@sema-agent/settings-schema 3.0.0 → 4.0.0

package/dist/conformance/entry-origin.js

@@ -0,0 +1,86 @@
+/**
+ * 来源律的**判别式**(§2d-2 同义反复护栏)——「这条腿的入口,其实就是契约包自己吗?」
+ *
+ * 成案:消费方登记的腿必须是**自己生产代码**的入口。把契约包的函数注册成腿,门证明的只是「包等于包」:
+ * 一次纯粹的同义反复,而且看起来全绿。判据落在**入口坐标**上,不在「你调了谁」上 —— 后者机器证不了
+ * (`docs/CONFORMANCE.md` 逐字写明了这条诚实边界)。
+ *
+ * **一只判别式,两处执法**(单铸,不许两处各写一遍「哪儿算契约包自己」)。两形是个**闭集**
+ * ({@link CONTRACT_OWNED_FORMS}),而**哪一形归哪一处**由一句话定:**工厂只拒在任何模式下都错的那一形**,
+ * 另一形归**看得见 `mode`** 的那道门。
+ *   · `own-build-output` —— 入口落在**正在跑这段码的这份**契约包自己的构建产物 `<包根>/dist/` 下。
+ *     这是「拿自己比自己」,`release` 与 `historical` 两个模式下都是同义反复 ⇒ {@link createContractAdapter}
+ *     造适配器时**当场拒**(运行期拒,不是告警)。
+ *   · `another-installed-copy` —— 入口落在**另一份**装好的契约包(`node_modules/<包名>/`)里。它在 `release`
+ *     下是同义反复,在 `historical` 下却**正当**(那个模式就是拿旧版包比行为,而旧版包常常正好装在
+ *     `node_modules/<包名>/` 这个布局下)⇒ 工厂**不拒**(工厂看不见 `mode`,不越权),由 `runConformance`
+ *     的 release 门记成违例。
+ * 手写的适配器字面量(接入文档的默认配方)根本走不到工厂 ⇒ 那道门**两形都判**。
+ *
+ * 为什么 `own-build-output` 咬 `dist/` 而不是整个包根:契约仓**自证**时,腿的入口是本仓的 `src/*.ts`
+ * (那对契约仓来说就是它的生产入口,是这只工厂存在的两个理由之一),而 `src/` 不随包发 —— 消费方手上
+ * 只有 `dist/`。于是同一条判据既拦住了消费方的同义反复,又放行了契约仓自证;historical 模式拿
+ * **另一份**旧版包当入口,那份不是「自己」,照样放行。
+ */
+import { readFileSync, realpathSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+import { PACKAGE_ROOT } from "./corpus.js";
+/** 契约包在盘上的两种样子(闭集):**我自己**,与**另一份**。 */
+export const CONTRACT_OWNED_FORMS = ["own-build-output", "another-installed-copy"];
+let cachedName;
+/** 本包的名字 —— 从**自己**的 package.json 读(不手抄;`kitIdentity()` 读的是同一个文件)。读不出来就抛:
+ *  一只判不了「哪儿是契约包自己」的判别式,静默放行等于把来源律整条关掉。 */
+function contractPackageName() {
+    if (cachedName === undefined) {
+        const pkg = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8"));
+        if (typeof pkg.name !== "string" || pkg.name.length === 0) {
+            throw new Error("conformance: 契约包自己的 package.json 没有 `name` —— 来源律判别式判不了「哪儿是契约包自己」");
+        }
+        cachedName = pkg.name;
+    }
+    return cachedName;
+}
+/** 一条路径的**归一形**(判据咬的是**文件**,不是字符串):点段 / 双斜杠先由 `resolve` 抹平,再尽力解一次
+ *  软链(`npm link` 出来的树就是软链)。文件不在盘上 ⇒ 解不了,那就只用字面归一形 —— 这不是放行:
+ *  「入口不存在」本来就由 release 门单独点名,这里少一个候选形不会让任何一形逃掉。 */
+function canonicalForms(p) {
+    const lexical = resolve(p);
+    try {
+        const real = realpathSync(lexical);
+        return real === lexical ? [lexical] : [lexical, real];
+    }
+    catch {
+        return [lexical];
+    }
+}
+/**
+ * 这个入口坐标落在契约包自己身上吗?命中回形与坐标,没命中回 `undefined`。
+ *
+ * ⚠️ **两形的判定顺序是承重的**:消费方装好的那份 kit **自己就住在 `node_modules/<包名>/` 里**,它的
+ * `dist/` 同时命中两形。「是不是**我自己**」必须先判 —— 否则最该拒的那一形(消费方拿自己比自己)会被
+ * 判成「另一份」而被工厂放行。先 `dist` 后 `node_modules`,两形于是不相交:`another-installed-copy`
+ * 字面意思就是**另一份**装好的契约包(historical 模式的正当目标)。
+ *
+ * ⚠️ **判之前先归一**(两侧都归):`<包根>/./dist/x.js` 与 `<包根>//dist/x.js` 与一条指向 `<包根>/dist`
+ * 的软链,指的都是同一个文件。release 门会先 `realpath` 再判,但 `historical` 模式根本不跑那道门 ——
+ * 工厂这一侧是那条路上唯一的闸,所以归一得在**判别式里**做,两处执法才咬同一个判据。
+ */
+export function contractOwnedEntry(modulePath) {
+    const candidates = canonicalForms(modulePath);
+    const ownDists = canonicalForms(join(PACKAGE_ROOT, "dist")).map((d) => d + sep);
+    for (const anchor of ownDists) {
+        if (candidates.some((c) => c.startsWith(anchor)))
+            return { form: "own-build-output", anchor };
+    }
+    const installed = `${sep}node_modules${sep}${contractPackageName().split("/").join(sep)}${sep}`;
+    if (candidates.some((c) => c.includes(installed)))
+        return { form: "another-installed-copy", anchor: installed };
+    return undefined;
+}
+/** 拒绝句/违例句共用的那一段:你落在哪儿、合法的是哪儿。两处文案同源,消费方读到的是同一句话。 */
+export function contractOwnedEntryWhy(leg, modulePath, owned) {
+    return (`leg \`${leg}\` entry.module sits inside the contract package (${modulePath}) —— 命中 ${owned.form} @ ${owned.anchor};` +
+        `那条腿证明的是「包等于包」。合法的入口 = **你自己生产代码**里那个真入口文件的绝对路径` +
+        `(消费方:对着你自己的装配层求 \`fileURLToPath(import.meta.url)\`;契约仓自证:本仓 \`src/*.ts\`;` +
+        `historical 模式:另一份旧版包的 dist)。见 docs/CONFORMANCE.md 的来源律一节。`);
+}

