@inf-monkeys-tech/monkeys 1.0.72 → 1.1.0

package/lib/runtime/declarative-control-compiler.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveWorkbenchEntry = exports.validateWorkbenchRuntimeSet = exports.compileNavigationRuntimeBundle = exports.compileWorkbenchRuntimeBundle = exports.compilePageRuntimeBundle = exports.materializeRouteSpacePath = exports.compileRouteClaims = exports.accessPolicyChainImplies = exports.declarativeProductResourceRevisionHash = exports.declarativeProductResourceSourceHash = exports.declarativeRouteSpaceRevisionHash = exports.declarativeRouteSpaceSourceHash = exports.declarativeCreateTemplateRevisionHash = exports.declarativeCreateTemplateSourceHash = exports.canonicalContentHash = exports.sameRevisionRef = exports.sameStableRef = exports.revisionRefKey = exports.stableRefKey = exports.DeclarativeControlCompilationError = void 0;
+exports.resolveWorkbenchEntry = exports.validateWorkbenchRuntimeSet = exports.compileNavigationRuntimeBundle = exports.compileWorkbenchRuntimeBundle = exports.compilePageRuntimeBundle = exports.materializeRouteSpacePath = exports.matchCompiledRouteClaim = exports.compileRouteClaims = exports.compiledRouteClaimsOverlap = exports.accessPolicyChainImplies = exports.parseExactDesignCapabilityCatalogArtifact = exports.parseExactProductDeclarativeCapabilityRegistration = exports.compileDesignCapabilityCatalogArtifact = exports.designCapabilityCatalogArtifactHash = exports.declarativeProductResourceRevisionHash = exports.declarativeProductResourceSourceHash = exports.declarativeRouteSpaceRevisionHash = exports.declarativeRouteSpaceSourceHash = exports.declarativeCreateTemplateRevisionHash = exports.declarativeCreateTemplateSourceHash = exports.compileDeclarativeWorkbenchCatalog = exports.compileDeclarativeRouteOwnerIndex = exports.permissionAlternativePolicyAllows = exports.parseExactLegacyRouteTakeoverAuthorization = exports.legacyRouteTakeoverAuthorizationHash = exports.compileLegacyRouteTakeoverAuthorization = exports.declarativeWorkbenchCatalogProjectionId = exports.declarativeRouteOwnerIndexProjectionId = exports.declarativeRuntimeProjectionId = exports.canonicalContentHash = exports.sameRevisionRef = exports.sameStableRef = exports.revisionRefKey = exports.stableRefKey = exports.DeclarativeControlCompilationError = void 0;
 const common_1 = require("../contracts/common");
+const declarative_control_http_1 = require("../contracts/declarative-control-http");
 const render_tree_compiler_1 = require("./render-tree-compiler");
 const declarative_control_1 = require("../contracts/declarative-control");
 class DeclarativeControlCompilationError extends Error {
@@ -46,19 +47,16 @@ const stableSerialize = (value) => {
         .map((key) => `${JSON.stringify(key)}:${stableSerialize(record[key])}`)
         .join(',')}}`;
 };
-const SHA256_INITIAL = [
-    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
-    0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
-];
+const SHA256_INITIAL = [0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19];
 const SHA256_ROUND = [
-    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98,
+    0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786,
+    0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8,
+    0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+    0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819,
+    0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a,
+    0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7,
+    0xc67178f2,
 ];
 const rotateRight = (value, amount) => (value >>> amount) | (value << (32 - amount));
 const sha256Hex = (value) => {
@@ -78,7 +76,8 @@ const sha256Hex = (value) => {
     for (let offset = 0; offset < source.length; offset += 64) {
         for (let index = 0; index < 16; index += 1) {
             const start = offset + index * 4;
-            words[index] = ((source[start] << 24) | (source[start + 1] << 16) | (source[start + 2] << 8) | source[start + 3]) >>> 0;
+            words[index] =
+                ((source[start] << 24) | (source[start + 1] << 16) | (source[start + 2] << 8) | source[start + 3]) >>> 0;
         }
         for (let index = 16; index < 64; index += 1) {
             const previous = words[index - 15];
@@ -117,6 +116,104 @@ const sha256Hex = (value) => {
 };
 const canonicalContentHash = (value) => sha256Hex(stableSerialize(value));
 exports.canonicalContentHash = canonicalContentHash;
+/**
+ * Names one immutable Runtime Bundle projection by its exact Release evidence.
+ * The fixed-size digest stays below Data Server's 256-byte projection id limit
+ * even when a governed release slot uses the maximum contract identifier size.
