@inf-monkeys-tech/monkeys 1.0.65 → 1.0.68

package/lib/runtime/declarative-control-compiler.js

@@ -0,0 +1,875 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWorkbenchEntry = exports.validateWorkbenchRuntimeSet = exports.compileNavigationRuntimeBundle = exports.compileWorkbenchRuntimeBundle = exports.compilePageRuntimeBundle = exports.materializeRouteSpacePath = exports.compileRouteClaims = exports.accessPolicyChainImplies = exports.declarativeProductResourceRevisionHash = exports.declarativeProductResourceSourceHash = exports.declarativeRouteSpaceRevisionHash = exports.declarativeRouteSpaceSourceHash = exports.declarativeCreateTemplateRevisionHash = exports.declarativeCreateTemplateSourceHash = exports.canonicalContentHash = exports.sameRevisionRef = exports.sameStableRef = exports.revisionRefKey = exports.stableRefKey = exports.DeclarativeControlCompilationError = void 0;
+const common_1 = require("../contracts/common");
+const render_tree_compiler_1 = require("./render-tree-compiler");
+const declarative_control_1 = require("../contracts/declarative-control");
+class DeclarativeControlCompilationError extends Error {
+    constructor(code, path, message) {
+        super(`${code} at ${path}: ${message}`);
+        this.code = code;
+        this.path = path;
+        this.name = 'DeclarativeControlCompilationError';
+    }
+}
+exports.DeclarativeControlCompilationError = DeclarativeControlCompilationError;
+const scopedIdentityKey = (reference) => `${reference.kind}:${reference.id}:${reference.ownerRepo}`;
+const scopeKey = (scope) => `${scopedIdentityKey(scope.tenantRef)}:${scopedIdentityKey(scope.dataSpaceRef)}:${scope.teamRef ? scopedIdentityKey(scope.teamRef) : ''}`;
+const stableRefKey = (reference) => `${reference.visibility}:${reference.tenantScope ? scopeKey(reference.tenantScope) : ''}:${reference.kind}:${reference.id}:${reference.ownerRepo}`;
+exports.stableRefKey = stableRefKey;
+const revisionRefKey = (reference) => `${(0, exports.stableRefKey)(reference)}@${reference.revision}:v${reference.schemaVersion}:${reference.contentHash.toLowerCase()}`;
+exports.revisionRefKey = revisionRefKey;
+const sameStableRef = (left, right) => (0, exports.stableRefKey)(left) === (0, exports.stableRefKey)(right);
+exports.sameStableRef = sameStableRef;
+const sameRevisionRef = (left, right) => (0, exports.revisionRefKey)(left) === (0, exports.revisionRefKey)(right);
+exports.sameRevisionRef = sameRevisionRef;
+const assertUniqueRegistryKeys = (keys, path) => {
+    const seen = new Set();
+    keys.forEach((key, index) => {
+        if (seen.has(key)) {
+            throw new DeclarativeControlCompilationError('REGISTRY_CONFLICT', `${path}[${index}]`, `Duplicate registry identity: ${key}`);
+        }
+        seen.add(key);
+    });
+};
+const stableSerialize = (value) => {
+    if (value === undefined)
+        return 'null';
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    if (Array.isArray(value))
+        return `[${value.map((item) => stableSerialize(item)).join(',')}]`;
+    const record = value;
+    return `{${Object.keys(record)
+        .filter((key) => record[key] !== undefined)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableSerialize(record[key])}`)
+        .join(',')}}`;
+};
+const SHA256_INITIAL = [
+    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+];
+const SHA256_ROUND = [
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+];
+const rotateRight = (value, amount) => (value >>> amount) | (value << (32 - amount));
+const sha256Hex = (value) => {
+    const source = [...new TextEncoder().encode(value)];
+    const bitLength = source.length * 8;
+    source.push(0x80);
+    while (source.length % 64 !== 56)
+        source.push(0);
+    const high = Math.floor(bitLength / 4294967296);
+    const low = bitLength >>> 0;
+    for (let shift = 24; shift >= 0; shift -= 8)
+        source.push((high >>> shift) & 0xff);
+    for (let shift = 24; shift >= 0; shift -= 8)
+        source.push((low >>> shift) & 0xff);
+    const hash = [...SHA256_INITIAL];
+    const words = new Array(64).fill(0);
+    for (let offset = 0; offset < source.length; offset += 64) {
+        for (let index = 0; index < 16; index += 1) {
+            const start = offset + index * 4;
+            words[index] = ((source[start] << 24) | (source[start + 1] << 16) | (source[start + 2] << 8) | source[start + 3]) >>> 0;
+        }
+        for (let index = 16; index < 64; index += 1) {
+            const previous = words[index - 15];
+            const recent = words[index - 2];
+            const small0 = rotateRight(previous, 7) ^ rotateRight(previous, 18) ^ (previous >>> 3);
+            const small1 = rotateRight(recent, 17) ^ rotateRight(recent, 19) ^ (recent >>> 10);
+            words[index] = (words[index - 16] + small0 + words[index - 7] + small1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, h] = hash;
+        for (let index = 0; index < 64; index += 1) {
+            const big1 = rotateRight(e, 6) ^ rotateRight(e, 11) ^ rotateRight(e, 25);
+            const choice = (e & f) ^ (~e & g);
+            const temp1 = (h + big1 + choice + SHA256_ROUND[index] + words[index]) >>> 0;
+            const big0 = rotateRight(a, 2) ^ rotateRight(a, 13) ^ rotateRight(a, 22);
+            const majority = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (big0 + majority) >>> 0;
+            h = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        hash[0] = (hash[0] + a) >>> 0;
+        hash[1] = (hash[1] + b) >>> 0;
+        hash[2] = (hash[2] + c) >>> 0;
+        hash[3] = (hash[3] + d) >>> 0;
+        hash[4] = (hash[4] + e) >>> 0;
+        hash[5] = (hash[5] + f) >>> 0;
+        hash[6] = (hash[6] + g) >>> 0;
+        hash[7] = (hash[7] + h) >>> 0;
+    }
+    return hash.map((part) => part.toString(16).padStart(8, '0')).join('');
+};
+const canonicalContentHash = (value) => sha256Hex(stableSerialize(value));
+exports.canonicalContentHash = canonicalContentHash;
+const declarativeCreateTemplateSourceHash = (document) => (0, exports.canonicalContentHash)(document);
+exports.declarativeCreateTemplateSourceHash = declarativeCreateTemplateSourceHash;
+const declarativeCreateTemplateRevisionHash = (registration) => (0, exports.canonicalContentHash)(registration.document);
+exports.declarativeCreateTemplateRevisionHash = declarativeCreateTemplateRevisionHash;
+const declarativeRouteSpaceSourceHash = (routeSpace) => (0, exports.canonicalContentHash)(routeSpace);
+exports.declarativeRouteSpaceSourceHash = declarativeRouteSpaceSourceHash;
+const declarativeRouteSpaceRevisionHash = (registration) => (0, exports.canonicalContentHash)(registration.routeSpace);
+exports.declarativeRouteSpaceRevisionHash = declarativeRouteSpaceRevisionHash;
+const declarativeProductResourceSourceHash = (document) => (0, exports.canonicalContentHash)(document);
+exports.declarativeProductResourceSourceHash = declarativeProductResourceSourceHash;
