@inf-monkeys-tech/monkeys 1.0.65 → 1.0.68

package/lib/contracts/declarative-control.js

@@ -0,0 +1,1078 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.WorkbenchRuntimeBundleSchema = exports.ResolvedWorkbenchAppInstanceSchema = exports.PageRuntimeBundleSchema = exports.NavigationReleaseSchema = exports.ResolvedNavigationTargetSchema = exports.NavigationSchema = exports.NavigationNodeSchema = exports.NavigationSeparatorNodeSchema = exports.NavigationTargetNodeSchema = exports.NavigationGroupNodeSchema = exports.WorkbenchReleaseSchema = exports.WorkbenchSchema = exports.WorkbenchAppInstanceSchema = exports.WorkbenchGroupSchema = exports.PageReleaseSchema = exports.PageSchema = exports.ActionBindingSchema = exports.OntologyBindingSchema = exports.CapabilityInstanceSchema = exports.BindingSourceSchema = exports.WorkbenchIdentitySchema = exports.PublicationPlanSchema = exports.PublicationPlanOperationSchema = exports.ReleaseEvidenceSchema = exports.ReleaseValidationSchema = exports.ReleaseDependencySchema = exports.ReleaseDependencyRoleSchema = exports.ReleaseOperationSchema = exports.CompiledRouteClaimSchema = exports.CompiledRouteMatcherSchema = exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema = exports.LegacyRouteClaimSchema = exports.RouteSpaceSchema = exports.RouteSpaceParameterSchema = exports.RoutePathTemplateSchema = exports.ManagementAccessSchema = exports.AccessPolicySchema = exports.ProductSurfaceSchema = exports.DeclarativeLifecycleSchema = exports.StableRefAliasMapSchema = exports.StableRefAliasSchema = exports.RevisionRefSchema = exports.StableRefSchema = exports.ReferenceVisibilitySchema = exports.TenantScopeSchema = exports.ScopedIdentityRefSchema = exports.I18nTextSchema = exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = void 0;
+exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = exports.DeclarativeControlOntologyDefinitionSchema = exports.NavigationRuntimeBundleSchema = exports.CompiledNavigationNodeSchema = exports.CompiledNavigationSeparatorNodeSchema = exports.CompiledNavigationTargetNodeSchema = exports.CompiledNavigationGroupNodeSchema = exports.CompiledNavigationResolvedTargetSchema = exports.CompiledNavigationDomainCommandTargetSchema = void 0;
+const zod_1 = require("zod");
+const common_1 = require("./common");
+const data_1 = require("./data");
+const render_1 = require("./render");
+exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = 1;
+const uniqueArray = (values, identity) => {
+    const seen = new Set();
+    for (const value of values) {
+        const key = identity(value);
+        if (seen.has(key))
+            return key;
+        seen.add(key);
+    }
+    return undefined;
+};
+exports.I18nTextSchema = zod_1.z
+    .object({
+    defaultLocale: common_1.LocaleIdentifierSchema,
+    values: zod_1.z.record(common_1.LocaleIdentifierSchema, zod_1.z.string().trim().min(1)),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!Object.prototype.hasOwnProperty.call(value.values, value.defaultLocale)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['values', value.defaultLocale],
+            message: 'I18nText values must contain the default locale.',
+        });
+    }
+});
+exports.ScopedIdentityRefSchema = zod_1.z
+    .object({
+    kind: common_1.ContractIdentifierSchema,
+    id: common_1.ContractIdentifierSchema,
+    ownerRepo: common_1.ContractIdentifierSchema,
+})
+    .strict();
+exports.TenantScopeSchema = zod_1.z
+    .object({
+    tenantRef: exports.ScopedIdentityRefSchema,
+    dataSpaceRef: exports.ScopedIdentityRefSchema,
+    teamRef: exports.ScopedIdentityRefSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const expectedKinds = [
+        ['tenantRef', value.tenantRef, 'tenant'],
+        ['dataSpaceRef', value.dataSpaceRef, 'data-space'],
+        ['teamRef', value.teamRef, 'team'],
+    ];
+    expectedKinds.forEach(([field, reference, expectedKind]) => {
+        if (reference && reference.kind !== expectedKind) {
+            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+        }
+    });
+});
+exports.ReferenceVisibilitySchema = zod_1.z.enum(['tenant', 'global', 'public']);
+const StableRefShape = {
+    kind: common_1.ContractIdentifierSchema,
+    id: common_1.ContractIdentifierSchema,
+    ownerRepo: common_1.ContractIdentifierSchema,
+    visibility: exports.ReferenceVisibilitySchema,
+    tenantScope: exports.TenantScopeSchema.optional(),
+};
+const validateReferenceScope = (value, context) => {
+    if (value.visibility === 'tenant' && !value.tenantScope) {
+        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Tenant references require an explicit tenant scope.' });
+    }
+    if (value.visibility !== 'tenant' && value.tenantScope) {
+        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Global and public references cannot carry a tenant scope.' });
+    }
+};
+exports.StableRefSchema = zod_1.z
+    .object(StableRefShape)
+    .strict()
+    .superRefine(validateReferenceScope);
+exports.RevisionRefSchema = zod_1.z
+    .object({
+    ...StableRefShape,
+    revision: zod_1.z.number().int().positive(),
+    schemaVersion: common_1.ContractVersionSchema,
+    contentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine(validateReferenceScope);
+const scopedIdentityKey = (reference) => `${reference.kind}:${reference.id}:${reference.ownerRepo}`;
+const tenantScopeKey = (scope) => `${scopedIdentityKey(scope.tenantRef)}:${scopedIdentityKey(scope.dataSpaceRef)}:${scope.teamRef ? scopedIdentityKey(scope.teamRef) : ''}`;
+const stableRefIdentity = (reference) => `${reference.visibility}:${reference.tenantScope ? tenantScopeKey(reference.tenantScope) : ''}:${reference.kind}:${reference.id}:${reference.ownerRepo}`;
+const exactRevisionRef = (left, right) => stableRefIdentity(left) === stableRefIdentity(right)
+    && left.revision === right.revision
+    && left.schemaVersion === right.schemaVersion
+    && left.contentHash === right.contentHash;
+exports.StableRefAliasSchema = zod_1.z
+    .object({
+    aliasRef: exports.StableRefSchema,
+    canonicalRef: exports.StableRefSchema,
+    validFrom: common_1.IsoDateTimeSchema,
+    validUntil: common_1.IsoDateTimeSchema.nullable(),