+ */
+const declarativeRuntimeProjectionId = (resourceKind, releaseSlotId, releaseRevisionRef) => `drb:${(0, exports.canonicalContentHash)({ resourceKind, releaseSlotId, releaseRevisionRef })}`;
+exports.declarativeRuntimeProjectionId = declarativeRuntimeProjectionId;
+/** Names the rebuildable route-owner index for one tenant environment surface. */
+const declarativeRouteOwnerIndexProjectionId = (tenantScope, environmentRef, surface) => `dri:${(0, exports.canonicalContentHash)({
+    tenantScope: {
+        teamRef: tenantScope.teamRef ? { kind: tenantScope.teamRef.kind, id: tenantScope.teamRef.id } : null,
+    },
+    environmentRef,
+    surface,
+})}`;
+exports.declarativeRouteOwnerIndexProjectionId = declarativeRouteOwnerIndexProjectionId;
+const declarativeWorkbenchCatalogProjectionId = (tenantScope, environmentRef, surface) => `dwc:${(0, exports.canonicalContentHash)({
+    tenantScope: {
+        teamRef: tenantScope.teamRef ? { kind: tenantScope.teamRef.kind, id: tenantScope.teamRef.id } : null,
+    },
+    environmentRef,
+    surface,
+})}`;
+exports.declarativeWorkbenchCatalogProjectionId = declarativeWorkbenchCatalogProjectionId;
+const takeoverHashSource = (authorization) => authorization;
+const compileLegacyRouteTakeoverAuthorization = (input) => {
+    const unsigned = {
+        ...input,
+        contract: 'LegacyRouteTakeoverAuthorization',
+        schemaVersion: 1,
+    };
+    return deepFreeze(declarative_control_1.LegacyRouteTakeoverAuthorizationSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(takeoverHashSource(unsigned)),
+    }));
+};
+exports.compileLegacyRouteTakeoverAuthorization = compileLegacyRouteTakeoverAuthorization;
+const legacyRouteTakeoverAuthorizationHash = (input) => (0, exports.canonicalContentHash)(takeoverHashSource(input));
+exports.legacyRouteTakeoverAuthorizationHash = legacyRouteTakeoverAuthorizationHash;
+const parseExactLegacyRouteTakeoverAuthorization = (input) => {
+    const parsed = declarative_control_1.LegacyRouteTakeoverAuthorizationSchema.parse(input);
+    const { contentHash, ...unsigned } = parsed;
+    if (contentHash !== (0, exports.legacyRouteTakeoverAuthorizationHash)(unsigned)) {
+        throw new DeclarativeControlCompilationError('ROUTE_TAKEOVER_INVALID', 'contentHash', 'Legacy route takeover authorization content hash is not exact.');
+    }
+    return deepFreeze(parsed);
+};
+exports.parseExactLegacyRouteTakeoverAuthorization = parseExactLegacyRouteTakeoverAuthorization;
+const permissionAlternativePolicyAllows = (policyInput, permissionCodes) => {
+    const parsed = declarative_control_1.PermissionAlternativePolicySchema.parse(policyInput);
+    const available = permissionCodes instanceof Set ? permissionCodes : new Set(permissionCodes);
+    return parsed.alternatives.some((alternative) => alternative.every((permission) => available.has(permission)));
+};
+exports.permissionAlternativePolicyAllows = permissionAlternativePolicyAllows;
+const compileDeclarativeRouteOwnerIndex = (input) => {
+    const entries = input.entries
+        .map((entry) => ({ ...entry }))
+        .sort((left, right) => {
+        const leftKey = `${left.resourceKind}:${left.releaseSlotId}`;
+        const rightKey = `${right.resourceKind}:${right.releaseSlotId}`;
+        return leftKey.localeCompare(rightKey);
+    });
+    const unsigned = {
+        contract: 'DeclarativeRouteOwnerIndex',
+        schemaVersion: 1,
+        tenantScope: declarative_control_1.TenantScopeSchema.parse(input.tenantScope),
+        environmentRef: declarative_control_1.StableRefSchema.parse(input.environmentRef),
+        surface: input.surface,
+        generation: input.generation,
+        entries,
+        rebuildable: true,
+    };
+    return deepFreeze(declarative_control_1.DeclarativeRouteOwnerIndexSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(unsigned),
+    }));
+};
+exports.compileDeclarativeRouteOwnerIndex = compileDeclarativeRouteOwnerIndex;
+const compileDeclarativeWorkbenchCatalog = (input) => {
+    const entries = input.entries
+        .map((entry) => ({ ...entry }))
+        .sort((left, right) => left.order - right.order || left.workbenchId.localeCompare(right.workbenchId));
+    const unsigned = {
+        contract: 'DeclarativeWorkbenchCatalog',
+        schemaVersion: 1,
+        tenantScope: declarative_control_1.TenantScopeSchema.parse(input.tenantScope),
+        environmentRef: declarative_control_1.StableRefSchema.parse(input.environmentRef),
+        surface: input.surface,
+        generation: input.generation,
+        entries,
+        rebuildable: true,
+    };
+    return deepFreeze(declarative_control_1.DeclarativeWorkbenchCatalogSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(unsigned),
+    }));
+};
+exports.compileDeclarativeWorkbenchCatalog = compileDeclarativeWorkbenchCatalog;
 const declarativeCreateTemplateSourceHash = (document) => (0, exports.canonicalContentHash)(document);
 exports.declarativeCreateTemplateSourceHash = declarativeCreateTemplateSourceHash;
 const declarativeCreateTemplateRevisionHash = (registration) => (0, exports.canonicalContentHash)(registration.document);
@@ -129,6 +226,98 @@ const declarativeProductResourceSourceHash = (document) => (0, exports.canonical
 exports.declarativeProductResourceSourceHash = declarativeProductResourceSourceHash;
 const declarativeProductResourceRevisionHash = (registration) => (0, exports.canonicalContentHash)(registration.document);
 exports.declarativeProductResourceRevisionHash = declarativeProductResourceRevisionHash;
+const designCapabilityCatalogHashSource = (input) => ({
+    contract: 'DesignCapabilityCatalogArtifact',
+    schemaVersion: 1,
+    sourceRef: input.sourceRef,
+    entries: input.entries,
+});
+const designCapabilityCatalogArtifactHash = (input) => (0, exports.canonicalContentHash)(designCapabilityCatalogHashSource(input));
+exports.designCapabilityCatalogArtifactHash = designCapabilityCatalogArtifactHash;
+const compileDesignCapabilityCatalogArtifact = (input) => {
+    const entries = input.entries
+        .map((entry) => ({ ...entry }))