+const declarativeProductResourceRevisionHash = (registration) => (0, exports.canonicalContentHash)(registration.document);
+exports.declarativeProductResourceRevisionHash = declarativeProductResourceRevisionHash;
+const deepFreeze = (value) => {
+    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    Object.values(value).forEach((child) => deepFreeze(child));
+    return Object.freeze(value);
+};
+const assertTenantCompatible = (reference, scope, path) => {
+    if (reference.visibility === 'tenant' && scopeKey(reference.tenantScope) !== scopeKey(scope)) {
+        throw new DeclarativeControlCompilationError('CROSS_TENANT_REFERENCE', path, `Reference ${reference.kind}/${reference.id} belongs to another tenant scope.`);
+    }
+};
+const assertSameTenantScope = (candidate, expected, path) => {
+    if (scopeKey(candidate) !== scopeKey(expected)) {
+        throw new DeclarativeControlCompilationError('CROSS_TENANT_REFERENCE', path, 'Record and release tenant scopes do not match.');
+    }
+};
+const stableFromRevision = (reference) => declarative_control_1.StableRefSchema.parse({
+    kind: reference.kind,
+    id: reference.id,
+    ownerRepo: reference.ownerRepo,
+    visibility: reference.visibility,
+    ...(reference.tenantScope ? { tenantScope: reference.tenantScope } : {}),
+});
+const assertRevisionIdentity = (reference, expectedKind, expectedId, scope, path) => {
+    if (reference.kind !== expectedKind || reference.id !== expectedId) {
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', path, `Expected ${expectedKind}/${expectedId}, received ${reference.kind}/${reference.id}.`);
+    }
+    assertTenantCompatible(reference, scope, path);
+};
+const dependencyKey = (role, reference) => `${role}:${(0, exports.revisionRefKey)(reference)}`;
+const requireDependencies = (snapshot, required) => {
+    const available = new Set(snapshot.map((dependency) => dependencyKey(dependency.role, dependency.revisionRef)));
+    for (const dependency of required) {
+        const key = dependencyKey(dependency.role, dependency.revisionRef);
+        if (!available.has(key)) {
+            throw new DeclarativeControlCompilationError('DEPENDENCY_MISSING', 'dependencySnapshot', `Missing exact ${dependency.role} dependency ${(0, exports.revisionRefKey)(dependency.revisionRef)}.`);
+        }
+    }
+};
+const assertDependencyScopes = (snapshot, scope) => snapshot.forEach((dependency, index) => assertTenantCompatible(dependency.revisionRef, scope, `dependencySnapshot[${index}].revisionRef`));
+const requireReleaseReady = (release) => {
+    if (release.evidence.validation.result !== 'pass') {
+        throw new DeclarativeControlCompilationError('RELEASE_VALIDATION_FAILED', 'evidence.validation.result', 'Runtime bundles require a passing release validation result.');
+    }
+};
+const refSet = (values) => new Set(values.map(exports.stableRefKey));
+const chainRequiresAll = (policies, field) => {
+    if (field === 'permissionAllOf')
+        return new Set(policies.flatMap((policy) => policy.permissionAllOf));
+    if (field === 'groupAllOf')
+        return refSet(policies.flatMap((policy) => policy.groupAllOf));
+    return new Set(policies.flatMap((policy) => policy.conditionAllOf.map(exports.revisionRefKey)));
+};
+const chainImpliesAny = (policies, targetAny, allValues, anyValues) => {
+    if (targetAny.size === 0)
+        return true;
+    if ([...allValues].some((value) => targetAny.has(value)))
+        return true;
+    return policies.some((policy) => {
+        const values = anyValues(policy);
+        return values.length > 0 && values.every((value) => targetAny.has(value));
+    });
+};
+const accessPolicyChainImplies = (policyInputs, targetInput) => {
+    const policies = policyInputs.map((policy) => declarative_control_1.AccessPolicySchema.parse(policy));
+    const target = declarative_control_1.AccessPolicySchema.parse(targetInput);
+    if (target.authenticated && !policies.some((policy) => policy.authenticated))
+        return false;
+    const permissionAll = chainRequiresAll(policies, 'permissionAllOf');
+    if (target.permissionAllOf.some((permission) => !permissionAll.has(permission)))
+        return false;
+    if (!chainImpliesAny(policies, new Set(target.permissionAnyOf), permissionAll, (policy) => policy.permissionAnyOf))
+        return false;
+    const groupAll = chainRequiresAll(policies, 'groupAllOf');
+    if (target.groupAllOf.some((group) => !groupAll.has((0, exports.stableRefKey)(group))))
+        return false;
+    if (!chainImpliesAny(policies, refSet(target.groupAnyOf), groupAll, (policy) => policy.groupAnyOf.map(exports.stableRefKey)))
+        return false;
+    const conditionAll = chainRequiresAll(policies, 'conditionAllOf');
+    if (target.conditionAllOf.some((condition) => !conditionAll.has((0, exports.revisionRefKey)(condition))))
+        return false;
+    return true;
+};
+exports.accessPolicyChainImplies = accessPolicyChainImplies;
+const normalizePath = (path, routeSpace) => {
+    let normalized = path;
+    if (!routeSpace.caseSensitive) {
+        normalized = normalized
+            .split('/')
+            .map((segment) => segment.startsWith(':') ? segment : segment.toLowerCase())
+            .join('/');
+    }
+    if (routeSpace.trailingSlash === 'remove' && normalized.length > 1)
+        normalized = normalized.replace(/\/+$/, '');
+    if (routeSpace.trailingSlash === 'require' && normalized.length > 1 && !normalized.endsWith('/'))
+        normalized += '/';
+    return normalized;
+};
+const compileRouteClaims = (input) => {
+    const registrations = input.routeSpaces.map((entry, index) => {
+        const revisionRef = declarative_control_1.RevisionRefSchema.parse(entry.revisionRef);
+        const routeSpace = declarative_control_1.RouteSpaceSchema.parse(entry.routeSpace);
+        if (revisionRef.kind !== 'route-space' || revisionRef.id !== routeSpace.routeSpaceId) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeSpaces[${index}]`, 'RouteSpace registration identity does not match its pinned revision.');
+        }
+        return { revisionRef, routeSpace };
+    });
+    assertUniqueRegistryKeys(registrations.map((entry) => (0, exports.revisionRefKey)(entry.revisionRef)), 'routeSpaces');
+    const routeSpacesByRevision = new Map(registrations.map((entry) => [(0, exports.revisionRefKey)(entry.revisionRef), entry.routeSpace]));
+    const normalizedPaths = new Set();
+    const compiled = [];
+    input.claims.forEach((inputClaim, index) => {
+        const parsedClaim = 'surface' in inputClaim
+            ? declarative_control_1.RouteClaimSchema.parse(inputClaim)
+            : declarative_control_1.LegacyRouteClaimSchema.parse(inputClaim);
+        const routeSpace = routeSpacesByRevision.get((0, exports.revisionRefKey)(parsedClaim.routeSpaceRevisionRef));
+        if (!routeSpace)
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISSING', `routeClaims[${index}].routeSpaceRevisionRef`, 'No exact RouteSpace registration exists.');