+    evidenceRef: exports.RevisionRefSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.aliasRef.kind !== value.canonicalRef.kind) {
+        context.addIssue({ code: 'custom', path: ['canonicalRef', 'kind'], message: 'Alias and canonical references must have the same kind.' });
+    }
+    if (value.validUntil && value.validUntil <= value.validFrom) {
+        context.addIssue({ code: 'custom', path: ['validUntil'], message: 'Alias validUntil must be later than validFrom.' });
+    }
+});
+exports.StableRefAliasMapSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('StableRefAliasMap'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    aliases: zod_1.z.array(exports.StableRefAliasSchema),
+    contentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    const duplicate = uniqueArray(value.aliases, (entry) => stableRefIdentity(entry.aliasRef));
+    if (duplicate)
+        context.addIssue({ code: 'custom', path: ['aliases'], message: `Duplicate alias reference: ${duplicate}` });
+});
+exports.DeclarativeLifecycleSchema = zod_1.z.enum(['active', 'deprecated', 'retired']);
+exports.ProductSurfaceSchema = zod_1.z.enum(['studio', 'kernel']);
+const GroupRefSchema = exports.StableRefSchema.superRefine((value, context) => {
+    if (value.kind !== 'group')
+        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access group references must use kind group.' });
+});
+const AccessConditionRefSchema = exports.RevisionRefSchema.superRefine((value, context) => {
+    if (value.kind !== 'access-condition') {
+        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access condition references must use kind access-condition.' });
+    }
+});
+exports.AccessPolicySchema = zod_1.z
+    .object({
+    authenticated: zod_1.z.boolean(),
+    groupAllOf: zod_1.z.array(GroupRefSchema),
+    groupAnyOf: zod_1.z.array(GroupRefSchema),
+    permissionAllOf: zod_1.z.array(common_1.ContractIdentifierSchema),
+    permissionAnyOf: zod_1.z.array(common_1.ContractIdentifierSchema),
+    conditionAllOf: zod_1.z.array(AccessConditionRefSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const checks = [
+        ['groupAllOf', value.groupAllOf, (candidate) => stableRefIdentity(candidate)],
+        ['groupAnyOf', value.groupAnyOf, (candidate) => stableRefIdentity(candidate)],
+        ['permissionAllOf', value.permissionAllOf, String],
+        ['permissionAnyOf', value.permissionAnyOf, String],
+        ['conditionAllOf', value.conditionAllOf, (candidate) => `${stableRefIdentity(candidate)}@${candidate.revision}`],
+    ];
+    checks.forEach(([field, values, identity]) => {
+        if (uniqueArray(values, identity))
+            context.addIssue({ code: 'custom', path: [field], message: `${field} entries must be unique.` });
+    });
+});
+exports.ManagementAccessSchema = zod_1.z
+    .object({
+    edit: exports.AccessPolicySchema,
+    preview: exports.AccessPolicySchema,
+    publish: exports.AccessPolicySchema,
+    deactivate: exports.AccessPolicySchema,
+    rollback: exports.AccessPolicySchema,
+    retire: exports.AccessPolicySchema,
+})
+    .strict();
+exports.RoutePathTemplateSchema = zod_1.z
+    .string()
+    .trim()
+    .regex(/^\/(?!\/)/, 'Expected an application-relative path.')
+    .superRefine((value, context) => {
+    if (value.includes('?') || value.includes('#') || value.includes('\\')) {
+        context.addIssue({ code: 'custom', message: 'Route paths cannot contain query strings, fragments, or backslashes.' });
+    }
+    if (value.split('/').some((segment) => segment === '.' || segment === '..')) {
+        context.addIssue({ code: 'custom', message: 'Route paths cannot contain traversal segments.' });
+    }
+    if (/^[a-z][a-z0-9+.-]*:/i.test(value) || value.includes('://')) {
+        context.addIssue({ code: 'custom', message: 'Route paths cannot contain a scheme or host.' });
+    }
+});
+exports.RouteSpaceParameterSchema = zod_1.z
+    .object({
+    name: common_1.ContractIdentifierSchema,
+    type: zod_1.z.enum(['identifier', 'integer', 'slug', 'uuid']),
+    required: zod_1.z.boolean(),
+})
+    .strict();
+exports.RouteSpaceSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('RouteSpace'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    routeSpaceId: common_1.ContractIdentifierSchema,
+    supportedSurface: exports.ProductSurfaceSchema,
+    basePath: exports.RoutePathTemplateSchema,
+    caseSensitive: zod_1.z.boolean(),
+    trailingSlash: zod_1.z.enum(['preserve', 'remove', 'require']),
+    reservedPaths: zod_1.z.array(exports.RoutePathTemplateSchema),
+    parameters: zod_1.z.array(exports.RouteSpaceParameterSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (uniqueArray(value.parameters, (parameter) => parameter.name)) {
+        context.addIssue({ code: 'custom', path: ['parameters'], message: 'RouteSpace parameter names must be unique.' });
+    }
+    if (uniqueArray(value.reservedPaths, (path) => path)) {
+        context.addIssue({ code: 'custom', path: ['reservedPaths'], message: 'RouteSpace reserved paths must be unique.' });
+    }
+});
+const RouteClaimBaseSchema = zod_1.z
+    .object({
+    kind: zod_1.z.enum(['canonical', 'alias', 'redirect']),
+    routeSpaceRevisionRef: exports.RevisionRefSchema,
+    pathTemplate: exports.RoutePathTemplateSchema,
+    redirectTargetRef: exports.StableRefSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.routeSpaceRevisionRef.kind !== 'route-space') {
+        context.addIssue({ code: 'custom', path: ['routeSpaceRevisionRef', 'kind'], message: 'Route claims must reference a route-space revision.' });
+    }
+    if (value.kind === 'redirect' && !value.redirectTargetRef) {
+        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Redirect claims require a governed target reference.' });
+    }
+    if (value.kind !== 'redirect' && value.redirectTargetRef) {
+        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Only redirect claims may declare redirectTargetRef.' });
+    }
+});
+/**
+ * Read compatibility for schemaVersion 1 Page and Workbench records written
+ * before route claims carried their owning product surface. New declarations
+ * must use RouteClaimSchema; compilers infer this legacy form only from the
+ * exact pinned RouteSpace.