+        .sort((left, right) => left.manifest.id.localeCompare(right.manifest.id));
+    entries.forEach((entry, index) => {
+        const registration = entry.declarativeRegistration;
+        const { registrationRevisionRef: _registrationRevisionRef, sourceContentHash: _sourceContentHash, ...unsignedRegistration } = registration;
+        const registrationHash = (0, exports.canonicalContentHash)(unsignedRegistration);
+        if (registration.capabilityRevisionRef.id !== entry.manifest.id ||
+            registration.capabilityRevisionRef.ownerRepo !== entry.manifest.ownerRepo ||
+            String(registration.capabilityRevisionRef.revision) !== String(entry.manifest.capabilityVersion) ||
+            registration.capabilityRevisionRef.contentHash !== (0, exports.canonicalContentHash)(entry.manifest) ||
+            registration.providerRevisionRef.id !== entry.provider.providerId ||
+            registration.providerRevisionRef.ownerRepo !== entry.provider.ownerRepo ||
+            String(registration.providerRevisionRef.revision) !== String(entry.provider.providerVersion) ||
+            registration.providerRevisionRef.contentHash !== (0, exports.canonicalContentHash)(entry.provider) ||
+            registration.sourceContentHash !== registrationHash ||
+            registration.registrationRevisionRef.contentHash !== registrationHash) {
+            throw new DeclarativeControlCompilationError('DESIGN_CATALOG_INVALID', `entries[${index}]`, 'Design capability manifest, provider and authoring registration are not exact.');
+        }
+        registration.schemaDocuments.forEach((schema, schemaIndex) => {
+            if (schema.schemaRevisionRef.ownerRepo !== 'monkeys-design' ||
+                schema.schemaRevisionRef.visibility !== 'global' ||
+                schema.schemaRevisionRef.contentHash !== (0, exports.canonicalContentHash)(schema.document)) {
+                throw new DeclarativeControlCompilationError('DESIGN_CATALOG_INVALID', `entries[${index}].declarativeRegistration.schemaDocuments[${schemaIndex}]`, 'Design Schema documents require exact global monkeys-design authority.');
+            }
+        });
+    });
+    const sourceContentHash = (0, exports.designCapabilityCatalogArtifactHash)({
+        sourceRef: input.sourceRef,
+        entries,
+    });
+    const sourceRevisionRef = declarative_control_1.RevisionRefSchema.parse({
+        kind: 'design-capability-catalog',
+        id: input.sourceRef,
+        ownerRepo: 'monkeys-design',
+        visibility: 'global',
+        revision: input.revision,
+        schemaVersion: 1,
+        contentHash: sourceContentHash,
+    });
+    return deepFreeze(declarative_control_http_1.DesignCapabilityCatalogArtifactSchema.parse({
+        contract: 'DesignCapabilityCatalogArtifact',
+        schemaVersion: 1,
+        sourceRef: input.sourceRef,
+        sourceRevisionRef,
+        entries,
+        sourceContentHash,
+    }));
+};
+exports.compileDesignCapabilityCatalogArtifact = compileDesignCapabilityCatalogArtifact;
+/** Validate immutable product-owned capability provenance from an application release. */
+const parseExactProductDeclarativeCapabilityRegistration = (input) => {
+    const entry = declarative_control_http_1.ProductDeclarativeCapabilityRegistrationSchema.parse(input);
+    const registration = entry.declarativeRegistration;
+    const { registrationRevisionRef: _registrationRevisionRef, sourceContentHash: _sourceContentHash, ...unsignedRegistration } = registration;
+    if (registration.capabilityRevisionRef.contentHash !== (0, exports.canonicalContentHash)(entry.manifest) ||
+        registration.providerRevisionRef.contentHash !== (0, exports.canonicalContentHash)(entry.provider) ||
+        registration.sourceContentHash !== (0, exports.canonicalContentHash)(unsignedRegistration) ||
+        registration.registrationRevisionRef.contentHash !== registration.sourceContentHash) {
+        throw new DeclarativeControlCompilationError('PRODUCT_CAPABILITY_CATALOG_INVALID', 'declarativeRegistration', 'Product capability manifest, provider and authoring registration are not exact.');
+    }
+    registration.schemaDocuments.forEach((schema, schemaIndex) => {
+        if (schema.schemaRevisionRef.contentHash !== (0, exports.canonicalContentHash)(schema.document)) {
+            throw new DeclarativeControlCompilationError('PRODUCT_CAPABILITY_CATALOG_INVALID', `declarativeRegistration.schemaDocuments[${schemaIndex}]`, 'Product capability Schema document does not match its exact RevisionRef.');
+        }
+    });
+    return deepFreeze(entry);
+};
+exports.parseExactProductDeclarativeCapabilityRegistration = parseExactProductDeclarativeCapabilityRegistration;
+const parseExactDesignCapabilityCatalogArtifact = (input) => {
+    const parsed = declarative_control_http_1.DesignCapabilityCatalogArtifactSchema.parse(input);
+    const expected = (0, exports.compileDesignCapabilityCatalogArtifact)({
+        sourceRef: parsed.sourceRef,
+        revision: parsed.sourceRevisionRef.revision,
+        entries: parsed.entries,
+    });
+    if (parsed.sourceContentHash !== expected.sourceContentHash ||
+        !(0, exports.sameRevisionRef)(parsed.sourceRevisionRef, expected.sourceRevisionRef)) {
+        throw new DeclarativeControlCompilationError('DESIGN_CATALOG_INVALID', 'sourceRevisionRef', 'Design capability catalog artifact provenance or content hash is not exact.');
+    }
+    return deepFreeze(parsed);
+};
+exports.parseExactDesignCapabilityCatalogArtifact = parseExactDesignCapabilityCatalogArtifact;
 const deepFreeze = (value) => {
     if (value === null || typeof value !== 'object' || Object.isFrozen(value))
         return value;
@@ -170,16 +359,27 @@ const requireDependencies = (snapshot, required) => {
 };
 const assertDependencyScopes = (snapshot, scope) => snapshot.forEach((dependency, index) => assertTenantCompatible(dependency.revisionRef, scope, `dependencySnapshot[${index}].revisionRef`));
 const requireReleaseReady = (release) => {
+    if (release.operation === 'deactivate') {