package/dist/conformance/run.js

@@ -18,12 +18,10 @@ import { canonicalize, deepEqual, diffJson, stableKey } from "./canonical.js";
 import { diffWarningMultiset, findSecretLeaks, projectWarning } from "./warnings.js";
 import { deriveLocalExpectation, deriveLocalInput, deriveWireExpectation, deriveWireInput, toManifestDoc } from "./derive.js";
 import { kitIdentity, loadCorpus } from "./corpus.js";
+import { contractOwnedEntry, contractOwnedEntryWhy } from "./entry-origin.js";
 import { LEG_NAMES, } from "./types.js";
 /** 一个**模块**文件的样子 —— 来源律用它挡住「随便找个存在的文件当入口」(`package.json` 也是文件)。 */
 const MODULE_EXTENSIONS = [".ts", ".mts", ".cts", ".tsx", ".js", ".mjs", ".cjs", ".jsx"];
-/** 契约包装在 `node_modules` 里的样子 —— 来源律用它判「这条腿其实就是契约包自己」。按**包名**拼,
- *  不手抄(包名从 kit 自己的 package.json 来)。 */
-const contractInNodeModules = (packageName) => `${sep}node_modules${sep}${packageName.split("/").join(sep)}${sep}`;
 /**
  * 把一份 `config.d/` 快照落成真目录 —— **kit 单铸**,消费方零复述(每个消费方各写一遍落盘逻辑,
  * mtime 怎么设、目录怎么建就会各不相同,而 `updatedAt` 正是按 mtime 算的)。
@@ -330,9 +328,11 @@ async function releaseViolations(adapter, opts, corpus, kit) {
         catch {
             v.push(`leg \`${name}\` entry.module does not exist: ${mod}`);
         }
-        const insideContract = contractInNodeModules(kit.name);
-        if (mod.includes(insideContract) || real.includes(insideContract))
-            v.push(`leg \`${name}\` entry.module sits inside the contract package (${mod}) — 那条腿证明的是「包等于包」`);
+        // 来源律判别式 = `./entry-origin.js` 那一只(工厂当场拒的同一只)。点段 / 双斜杠 / 软链的归一在
+        // 判别式**里面**做(两处执法咬同一个判据),所以这里不再自己解一遍。
+        const owned = contractOwnedEntry(mod);
+        if (owned !== undefined)
+            v.push(contractOwnedEntryWhy(name, mod, owned));
         if (leg.entry.export.trim().length === 0)
             v.push(`leg \`${name}\` entry.export is empty`);
     }

package/dist/conformance/types.d.ts

@@ -81,7 +81,11 @@ export interface ConformanceProvenance {
  * 同义反复,而且看起来全绿。`module` 必须是消费方**生产代码**里那个真入口文件的绝对路径,`export`
  * 是它导出的那个名字。
  *
- * **门的诚实边界**:kit 能核的是「这个文件真的存在」「它不在契约包的 node_modules 目录之下」。它**不能**
+ * 4.0.0 起这条律**有牙且两处执法**:判别式单铸在 `./entry-origin.js`(两形闭集 —— **我自己**的构建产物 /
+ * **另一份**装好的包)。`createContractAdapter` 看不见 `mode`,只拒在任何模式下都错的那一形(拿自己比自己),
+ * **当场拒**;另一形在 `historical` 下正当,连同手写的适配器字面量(走不到工厂)一起由 `release` 门记成违例。
+ *
+ * **门的诚实边界**:kit 能核的是「这个文件真的存在」「它不落在契约包自己身上」。它**不能**
  * 证明这个文件内部没有直接转调契约函数 —— 那由消费方半场的**变异自证**负责(消费方对自己的折叠/投影层
  * 注入一处变异 ⇒ kit 必红)。本字段是护栏,不是证明,docs/CONFORMANCE.md 逐字写明这一点。
  */