+        const claim = declarative_control_1.RouteClaimSchema.parse({
+            ...parsedClaim,
+            surface: 'surface' in parsedClaim ? parsedClaim.surface : routeSpace.supportedSurface,
+        });
+        if (routeSpace.supportedSurface !== claim.surface) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeClaims[${index}].surface`, `Route claim surface ${claim.surface} does not match RouteSpace ${routeSpace.routeSpaceId}.`);
+        }
+        if (claim.surface !== input.surface)
+            return;
+        const normalizedPath = normalizePath(claim.pathTemplate, routeSpace);
+        const knownParameters = new Set(routeSpace.parameters.map((parameter) => parameter.name));
+        const pathParameters = [...normalizedPath.matchAll(/:([A-Za-z][A-Za-z0-9_-]*)/g)].map((match) => match[1]);
+        if (new Set(pathParameters).size !== pathParameters.length) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeClaims[${index}].pathTemplate`, 'Route parameters must be unique within a path.');
+        }
+        const unknownParameter = pathParameters.find((parameter) => !knownParameters.has(parameter));
+        if (unknownParameter) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeClaims[${index}].pathTemplate`, `Route parameter ${unknownParameter} is not declared by ${routeSpace.routeSpaceId}.`);
+        }
+        const reserved = routeSpace.reservedPaths.some((candidate) => {
+            const normalizedReserved = normalizePath(candidate, routeSpace);
+            return normalizedPath === normalizedReserved || normalizedPath.startsWith(`${normalizedReserved}/`);
+        });
+        if (reserved)
+            throw new DeclarativeControlCompilationError('ROUTE_RESERVED', `routeClaims[${index}].pathTemplate`, `Route ${normalizedPath} is reserved by ${routeSpace.routeSpaceId}.`);
+        const routeIdentity = `${(0, exports.revisionRefKey)(claim.routeSpaceRevisionRef)}:${normalizedPath}`;
+        if (normalizedPaths.has(routeIdentity))
+            throw new DeclarativeControlCompilationError('ROUTE_CONFLICT', `routeClaims[${index}].pathTemplate`, `Duplicate normalized route ${normalizedPath}.`);
+        normalizedPaths.add(routeIdentity);
+        compiled.push(declarative_control_1.CompiledRouteClaimSchema.parse({
+            ...claim,
+            normalizedPath,
+            matcher: {
+                surface: claim.surface,
+                caseSensitive: routeSpace.caseSensitive,
+                trailingSlash: routeSpace.trailingSlash,
+                parameters: routeSpace.parameters,
+            },
+        }));
+    });
+    if (!compiled.some((claim) => claim.kind === 'canonical')) {
+        throw new DeclarativeControlCompilationError('ROUTE_CONFLICT', 'routeClaims', 'At least one canonical route claim is required.');
+    }
+    return Object.freeze(compiled);
+};
+exports.compileRouteClaims = compileRouteClaims;
+const routeParameterPattern = (type) => {
+    if (type === 'integer')
+        return /^-?\d+$/;
+    if (type === 'uuid')
+        return /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+    if (type === 'slug')
+        return /^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/;
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+};
+/**
+ * Materializes the browser URL owned by a RouteSpace from an application-relative
+ * compiled route. Declarations and runtime resolution remain application-relative;
+ * only this boundary applies product bases such as /:teamId or /kernel.
+ */
+const materializeRouteSpacePath = (input) => {
+    const routeSpace = declarative_control_1.RouteSpaceSchema.parse(input.routeSpace);
+    const applicationPath = declarative_control_1.RoutePathTemplateSchema.parse(input.applicationPath);
+    const basePath = routeSpace.basePath === '/' ? '' : routeSpace.basePath.replace(/\/+$/, '');
+    let browserTemplate = normalizePath(`${basePath}${applicationPath === '/' ? '/' : applicationPath}` || '/', routeSpace);
+    const parameters = input.parameters || {};
+    const declared = new Map(routeSpace.parameters.map((parameter) => [parameter.name, parameter]));
+    const referenced = [...browserTemplate.matchAll(/:([A-Za-z][A-Za-z0-9_-]*)/g)].map((match) => match[1]);
+    for (const name of referenced) {
+        const definition = declared.get(name);
+        const raw = parameters[name];
+        if (!definition || raw === undefined || raw === null || String(raw).trim() === '') {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'parameters', `Route parameter ${name} is not resolved by ${routeSpace.routeSpaceId}.`);
+        }
+        const value = String(raw);
+        if (!routeParameterPattern(definition.type).test(value)) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `parameters.${name}`, `Route parameter ${name} does not satisfy ${definition.type}.`);
+        }
+        browserTemplate = browserTemplate.replace(`:${name}`, encodeURIComponent(value));
+    }
+    const unknown = Object.keys(parameters).find((name) => !declared.has(name));
+    if (unknown)
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `parameters.${unknown}`, `RouteSpace ${routeSpace.routeSpaceId} does not declare ${unknown}.`);
+    return browserTemplate;
+};
+exports.materializeRouteSpacePath = materializeRouteSpacePath;
+const renderTreeDepth = (tree) => {
+    const byId = new Map(tree.nodes.map((node) => [node.nodeId, node]));
+    let maximum = 0;
+    tree.nodes.forEach((node) => {
+        let depth = 1;
+        let parentId = node.parentNodeId;
+        while (parentId) {
+            depth += 1;
+            parentId = byId.get(parentId)?.parentNodeId;
+        }
+        maximum = Math.max(maximum, depth);
+    });
+    return maximum;
+};
+const compareLegacyEntityRef = (reference, revision) => reference.kind === revision.kind
+    && reference.id === revision.id
+    && String(reference.version) === String(revision.revision)
+    && reference.ownerRepo === revision.ownerRepo;
+const pageDependencies = (page, compilerRevisionRef) => [
+    ...page.routeClaims.map((claim) => ({ role: 'route-space', revisionRef: claim.routeSpaceRevisionRef })),
+    { role: 'shell', revisionRef: page.shellRevisionRef },
+    ...page.capabilityInstances.flatMap((instance) => [
+        { role: 'capability', revisionRef: instance.capabilityRevisionRef },
+        { role: 'provider', revisionRef: instance.providerRevisionRef },
+        { role: 'schema', revisionRef: instance.propertySchemaRevisionRef },
+    ]),
+    ...page.ontologyBindings.flatMap((binding) => [
+        { role: 'ontology-definition', revisionRef: binding.ontologyDefinitionRevisionRef },
+        ...(binding.viewRevisionRef ? [{ role: 'view', revisionRef: binding.viewRevisionRef }] : []),
+        ...(binding.projectionRevisionRef ? [{ role: 'projection', revisionRef: binding.projectionRevisionRef }] : []),
+        { role: 'schema', revisionRef: binding.renderModelSchemaRevisionRef },
+    ]),
+    ...page.actionBindings.flatMap((binding) => [