+        throw new DeclarativeControlCompilationError('RELEASE_OPERATION_INVALID', 'operation', 'A deactivation Release cannot produce an active runtime bundle.');
+    }
     if (release.evidence.validation.result !== 'pass') {
         throw new DeclarativeControlCompilationError('RELEASE_VALIDATION_FAILED', 'evidence.validation.result', 'Runtime bundles require a passing release validation result.');
     }
 };
 const refSet = (values) => new Set(values.map(exports.stableRefKey));
 const chainRequiresAll = (policies, field) => {
-    if (field === 'permissionAllOf')
-        return new Set(policies.flatMap((policy) => policy.permissionAllOf));
-    if (field === 'groupAllOf')
-        return refSet(policies.flatMap((policy) => policy.groupAllOf));
+    if (field === 'permissionAllOf') {
+        return new Set(policies.flatMap((policy) => [
+            ...policy.permissionAllOf,
+            ...(policy.permissionAnyOf.length === 1 ? policy.permissionAnyOf : []),
+        ]));
+    }
+    if (field === 'groupAllOf') {
+        return refSet(policies.flatMap((policy) => [
+            ...policy.groupAllOf,
+            ...(policy.groupAnyOf.length === 1 ? policy.groupAnyOf : []),
+        ]));
+    }
     return new Set(policies.flatMap((policy) => policy.conditionAllOf.map(exports.revisionRefKey)));
 };
 const chainImpliesAny = (policies, targetAny, allValues, anyValues) => {
@@ -218,7 +418,7 @@ const normalizePath = (path, routeSpace) => {
     if (!routeSpace.caseSensitive) {
         normalized = normalized
             .split('/')
-            .map((segment) => segment.startsWith(':') ? segment : segment.toLowerCase())
+            .map((segment) => (segment.startsWith(':') ? segment : segment.toLowerCase()))
             .join('/');
     }
     if (routeSpace.trailingSlash === 'remove' && normalized.length > 1)
@@ -227,7 +427,65 @@ const normalizePath = (path, routeSpace) => {
         normalized += '/';
     return normalized;
 };
+const acceptedTrailingSlashStates = (claim) => {
+    if (claim.matcher.trailingSlash === 'remove')
+        return new Set([false, true]);
+    if (claim.matcher.trailingSlash === 'require')
+        return new Set([true]);
+    return new Set([claim.normalizedPath.length > 1 && claim.normalizedPath.endsWith('/')]);
+};
+const routeSegmentParameter = (segment) => segment.match(/^[:$]([A-Za-z][A-Za-z0-9_-]*)$/)?.[1];
+const parameterTypeFor = (claim, name) => claim.matcher.parameters.find((parameter) => parameter.name === name)?.type;
+const compiledRouteClaimsOverlap = (leftInput, rightInput) => {
+    const left = declarative_control_1.CompiledRouteClaimSchema.parse(leftInput);
+    const right = declarative_control_1.CompiledRouteClaimSchema.parse(rightInput);
+    if (![...acceptedTrailingSlashStates(left)].some((state) => acceptedTrailingSlashStates(right).has(state)))
+        return false;
+    const leftSegments = left.normalizedPath.split('/').filter(Boolean);
+    const rightSegments = right.normalizedPath.split('/').filter(Boolean);
+    if (leftSegments.length !== rightSegments.length)
+        return false;
+    return leftSegments.every((leftSegment, index) => {
+        const rightSegment = rightSegments[index];
+        const leftParameter = routeSegmentParameter(leftSegment);
+        const rightParameter = routeSegmentParameter(rightSegment);
+        if (!leftParameter && !rightParameter) {
+            if (left.matcher.caseSensitive && right.matcher.caseSensitive)
+                return leftSegment === rightSegment;
+            return leftSegment.toLowerCase() === rightSegment.toLowerCase();
+        }
+        if (leftParameter && !rightParameter) {
+            const type = parameterTypeFor(left, leftParameter);
+            return !!type && routeParameterPattern(type).test(rightSegment);
+        }
+        if (!leftParameter && rightParameter) {
+            const type = parameterTypeFor(right, rightParameter);
+            return !!type && routeParameterPattern(type).test(leftSegment);
+        }
+        const leftType = parameterTypeFor(left, leftParameter);
+        const rightType = parameterTypeFor(right, rightParameter);
+        if (!leftType || !rightType)
+            return false;
+        return !(leftType === 'integer' && rightType === 'uuid') && !(leftType === 'uuid' && rightType === 'integer');
+    });
+};
+exports.compiledRouteClaimsOverlap = compiledRouteClaimsOverlap;
 const compileRouteClaims = (input) => {
+    const embeddedTakeovers = input.claims.flatMap((claim) => {
+        const authorization = 'legacyRouteTakeoverAuthorization' in claim ? claim.legacyRouteTakeoverAuthorization : undefined;
+        return authorization ? [authorization] : [];
+    });
+    const takeoverAuthorizations = [...(input.legacyRouteTakeoverAuthorizations ?? []), ...embeddedTakeovers].map((authorization, index) => {
+        try {
+            return (0, exports.parseExactLegacyRouteTakeoverAuthorization)(authorization);
+        }
+        catch (error) {
+            if (error instanceof DeclarativeControlCompilationError) {
+                throw new DeclarativeControlCompilationError(error.code, `legacyRouteTakeoverAuthorizations[${index}].${error.path}`, error.message);
+            }
+            throw error;
+        }
+    });
     const registrations = input.routeSpaces.map((entry, index) => {
         const revisionRef = declarative_control_1.RevisionRefSchema.parse(entry.revisionRef);
         const routeSpace = declarative_control_1.RouteSpaceSchema.parse(entry.routeSpace);
@@ -238,18 +496,16 @@ const compileRouteClaims = (input) => {
     });
     assertUniqueRegistryKeys(registrations.map((entry) => (0, exports.revisionRefKey)(entry.revisionRef)), 'routeSpaces');
     const routeSpacesByRevision = new Map(registrations.map((entry) => [(0, exports.revisionRefKey)(entry.revisionRef), entry.routeSpace]));
-    const normalizedPaths = new Set();
     const compiled = [];
     input.claims.forEach((inputClaim, index) => {
-        const parsedClaim = 'surface' in inputClaim
-            ? declarative_control_1.RouteClaimSchema.parse(inputClaim)
-            : declarative_control_1.LegacyRouteClaimSchema.parse(inputClaim);