package/dist/conformance/warnings.d.ts

@@ -1,9 +1,10 @@
 /**
- * 告警的**穷举 typed 投影**与**多重集**比对 —— kit 的第二个单铸点。
+ * 告警投影的**多重集比对** —— kit 的第二个单铸点。
  *
- * 为什么是穷举投影而不是「把告警对象整个比一遍」:`error` 字段带的是 zod 的错误对象/文案,它可经脱敏、
- * 可随 zod 小版本改字 —— 比文案就是比实现。所以投影**逐臂列全**每个 kind 的非 `error` 字段,`error`
- * 一律不进比对;但它也不是就这么放过去了:{@link findSecretLeaks} 先断言它不含语料自带的秘密清单。
+ * **投影本身不在这里**(4.0.0):`WarningProjection` / `projectWarning` / `WARNING_KINDS` 的属主是告警联合
+ * 自己的模块 `../config-fns`,本文件只再导出(kit 的进口逐字不变)。投影 = 每臂减掉 `error`,**从联合派生**;
+ * 为什么要剥 `error`:它带的是 zod 的错误对象/文案,可经脱敏、可随 zod 小版本改字 —— 比文案就是比实现。
+ * `error` 因此不进比对,但也不是就这么放过去了:{@link findSecretLeaks} 先断言它不含语料自带的秘密清单。
  *
  * 为什么是**多重集**而不是集合:同一个 kind 在同一个域上发两次(两条坏条目、两处未知键路径)是有信息的
  * —— 去重会让「报了一条」与「报了两条」同形,而那恰是消费方最容易漏折的一类。
@@ -11,51 +12,9 @@
  * 坐标({@link ConfigPath})按**结构**比:段数组进 JSON 编码,`["a.b"]` 与 `["a","b"]`、`["1"]` 与 `[1]`
  * 在编码里都还分得开。kit 内**零** `formatConfigPath` 调用 —— 出门形是给人看的,不是比对用的。
  */
-import type { ConfigPath, EffectiveReadWarning } from "../config-fns.js";
+import { type ConfigPath, type EffectiveReadWarning, type WarningProjection } from "../config-fns.js";
 import type { ConformanceNormalizer } from "./types.js";
-/** {@link EffectiveReadWarning} 的 `kind` 闭集(覆盖律按它计数;新 kind 不登记 ⇒ 下面的 switch 编译红)。 */
-export declare const WARNING_KINDS: readonly ["hosts-grandfathered", "domain-defaulted", "unknown-keys-dropped", "unknown-keys-carried", "legacy-governance-lifted", "entry-dropped", "unread-config-file"];
-export type WarningKind = (typeof WARNING_KINDS)[number];
-/** 一条告警的投影 —— 每臂列全该 kind 的**非 `error`** 字段。 */
-export type WarningProjection = {
-    kind: "hosts-grandfathered";
-    domain: "hosts";
-    droppedNames: readonly string[];
-    truncatedFrom?: number;
-} | {
-    kind: "domain-defaulted";
-    domain: string;
-} | {
-    kind: "unknown-keys-dropped";
-    domain: string;
-    keys: readonly ConfigPath[];
-    truncatedFrom?: number;
-} | {
-    kind: "unknown-keys-carried";
-    domain: string;
-    keys: readonly ConfigPath[];
-    truncatedFrom?: number;
-} | {
-    kind: "legacy-governance-lifted";
-    domain: "governance";
-    keys: readonly ConfigPath[];
-} | {
-    kind: "entry-dropped";
-    domain: string;
-    path: ConfigPath;
-} | {
-    kind: "unread-config-file";
-    file: string;
-    domain?: string;
-    why: string;
-};
-/**
- * 一条告警 → 它的投影。**闭集穷举**:新 kind 不在这里表态就编译红(#157 的闭集纪律)。
- *
- * `truncatedFrom` 缺席时**不铸这个键**(不是铸 `undefined`)—— 规范化会把 `undefined` 值剔掉,两种写法
- * 最终同形,但不铸更诚实:「没有截断」与「截断了 0 条」不该在中间形上分成两件事。
- */
-export declare function projectWarning(w: EffectiveReadWarning): WarningProjection;
+export { WARNING_KINDS, projectWarning, type WarningKind, type WarningProjection } from "../config-fns.js";
 /**
  * 一条投影的**比对归一形**:①坐标过一遍映射(historical 模式把段拼成旧版的点号串;无归一器时是恒等);
  * ②`keys` / `droppedNames` 这两个**集合字段**按袋归一。第二处闭集穷举:哪些 kind 带坐标、带在哪个字段上,