+ */
+exports.LegacyRouteClaimSchema = RouteClaimBaseSchema;
+exports.RouteClaimSchema = RouteClaimBaseSchema.safeExtend({
+    surface: exports.ProductSurfaceSchema,
+}).strict();
+exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema;
+const LegacyDeclarativeRouteClaimSchema = exports.LegacyRouteClaimSchema;
+const LegacyCompiledRouteMatcherSchema = zod_1.z
+    .object({
+    caseSensitive: zod_1.z.boolean(),
+    trailingSlash: zod_1.z.enum(['preserve', 'remove', 'require']),
+    parameters: zod_1.z.array(exports.RouteSpaceParameterSchema),
+})
+    .strict();
+exports.CompiledRouteMatcherSchema = LegacyCompiledRouteMatcherSchema.safeExtend({
+    surface: exports.ProductSurfaceSchema,
+}).strict();
+exports.CompiledRouteClaimSchema = exports.RouteClaimSchema.safeExtend({
+    normalizedPath: exports.RoutePathTemplateSchema,
+    matcher: exports.CompiledRouteMatcherSchema,
+}).strict();
+const LegacyCompiledRouteClaimSchema = exports.LegacyRouteClaimSchema.safeExtend({
+    normalizedPath: exports.RoutePathTemplateSchema,
+    matcher: LegacyCompiledRouteMatcherSchema,
+}).strict();
+const validateDeclaredRouteSurfaces = (supportedSurfaces, routeClaims, context) => {
+    if (uniqueArray(supportedSurfaces, (surface) => surface)) {
+        context.addIssue({ code: 'custom', path: ['supportedSurfaces'], message: 'Supported surfaces must be unique.' });
+    }
+    const explicitClaims = routeClaims.filter((claim) => 'surface' in claim);
+    if (explicitClaims.length > 0 && explicitClaims.length < routeClaims.length) {
+        context.addIssue({ code: 'custom', path: ['routeClaims'], message: 'Route claims must either all declare surface or all omit it for legacy compatibility.' });
+        return;
+    }
+    routeClaims.forEach((claim, index) => {
+        if ('surface' in claim && !supportedSurfaces.includes(claim.surface)) {
+            context.addIssue({ code: 'custom', path: ['routeClaims', index, 'surface'], message: 'Route claim surface must be declared by supportedSurfaces.' });
+        }
+    });
+    if (explicitClaims.length !== routeClaims.length)
+        return;
+    supportedSurfaces.forEach((surface) => {
+        const canonicalCount = explicitClaims.filter((claim) => claim.surface === surface && claim.kind === 'canonical').length;
+        if (canonicalCount !== 1) {
+            context.addIssue({ code: 'custom', path: ['routeClaims'], message: `Surface ${surface} requires exactly one canonical route claim.` });
+        }
+    });
+};
+exports.ReleaseOperationSchema = zod_1.z.enum(['activate', 'deactivate', 'rollback']);
+exports.ReleaseDependencyRoleSchema = zod_1.z.enum([
+    'route-space',
+    'shell',
+    'page',
+    'page-release',
+    'workbench',
+    'workbench-release',
+    'navigation',
+    'navigation-release',
+    'menu-action',
+    'application-menu-catalog',
+    'capability',
+    'provider',
+    'ontology-definition',
+    'view',
+    'projection',
+    'action',
+    'token',
+    'schema',
+    'compiler',
+    'workflow',
+    'agent',
+    'built-in-application',
+    'design',
+    'layout-policy',
+    'performance-budget',
+    'observation-policy',
+]);
+const DependencyKindByRole = {
+    'route-space': 'route-space',
+    shell: 'shell',
+    page: 'page',
+    'page-release': 'page-release',
+    workbench: 'workbench',
+    'workbench-release': 'workbench-release',
+    navigation: 'navigation',
+    'navigation-release': 'navigation-release',
+    'menu-action': 'menu-action',
+    'application-menu-catalog': 'application-menu-catalog',
+    capability: 'capability',
+    provider: 'view-provider',
+    'ontology-definition': 'ontology-definition',
+    view: 'view',
+    projection: 'projection',
+    action: 'domain-command',
+    token: 'design-token',
+    schema: 'schema',
+    compiler: 'compiler',
+    workflow: 'workflow',
+    agent: 'agent',
+    'built-in-application': 'built-in-application',
+    design: 'design',
+    'layout-policy': 'layout-policy',
+    'performance-budget': 'performance-budget',
+    'observation-policy': 'observation-policy',
+};
+exports.ReleaseDependencySchema = zod_1.z
+    .object({
+    role: exports.ReleaseDependencyRoleSchema,
+    revisionRef: exports.RevisionRefSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    const expectedKind = DependencyKindByRole[value.role];
+    if (value.revisionRef.kind !== expectedKind) {
+        context.addIssue({
+            code: 'custom',
+            path: ['revisionRef', 'kind'],
+            message: `Dependency role ${value.role} requires reference kind ${expectedKind}.`,
+        });
+    }
+});
+exports.ReleaseValidationSchema = zod_1.z
+    .object({
+    result: zod_1.z.enum(['pass', 'fail']),
+    inputHash: common_1.Sha256Schema,
+    diagnosticRefs: zod_1.z.array(exports.RevisionRefSchema),
+})
+    .strict();
+exports.ReleaseEvidenceSchema = zod_1.z
+    .object({
+    publicationPlanRef: exports.StableRefSchema,
+    expectedHeadRevisionRef: exports.RevisionRefSchema.nullable(),
+    validation: exports.ReleaseValidationSchema,
+    approvalPolicyRevisionRef: exports.RevisionRefSchema,
+    approvalDecisionRevisionRef: exports.RevisionRefSchema,
+    actorRef: exports.StableRefSchema,
+    reason: zod_1.z.string().trim().min(1).max(4096),
+    idempotencyKey: common_1.ContractIdentifierSchema,
+    occurredAt: common_1.IsoDateTimeSchema,
+    evidenceRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const expectedKinds = [
+        ['publicationPlanRef', value.publicationPlanRef, 'publication-plan'],
+        ['approvalPolicyRevisionRef', value.approvalPolicyRevisionRef, 'approval-policy'],
+        ['approvalDecisionRevisionRef', value.approvalDecisionRevisionRef, 'approval-decision'],
+        ['actorRef', value.actorRef, 'actor'],
+    ];
+    expectedKinds.forEach(([field, reference, expectedKind]) => {
+        if (reference.kind !== expectedKind) {
+            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+        }
+    });
+    value.evidenceRefs.forEach((reference, index) => {
+        if (reference.kind !== 'evidence')
+            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Release evidenceRefs must reference evidence revisions.' });
+    });
+});
+exports.PublicationPlanOperationSchema = zod_1.z
+    .object({
+    releaseKind: zod_1.z.enum(['page-release', 'workbench-release', 'navigation-release']),
+    releaseSlotId: common_1.ContractIdentifierSchema,
+    releaseRevisionRef: exports.RevisionRefSchema,
+    expectedHeadRevisionRef: exports.RevisionRefSchema.nullable(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.releaseRevisionRef.kind !== value.releaseKind || value.releaseRevisionRef.id !== value.releaseSlotId) {
+        context.addIssue({ code: 'custom', path: ['releaseRevisionRef'], message: 'Publication Plan operation must pin the exact release slot revision.' });