-        const routeSpace = routeSpacesByRevision.get((0, exports.revisionRefKey)(parsedClaim.routeSpaceRevisionRef));
+        const { legacyRouteTakeoverAuthorization: _authorization, ...runtimeClaim } = inputClaim;
+        const legacyClaim = 'surface' in runtimeClaim ? declarative_control_1.RouteClaimSchema.parse(runtimeClaim) : declarative_control_1.LegacyRouteClaimSchema.parse(runtimeClaim);
+        const routeSpace = routeSpacesByRevision.get((0, exports.revisionRefKey)(legacyClaim.routeSpaceRevisionRef));
         if (!routeSpace)
             throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISSING', `routeClaims[${index}].routeSpaceRevisionRef`, 'No exact RouteSpace registration exists.');
         const claim = declarative_control_1.RouteClaimSchema.parse({
-            ...parsedClaim,
-            surface: 'surface' in parsedClaim ? parsedClaim.surface : routeSpace.supportedSurface,
+            ...legacyClaim,
+            surface: 'surface' in legacyClaim ? legacyClaim.surface : routeSpace.supportedSurface,
         });
         if (routeSpace.supportedSurface !== claim.surface) {
             throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeClaims[${index}].surface`, `Route claim surface ${claim.surface} does not match RouteSpace ${routeSpace.routeSpaceId}.`);
@@ -266,26 +522,43 @@ const compileRouteClaims = (input) => {
         if (unknownParameter) {
             throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `routeClaims[${index}].pathTemplate`, `Route parameter ${unknownParameter} is not declared by ${routeSpace.routeSpaceId}.`);
         }
-        const reserved = routeSpace.reservedPaths.some((candidate) => {
-            const normalizedReserved = normalizePath(candidate, routeSpace);
-            return normalizedPath === normalizedReserved || normalizedPath.startsWith(`${normalizedReserved}/`);
-        });
-        if (reserved)
-            throw new DeclarativeControlCompilationError('ROUTE_RESERVED', `routeClaims[${index}].pathTemplate`, `Route ${normalizedPath} is reserved by ${routeSpace.routeSpaceId}.`);
-        const routeIdentity = `${(0, exports.revisionRefKey)(claim.routeSpaceRevisionRef)}:${normalizedPath}`;
-        if (normalizedPaths.has(routeIdentity))
-            throw new DeclarativeControlCompilationError('ROUTE_CONFLICT', `routeClaims[${index}].pathTemplate`, `Duplicate normalized route ${normalizedPath}.`);
-        normalizedPaths.add(routeIdentity);
-        compiled.push(declarative_control_1.CompiledRouteClaimSchema.parse({
+        const matcher = {
+            surface: claim.surface,
+            caseSensitive: routeSpace.caseSensitive,
+            trailingSlash: routeSpace.trailingSlash,
+            parameters: routeSpace.parameters,
+        };
+        const compiledClaim = declarative_control_1.CompiledRouteClaimSchema.parse({
             ...claim,
             normalizedPath,
-            matcher: {
+            matcher,
+        });
+        const reserved = routeSpace.reservedPaths.some((candidate) => {
+            const normalizedReserved = normalizePath(candidate, routeSpace);
+            const reservedClaim = declarative_control_1.CompiledRouteClaimSchema.parse({
+                kind: 'canonical',
+                routeSpaceRevisionRef: claim.routeSpaceRevisionRef,
+                pathTemplate: candidate,
                 surface: claim.surface,
-                caseSensitive: routeSpace.caseSensitive,
-                trailingSlash: routeSpace.trailingSlash,
-                parameters: routeSpace.parameters,
-            },
-        }));
+                normalizedPath: normalizedReserved,
+                matcher,
+            });
+            return ((0, exports.compiledRouteClaimsOverlap)(compiledClaim, reservedClaim) ||
+                normalizedPath.startsWith(`${normalizedReserved.replace(/\/+$/, '')}/`));
+        });
+        if (reserved) {
+            const takeover = takeoverAuthorizations.find((authorization) => compiledClaim.kind === 'canonical' &&
+                authorization.normalizedPath === compiledClaim.normalizedPath &&
+                (0, exports.sameRevisionRef)(authorization.routeSpaceRevisionRef, compiledClaim.routeSpaceRevisionRef));
+            if (!takeover) {
+                throw new DeclarativeControlCompilationError('ROUTE_RESERVED', `routeClaims[${index}].pathTemplate`, `Route ${normalizedPath} is reserved by ${routeSpace.routeSpaceId}.`);
+            }
+        }
+        const conflict = compiled.find((candidate) => (0, exports.sameRevisionRef)(candidate.routeSpaceRevisionRef, claim.routeSpaceRevisionRef) &&
+            (0, exports.compiledRouteClaimsOverlap)(candidate, compiledClaim));
+        if (conflict)
+            throw new DeclarativeControlCompilationError('ROUTE_CONFLICT', `routeClaims[${index}].pathTemplate`, `Route ${normalizedPath} overlaps another active claim pattern.`);
+        compiled.push(compiledClaim);
     });
     if (!compiled.some((claim) => claim.kind === 'canonical')) {
         throw new DeclarativeControlCompilationError('ROUTE_CONFLICT', 'routeClaims', 'At least one canonical route claim is required.');
@@ -293,7 +566,81 @@ const compileRouteClaims = (input) => {
     return Object.freeze(compiled);
 };
 exports.compileRouteClaims = compileRouteClaims;
-const routeParameterPattern = (type) => {
+/**
+ * Matches an application-relative request path using only the policy frozen into
+ * a CompiledRouteClaim. Runtime consumers must not reconstruct RouteSpace policy
+ * from product ids or deployment configuration.
+ */
+const matchCompiledRouteClaim = (claimInput, pathInput) => {
+    const claim = declarative_control_1.CompiledRouteClaimSchema.parse(claimInput);
+    const rawPath = String(pathInput || '').trim();
+    if (!rawPath.startsWith('/') ||
+        rawPath.includes('?') ||
+        rawPath.includes('#') ||
+        rawPath.includes('\\') ||
+        rawPath.includes('://')) {
+        return { matched: false, parameters: {} };
+    }
+    const rawSegments = rawPath.split('/');
+    if (rawSegments.some((segment) => segment === '.' || segment === '..'))