package/dist/conformance/warnings.js

@@ -1,46 +1,23 @@
-import { canonicalize, stableKey } from "./canonical.js";
-/** {@link EffectiveReadWarning} 的 `kind` 闭集(覆盖律按它计数;新 kind 不登记 ⇒ 下面的 switch 编译红)。 */
-export const WARNING_KINDS = [
-    "hosts-grandfathered",
-    "domain-defaulted",
-    "unknown-keys-dropped",
-    "unknown-keys-carried",
-    "legacy-governance-lifted",
-    "entry-dropped",
-    "unread-config-file",
-];
 /**
- * 一条告警 → 它的投影。**闭集穷举**:新 kind 不在这里表态就编译红(#157 的闭集纪律)。
+ * 告警投影的**多重集比对** —— kit 的第二个单铸点。
+ *
+ * **投影本身不在这里**(4.0.0):`WarningProjection` / `projectWarning` / `WARNING_KINDS` 的属主是告警联合
+ * 自己的模块 `../config-fns`,本文件只再导出(kit 的进口逐字不变)。投影 = 每臂减掉 `error`,**从联合派生**;
+ * 为什么要剥 `error`:它带的是 zod 的错误对象/文案,可经脱敏、可随 zod 小版本改字 —— 比文案就是比实现。
+ * `error` 因此不进比对,但也不是就这么放过去了:{@link findSecretLeaks} 先断言它不含语料自带的秘密清单。
  *
- * `truncatedFrom` 缺席时**不铸这个键**(不是铸 `undefined`)—— 规范化会把 `undefined` 值剔掉,两种写法
- * 最终同形,但不铸更诚实:「没有截断」与「截断了 0 条」不该在中间形上分成两件事。
+ * 为什么是**多重集**而不是集合:同一个 kind 在同一个域上发两次(两条坏条目、两处未知键路径)是有信息的
+ * —— 去重会让「报了一条」与「报了两条」同形,而那恰是消费方最容易漏折的一类。
+ *
+ * 坐标({@link ConfigPath})按**结构**比:段数组进 JSON 编码,`["a.b"]` 与 `["a","b"]`、`["1"]` 与 `[1]`
+ * 在编码里都还分得开。kit 内**零** `formatConfigPath` 调用 —— 出门形是给人看的,不是比对用的。
  */
-export function projectWarning(w) {
-    switch (w.kind) {
-        case "hosts-grandfathered":
-            return { kind: w.kind, domain: w.domain, droppedNames: w.droppedNames, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
-        case "domain-defaulted":
-            return { kind: w.kind, domain: w.domain };
-        // 两臂字段相同但**不合并**:合并后 `kind` 塌成两员的联合,TS 就再也认不出它属于投影联合的哪一员
-        // (真编译红过一次)。逐 kind 一臂,是这张表本来的样子。
-        case "unknown-keys-dropped":
-            return { kind: w.kind, domain: w.domain, keys: w.keys, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
-        case "unknown-keys-carried":
-            return { kind: w.kind, domain: w.domain, keys: w.keys, ...(w.truncatedFrom === undefined ? {} : { truncatedFrom: w.truncatedFrom }) };
-        case "legacy-governance-lifted":
-            return { kind: w.kind, domain: w.domain, keys: w.keys };
-        case "entry-dropped":
-            return { kind: w.kind, domain: w.domain, path: w.path };
-        case "unread-config-file":
-            return { kind: w.kind, file: w.file, ...(w.domain === undefined ? {} : { domain: w.domain }), why: w.why };
-        default: {
-            const unhandled = w;
-            // 运行期到不了(本联合由契约包铸造);到了就让它红 —— 一条不认识的告警被静默投影成空,
-            // 正是「门看起来全绿」的那种假绿。
-            throw new Error(`conformance: unknown EffectiveReadWarning kind — ${JSON.stringify(unhandled)}`);
-        }
-    }
-}
+import { projectWarning } from "../config-fns.js";
+import { canonicalize, stableKey } from "./canonical.js";
+// 投影的**属主在 `../config-fns`**(告警联合自己的模块;4.0.0 起)—— kit 只再导出,进口不断。
+// 4.0.0 之前这三件住在本文件里,于是「一条告警有哪些字段」在舰队里有两个属主:契约那边加一个字段,
+// 这边的手写投影不动,而**没有一格会红**。现在投影从联合逐臂派生(`Omit<臂, "error">`),那条缝没了。
+export { WARNING_KINDS, projectWarning } from "../config-fns.js";
 /** 一只**袋**:元素按各自的稳定编码排序,重数保留。比对前归一用,不改变「报了几条」这件事。 */
 const bag = (items) => [...items].sort((a, b) => (stableKey(a) < stableKey(b) ? -1 : stableKey(a) > stableKey(b) ? 1 : 0));
 /**

package/dist/cross-domain.d.ts

@@ -23,16 +23,36 @@ export type SiblingResolver = <K extends keyof DomainConfig>(domain: K) => Promi
  *  Widened from the fat ConfigStore to the narrow {@link ConfigReader} (it only calls `getDomain`) so a TOC
  *  file source can use it without the full store.
  *
- *  1.11.0 renamed this from `siblingResolver` (BREAKING, zero aliases): the naming law is `build*` returns
+ *  2.0.0 renamed this from `siblingResolver` (BREAKING, zero aliases): the naming law is `build*` returns
  *  plain DATA and `create*` returns a LIVE object — this returns a closure, so it was on the wrong side of
  *  the line and carried neither prefix. A consumer's compile error IS the notice; the fix is the new name. */
 export declare function createSiblingResolver(store: ConfigReader, pending?: Partial<{
     [K in keyof DomainConfig]: DomainConfig[K];
 }>): SiblingResolver;
-/** The domains whose writes carry cross-domain model/roster references we validate at save time. */
-export type RefCheckedDomain = "rosters" | "workers" | "models" | "collab" | "systems" | "entitlement";
-/** Cross-domain ref integrity for a rosters/workers/models/collab/systems value. Paths start with the domain
- *  key (e.g. `["rosters", i, "models", j]`) so a caller can prefix a batch index. Empty = ok. Runtime
- *  resolution stays tolerant (falls back); this is purely a save-time guard — a precise 400 at save time is
- *  friendlier than a silently-wrong roster. */
+/** The domains whose writes carry cross-domain model/roster references we validate at save time — the closed
+ *  set as a RUNTIME VALUE (4.0.0). A consumer that has to ask "is this domain ref-checked?" at runtime (a
+ *  config-rollback path deciding whether to run the guard before writing) could only hand-copy the list
+ *  before, and a hand copy drifts silently: two rollback routes in the admin console each carried a
+ *  five-member copy that had lost `entitlement`, so an entitlement rollback skipped the guard entirely with
+ *  nothing red anywhere. Ask this constant (or {@link isRefCheckedDomain}) instead of writing a list.
+ *
+ *  `satisfies readonly (keyof DomainConfig)[]` keeps every member a real domain key; {@link RefCheckedDomain}
+ *  is DERIVED from this value, so there is exactly one place the set is written down. */
+export declare const REF_CHECKED_DOMAINS: readonly ["rosters", "workers", "models", "collab", "systems", "entitlement"];
+/** The domains whose writes carry cross-domain model/roster references we validate at save time.
+ *  DERIVED from {@link REF_CHECKED_DOMAINS} (4.0.0) — a hand-written union next to the value would be a
+ *  second copy of the same set, free to disagree with it. */
+export type RefCheckedDomain = (typeof REF_CHECKED_DOMAINS)[number];
+/** Runtime narrowing to {@link RefCheckedDomain}, same idiom as `isDomainName`: use it instead of hard-coding
+ *  the set when filtering an arbitrary domain key (a batch payload's keys, a rollback target). */
+export declare function isRefCheckedDomain(d: unknown): d is RefCheckedDomain;
+/** Cross-domain ref integrity for one {@link RefCheckedDomain} value. Every issue `path` starts with the
+ *  DOMAIN KEY (e.g. `["rosters", i, "models", j]`, `["collab", "templates", i, …]`) so a caller can prefix a
+ *  batch index and get a coordinate that is unambiguous across arms. Empty = ok. Runtime resolution stays
+ *  tolerant (falls back); this is purely a save-time guard — a precise 400 at save time is friendlier than a
+ *  silently-wrong roster.
+ *
+ *  4.0.0 made that first sentence TRUE: the `collab` arm used to start its paths at `"templates"` and the
+ *  `entitlement` arm at `"tiers"`, so a caller could not read `path[0]` as the domain. See the CHANGELOG entry
+ *  for the migration (BREAKING, value shape). */
 export declare function refIntegrityIssues(domain: RefCheckedDomain, value: unknown, resolve: SiblingResolver): Promise<RefIssue[]>;