+        { role: 'action', revisionRef: binding.commandRevisionRef },
+        { role: 'schema', revisionRef: binding.sourceIntentSchemaRevisionRef },
+        { role: 'schema', revisionRef: binding.inputSchemaRevisionRef },
+        { role: 'schema', revisionRef: binding.resultSchemaRevisionRef },
+        ...(binding.compensationCommandRevisionRef ? [{ role: 'action', revisionRef: binding.compensationCommandRevisionRef }] : []),
+    ]),
+    ...page.tokenRevisionRefs.map((revisionRef) => ({ role: 'token', revisionRef })),
+    { role: 'performance-budget', revisionRef: page.performanceBudgetRef },
+    { role: 'observation-policy', revisionRef: page.observationPolicyRevisionRef },
+    { role: 'compiler', revisionRef: compilerRevisionRef },
+];
+const compilePageRuntimeBundle = (input) => {
+    const page = declarative_control_1.PageSchema.parse(input.page);
+    const pageRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.pageRevisionRef);
+    const release = declarative_control_1.PageReleaseSchema.parse(input.release);
+    const releaseRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.releaseRevisionRef);
+    const compilerRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.compilerRevisionRef);
+    const scope = declarative_control_1.TenantScopeSchema.parse(page.tenantScope);
+    assertSameTenantScope(release.tenantScope, scope, 'release.tenantScope');
+    assertRevisionIdentity(pageRevisionRef, 'page', page.pageId, scope, 'pageRevisionRef');
+    assertRevisionIdentity(release.pageRevisionRef, 'page', page.pageId, scope, 'release.pageRevisionRef');
+    if (!(0, exports.sameRevisionRef)(pageRevisionRef, release.pageRevisionRef))
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.pageRevisionRef', 'Release does not pin the supplied Page revision.');
+    assertRevisionIdentity(releaseRevisionRef, 'page-release', release.releaseSlotId, scope, 'releaseRevisionRef');
+    requireReleaseReady(release);
+    requireDependencies(release.dependencySnapshot, pageDependencies(page, compilerRevisionRef));
+    assertDependencyScopes(release.dependencySnapshot, scope);
+    if (page.renderTree.nodes.length > input.limits.maxRenderNodes)
+        throw new DeclarativeControlCompilationError('RENDER_NODE_LIMIT_EXCEEDED', 'page.renderTree.nodes', 'RenderTree exceeds the caller-approved node limit.');
+    if (renderTreeDepth(page.renderTree) > input.limits.maxRenderDepth)
+        throw new DeclarativeControlCompilationError('RENDER_DEPTH_EXCEEDED', 'page.renderTree.nodes', 'RenderTree exceeds the caller-approved depth limit.');
+    const renderTree = (0, render_tree_compiler_1.compileRenderTree)(page.renderTree).tree;
+    const instancesByNode = new Map(page.capabilityInstances.map((instance) => [instance.nodeId, instance]));
+    const registrations = input.capabilityRegistry.map((registration, registrationIndex) => ({
+        ...registration,
+        capabilityRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.capabilityRevisionRef),
+        providerRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.providerRevisionRef),
+        inputPorts: registration.inputPorts.map((port, portIndex) => {
+            const schemaRevisionRef = declarative_control_1.RevisionRefSchema.parse(port.schemaRevisionRef);
+            if (schemaRevisionRef.kind !== 'schema') {
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `capabilityRegistry[${registrationIndex}].inputPorts[${portIndex}].schemaRevisionRef`, 'Capability ports must pin schema revisions.');
+            }
+            return { ...port, schemaRevisionRef };
+        }),
+        outputPorts: registration.outputPorts.map((port, portIndex) => {
+            const schemaRevisionRef = declarative_control_1.RevisionRefSchema.parse(port.schemaRevisionRef);
+            if (schemaRevisionRef.kind !== 'schema') {
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `capabilityRegistry[${registrationIndex}].outputPorts[${portIndex}].schemaRevisionRef`, 'Capability ports must pin schema revisions.');
+            }
+            return { ...port, schemaRevisionRef };
+        }),
+    }));
+    assertUniqueRegistryKeys(registrations.map((registration) => `${(0, exports.revisionRefKey)(registration.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(registration.providerRevisionRef)}`), 'capabilityRegistry');
+    const registrationsByPair = new Map(registrations.map((registration) => [
+        `${(0, exports.revisionRefKey)(registration.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(registration.providerRevisionRef)}`,
+        registration,
+    ]));
+    page.capabilityInstances.forEach((instance, index) => {
+        const node = renderTree.nodes.find((candidate) => candidate.nodeId === instance.nodeId);
+        if (!node || !compareLegacyEntityRef(node.capabilityRef, instance.capabilityRevisionRef)
+            || !node.providerRef || !compareLegacyEntityRef(node.providerRef, instance.providerRevisionRef)
+            || node.pageRef.id !== page.pageId) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}]`, 'RenderTree node identity does not match the declared capability/provider instance.');
+        }
+        const registration = registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        if (!registration?.editorEligible) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_NOT_EDITOR_ELIGIBLE', `capabilityInstances[${index}]`, 'Capability/provider pair is not editor-eligible.');
+        }
+        if (instance.allowedSideEffects.some((sideEffect) => !registration.allowedSideEffects.includes(sideEffect))) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}].allowedSideEffects`, 'Page requests undeclared provider side effects.');
+        }
+    });
+    page.ontologyBindings.forEach((binding, index) => {
+        const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.target.capabilityInstanceId);
+        const registration = instance && registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const port = registration?.inputPorts.find((candidate) => candidate.name === binding.target.port);
+        if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.renderModelSchemaRevisionRef)) {
+            throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `ontologyBindings[${index}].target.port`, 'Ontology render model does not match the registered capability input port.');
+        }
+    });
+    page.actionBindings.forEach((binding, index) => {
+        const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.source.capabilityInstanceId);
+        const registration = instance && registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const port = registration?.outputPorts.find((candidate) => candidate.name === binding.source.port);
+        if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.sourceIntentSchemaRevisionRef)) {
+            throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `actionBindings[${index}].sourceIntentSchemaRevisionRef`, 'Action source intent does not match the registered capability output port.');