+        return { matched: false, parameters: {} };
+    const requestHasTrailingSlash = rawPath.length > 1 && rawPath.endsWith('/');
+    if (claim.matcher.trailingSlash === 'require' && !requestHasTrailingSlash)
+        return { matched: false, parameters: {} };
+    if (claim.matcher.trailingSlash === 'preserve' &&
+        requestHasTrailingSlash !== (claim.normalizedPath.length > 1 && claim.normalizedPath.endsWith('/'))) {
+        return { matched: false, parameters: {} };
+    }
+    const normalizeTrailing = (value) => {
+        if (claim.matcher.trailingSlash === 'remove' && value.length > 1)
+            return value.replace(/\/+$/, '');
+        if (claim.matcher.trailingSlash === 'require' && value.length > 1 && !value.endsWith('/'))
+            return `${value}/`;
+        return value;
+    };
+    const requestPath = normalizeTrailing(rawPath);
+    const templatePath = normalizeTrailing(claim.normalizedPath);
+    const requestSegments = requestPath.split('/').filter(Boolean);
+    const templateSegments = templatePath.split('/').filter(Boolean);
+    if (requestSegments.length !== templateSegments.length)
+        return { matched: false, parameters: {} };
+    const parameterDefinitions = new Map(claim.matcher.parameters.map((parameter) => [parameter.name, parameter]));
+    const parameters = {};
+    const normalizedSegments = [];
+    for (let index = 0; index < templateSegments.length; index += 1) {
+        const template = templateSegments[index];
+        const rawValue = requestSegments[index];
+        const match = template.match(/^[:$]([A-Za-z][A-Za-z0-9_-]*)$/);
+        if (!match) {
+            if ((claim.matcher.caseSensitive ? template : template.toLowerCase()) !==
+                (claim.matcher.caseSensitive ? rawValue : rawValue.toLowerCase())) {
+                return { matched: false, parameters: {} };
+            }
+            normalizedSegments.push(template);
+            continue;
+        }
+        const definition = parameterDefinitions.get(match[1]);
+        let value;
+        try {
+            value = decodeURIComponent(rawValue);
+        }
+        catch {
+            return { matched: false, parameters: {} };
+        }
+        if (!definition || !routeParameterPattern(definition.type).test(value))
+            return { matched: false, parameters: {} };
+        parameters[definition.name] = value;
+        normalizedSegments.push(rawValue);
+    }
+    const canonicalPath = normalizeTrailing(`/${normalizedSegments.join('/')}` || '/');
+    return {
+        matched: true,
+        normalizedPath: canonicalPath,
+        parameters: Object.freeze(parameters),
+    };
+};
+exports.matchCompiledRouteClaim = matchCompiledRouteClaim;
+function routeParameterPattern(type) {
     if (type === 'integer')
         return /^-?\d+$/;
     if (type === 'uuid')
@@ -301,7 +648,7 @@ const routeParameterPattern = (type) => {
     if (type === 'slug')
         return /^[A-Za-z0-9]+(?:[._-][A-Za-z0-9]+)*$/;
     return /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-};
+}
 /**
  * Materializes the browser URL owned by a RouteSpace from an application-relative
  * compiled route. Declarations and runtime resolution remain application-relative;
@@ -339,7 +686,12 @@ const renderTreeDepth = (tree) => {
     tree.nodes.forEach((node) => {
         let depth = 1;
         let parentId = node.parentNodeId;
+        const ancestors = new Set([node.nodeId]);
         while (parentId) {
+            if (ancestors.has(parentId)) {
+                throw new DeclarativeControlCompilationError('RENDER_TREE_INVALID', 'page.renderTree.nodes', `RenderTree contains a parent cycle at ${parentId}.`);
+            }
+            ancestors.add(parentId);
             depth += 1;
             parentId = byId.get(parentId)?.parentNodeId;
         }
@@ -347,38 +699,138 @@ const renderTreeDepth = (tree) => {
     });
     return maximum;
 };
-const compareLegacyEntityRef = (reference, revision) => reference.kind === revision.kind
-    && reference.id === revision.id
-    && String(reference.version) === String(revision.revision)
-    && reference.ownerRepo === revision.ownerRepo;
+const compareLegacyEntityRef = (reference, revision) => reference.kind === revision.kind &&
+    reference.id === revision.id &&
+    String(reference.version) === String(revision.revision) &&
+    reference.ownerRepo === revision.ownerRepo;
 const pageDependencies = (page, compilerRevisionRef) => [
-    ...page.routeClaims.map((claim) => ({ role: 'route-space', revisionRef: claim.routeSpaceRevisionRef })),
+    ...page.routeClaims.map((claim) => ({
+        role: 'route-space',
+        revisionRef: claim.routeSpaceRevisionRef,
+    })),
     { role: 'shell', revisionRef: page.shellRevisionRef },
     ...page.capabilityInstances.flatMap((instance) => [
-        { role: 'capability', revisionRef: instance.capabilityRevisionRef },
+        {
+            role: 'capability',
+            revisionRef: instance.capabilityRevisionRef,
+        },
         { role: 'provider', revisionRef: instance.providerRevisionRef },
-        { role: 'schema', revisionRef: instance.propertySchemaRevisionRef },
+        ...(instance.eventEffects ?? []).map((effect) => ({ role: 'schema', revisionRef: effect.sourceIntentSchemaRevisionRef })),
+        {
+            role: 'schema',
+            revisionRef: instance.propertySchemaRevisionRef,
+        },
     ]),
+    ...(page.stateDefinitions ?? []).map((state) => ({
+        role: 'schema',
+        revisionRef: state.schemaRevisionRef,
+    })),
+    ...(page.interactionBindings ?? []).map((binding) => ({
+        role: 'schema',
+        revisionRef: binding.sourceIntentSchemaRevisionRef,
+    })),
     ...page.ontologyBindings.flatMap((binding) => [