package/dist/cross-domain.js

@@ -2,7 +2,7 @@
  *  Widened from the fat ConfigStore to the narrow {@link ConfigReader} (it only calls `getDomain`) so a TOC
  *  file source can use it without the full store.
  *
- *  1.11.0 renamed this from `siblingResolver` (BREAKING, zero aliases): the naming law is `build*` returns
+ *  2.0.0 renamed this from `siblingResolver` (BREAKING, zero aliases): the naming law is `build*` returns
  *  plain DATA and `create*` returns a LIVE object — this returns a closure, so it was on the wrong side of
  *  the line and carried neither prefix. A consumer's compile error IS the notice; the fix is the new name. */
 export function createSiblingResolver(store, pending) {
@@ -12,10 +12,30 @@ export function createSiblingResolver(store, pending) {
         return store.getDomain(domain);
     };
 }
-/** Cross-domain ref integrity for a rosters/workers/models/collab/systems value. Paths start with the domain
- *  key (e.g. `["rosters", i, "models", j]`) so a caller can prefix a batch index. Empty = ok. Runtime
- *  resolution stays tolerant (falls back); this is purely a save-time guard — a precise 400 at save time is
- *  friendlier than a silently-wrong roster. */
+/** The domains whose writes carry cross-domain model/roster references we validate at save time — the closed
+ *  set as a RUNTIME VALUE (4.0.0). A consumer that has to ask "is this domain ref-checked?" at runtime (a
+ *  config-rollback path deciding whether to run the guard before writing) could only hand-copy the list
+ *  before, and a hand copy drifts silently: two rollback routes in the admin console each carried a
+ *  five-member copy that had lost `entitlement`, so an entitlement rollback skipped the guard entirely with
+ *  nothing red anywhere. Ask this constant (or {@link isRefCheckedDomain}) instead of writing a list.
+ *
+ *  `satisfies readonly (keyof DomainConfig)[]` keeps every member a real domain key; {@link RefCheckedDomain}
+ *  is DERIVED from this value, so there is exactly one place the set is written down. */
+export const REF_CHECKED_DOMAINS = ["rosters", "workers", "models", "collab", "systems", "entitlement"];
+/** Runtime narrowing to {@link RefCheckedDomain}, same idiom as `isDomainName`: use it instead of hard-coding
+ *  the set when filtering an arbitrary domain key (a batch payload's keys, a rollback target). */
+export function isRefCheckedDomain(d) {
+    return typeof d === "string" && REF_CHECKED_DOMAINS.includes(d);
+}
+/** Cross-domain ref integrity for one {@link RefCheckedDomain} value. Every issue `path` starts with the
+ *  DOMAIN KEY (e.g. `["rosters", i, "models", j]`, `["collab", "templates", i, …]`) so a caller can prefix a
+ *  batch index and get a coordinate that is unambiguous across arms. Empty = ok. Runtime resolution stays
+ *  tolerant (falls back); this is purely a save-time guard — a precise 400 at save time is friendlier than a
+ *  silently-wrong roster.
+ *
+ *  4.0.0 made that first sentence TRUE: the `collab` arm used to start its paths at `"templates"` and the
+ *  `entitlement` arm at `"tiers"`, so a caller could not read `path[0]` as the domain. See the CHANGELOG entry
+ *  for the migration (BREAKING, value shape). */
 export async function refIntegrityIssues(domain, value, resolve) {
     const issues = [];
     if (domain === "rosters") {
@@ -73,7 +93,7 @@ export async function refIntegrityIssues(domain, value, resolve) {
             t.slots.forEach((s, j) => {
                 s.members.forEach((mem, k) => {
                     if (mem.modelRef && !catalog.has(mem.modelRef))
-                        issues.push({ path: ["templates", i, "slots", j, "members", k, "modelRef"], message: `collab template "${t.id}" slot "${s.id}" → unknown model "${mem.modelRef}" (not in the catalog)`, code: "custom" });
+                        issues.push({ path: ["collab", "templates", i, "slots", j, "members", k, "modelRef"], message: `collab template "${t.id}" slot "${s.id}" → unknown model "${mem.modelRef}" (not in the catalog)`, code: "custom" });
                 });
             });
         });
@@ -101,15 +121,15 @@ export async function refIntegrityIssues(domain, value, resolve) {
         const pluginNames = new Set((await resolve("plugins"))?.plugins.map((p) => p.name) ?? []);
         value.tiers.forEach((t, i) => {
             if (t.roster && !rosterNames.has(t.roster))
-                issues.push({ path: ["tiers", i, "roster"], message: `tier "${t.id}" references unknown roster "${t.roster}"`, code: "custom" });
+                issues.push({ path: ["entitlement", "tiers", i, "roster"], message: `tier "${t.id}" references unknown roster "${t.roster}"`, code: "custom" });
             (t.models ?? []).forEach((name, j) => { if (!modelCatalog.has(name))
-                issues.push({ path: ["tiers", i, "models", j], message: `tier "${t.id}" model "${name}" not in the models catalog`, code: "custom" }); });
+                issues.push({ path: ["entitlement", "tiers", i, "models", j], message: `tier "${t.id}" model "${name}" not in the models catalog`, code: "custom" }); });
             (t.visibleSkills ?? []).forEach((name, j) => { if (!skillNames.has(name))
-                issues.push({ path: ["tiers", i, "visibleSkills", j], message: `tier "${t.id}" visibleSkill "${name}" not in skills`, code: "custom" }); });
+                issues.push({ path: ["entitlement", "tiers", i, "visibleSkills", j], message: `tier "${t.id}" visibleSkill "${name}" not in skills`, code: "custom" }); });
             (t.visibleMcp ?? []).forEach((name, j) => { if (!mcpNames.has(name))
-                issues.push({ path: ["tiers", i, "visibleMcp", j], message: `tier "${t.id}" visibleMcp "${name}" not in mcp`, code: "custom" }); });
+                issues.push({ path: ["entitlement", "tiers", i, "visibleMcp", j], message: `tier "${t.id}" visibleMcp "${name}" not in mcp`, code: "custom" }); });
             (t.visiblePlugins ?? []).forEach((name, j) => { if (!pluginNames.has(name))
-                issues.push({ path: ["tiers", i, "visiblePlugins", j], message: `tier "${t.id}" visiblePlugin "${name}" not in plugins`, code: "custom" }); });
+                issues.push({ path: ["entitlement", "tiers", i, "visiblePlugins", j], message: `tier "${t.id}" visiblePlugin "${name}" not in plugins`, code: "custom" }); });
         });
     }
     else {

