Centralize message role invariants

internal/promptdef/repository_test.go

@@ -1087,6 +1087,48 @@ output:
 	}
 }
 
+func TestPromptDefinitionMessageRoleNormalization(t *testing.T) {
+	const invalidRole = "consumer-private-role"
+	repo := NewFSRepository(fstest.MapFS{
+		"canonical.yaml": {Data: []byte(`
+id: canonical
+version: "1"
+messages:
+  - role: " \u2003SyStEm\u2003 "
+    content: test
+output:
+  format: text
+  validation_mode: none
+`)},
+		"invalid.yaml": {Data: []byte(`
+id: invalid-role
+version: "1"
+messages:
+  - role: consumer-private-role
+    content: test
+output:
+  format: text
+  validation_mode: none
+`)},
+	}, ".")
+
+	definition, err := repo.GetPromptDefinition(context.Background(), "canonical", "")
+	if err != nil {
+		t.Fatalf("GetPromptDefinition() error = %v", err)
+	}
+	if got := definition.Templates[0].Role; got != domain.RoleSystem {
+		t.Fatalf("normalized role = %q, want %q", got, domain.RoleSystem)
+	}
+
+	_, err = repo.GetPromptDefinition(context.Background(), "invalid-role", "")
+	if !errors.Is(err, ErrInvalidPromptDefinition) {
+		t.Fatalf("expected ErrInvalidPromptDefinition, got %v", err)
+	}
+	if strings.Contains(err.Error(), invalidRole) {
+		t.Fatalf("invalid prompt error exposed the supplied role: %v", err)
+	}
+}
+
 func assertCacheControl(t *testing.T, got *domain.CacheControl, wantType domain.CacheControlType, wantTTL string) {
 	t.Helper()
 	if got == nil {