+        }
+    });
+    const routeClaims = (0, exports.compileRouteClaims)({ claims: page.routeClaims, routeSpaces: input.routeSpaces, surface: release.target.surface });
+    const releaseRoute = routeClaims.find((claim) => claim.kind === 'canonical' && claim.normalizedPath === release.target.normalizedPath);
+    if (!releaseRoute || !(0, exports.sameRevisionRef)(releaseRoute.routeSpaceRevisionRef, release.target.routeSpaceRevisionRef)) {
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match a canonical Page route claim.');
+    }
+    if (!page.supportedSurfaces.includes(release.target.surface)) {
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target.surface', 'Page does not support the release surface.');
+    }
+    const unsigned = {
+        contract: 'PageRuntimeBundle',
+        schemaVersion: 1,
+        tenantScope: scope,
+        releaseRevisionRef,
+        compilerRevisionRef,
+        generation: input.generation,
+        dependencySnapshot: release.dependencySnapshot,
+        rebuildable: true,
+        diagnostics: [],
+        pageId: page.pageId,
+        pageRevisionRef,
+        surface: release.target.surface,
+        routeClaims,
+        shellRevisionRef: page.shellRevisionRef,
+        renderTree,
+        capabilityInstances: page.capabilityInstances,
+        ontologyBindings: page.ontologyBindings,
+        actionBindings: page.actionBindings,
+        pageAccessPolicy: page.pageAccessPolicy,
+        tokenRevisionRefs: page.tokenRevisionRefs,
+        performanceBudgetRef: page.performanceBudgetRef,
+        observationPolicyRevisionRef: page.observationPolicyRevisionRef,
+        privacyClassification: page.privacyClassification,
+    };
+    return deepFreeze(declarative_control_1.PageRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+};
+exports.compilePageRuntimeBundle = compilePageRuntimeBundle;
+const workbenchDependencyRole = (kind) => {
+    switch (kind) {
+        case 'workflow': return 'workflow';
+        case 'agent': return 'agent';
+        case 'capability': return 'capability';
+        case 'design': return 'design';
+        case 'built-in-application': return 'built-in-application';
+        default: return 'workflow';
+    }
+};
+const workbenchDependencies = (workbench, compilerRevisionRef) => [
+    ...workbench.routeClaims.map((claim) => ({ role: 'route-space', revisionRef: claim.routeSpaceRevisionRef })),
+    ...workbench.appInstances.flatMap((instance) => [
+        { role: workbenchDependencyRole(instance.targetRevisionRef.kind), revisionRef: instance.targetRevisionRef },
+        { role: 'provider', revisionRef: instance.providerRevisionRef },
+        { role: 'schema', revisionRef: instance.inputSchemaRevisionRef },
+    ]),
+    { role: 'capability', revisionRef: workbench.layout.hostCapabilityRevisionRef },
+    { role: 'provider', revisionRef: workbench.layout.hostProviderRevisionRef },
+    { role: 'layout-policy', revisionRef: workbench.layout.layoutPolicyRevisionRef },
+    ...workbench.layout.tokenRevisionRefs.map((revisionRef) => ({ role: 'token', revisionRef })),
+    { role: 'performance-budget', revisionRef: workbench.performanceBudgetRef },
+    { role: 'observation-policy', revisionRef: workbench.observationPolicyRevisionRef },
+    { role: 'compiler', revisionRef: compilerRevisionRef },
+];
+const compileWorkbenchRuntimeBundle = (input) => {
+    const workbench = declarative_control_1.WorkbenchSchema.parse(input.workbench);
+    const workbenchRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.workbenchRevisionRef);
+    const release = declarative_control_1.WorkbenchReleaseSchema.parse(input.release);
+    const releaseRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.releaseRevisionRef);
+    const compilerRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.compilerRevisionRef);
+    const scope = declarative_control_1.TenantScopeSchema.parse(workbench.tenantScope);
+    assertSameTenantScope(release.tenantScope, scope, 'release.tenantScope');
+    if (workbench.purpose === 'template')
+        throw new DeclarativeControlCompilationError('WORKBENCH_TEMPLATE_UNRELEASABLE', 'workbench.purpose', 'Workbench templates cannot be activated.');
+    if (workbench.groups.length > input.limits.maxWorkbenchGroups || workbench.appInstances.length > input.limits.maxWorkbenchInstances) {
+        throw new DeclarativeControlCompilationError('WORKBENCH_INSTANCE_LIMIT_EXCEEDED', 'workbench', 'Workbench exceeds caller-approved compilation limits.');
+    }
+    assertRevisionIdentity(workbenchRevisionRef, 'workbench', workbench.workbenchId, scope, 'workbenchRevisionRef');
+    assertRevisionIdentity(release.workbenchRevisionRef, 'workbench', workbench.workbenchId, scope, 'release.workbenchRevisionRef');
+    if (!(0, exports.sameRevisionRef)(workbenchRevisionRef, release.workbenchRevisionRef))
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.workbenchRevisionRef', 'Release does not pin the supplied Workbench revision.');
+    assertRevisionIdentity(releaseRevisionRef, 'workbench-release', release.releaseSlotId, scope, 'releaseRevisionRef');
+    if (release.target.workbenchId !== workbench.workbenchId)
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.target.workbenchId', 'Release target does not match Workbench identity.');
+    requireReleaseReady(release);
+    requireDependencies(release.dependencySnapshot, workbenchDependencies(workbench, compilerRevisionRef));
+    assertDependencyScopes(release.dependencySnapshot, scope);
+    const routeClaims = (0, exports.compileRouteClaims)({ claims: workbench.routeClaims, routeSpaces: input.routeSpaces, surface: release.target.surface });
+    const releaseRoute = routeClaims.find((claim) => claim.kind === 'canonical' && claim.normalizedPath === release.target.normalizedPath);
+    if (!releaseRoute || !(0, exports.sameRevisionRef)(releaseRoute.routeSpaceRevisionRef, release.target.routeSpaceRevisionRef)) {
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match a canonical Workbench route claim.');
+    }
+    const targetRegistry = input.targetRegistry.map((registration) => ({
+        stableTargetRef: declarative_control_1.StableRefSchema.parse(registration.stableTargetRef),
+        targetRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.targetRevisionRef),
+        accessPolicy: declarative_control_1.AccessPolicySchema.parse(registration.accessPolicy),
+    }));
+    assertUniqueRegistryKeys(targetRegistry.map((registration) => (0, exports.stableRefKey)(registration.stableTargetRef)), 'targetRegistry');
+    const targetsByStableRef = new Map(targetRegistry.map((registration) => [(0, exports.stableRefKey)(registration.stableTargetRef), registration]));
+    const groupsById = new Map(workbench.groups.map((group) => [group.groupId, group]));
+    const appInstances = workbench.appInstances.map((instance, index) => {
+        const stableTarget = declarative_control_1.StableRefSchema.parse({