+    }
+    if (value.expectedHeadRevisionRef
+        && (value.expectedHeadRevisionRef.kind !== value.releaseKind || value.expectedHeadRevisionRef.id !== value.releaseSlotId)) {
+        context.addIssue({ code: 'custom', path: ['expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+    }
+});
+exports.PublicationPlanSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('PublicationPlan'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    planId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    environmentRef: exports.StableRefSchema,
+    operations: zod_1.z.array(exports.PublicationPlanOperationSchema).min(1),
+    validation: exports.ReleaseValidationSchema,
+    approvalPolicyRevisionRef: exports.RevisionRefSchema,
+    approvalDecisionRevisionRef: exports.RevisionRefSchema,
+    actorRef: exports.StableRefSchema,
+    idempotencyKey: common_1.ContractIdentifierSchema,
+    evidenceRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
+    createdAt: common_1.IsoDateTimeSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.environmentRef.kind !== 'environment')
+        context.addIssue({ code: 'custom', path: ['environmentRef', 'kind'], message: 'Publication Plan requires an environment reference.' });
+    const governedRefs = [
+        ['approvalPolicyRevisionRef', value.approvalPolicyRevisionRef, 'approval-policy'],
+        ['approvalDecisionRevisionRef', value.approvalDecisionRevisionRef, 'approval-decision'],
+        ['actorRef', value.actorRef, 'actor'],
+    ];
+    governedRefs.forEach(([field, reference, expectedKind]) => {
+        if (reference.kind !== expectedKind)
+            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+    });
+    value.operations.forEach((operation, index) => {
+        [operation.releaseRevisionRef, operation.expectedHeadRevisionRef].forEach((reference, referenceIndex) => {
+            if (reference?.tenantScope && tenantScopeKey(reference.tenantScope) !== tenantScopeKey(value.tenantScope)) {
+                const field = referenceIndex === 0 ? 'releaseRevisionRef' : 'expectedHeadRevisionRef';
+                context.addIssue({ code: 'custom', path: ['operations', index, field, 'tenantScope'], message: 'Publication Plan operation belongs to another tenant scope.' });
+            }
+        });
+    });
+    value.evidenceRefs.forEach((reference, index) => {
+        if (reference.kind !== 'evidence')
+            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Publication Plan evidenceRefs must reference evidence revisions.' });
+    });
+    if (uniqueArray(value.operations, (operation) => `${operation.releaseKind}:${operation.releaseSlotId}`)) {
+        context.addIssue({ code: 'custom', path: ['operations'], message: 'Publication Plan release slots must be unique.' });
+    }
+});
+const IdentitySchema = zod_1.z
+    .object({
+    name: exports.I18nTextSchema,
+    description: exports.I18nTextSchema.optional(),
+    tags: zod_1.z.array(common_1.ContractIdentifierSchema).default([]),
+})
+    .strict();
+exports.WorkbenchIdentitySchema = IdentitySchema.extend({ iconRef: exports.StableRefSchema.optional() }).strict();
+const ReleaseBaseShape = {
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    releaseSlotId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    operation: exports.ReleaseOperationSchema,
+    dependencySnapshot: zod_1.z.array(exports.ReleaseDependencySchema),
+    evidence: exports.ReleaseEvidenceSchema,
+};
+const validateDependencySnapshot = (snapshot, context) => {
+    const duplicate = uniqueArray(snapshot, (dependency) => `${dependency.role}:${stableRefIdentity(dependency.revisionRef)}@${dependency.revisionRef.revision}`);
+    if (duplicate)
+        context.addIssue({ code: 'custom', path: ['dependencySnapshot'], message: `Duplicate dependency: ${duplicate}` });
+};
+const validateReleaseExpectedHead = (value, expectedKind, context) => {
+    const expectedHead = value.evidence.expectedHeadRevisionRef;
+    if (expectedHead && (expectedHead.kind !== expectedKind || expectedHead.id !== value.releaseSlotId)) {
+        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+    }
+    if (expectedHead?.tenantScope && tenantScopeKey(expectedHead.tenantScope) !== tenantScopeKey(value.tenantScope)) {
+        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef', 'tenantScope'], message: 'Expected head belongs to another tenant scope.' });
+    }
+};
+exports.BindingSourceSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({ kind: zod_1.z.literal('constant'), value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]) }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('route-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('query-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('identity'), name: zod_1.z.enum(['tenantId', 'teamId', 'userId']) }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('intent-field'), path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
+    zod_1.z.object({ kind: zod_1.z.literal('binding-field'), bindingId: common_1.ContractIdentifierSchema, path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
+]);
+exports.CapabilityInstanceSchema = zod_1.z
+    .object({
+    instanceId: common_1.ContractIdentifierSchema,
+    nodeId: common_1.ContractIdentifierSchema,
+    capabilityRevisionRef: exports.RevisionRefSchema,
+    providerRevisionRef: exports.RevisionRefSchema,
+    propertySchemaRevisionRef: exports.RevisionRefSchema,
+    properties: common_1.JsonObjectSchema,
+    allowedSideEffects: zod_1.z.array(zod_1.z.enum(['network', 'storage', 'navigation', 'worker', 'websocket'])),
+})
+    .strict();
+exports.OntologyBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    ontologyDefinitionRevisionRef: exports.RevisionRefSchema,
+    viewRevisionRef: exports.RevisionRefSchema.optional(),
+    projectionRevisionRef: exports.RevisionRefSchema.optional(),
+    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    target: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
+    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
+    pagination: zod_1.z.enum(['none', 'cursor', 'offset']),
+    cache: zod_1.z.enum(['none', 'identity-scoped', 'tenant-scoped']),
+    cancelOnChange: zod_1.z.boolean(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if ((value.viewRevisionRef ? 1 : 0) + (value.projectionRevisionRef ? 1 : 0) !== 1) {
+        context.addIssue({ code: 'custom', path: ['viewRevisionRef'], message: 'Ontology bindings require exactly one View or Projection revision.' });
+    }
+    if (value.ontologyDefinitionRevisionRef.kind !== 'ontology-definition') {
+        context.addIssue({ code: 'custom', path: ['ontologyDefinitionRevisionRef', 'kind'], message: 'Expected an ontology-definition revision.' });
+    }
+});