package/dist/hooks.d.ts

@@ -10,7 +10,7 @@
  * DRIFT: this package OWNS the hooks contract, so it owns noticing that CC moved. `test/upstream-drift.test.ts`
  * compares {@link HOOK_EVENTS} against a CC anchor snapshot that `scripts/extract-cc-hook-events.mjs` extracts
  * from the CLI bundle — a word CC has and this set does not is a RED test naming it, instead of a consumer
- * discovering it the hard way (the 1.3.0 / 1.6.0 / 1.8.0 / 1.11.0 pattern).
+ * discovering it the hard way (the 1.3.0 / 1.6.0 / 1.8.0 / 2.0.0 pattern).
  *
  * CONSUMERS
  * - service (the worker server): `TaskRequest.settings.hooks` wire face = `HooksConfig` below; the worker-side
@@ -35,7 +35,7 @@ export declare const CC_198_HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse",
  * Post-CC-2.1.198 additions (sema superset; CC added them after 198).
  * APPEND-ONLY: new members go at the tail (1.3.0 `DirectoryAdded`, CC 2.1.219 — CC's own tuple places it
  * between FileChanged and MessageDisplay; the declaration order here is not normative, the enum is a set).
- * 1.11.0 appends the model-switch pair (`PreModelSwitch` / `PostModelSwitch`, CC 2.1.259 — absent from the
+ * 2.0.0 appends the model-switch pair (`PreModelSwitch` / `PostModelSwitch`, CC 2.1.259 — absent from the
  * 2.1.250 corpus, so 250→259 is when they landed upstream).
  *
  * 🔴 This list is no longer maintained by hand-reading a CLI bundle: `test/upstream-drift.test.ts` fails

package/dist/hooks.js

@@ -10,7 +10,7 @@
  * DRIFT: this package OWNS the hooks contract, so it owns noticing that CC moved. `test/upstream-drift.test.ts`
  * compares {@link HOOK_EVENTS} against a CC anchor snapshot that `scripts/extract-cc-hook-events.mjs` extracts
  * from the CLI bundle — a word CC has and this set does not is a RED test naming it, instead of a consumer
- * discovering it the hard way (the 1.3.0 / 1.6.0 / 1.8.0 / 1.11.0 pattern).
+ * discovering it the hard way (the 1.3.0 / 1.6.0 / 1.8.0 / 2.0.0 pattern).
  *
  * CONSUMERS
  * - service (the worker server): `TaskRequest.settings.hooks` wire face = `HooksConfig` below; the worker-side
@@ -64,7 +64,7 @@ export const CC_198_HOOK_EVENTS = [
  * Post-CC-2.1.198 additions (sema superset; CC added them after 198).
  * APPEND-ONLY: new members go at the tail (1.3.0 `DirectoryAdded`, CC 2.1.219 — CC's own tuple places it
  * between FileChanged and MessageDisplay; the declaration order here is not normative, the enum is a set).
- * 1.11.0 appends the model-switch pair (`PreModelSwitch` / `PostModelSwitch`, CC 2.1.259 — absent from the
+ * 2.0.0 appends the model-switch pair (`PreModelSwitch` / `PostModelSwitch`, CC 2.1.259 — absent from the
  * 2.1.250 corpus, so 250→259 is when they landed upstream).
  *
  * 🔴 This list is no longer maintained by hand-reading a CLI bundle: `test/upstream-drift.test.ts` fails

package/dist/node.d.ts

@@ -9,3 +9,4 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js";
+export * from "./prompts-digest.js";

package/dist/node.js

@@ -9,3 +9,4 @@ export * from "./file-edit.js";
 export * from "./bundle.js";
 export * from "./local-load.js";
 export * from "./scheduler-store-node.js"; // R7 self-wake scheduler store — fs binding of the ./scheduler-store contract
+export * from "./prompts-digest.js"; // prompts 下发包的内容摘要(4.0.0 从 scheduler-store-node 搬来 —— 与调度存储无关;出口路径不变)