+            kind: instance.targetRevisionRef.kind,
+            id: instance.targetRevisionRef.id,
+            ownerRepo: instance.targetRevisionRef.ownerRepo,
+            visibility: instance.targetRevisionRef.visibility,
+            ...(instance.targetRevisionRef.tenantScope ? { tenantScope: instance.targetRevisionRef.tenantScope } : {}),
+        });
+        const registration = targetsByStableRef.get((0, exports.stableRefKey)(stableTarget));
+        if (!registration || !(0, exports.sameStableRef)(registration.stableTargetRef, stableFromRevision(registration.targetRevisionRef))
+            || !(0, exports.sameRevisionRef)(registration.targetRevisionRef, instance.targetRevisionRef)) {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `appInstances[${index}].targetRevisionRef`, 'Workbench app target is not present at the exact registered revision.');
+        }
+        assertTenantCompatible(instance.targetRevisionRef, scope, `appInstances[${index}].targetRevisionRef`);
+        const group = groupsById.get(instance.groupId);
+        const chain = [workbench.workbenchAccessPolicy, ...(group?.accessPolicy ? [group.accessPolicy] : []), instance.accessPolicy];
+        if (!(0, exports.accessPolicyChainImplies)(chain, registration.accessPolicy)) {
+            throw new DeclarativeControlCompilationError('AUDIENCE_WIDER_THAN_TARGET', `appInstances[${index}].accessPolicy`, 'Workbench and instance audience is wider than the target audience.');
+        }
+        return { ...instance, targetAccessPolicy: registration.accessPolicy };
+    });
+    const unsigned = {
+        contract: 'WorkbenchRuntimeBundle',
+        schemaVersion: 1,
+        tenantScope: scope,
+        releaseRevisionRef,
+        compilerRevisionRef,
+        generation: input.generation,
+        dependencySnapshot: release.dependencySnapshot,
+        rebuildable: true,
+        diagnostics: [],
+        workbenchId: workbench.workbenchId,
+        workbenchRevisionRef,
+        surface: release.target.surface,
+        routeClaims,
+        groups: workbench.groups,
+        appInstances,
+        defaultEntry: workbench.defaultEntry,
+        layout: workbench.layout,
+        workbenchAccessPolicy: workbench.workbenchAccessPolicy,
+        personalPreferencesPolicy: workbench.personalPreferencesPolicy,
+        target: { ...release.target, routeClaim: releaseRoute },
+        performanceBudgetRef: workbench.performanceBudgetRef,
+        observationPolicyRevisionRef: workbench.observationPolicyRevisionRef,
+        privacyClassification: workbench.privacyClassification,
+    };
+    return deepFreeze(declarative_control_1.WorkbenchRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+};
+exports.compileWorkbenchRuntimeBundle = compileWorkbenchRuntimeBundle;
+const navigationDepth = (navigation) => {
+    const byId = new Map(navigation.nodes.map((node) => [node.nodeId, node]));
+    let maximum = 0;
+    navigation.nodes.forEach((node) => {
+        let depth = 1;
+        let parentId = node.parentNodeId;
+        while (parentId) {
+            depth += 1;
+            parentId = byId.get(parentId)?.parentNodeId ?? null;
+        }
+        maximum = Math.max(maximum, depth);
+    });
+    return maximum;
+};
+const orderedNavigationNodes = (navigation) => {
+    const children = new Map();
+    navigation.nodes.forEach((node) => {
+        const parent = node.parentNodeId ?? '';
+        const siblings = children.get(parent) ?? [];
+        children.set(parent, [...siblings, node]);
+    });
+    children.forEach((siblings) => siblings.sort((left, right) => left.order - right.order || left.nodeId.localeCompare(right.nodeId)));
+    const ordered = [];
+    const append = (parentId) => {
+        for (const node of children.get(parentId) ?? []) {
+            ordered.push(node);
+            append(node.nodeId);
+        }
+    };
+    append('');
+    return ordered;
+};
+const navigationDependencies = (navigation, release, compilerRevisionRef) => [
+    ...release.resolvedTargets.flatMap((target) => [
+        { role: target.targetRevisionRef.kind === 'domain-command' ? 'action' : target.targetRevisionRef.kind, revisionRef: target.targetRevisionRef },
+        ...(target.releaseRevisionRef ? [{ role: target.releaseRevisionRef.kind, revisionRef: target.releaseRevisionRef }] : []),
+    ]),
+    { role: 'performance-budget', revisionRef: navigation.performanceBudgetRef },
+    { role: 'observation-policy', revisionRef: navigation.observationPolicyRevisionRef },
+    { role: 'compiler', revisionRef: compilerRevisionRef },
+];
+const compileNavigationRuntimeBundle = (input) => {
+    const navigation = declarative_control_1.NavigationSchema.parse(input.navigation);
+    const navigationRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.navigationRevisionRef);
+    const release = declarative_control_1.NavigationReleaseSchema.parse(input.release);
+    const releaseRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.releaseRevisionRef);
+    const compilerRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.compilerRevisionRef);
+    const scope = declarative_control_1.TenantScopeSchema.parse(navigation.tenantScope);
+    assertSameTenantScope(release.tenantScope, scope, 'release.tenantScope');
+    if (navigation.nodes.length > input.limits.maxNavigationNodes)
+        throw new DeclarativeControlCompilationError('NAV_NODE_LIMIT_EXCEEDED', 'navigation.nodes', 'Navigation exceeds the caller-approved node limit.');
+    if (navigationDepth(navigation) > input.limits.maxNavigationDepth)
+        throw new DeclarativeControlCompilationError('NAV_DEPTH_EXCEEDED', 'navigation.nodes', 'Navigation exceeds the caller-approved depth limit.');
+    assertRevisionIdentity(navigationRevisionRef, 'navigation', navigation.navigationId, scope, 'navigationRevisionRef');
+    assertRevisionIdentity(release.navigationRevisionRef, 'navigation', navigation.navigationId, scope, 'release.navigationRevisionRef');
+    if (!(0, exports.sameRevisionRef)(navigationRevisionRef, release.navigationRevisionRef))
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.navigationRevisionRef', 'Release does not pin the supplied Navigation revision.');
+    assertRevisionIdentity(releaseRevisionRef, 'navigation-release', release.releaseSlotId, scope, 'releaseRevisionRef');
+    if (release.target.surface !== navigation.supportedSurfaces.find((surface) => surface === release.target.surface)
+        || !navigation.placements.includes(release.target.placement)) {
+        throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.target', 'Navigation release target is not declared by the Navigation record.');
+    }
+    requireReleaseReady(release);
+    requireDependencies(release.dependencySnapshot, navigationDependencies(navigation, release, compilerRevisionRef));
+    assertDependencyScopes(release.dependencySnapshot, scope);
+    const targetRegistry = input.targetRegistry.map((registration, index) => {
+        const common = {