-        { role: 'ontology-definition', revisionRef: binding.ontologyDefinitionRevisionRef },
-        ...(binding.viewRevisionRef ? [{ role: 'view', revisionRef: binding.viewRevisionRef }] : []),
-        ...(binding.projectionRevisionRef ? [{ role: 'projection', revisionRef: binding.projectionRevisionRef }] : []),
-        { role: 'schema', revisionRef: binding.renderModelSchemaRevisionRef },
+        {
+            role: 'ontology-definition',
+            revisionRef: binding.ontologyDefinitionRevisionRef,
+        },
+        { role: 'view', revisionRef: binding.viewRevisionRef },
+        {
+            role: 'view',
+            revisionRef: binding.canonicalDataViewRevisionRef,
+        },
+        {
+            role: 'schema',
+            revisionRef: binding.renderModelSchemaRevisionRef,
+        },
+        ...(binding.cursorWindow
+            ? [
+                {
+                    role: 'schema',
+                    revisionRef: binding.cursorWindow.pageChangeIntentSchemaRevisionRef,
+                },
+            ]
+            : []),
+    ]),
+    ...(page.queryBindings ?? []).flatMap((binding) => [
+        {
+            role: 'query-definition',
+            revisionRef: binding.queryDefinitionRevisionRef,
+        },
+        {
+            role: 'schema',
+            revisionRef: binding.renderModelSchemaRevisionRef,
+        },
+        ...(binding.targetProjection ? [{ role: 'schema', revisionRef: binding.targetProjection.schemaRevisionRef }] : []),
+        ...(binding.streamTargetProjection ? [{ role: 'schema', revisionRef: binding.streamTargetProjection.schemaRevisionRef }] : []),
+        ...(binding.cursorWindow
+            ? [
+                {
+                    role: 'schema',
+                    revisionRef: binding.cursorWindow.pageChangeIntentSchemaRevisionRef,
+                },
+            ]
+            : []),
     ]),
     ...page.actionBindings.flatMap((binding) => [
         { role: 'action', revisionRef: binding.commandRevisionRef },
-        { role: 'schema', revisionRef: binding.sourceIntentSchemaRevisionRef },
+        {
+            role: 'schema',
+            revisionRef: binding.sourceIntentSchemaRevisionRef,
+        },
         { role: 'schema', revisionRef: binding.inputSchemaRevisionRef },
         { role: 'schema', revisionRef: binding.resultSchemaRevisionRef },
-        ...(binding.compensationCommandRevisionRef ? [{ role: 'action', revisionRef: binding.compensationCommandRevisionRef }] : []),
+        ...(binding.compensationCommandRevisionRef
+            ? [
+                {
+                    role: 'action',
+                    revisionRef: binding.compensationCommandRevisionRef,
+                },
+            ]
+            : []),
     ]),
-    ...page.tokenRevisionRefs.map((revisionRef) => ({ role: 'token', revisionRef })),
+    ...page.tokenRevisionRefs.map((revisionRef) => ({
+        role: 'token',
+        revisionRef,
+    })),
     { role: 'performance-budget', revisionRef: page.performanceBudgetRef },
-    { role: 'observation-policy', revisionRef: page.observationPolicyRevisionRef },
+    {
+        role: 'observation-policy',
+        revisionRef: page.observationPolicyRevisionRef,
+    },
     { role: 'compiler', revisionRef: compilerRevisionRef },
 ];
+const domainQueryDependencies = (definition) => [
+    ...(definition.ontologyDefinitionRevisionRef
+        ? [
+            {
+                role: 'ontology-definition',
+                revisionRef: definition.ontologyDefinitionRevisionRef,
+            },
+        ]
+        : []),
+    ...(definition.viewRevisionRef ? [{ role: 'view', revisionRef: definition.viewRevisionRef }] : []),
+    ...(definition.canonicalDataViewRevisionRef
+        ? [
+            {
+                role: 'view',
+                revisionRef: definition.canonicalDataViewRevisionRef,
+            },
+        ]
+        : []),
+    { role: 'schema', revisionRef: definition.inputSchemaRevisionRef },
+    { role: 'schema', revisionRef: definition.resultSchemaRevisionRef },
+];
 const compilePageRuntimeBundle = (input) => {
-    const page = declarative_control_1.PageSchema.parse(input.page);
+    const parsedPage = declarative_control_1.PageSchema.parse(input.page);
+    const page = {
+        ...parsedPage,
+        routeStatePresentations: parsedPage.routeStatePresentations ?? [],
+        stateDefinitions: parsedPage.stateDefinitions ?? [],
+        entryTransitions: parsedPage.entryTransitions ?? [],
+        interactionBindings: parsedPage.interactionBindings ?? [],
+        queryBindings: parsedPage.queryBindings ?? [],
+    };
     const pageRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.pageRevisionRef);
     const release = declarative_control_1.PageReleaseSchema.parse(input.release);
     const releaseRevisionRef = declarative_control_1.RevisionRefSchema.parse(input.releaseRevisionRef);
@@ -393,6 +845,61 @@ const compilePageRuntimeBundle = (input) => {
     requireReleaseReady(release);
     requireDependencies(release.dependencySnapshot, pageDependencies(page, compilerRevisionRef));
     assertDependencyScopes(release.dependencySnapshot, scope);
+    const queryRegistrations = (input.domainQueryRegistry ?? []).map((registration, index) => {
+        const definitionRevisionRef = declarative_control_1.RevisionRefSchema.parse(registration.definitionRevisionRef);
+        const definition = declarative_control_1.DomainQueryDefinitionSchema.parse(registration.definition);
+        assertSameTenantScope(definition.tenantScope, scope, `domainQueryRegistry[${index}].definition.tenantScope`);
+        assertRevisionIdentity(definitionRevisionRef, 'domain-query-definition', definition.queryId, scope, `domainQueryRegistry[${index}].definitionRevisionRef`);