package/dist/prompts-digest.d.ts

@@ -0,0 +1,16 @@
+/** [1057]① prompts contentDigest:canonical JSON(stableStringify 同姿势:键序稳定+深度护栏)全量 sha256,
+ *  **非盐化**(三方可独立复算)。入参=下发形的 `{sections, scenarioOverrides?}`(packId/contentDigest
+ *  自身不入 hash)。 */
+export declare function promptsContentDigest(payload: {
+    sections: unknown;
+    scenarioOverrides?: unknown;
+}): {
+    contentDigest: string;
+    packId: string;
+    /** [1062]③ 顺带:逐 section 对 `text` 铸的 contentHash(与 core 1.315 校验语义同刻度=
+     *  sha256(text));元素无 string text 位=undefined。center 物化流程=先把这些写回
+     *  declaration.contentHash,再对含 hash 的终形铸整包 digest(本函数对入参原样铸,两步自洽)。 */
+    sectionHashes: Array<string | undefined>;
+};
+/** 逐 section 对账锚(core 1.315 `PromptTextDeclaration.contentHash` 同刻度):sha256(text)。 */
+export declare function sectionContentHash(text: string): string;

package/dist/prompts-digest.js

@@ -0,0 +1,48 @@
+/**
+ * @sema-agent/settings-schema/node — prompts 下发包的**内容摘要**([1057]①/[1062]③)。
+ *
+ * 这两只是跨仓**对账锚**:center 铸、server 透传、core 的 manifest 归因**独立复算**,三方算出同一个值才
+ * 对得上账([1050]② operator 对账位)。所以它们只有一件事要守:**一个刻度**。
+ *
+ * 4.0.0 从 `scheduler-store-node.ts` 搬到这里(不 breaking —— 仍挂在 `./node` 这条 subpath 上,消费方的
+ * import 一个字不用改)。两条理由:①它与调度存储(`scheduled_tasks.json` 的原子读写 + 跨进程变更原语)
+ * 零关系,住在一起只是历史;②搬家顺手把**两个** sha256 铸点合成一只 —— 此前整包 digest 与逐 section
+ * contentHash 各自 `createHash('sha256')` 一次、各自拼一次 `sha256:` 前缀,哪天有人只改一处就成了两个刻度,
+ * 而没有一格会红(门:`test/prompts-digest-4.0.0.test.ts` 逐条看着铸点数与出门前缀数)。
+ *
+ * 摘要用本包**纯实现**的 sha256(`./sha256.ts`),不是 `node:crypto` —— 那份实现与
+ * `createHash("sha256").update(s,"utf8").digest("hex")` 逐字节相同(`test/sha256.test.ts` 逐例压着,
+ * 本模块的门再压一遍摘要值本身),于是整个包的 sha256 只有**一份实现**。
+ */
+import { stableStringify } from './hash.js';
+import { sha256Hex } from './sha256.js';
+/**
+ * 本模块**唯一**的 sha256 铸点:一段 utf8 文本 → `{ hex, anchor }`。`anchor` = 出门形 `sha256:<hex>`
+ * (自描述算法,与 skills 的内容地址同形),`hex` 给需要裸 hex 的那一处(packId 取前 12 位)。
+ * 两个出门形从**同一次**摘要派生 —— 这正是本模块存在的理由。
+ */
+function contentAnchor(text) {
+    const hex = sha256Hex(text);
+    return { hex, anchor: `sha256:${hex}` };
+}
+/** [1057]① prompts contentDigest:canonical JSON(stableStringify 同姿势:键序稳定+深度护栏)全量 sha256,
+ *  **非盐化**(三方可独立复算)。入参=下发形的 `{sections, scenarioOverrides?}`(packId/contentDigest
+ *  自身不入 hash)。 */
+export function promptsContentDigest(payload) {
+    const canonical = stableStringify({
+        sections: payload.sections,
+        ...(payload.scenarioOverrides !== undefined ? { scenarioOverrides: payload.scenarioOverrides } : {}),
+    });
+    const { hex, anchor } = contentAnchor(canonical);
+    const sectionHashes = Array.isArray(payload.sections)
+        ? payload.sections.map((s) => {
+            const t = s?.text;
+            return typeof t === 'string' ? sectionContentHash(t) : undefined;
+        })
+        : [];
+    return { contentDigest: anchor, packId: `center:${hex.slice(0, 12)}`, sectionHashes };
+}
+/** 逐 section 对账锚(core 1.315 `PromptTextDeclaration.contentHash` 同刻度):sha256(text)。 */
+export function sectionContentHash(text) {
+    return contentAnchor(text).anchor;
+}