+exports.ActionBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    commandRevisionRef: exports.RevisionRefSchema,
+    source: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
+    sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    accessPolicy: exports.AccessPolicySchema,
+    confirmation: exports.I18nTextSchema.optional(),
+    idempotencyKeySource: zod_1.z.enum(['interaction', 'record-and-interaction', 'caller-provided']),
+    compensationCommandRevisionRef: exports.RevisionRefSchema.optional(),
+    resultSchemaRevisionRef: exports.RevisionRefSchema,
+    success: zod_1.z.object({
+        refreshBindingIds: zod_1.z.array(common_1.ContractIdentifierSchema),
+        navigationTargetRef: exports.StableRefSchema.optional(),
+    }).strict(),
+    recovery: zod_1.z.enum(['retry-safe', 'compensating-command', 'manual-review']),
+    lineageRequired: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.commandRevisionRef.kind !== 'domain-command') {
+        context.addIssue({ code: 'custom', path: ['commandRevisionRef', 'kind'], message: 'Action bindings must reference a domain-command revision.' });
+    }
+    if (value.sourceIntentSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({ code: 'custom', path: ['sourceIntentSchemaRevisionRef', 'kind'], message: 'Action source intents must pin a schema revision.' });
+    }
+    if (value.inputSchemaRevisionRef.kind !== 'schema') {
+        context.addIssue({ code: 'custom', path: ['inputSchemaRevisionRef', 'kind'], message: 'Action command inputs must pin a schema revision.' });
+    }
+    if (value.recovery === 'compensating-command' && !value.compensationCommandRevisionRef) {
+        context.addIssue({ code: 'custom', path: ['compensationCommandRevisionRef'], message: 'Compensating recovery requires a compensation command.' });
+    }
+});
+exports.PageSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('Page'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    pageId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    identity: IdentitySchema,
+    supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
+    lifecycle: exports.DeclarativeLifecycleSchema,
+    routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
+    shellRevisionRef: exports.RevisionRefSchema,
+    renderTree: render_1.RenderTreeSchema,
+    capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema).min(1),
+    ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    actionBindings: zod_1.z.array(exports.ActionBindingSchema),
+    pageAccessPolicy: exports.AccessPolicySchema,
+    managementAccess: exports.ManagementAccessSchema,
+    tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
+    const uniqueness = [
+        ['capabilityInstances', value.capabilityInstances, (candidate) => String(candidate.instanceId)],
+        ['ontologyBindings', value.ontologyBindings, (candidate) => String(candidate.bindingId)],
+        ['actionBindings', value.actionBindings, (candidate) => String(candidate.bindingId)],
+    ];
+    uniqueness.forEach(([field, values, identity]) => {
+        if (uniqueArray(values, identity))
+            context.addIssue({ code: 'custom', path: [field], message: `${field} identities must be unique.` });
+    });
+    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
+    value.ontologyBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.target.capabilityInstanceId)) {
+            context.addIssue({ code: 'custom', path: ['ontologyBindings', index, 'target', 'capabilityInstanceId'], message: 'Ontology binding targets an unknown capability instance.' });
+        }
+    });
+    value.actionBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.source.capabilityInstanceId)) {
+            context.addIssue({ code: 'custom', path: ['actionBindings', index, 'source', 'capabilityInstanceId'], message: 'Action binding sources an unknown capability instance.' });
+        }
+        binding.success.refreshBindingIds.forEach((bindingId) => {
+            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === bindingId)) {
+                context.addIssue({ code: 'custom', path: ['actionBindings', index, 'success', 'refreshBindingIds'], message: `Unknown refresh binding: ${bindingId}` });
+            }
+        });
+    });
+    if (value.shellRevisionRef.kind !== 'shell')
+        context.addIssue({ code: 'custom', path: ['shellRevisionRef', 'kind'], message: 'Page shellRevisionRef must reference a shell.' });
+    value.capabilityInstances.forEach((instance, index) => {
+        const refs = [
+            ['capabilityRevisionRef', instance.capabilityRevisionRef, 'capability'],
+            ['providerRevisionRef', instance.providerRevisionRef, 'view-provider'],
+            ['propertySchemaRevisionRef', instance.propertySchemaRevisionRef, 'schema'],
+        ];
+        refs.forEach(([field, reference, expectedKind]) => {
+            if (reference.kind !== expectedKind)
+                context.addIssue({ code: 'custom', path: ['capabilityInstances', index, field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+        });
+    });
+    value.tokenRevisionRefs.forEach((reference, index) => {
+        if (reference.kind !== 'design-token')
+            context.addIssue({ code: 'custom', path: ['tokenRevisionRefs', index, 'kind'], message: 'Page token references must use kind design-token.' });
+    });
+    if (value.performanceBudgetRef.kind !== 'performance-budget')
+        context.addIssue({ code: 'custom', path: ['performanceBudgetRef', 'kind'], message: 'Page requires a performance-budget revision.' });
+    if (value.observationPolicyRevisionRef.kind !== 'observation-policy')
+        context.addIssue({ code: 'custom', path: ['observationPolicyRevisionRef', 'kind'], message: 'Page requires an observation-policy revision.' });
+});
+exports.PageReleaseSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('PageRelease'),
+    ...ReleaseBaseShape,
+    pageRevisionRef: exports.RevisionRefSchema,
+    target: zod_1.z.object({
+        environmentRef: exports.StableRefSchema,
+        surface: exports.ProductSurfaceSchema,
+        routeSpaceRevisionRef: exports.RevisionRefSchema,
+        normalizedPath: exports.RoutePathTemplateSchema,
+        routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
+    }).strict(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDependencySnapshot(value.dependencySnapshot, context);
+    validateReleaseExpectedHead(value, 'page-release', context);
+    if (value.pageRevisionRef.kind !== 'page')
+        context.addIssue({ code: 'custom', path: ['pageRevisionRef', 'kind'], message: 'Expected a page revision.' });
+    if (value.target.environmentRef.kind !== 'environment')
+        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Page release target requires an environment reference.' });
+    if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