+            stableTargetRef: declarative_control_1.StableRefSchema.parse(registration.stableTargetRef),
+            targetRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.targetRevisionRef),
+            surface: declarative_control_1.ProductSurfaceSchema.parse(registration.surface),
+            accessPolicy: declarative_control_1.AccessPolicySchema.parse(registration.accessPolicy),
+        };
+        if (registration.kind === 'route') {
+            const routeClaim = declarative_control_1.CompiledRouteClaimSchema.parse(registration.routeClaim);
+            if (routeClaim.surface !== common.surface) {
+                throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `targetRegistry[${index}].routeClaim.surface`, 'Navigation route claim must match its registered surface.');
+            }
+            return {
+                ...common,
+                kind: 'route',
+                releaseRevisionRef: registration.releaseRevisionRef ? declarative_control_1.RevisionRefSchema.parse(registration.releaseRevisionRef) : undefined,
+                routeClaim,
+            };
+        }
+        if (registration.kind === 'registered-menu-action') {
+            const sourceCatalogRevisionRef = declarative_control_1.RevisionRefSchema.parse(registration.sourceCatalogRevisionRef);
+            if (sourceCatalogRevisionRef.kind !== 'application-menu-catalog' || registration.targetRevisionRef.kind !== 'menu-action') {
+                throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Registered Menu Actions require exact menu-action and application-menu-catalog revisions.');
+            }
+            if (registration.inputSchemaRef && !registration.validateInput) {
+                throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Registered Menu Actions with input schemas require the active catalog validator.');
+            }
+            return { ...common, kind: 'registered-menu-action', applicationId: registration.applicationId, actionRef: registration.actionRef, inputSchemaRef: registration.inputSchemaRef, validateInput: registration.validateInput, sourceCatalogRevisionRef };
+        }
+        if (registration.targetRevisionRef.kind !== 'domain-command') {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Governed DomainCommand actions require an exact domain-command revision.');
+        }
+        const inputSchemaRevisionRef = declarative_control_1.RevisionRefSchema.parse(registration.inputSchemaRevisionRef);
+        const resultSchemaRevisionRef = registration.resultSchemaRevisionRef
+            ? declarative_control_1.RevisionRefSchema.parse(registration.resultSchemaRevisionRef)
+            : undefined;
+        if (inputSchemaRevisionRef.kind !== 'schema' || (resultSchemaRevisionRef && resultSchemaRevisionRef.kind !== 'schema')) {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Governed DomainCommand actions require exact input and output Schema revisions.');
+        }
+        return { ...common, kind: 'governed-domain-command', inputSchemaRevisionRef, resultSchemaRevisionRef };
+    });
+    assertUniqueRegistryKeys(targetRegistry.map((registration) => (0, exports.stableRefKey)(registration.stableTargetRef)), 'targetRegistry');
+    const targetsByStableRef = new Map(targetRegistry.map((registration) => [(0, exports.stableRefKey)(registration.stableTargetRef), registration]));
+    const releasedByNodeId = new Map(release.resolvedTargets.map((target) => [target.nodeId, target]));
+    const nodesById = new Map(navigation.nodes.map((node) => [node.nodeId, node]));
+    const nodes = orderedNavigationNodes(navigation).map((node, index) => {
+        const ancestors = [];
+        let parentId = node.parentNodeId;
+        while (parentId) {
+            const parent = nodesById.get(parentId);
+            if (parent?.kind === 'group')
+                ancestors.unshift(parent.audience);
+            parentId = parent?.parentNodeId ?? null;
+        }
+        if (node.kind !== 'target')
+            return { ...node, ancestorAccessPolicies: ancestors };
+        if (!['page', 'workbench', 'menu-action', 'domain-command'].includes(node.targetRef.kind)) {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `nodes[${index}].targetRef.kind`, 'Navigation targets may reference only Page, Workbench, registered Menu Action, or DomainCommand identities.');
+        }
+        const registration = targetsByStableRef.get((0, exports.stableRefKey)(node.targetRef));
+        const released = releasedByNodeId.get(node.nodeId);
+        if (!registration || !released
+            || !(0, exports.sameStableRef)(registration.stableTargetRef, stableFromRevision(registration.targetRevisionRef))
+            || !(0, exports.sameStableRef)(registration.stableTargetRef, released.stableTargetRef)
+            || !(0, exports.sameRevisionRef)(registration.targetRevisionRef, released.targetRevisionRef)
+            || (registration.kind === 'route' && (Boolean(registration.releaseRevisionRef) !== Boolean(released.releaseRevisionRef)
+                || (registration.releaseRevisionRef && released.releaseRevisionRef && !(0, exports.sameRevisionRef)(registration.releaseRevisionRef, released.releaseRevisionRef))))) {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `nodes[${index}].targetRef`, 'Navigation target is not resolved to the exact active release recorded by NavigationRelease.');
+        }
+        if (registration.surface !== release.target.surface) {
+            throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `nodes[${index}].targetRef`, 'Navigation target is active on another surface.');
+        }
+        assertTenantCompatible(registration.targetRevisionRef, scope, `nodes[${index}].targetRef`);
+        if (!(0, exports.accessPolicyChainImplies)([...ancestors, node.audience], registration.accessPolicy)) {
+            throw new DeclarativeControlCompilationError('AUDIENCE_WIDER_THAN_TARGET', `nodes[${index}].audience`, 'Effective Navigation audience is wider than the target audience.');
+        }
+        const mappedInput = Object.fromEntries(Object.entries(node.parameterMapping).map(([name, source]) => {
+            if (source.kind !== 'constant') {
+                throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `nodes[${index}].parameterMapping.${name}`, 'Navigation actions accept only publication-time constant input.');
+            }
+            return [name, source.value];
+        }));
+        let resolvedTarget;
+        if (registration.kind === 'route') {
+            resolvedTarget = { ...released, kind: 'route', accessPolicy: registration.accessPolicy, routeClaim: registration.routeClaim };
+        }
+        else if (registration.kind === 'registered-menu-action') {
+            if (!registration.inputSchemaRef && Object.keys(mappedInput).length > 0) {
+                throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `nodes[${index}].parameterMapping`, 'The registered Menu Action does not accept input.');