package/dist/scheduler-store-node.d.ts

@@ -13,8 +13,13 @@ export declare function loadSchedulerStore(path: string): SchedulerRecord[];
  * concurrent reader never sees a partial file). Throws on IO failure (caller maps to a domain error).
  */
 export declare function saveSchedulerStore(path: string, records: SchedulerRecord[]): void;
-/** A filesystem-backed {@link SchedulerStore} bound to a path (convenience for the daemon/backend constructors). */
-export declare function fileSchedulerStore(path: string): SchedulerStore;
+/** A filesystem-backed {@link SchedulerStore} bound to a path (convenience for the daemon/backend constructors).
+ *
+ * 4.0.0 BREAKING 改名(S-571 B5,**零别名**):旧名 `fileSchedulerStore` 已删。它返回一只带 `load`/`save`
+ * 的**活对象** ⇒ 按本组工厂命名法(`build*` 出纯数据、`create*` 出活对象)该叫 `create*`;2.0.0 那次照人眼
+ * 改只改到了 `createSiblingResolver`,漏了这处 —— 现在由 `test/factory-naming-4.0.0.test.ts` 的门④ 机器看着。
+ * 消费方改调 `createFileSchedulerStore`(改名是硬 breaking:消费方的 tsc 红 / 运行期 undefined 就是通知本身)。 */
+export declare function createFileSchedulerStore(path: string): SchedulerStore;
 /** Outcome of {@link mutateSchedulerStore}. `conflict_exhausted` = a concurrent writer kept changing the file
  *  faster than the bounded replays; nothing was written on that final attempt (earlier attempts never wrote). */
 export type SchedulerStoreMutation = {
@@ -53,20 +58,3 @@ export type SchedulerStoreMutation = {
 export declare function mutateSchedulerStore(path: string, fn: (records: SchedulerRecord[]) => SchedulerRecord[] | null, opts?: {
     retries?: number;
 }): SchedulerStoreMutation;
-/** [1057]① prompts contentDigest(node 绑定;browser-safe 纯层不带 crypto):
- *  canonical JSON(stableStringify 同姿势:键序稳定+深度护栏)全量 sha256,**非盐化**
- *  ([1050]② operator 对账位——center 产、server 透传、core manifest 归因三方可独立复算)。
- *  入参=下发形的 {sections, scenarioOverrides?}(packId/contentDigest 自身不入 hash)。 */
-export declare function promptsContentDigest(payload: {
-    sections: unknown;
-    scenarioOverrides?: unknown;
-}): {
-    contentDigest: string;
-    packId: string;
-    /** [1062]③ 顺带:逐 section 对 `text` 铸的 contentHash(与 core 1.315 校验语义同刻度=
-     *  sha256(text));元素无 string text 位=undefined。center 物化流程=先把这些写回
-     *  declaration.contentHash,再对含 hash 的终形铸整包 digest(本函数对入参原样铸,两步自洽)。 */
-    sectionHashes: Array<string | undefined>;
-};
-/** 逐 section 对账锚(core 1.315 `PromptTextDeclaration.contentHash` 同刻度):sha256(text)。 */
-export declare function sectionContentHash(text: string): string;

package/dist/scheduler-store-node.js

@@ -8,9 +8,8 @@
  */
 import { mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
 import { dirname } from 'node:path';
-import { randomBytes, createHash } from 'node:crypto';
+import { randomBytes } from 'node:crypto';
 import { parseSchedulerStore, serializeSchedulerStore } from './scheduler-store.js';
-import { stableStringify } from './hash.js';
 /**
  * Load the durable store. A MISSING file (ENOENT) ⇒ `[]` (fail-soft, first-run/never-written case); any OTHER
  * read failure (EACCES/EIO/EISDIR/…) RETHROWS — only absence means "empty", not "unreadable for any reason"
@@ -39,8 +38,13 @@ export function saveSchedulerStore(path, records) {
     writeFileSync(tmp, serializeSchedulerStore(records), { mode: 0o600 });
     renameSync(tmp, path); // atomic over the target
 }
-/** A filesystem-backed {@link SchedulerStore} bound to a path (convenience for the daemon/backend constructors). */
-export function fileSchedulerStore(path) {
+/** A filesystem-backed {@link SchedulerStore} bound to a path (convenience for the daemon/backend constructors).
+ *
+ * 4.0.0 BREAKING 改名(S-571 B5,**零别名**):旧名 `fileSchedulerStore` 已删。它返回一只带 `load`/`save`
+ * 的**活对象** ⇒ 按本组工厂命名法(`build*` 出纯数据、`create*` 出活对象)该叫 `create*`;2.0.0 那次照人眼
+ * 改只改到了 `createSiblingResolver`,漏了这处 —— 现在由 `test/factory-naming-4.0.0.test.ts` 的门④ 机器看着。
+ * 消费方改调 `createFileSchedulerStore`(改名是硬 breaking:消费方的 tsc 红 / 运行期 undefined 就是通知本身)。 */
+export function createFileSchedulerStore(path) {
     return {
         load: () => loadSchedulerStore(path),
         save: (records) => saveSchedulerStore(path, records),
@@ -95,25 +99,3 @@ export function mutateSchedulerStore(path, fn, opts) {
         return { ok: true, records: next, retries: attempt };
     }
 }
-/** [1057]① prompts contentDigest(node 绑定;browser-safe 纯层不带 crypto):
- *  canonical JSON(stableStringify 同姿势:键序稳定+深度护栏)全量 sha256,**非盐化**
- *  ([1050]② operator 对账位——center 产、server 透传、core manifest 归因三方可独立复算)。
- *  入参=下发形的 {sections, scenarioOverrides?}(packId/contentDigest 自身不入 hash)。 */
-export function promptsContentDigest(payload) {
-    const canonical = stableStringify({
-        sections: payload.sections,
-        ...(payload.scenarioOverrides !== undefined ? { scenarioOverrides: payload.scenarioOverrides } : {}),
-    });
-    const hex = createHash('sha256').update(canonical, 'utf8').digest('hex');
-    const sectionHashes = Array.isArray(payload.sections)
-        ? payload.sections.map((s) => {
-            const t = s?.text;
-            return typeof t === 'string' ? sectionContentHash(t) : undefined;
-        })
-        : [];
-    return { contentDigest: `sha256:${hex}`, packId: `center:${hex.slice(0, 12)}`, sectionHashes };
-}
-/** 逐 section 对账锚(core 1.315 `PromptTextDeclaration.contentHash` 同刻度):sha256(text)。 */
-export function sectionContentHash(text) {
-    return `sha256:${createHash('sha256').update(text, 'utf8').digest('hex')}`;
-}

package/dist/scheduler-store.d.ts

@@ -60,7 +60,7 @@ export declare function isSchedulerRecord(v: unknown): v is SchedulerRecord;
  *  `switch` gains an arm to write).
  *   - `malformed-record`      — the record failed {@link isSchedulerRecord} and was dropped; `record` = the
  *                               raw (unvalidated) value, for diagnostics.
- *   - `durable-scope-rekeyed` — the durable-scope compat arm rewrote this row's `scope` (1.11.0; before that
+ *   - `durable-scope-rekeyed` — the durable-scope compat arm rewrote this row's `scope` (2.0.0; before that
  *                               the rewrite happened silently every parse). */
 export type SchedulerParseWarning = {
     index: number;