+        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Page release target requires a route-space revision.' });
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Page Release route authority must pin the exact compiled claim and normalized path.' });
+    }
+    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
+        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Page Release route claim must match the target surface.' });
+    }
+});
+exports.WorkbenchGroupSchema = zod_1.z
+    .object({
+    groupId: common_1.ContractIdentifierSchema,
+    label: exports.I18nTextSchema,
+    iconRef: exports.StableRefSchema.optional(),
+    order: zod_1.z.number().int(),
+    collapsedByDefault: zod_1.z.boolean(),
+    accessPolicy: exports.AccessPolicySchema.optional(),
+})
+    .strict();
+exports.WorkbenchAppInstanceSchema = zod_1.z
+    .object({
+    instanceId: common_1.ContractIdentifierSchema,
+    kind: zod_1.z.enum(['built-in-application', 'workflow-form', 'workflow', 'agent', 'design', 'capability']),
+    targetRevisionRef: exports.RevisionRefSchema,
+    providerRevisionRef: exports.RevisionRefSchema,
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    input: common_1.JsonObjectSchema,
+    groupId: common_1.ContractIdentifierSchema,
+    order: zod_1.z.number().int(),
+    display: zod_1.z.object({ name: exports.I18nTextSchema.optional(), iconRef: exports.StableRefSchema.optional() }).strict(),
+    accessPolicy: exports.AccessPolicySchema,
+})
+    .strict();
+exports.WorkbenchSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('Workbench'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    workbenchId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    purpose: zod_1.z.enum(['instance', 'template']),
+    sourceTemplateRevisionRef: exports.RevisionRefSchema.optional(),
+    identity: exports.WorkbenchIdentitySchema,
+    supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
+    lifecycle: exports.DeclarativeLifecycleSchema,
+    routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
+    groups: zod_1.z.array(exports.WorkbenchGroupSchema).min(1),
+    appInstances: zod_1.z.array(exports.WorkbenchAppInstanceSchema).min(1),
+    defaultEntry: zod_1.z.object({ groupId: common_1.ContractIdentifierSchema, instanceId: common_1.ContractIdentifierSchema, showDefaultGroup: zod_1.z.boolean() }).strict(),
+    layout: zod_1.z.object({
+        hostCapabilityRevisionRef: exports.RevisionRefSchema,
+        hostProviderRevisionRef: exports.RevisionRefSchema,
+        layoutPolicyRevisionRef: exports.RevisionRefSchema,
+        tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
+    }).strict(),
+    workbenchAccessPolicy: exports.AccessPolicySchema,
+    managementAccess: exports.ManagementAccessSchema,
+    personalPreferencesPolicy: zod_1.z.object({
+        allowed: zod_1.z.array(zod_1.z.enum(['collapsed-groups', 'recent-entry', 'layout-density'])),
+        authority: zod_1.z.literal('identity-overlay'),
+    }).strict(),
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
+    if (value.purpose === 'template' && value.sourceTemplateRevisionRef) {
+        context.addIssue({ code: 'custom', path: ['sourceTemplateRevisionRef'], message: 'Templates cannot derive from another template at runtime.' });
+    }
+    const duplicateGroup = uniqueArray(value.groups, (group) => group.groupId);
+    if (duplicateGroup)
+        context.addIssue({ code: 'custom', path: ['groups'], message: `Duplicate Workbench group: ${duplicateGroup}` });
+    const duplicateInstance = uniqueArray(value.appInstances, (instance) => instance.instanceId);
+    if (duplicateInstance)
+        context.addIssue({ code: 'custom', path: ['appInstances'], message: `Duplicate Workbench instance: ${duplicateInstance}` });
+    const groupIds = new Set(value.groups.map((group) => group.groupId));
+    value.appInstances.forEach((instance, index) => {
+        if (!groupIds.has(instance.groupId))
+            context.addIssue({ code: 'custom', path: ['appInstances', index, 'groupId'], message: 'Workbench app references an unknown group.' });
+    });
+    const defaultInstance = value.appInstances.find((instance) => instance.instanceId === value.defaultEntry.instanceId);
+    if (!defaultInstance || defaultInstance.groupId !== value.defaultEntry.groupId) {
+        context.addIssue({ code: 'custom', path: ['defaultEntry'], message: 'Workbench default entry must reference an app in the declared group.' });
+    }
+    const targetKindByInstanceKind = {
+        'built-in-application': 'built-in-application',
+        'workflow-form': 'workflow',
+        workflow: 'workflow',
+        agent: 'agent',
+        design: 'design',
+        capability: 'capability',
+    };
+    value.appInstances.forEach((instance, index) => {
+        if (instance.targetRevisionRef.kind !== targetKindByInstanceKind[instance.kind])
+            context.addIssue({ code: 'custom', path: ['appInstances', index, 'targetRevisionRef', 'kind'], message: `Workbench ${instance.kind} target has an incompatible reference kind.` });
+        if (instance.providerRevisionRef.kind !== 'view-provider')
+            context.addIssue({ code: 'custom', path: ['appInstances', index, 'providerRevisionRef', 'kind'], message: 'Workbench app provider must use kind view-provider.' });
+        if (instance.inputSchemaRevisionRef.kind !== 'schema')
+            context.addIssue({ code: 'custom', path: ['appInstances', index, 'inputSchemaRevisionRef', 'kind'], message: 'Workbench app input must pin a schema revision.' });
+    });
+    const layoutRefs = [
+        ['hostCapabilityRevisionRef', value.layout.hostCapabilityRevisionRef, 'capability'],
+        ['hostProviderRevisionRef', value.layout.hostProviderRevisionRef, 'view-provider'],
+        ['layoutPolicyRevisionRef', value.layout.layoutPolicyRevisionRef, 'layout-policy'],
+    ];
+    layoutRefs.forEach(([field, reference, expectedKind]) => {
+        if (reference.kind !== expectedKind)
+            context.addIssue({ code: 'custom', path: ['layout', field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+    });
+    value.layout.tokenRevisionRefs.forEach((reference, index) => {
+        if (reference.kind !== 'design-token')
+            context.addIssue({ code: 'custom', path: ['layout', 'tokenRevisionRefs', index, 'kind'], message: 'Workbench token references must use kind design-token.' });
+    });
+});
+exports.WorkbenchReleaseSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('WorkbenchRelease'),
+    ...ReleaseBaseShape,
+    workbenchRevisionRef: exports.RevisionRefSchema,
+    target: zod_1.z.object({
+        environmentRef: exports.StableRefSchema,
+        surface: exports.ProductSurfaceSchema,
+        workbenchId: common_1.ContractIdentifierSchema,
+        routeSpaceRevisionRef: exports.RevisionRefSchema,
+        normalizedPath: exports.RoutePathTemplateSchema,
