: "local";
     session: "session";
-    global: "global";
     project: "project";
+    global: "global";
     managed: "managed";
     task: "task";
 }>;
@@ -118,8 +118,8 @@ export declare const MemberAdmission: z.ZodObject<{
     minTrust: z.ZodOptional<z.ZodEnum<{
         local: "local";
         session: "session";
-        global: "global";
         project: "project";
+        global: "global";
         managed: "managed";
         task: "task";
     }>>;
@@ -128,8 +128,8 @@ export declare const MemberAdmission: z.ZodObject<{
         minTrust: z.ZodEnum<{
             local: "local";
             session: "session";
-            global: "global";
             project: "project";
+            global: "global";
             managed: "managed";
             task: "task";
         }>;
@@ -194,8 +194,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
     minTrust: z.ZodEnum<{
         local: "local";
         session: "session";
-        global: "global";
         project: "project";
+        global: "global";
         managed: "managed";
         task: "task";
     }>;
@@ -240,8 +240,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
         minTrust: z.ZodOptional<z.ZodEnum<{
             local: "local";
             session: "session";
-            global: "global";
             project: "project";
+            global: "global";
             managed: "managed";
             task: "task";
         }>>;
@@ -250,8 +250,8 @@ export declare const MergeCategorySpec: z.ZodObject<{
             minTrust: z.ZodEnum<{
                 local: "local";
                 session: "session";
-                global: "global";
                 project: "project";
+                global: "global";
                 managed: "managed";
                 task: "task";
             }>;