+            }
+            let input;
+            try {
+                input = common_1.JsonObjectSchema.parse(registration.validateInput ? registration.validateInput(mappedInput) : mappedInput);
+            }
+            catch (error) {
+                throw new DeclarativeControlCompilationError('NAV_ACTION_INPUT_INVALID', `nodes[${index}].parameterMapping`, `Registered Menu Action input failed its active catalog schema: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            const sourceDependency = release.dependencySnapshot.find((dependency) => dependency.role === 'application-menu-catalog' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.sourceCatalogRevisionRef));
+            if (!sourceDependency)
+                throw new DeclarativeControlCompilationError('DEPENDENCY_MISSING', `nodes[${index}].targetRef`, 'Registered Menu Action source catalog is not pinned by NavigationRelease.');
+            resolvedTarget = {
+                ...released,
+                kind: 'registered-menu-action',
+                accessPolicy: registration.accessPolicy,
+                execution: 'client',
+                applicationId: registration.applicationId,
+                actionRef: registration.actionRef,
+                ...(registration.inputSchemaRef ? { inputSchemaRef: registration.inputSchemaRef } : {}),
+                input,
+                sourceCatalogRevisionRef: registration.sourceCatalogRevisionRef,
+            };
+        }
+        else {
+            const inputDependency = release.dependencySnapshot.find((dependency) => dependency.role === 'schema' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.inputSchemaRevisionRef));
+            const resultDependency = registration.resultSchemaRevisionRef
+                ? release.dependencySnapshot.find((dependency) => dependency.role === 'schema' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.resultSchemaRevisionRef))
+                : undefined;
+            if (!inputDependency || (registration.resultSchemaRevisionRef && !resultDependency)) {
+                throw new DeclarativeControlCompilationError('DEPENDENCY_MISSING', `nodes[${index}].targetRef`, 'Governed DomainCommand schemas are not pinned by NavigationRelease.');
+            }
+            resolvedTarget = {
+                ...released,
+                kind: 'governed-domain-command',
+                accessPolicy: registration.accessPolicy,
+                execution: 'server',
+                commandRevisionRef: registration.targetRevisionRef,
+                inputSchemaRevisionRef: registration.inputSchemaRevisionRef,
+                ...(registration.resultSchemaRevisionRef ? { resultSchemaRevisionRef: registration.resultSchemaRevisionRef } : {}),
+                input: common_1.JsonObjectSchema.parse(mappedInput),
+            };
+        }
+        return {
+            ...node,
+            ancestorAccessPolicies: ancestors,
+            resolvedTarget,
+        };
+    });
+    const unsigned = {
+        contract: 'NavigationRuntimeBundle',
+        schemaVersion: 1,
+        tenantScope: scope,
+        releaseRevisionRef,
+        compilerRevisionRef,
+        generation: input.generation,
+        dependencySnapshot: release.dependencySnapshot,
+        rebuildable: true,
+        diagnostics: [],
+        navigationId: navigation.navigationId,
+        navigationRevisionRef,
+        surface: release.target.surface,
+        placement: release.target.placement,
+        nodes,
+        performanceBudgetRef: navigation.performanceBudgetRef,
+        observationPolicyRevisionRef: navigation.observationPolicyRevisionRef,
+    };
+    return deepFreeze(declarative_control_1.NavigationRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+};
+exports.compileNavigationRuntimeBundle = compileNavigationRuntimeBundle;
+const validateWorkbenchRuntimeSet = (bundleInputs) => {
+    const bundles = bundleInputs.map((bundle) => declarative_control_1.WorkbenchRuntimeBundleSchema.parse(bundle));
+    if (bundles.length === 0) {
+        throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', 'bundles', 'An active Workbench release set must retain at least one Workbench.');
+    }
+    const first = bundles[0];
+    const seenIds = new Set();
+    const seenOrders = new Set();
+    let defaultCount = 0;
+    bundles.forEach((bundle, index) => {
+        if (scopeKey(bundle.tenantScope) !== scopeKey(first.tenantScope)
+            || bundle.surface !== first.surface
+            || !(0, exports.sameStableRef)(bundle.target.environmentRef, first.target.environmentRef)) {
+            throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', `bundles[${index}]`, 'Workbench release set entries must share tenant, environment, and surface.');
+        }
+        if (seenIds.has(bundle.workbenchId))
+            throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', `bundles[${index}].workbenchId`, 'Workbench identities must be unique in an active release set.');
+        if (seenOrders.has(bundle.target.order))
+            throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', `bundles[${index}].target.order`, 'Workbench order values must be unique in an active release set.');
+        seenIds.add(bundle.workbenchId);
+        seenOrders.add(bundle.target.order);
+        if (bundle.target.isDefaultCandidate)
+            defaultCount += 1;
+    });
+    if (defaultCount > 1)
+        throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', 'bundles', 'An active Workbench release set may have at most one default candidate.');
+    return Object.freeze([...bundles].sort((left, right) => left.target.order - right.target.order || left.workbenchId.localeCompare(right.workbenchId)));
+};
+exports.validateWorkbenchRuntimeSet = validateWorkbenchRuntimeSet;
+const resolveWorkbenchEntry = (input) => {
+    if (input.requestedWorkbenchId) {
+        const requested = input.bundles.find((bundle) => bundle.workbenchId === input.requestedWorkbenchId);
+        if (!requested)
+            return { status: 'not-found', workbenchId: input.requestedWorkbenchId };
+        if (!input.isAllowed(requested))
+            return { status: 'forbidden', workbenchId: input.requestedWorkbenchId };
+        return { status: 'resolved', bundle: requested, source: 'explicit' };
+    }
+    const allowed = input.bundles
+        .filter(input.isAllowed)
+        .sort((left, right) => left.target.order - right.target.order || left.workbenchId.localeCompare(right.workbenchId));
+    const defaultBundle = allowed.find((bundle) => bundle.target.isDefaultCandidate);
+    if (defaultBundle)
+        return { status: 'resolved', bundle: defaultBundle, source: 'default' };
+    if (allowed[0])
+        return { status: 'resolved', bundle: allowed[0], source: 'first-accessible' };
+    return { status: 'forbidden', workbenchId: '' };
+};
+exports.resolveWorkbenchEntry = resolveWorkbenchEntry;
+//# sourceMappingURL=declarative-control-compiler.js.map