+        routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
+        order: zod_1.z.number().int(),
+        isDefaultCandidate: zod_1.z.boolean(),
+    }).strict(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDependencySnapshot(value.dependencySnapshot, context);
+    validateReleaseExpectedHead(value, 'workbench-release', context);
+    if (value.workbenchRevisionRef.kind !== 'workbench')
+        context.addIssue({ code: 'custom', path: ['workbenchRevisionRef', 'kind'], message: 'Expected a workbench revision.' });
+    if (value.target.environmentRef.kind !== 'environment')
+        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Workbench release target requires an environment reference.' });
+    if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
+        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Workbench release target requires a route-space revision.' });
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Workbench Release route authority must pin the exact compiled claim and normalized path.' });
+    }
+    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
+        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Workbench Release route claim must match the target surface.' });
+    }
+});
+const NavigationNodeBaseShape = {
+    nodeId: common_1.ContractIdentifierSchema,
+    parentNodeId: common_1.ContractIdentifierSchema.nullable(),
+    order: zod_1.z.number().int(),
+    disabled: zod_1.z.boolean().optional(),
+};
+exports.NavigationGroupNodeSchema = zod_1.z.object({
+    ...NavigationNodeBaseShape,
+    kind: zod_1.z.literal('group'),
+    label: exports.I18nTextSchema,
+    iconRef: exports.StableRefSchema.optional(),
+    collapsedByDefault: zod_1.z.boolean(),
+    audience: exports.AccessPolicySchema,
+}).strict();
+exports.NavigationTargetNodeSchema = zod_1.z.object({
+    ...NavigationNodeBaseShape,
+    kind: zod_1.z.literal('target'),
+    label: exports.I18nTextSchema,
+    iconRef: exports.StableRefSchema.optional(),
+    tone: zod_1.z.enum(['default', 'danger']).optional(),
+    targetRef: exports.StableRefSchema,
+    parameterMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    audience: exports.AccessPolicySchema,
+}).strict();
+exports.NavigationSeparatorNodeSchema = zod_1.z.object({
+    ...NavigationNodeBaseShape,
+    kind: zod_1.z.literal('separator'),
+}).strict();
+exports.NavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.NavigationGroupNodeSchema,
+    exports.NavigationTargetNodeSchema,
+    exports.NavigationSeparatorNodeSchema,
+]);
+const validateNavigationTree = (nodes, context) => {
+    const byId = new Map();
+    nodes.forEach((node, index) => {
+        if (byId.has(node.nodeId))
+            context.addIssue({ code: 'custom', path: ['nodes', index, 'nodeId'], message: `Duplicate Navigation node: ${node.nodeId}` });
+        else
+            byId.set(node.nodeId, { node, index });
+    });
+    const siblingOrders = new Set();
+    nodes.forEach((node, index) => {
+        const orderKey = `${node.parentNodeId ?? ''}:${node.order}`;
+        if (siblingOrders.has(orderKey))
+            context.addIssue({ code: 'custom', path: ['nodes', index, 'order'], message: 'Sibling Navigation order values must be unique.' });
+        siblingOrders.add(orderKey);
+        if (node.parentNodeId) {
+            const parent = byId.get(node.parentNodeId)?.node;
+            if (!parent)
+                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation node has an unknown parent.' });
+            else if (parent.kind !== 'group')
+                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation parents must be groups.' });
+        }
+        const ancestors = new Set([node.nodeId]);
+        let parentId = node.parentNodeId;
+        while (parentId) {
+            if (ancestors.has(parentId)) {
+                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: `Navigation cycle contains ${node.nodeId}.` });
+                break;
+            }
+            ancestors.add(parentId);
+            parentId = byId.get(parentId)?.node.parentNodeId ?? null;
+        }
+    });
+};
+exports.NavigationSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('Navigation'),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    navigationId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    identity: IdentitySchema,
+    supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
+    placements: zod_1.z.array(common_1.ContractIdentifierSchema).min(1),
+    lifecycle: exports.DeclarativeLifecycleSchema,
+    nodes: zod_1.z.array(exports.NavigationNodeSchema),
+    managementAccess: exports.ManagementAccessSchema,
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateNavigationTree(value.nodes, context);
+    value.nodes.forEach((node, index) => {
+        if (node.kind === 'target' && !['page', 'workbench', 'menu-action', 'domain-command'].includes(node.targetRef.kind)) {
+            context.addIssue({ code: 'custom', path: ['nodes', index, 'targetRef', 'kind'], message: 'Navigation targets must reference Page, Workbench, registered Menu Action, or DomainCommand identities.' });
+        }
+    });
+});
+exports.ResolvedNavigationTargetSchema = zod_1.z
+    .object({
+    nodeId: common_1.ContractIdentifierSchema,
+    stableTargetRef: exports.StableRefSchema,
+    targetRevisionRef: exports.RevisionRefSchema,
+    releaseRevisionRef: exports.RevisionRefSchema.optional(),
+})
+    .strict();
+exports.NavigationReleaseSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal('NavigationRelease'),
+    ...ReleaseBaseShape,
+    navigationRevisionRef: exports.RevisionRefSchema,
+    target: zod_1.z.object({
+        environmentRef: exports.StableRefSchema,
+        surface: exports.ProductSurfaceSchema,
+        placement: common_1.ContractIdentifierSchema,
+    }).strict(),
+    resolvedTargets: zod_1.z.array(exports.ResolvedNavigationTargetSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDependencySnapshot(value.dependencySnapshot, context);
+    validateReleaseExpectedHead(value, 'navigation-release', context);
+    if (value.navigationRevisionRef.kind !== 'navigation')
+        context.addIssue({ code: 'custom', path: ['navigationRevisionRef', 'kind'], message: 'Expected a navigation revision.' });
+    if (value.target.environmentRef.kind !== 'environment')
+        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Navigation release target requires an environment reference.' });
+    if (uniqueArray(value.resolvedTargets, (target) => target.nodeId))
+        context.addIssue({ code: 'custom', path: ['resolvedTargets'], message: 'Resolved Navigation node IDs must be unique.' });
+});
+const RuntimeDiagnosticSchema = zod_1.z.object({
+    code: common_1.ContractIdentifierSchema,
+    severity: zod_1.z.enum(['info', 'warning', 'error']),
+    path: zod_1.z.string().trim().min(1),
+    message: zod_1.z.string().trim().min(1),
+}).strict();
+const RuntimeBundleBaseShape = {
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    releaseRevisionRef: exports.RevisionRefSchema,
+    compilerRevisionRef: exports.RevisionRefSchema,
+    generation: zod_1.z.number().int().nonnegative(),
+    dependencySnapshot: zod_1.z.array(exports.ReleaseDependencySchema),
+    contentHash: common_1.Sha256Schema,
+    rebuildable: zod_1.z.literal(true),
+    diagnostics: zod_1.z.array(RuntimeDiagnosticSchema),
+};
+exports.PageRuntimeBundleSchema = zod_1.z.object({
+    contract: zod_1.z.literal('PageRuntimeBundle'),
+    ...RuntimeBundleBaseShape,
+    pageId: common_1.ContractIdentifierSchema,
+    pageRevisionRef: exports.RevisionRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
+    shellRevisionRef: exports.RevisionRefSchema,
+    renderTree: render_1.RenderTreeSchema,
+    capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema),
+    ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    actionBindings: zod_1.z.array(exports.ActionBindingSchema),
+    pageAccessPolicy: exports.AccessPolicySchema,
+    tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema),
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+}).strict();
+exports.ResolvedWorkbenchAppInstanceSchema = exports.WorkbenchAppInstanceSchema.extend({
+    targetAccessPolicy: exports.AccessPolicySchema,
+}).strict();
+const WorkbenchRuntimeTargetSchema = exports.WorkbenchReleaseSchema.shape.target.safeExtend({
+    routeClaim: exports.CompiledRouteClaimSchema,
+}).strict();
+exports.WorkbenchRuntimeBundleSchema = zod_1.z.object({
+    contract: zod_1.z.literal('WorkbenchRuntimeBundle'),
+    ...RuntimeBundleBaseShape,
+    workbenchId: common_1.ContractIdentifierSchema,
+    workbenchRevisionRef: exports.RevisionRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
+    groups: zod_1.z.array(exports.WorkbenchGroupSchema),
+    appInstances: zod_1.z.array(exports.ResolvedWorkbenchAppInstanceSchema),
+    defaultEntry: exports.WorkbenchSchema.shape.defaultEntry,
+    layout: exports.WorkbenchSchema.shape.layout,
+    workbenchAccessPolicy: exports.AccessPolicySchema,
+    personalPreferencesPolicy: exports.WorkbenchSchema.shape.personalPreferencesPolicy,
+    target: WorkbenchRuntimeTargetSchema,
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+}).strict();
+const CompiledNavigationTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
+    kind: zod_1.z.literal('route'),
+    accessPolicy: exports.AccessPolicySchema,
+    routeClaim: exports.CompiledRouteClaimSchema,
+}).strict();
+exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
+    kind: zod_1.z.literal('registered-menu-action'),
+    accessPolicy: exports.AccessPolicySchema,
+    execution: zod_1.z.literal('client'),
+    applicationId: common_1.ContractIdentifierSchema,
+    actionRef: common_1.ContractIdentifierSchema,
+    inputSchemaRef: common_1.ContractIdentifierSchema.optional(),
+    input: common_1.JsonObjectSchema,
+    sourceCatalogRevisionRef: exports.RevisionRefSchema,
+}).strict();
+exports.CompiledNavigationDomainCommandTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
+    kind: zod_1.z.literal('governed-domain-command'),
+    accessPolicy: exports.AccessPolicySchema,
+    execution: zod_1.z.literal('server'),
+    commandRevisionRef: exports.RevisionRefSchema,
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    resultSchemaRevisionRef: exports.RevisionRefSchema.optional(),
+    input: common_1.JsonObjectSchema,
+}).strict();
+exports.CompiledNavigationResolvedTargetSchema = zod_1.z.discriminatedUnion('kind', [
+    CompiledNavigationTargetSchema,
+    exports.CompiledNavigationRegisteredMenuActionTargetSchema,
+    exports.CompiledNavigationDomainCommandTargetSchema,
+]);
+exports.CompiledNavigationGroupNodeSchema = exports.NavigationGroupNodeSchema.extend({
+    ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
+}).strict();
+exports.CompiledNavigationTargetNodeSchema = exports.NavigationTargetNodeSchema.extend({
+    ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
+    resolvedTarget: exports.CompiledNavigationResolvedTargetSchema,
+}).strict();
+exports.CompiledNavigationSeparatorNodeSchema = exports.NavigationSeparatorNodeSchema.extend({
+    ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
+}).strict();
+exports.CompiledNavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
+    exports.CompiledNavigationGroupNodeSchema,
+    exports.CompiledNavigationTargetNodeSchema,
+    exports.CompiledNavigationSeparatorNodeSchema,
+]);
+exports.NavigationRuntimeBundleSchema = zod_1.z.object({
+    contract: zod_1.z.literal('NavigationRuntimeBundle'),
+    ...RuntimeBundleBaseShape,
+    navigationId: common_1.ContractIdentifierSchema,
+    navigationRevisionRef: exports.RevisionRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    placement: common_1.ContractIdentifierSchema,
+    nodes: zod_1.z.array(exports.CompiledNavigationNodeSchema),
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+}).strict();
+exports.DeclarativeControlOntologyDefinitionSchema = data_1.OntologyDefinitionSchema.extend({
+    classification: zod_1.z.literal('control'),
+    discovery: zod_1.z.object({
+        ordinaryDataBrowser: zod_1.z.literal(false),
+        businessSearch: zod_1.z.literal(false),
+        businessStatistics: zod_1.z.literal(false),
+        ordinaryExport: zod_1.z.literal(false),
+        genericWrite: zod_1.z.literal(false),
+    }).strict(),
+}).strict();
+const controlDefinition = (ontologyId, bodySchemaRef) => exports.DeclarativeControlOntologyDefinitionSchema.parse({
+    contract: 'OntologyDefinition',
+    ontologyId,
+    dataSpaceId: 'monkeys.control',
+    ownerRepo: 'monkeys-js-sdk',
+    bodySchemaRef,
+    authority: { service: 'monkeys-data-server', storage: 'domain-record', scope: 'tenant' },
+    relationKinds: [],
+    metricKinds: [],
+    classification: 'control',
+    discovery: {
+        ordinaryDataBrowser: false,
+        businessSearch: false,
+        businessStatistics: false,
+        ordinaryExport: false,
+        genericWrite: false,
+    },
+});
+exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = Object.freeze([
+    controlDefinition('monkeys.system.page', 'monkeys.system.page/v1'),
+    controlDefinition('monkeys.system.page-release', 'monkeys.system.page-release/v1'),
+    controlDefinition('monkeys.system.workbench', 'monkeys.system.workbench/v1'),
+    controlDefinition('monkeys.system.workbench-release', 'monkeys.system.workbench-release/v1'),
+    controlDefinition('monkeys.system.navigation', 'monkeys.system.navigation/v1'),
+    controlDefinition('monkeys.system.navigation-release', 'monkeys.system.navigation-release/v1'),
+]);
+//# sourceMappingURL=declarative-control.js.map