+        if (definitionRevisionRef.contentHash !== (0, exports.canonicalContentHash)(definition)) {
+            throw new DeclarativeControlCompilationError('QUERY_DEFINITION_MISMATCH', `domainQueryRegistry[${index}].definitionRevisionRef.contentHash`, 'Domain Query registry entry does not match its exact definition content hash.');
+        }
+        return { definitionRevisionRef, definition };
+    });
+    assertUniqueRegistryKeys(queryRegistrations.map((registration) => (0, exports.revisionRefKey)(registration.definitionRevisionRef)), 'domainQueryRegistry');
+    const queryDefinitionsByRevision = new Map(queryRegistrations.map((registration) => [
+        (0, exports.revisionRefKey)(registration.definitionRevisionRef),
+        registration.definition,
+    ]));
+    page.queryBindings.forEach((binding, index) => {
+        const definition = queryDefinitionsByRevision.get((0, exports.revisionRefKey)(binding.queryDefinitionRevisionRef));
+        if (!definition) {
+            throw new DeclarativeControlCompilationError('QUERY_DEFINITION_MISMATCH', `queryBindings[${index}].queryDefinitionRevisionRef`, 'Query binding does not resolve to one exact governed Domain Query definition.');
+        }
+        if (!(0, exports.sameRevisionRef)(definition.resultSchemaRevisionRef, binding.renderModelSchemaRevisionRef)) {
+            throw new DeclarativeControlCompilationError('QUERY_DEFINITION_MISMATCH', `queryBindings[${index}].renderModelSchemaRevisionRef`, 'Query binding render model does not match the exact Domain Query result schema.');
+        }
+        if (!(0, exports.accessPolicyChainImplies)([page.pageAccessPolicy], definition.accessPolicy) &&
+            binding.accessFailure !== 'render-forbidden') {
+            throw new DeclarativeControlCompilationError('AUDIENCE_WIDER_THAN_TARGET', `queryBindings[${index}]`, 'Page access is wider than the governed Domain Query audience.');
+        }
+        const sourceKind = definition.dataSource?.kind ?? 'exact-view';
+        if (binding.execution === 'local-state' && sourceKind !== 'page-state') {
+            throw new DeclarativeControlCompilationError('QUERY_DEFINITION_MISMATCH', `queryBindings[${index}].execution`, 'A local-state binding must resolve to one page-state Domain Query definition.');
+        }
+        if (binding.execution === 'server' && sourceKind === 'page-state') {
+            throw new DeclarativeControlCompilationError('QUERY_DEFINITION_MISMATCH', `queryBindings[${index}].execution`, 'A page-state Domain Query cannot execute on the Server.');
+        }
+        requireDependencies(release.dependencySnapshot, domainQueryDependencies(definition));
+    });
+    const shellRegistration = declarative_control_http_1.DeclarativeProductResourceRegistrationSchema.parse(input.shellRegistration);
+    if (shellRegistration.resourceKind !== 'shell' ||
+        !(0, exports.sameRevisionRef)(shellRegistration.resourceRevisionRef, page.shellRevisionRef) ||
+        (0, exports.declarativeProductResourceRevisionHash)(shellRegistration) !== shellRegistration.resourceRevisionRef.contentHash ||
+        (0, exports.declarativeProductResourceSourceHash)(shellRegistration.document) !== shellRegistration.sourceContentHash) {
+        throw new DeclarativeControlCompilationError('SHELL_REVISION_MISMATCH', 'shellRegistration', 'The active Shell registration does not match the Page exact Shell revision.');
+    }
+    if (!shellRegistration.supportedSurfaces.includes(release.target.surface)) {
+        throw new DeclarativeControlCompilationError('SHELL_SURFACE_MISMATCH', 'shellRegistration.supportedSurfaces', 'The active Shell registration does not support the release surface.');
+    }
+    const shellDocument = declarative_control_http_1.DeclarativeShellResourceDocumentSchema.parse(shellRegistration.document);
+    const shellChrome = shellDocument.surfaceChrome.find((entry) => entry.surface === release.target.surface);
+    if (!shellChrome) {
+        throw new DeclarativeControlCompilationError('SHELL_CHROME_UNAVAILABLE', 'shellRegistration.document.surfaceChrome', 'The active Shell does not declare chrome for the release surface.');
+    }
+    const shellDescriptor = {
+        shellRevisionRef: page.shellRevisionRef,
+        header: shellChrome.header,
+    };
     if (page.renderTree.nodes.length > input.limits.maxRenderNodes)
         throw new DeclarativeControlCompilationError('RENDER_NODE_LIMIT_EXCEEDED', 'page.renderTree.nodes', 'RenderTree exceeds the caller-approved node limit.');
     if (renderTreeDepth(page.renderTree) > input.limits.maxRenderDepth)
@@ -425,43 +932,187 @@ const compilePageRuntimeBundle = (input) => {
     ]));
     page.capabilityInstances.forEach((instance, index) => {
         const node = renderTree.nodes.find((candidate) => candidate.nodeId === instance.nodeId);
-        if (!node || !compareLegacyEntityRef(node.capabilityRef, instance.capabilityRevisionRef)
-            || !node.providerRef || !compareLegacyEntityRef(node.providerRef, instance.providerRevisionRef)
-            || node.pageRef.id !== page.pageId) {
+        if (!node ||
+            !compareLegacyEntityRef(node.capabilityRef, instance.capabilityRevisionRef) ||
+            !node.providerRef ||
+            !compareLegacyEntityRef(node.providerRef, instance.providerRevisionRef) ||
+            node.pageRef.id !== page.pageId) {
             throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}]`, 'RenderTree node identity does not match the declared capability/provider instance.');
         }
         const registration = registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
-        if (!registration?.editorEligible) {
-            throw new DeclarativeControlCompilationError('CAPABILITY_NOT_EDITOR_ELIGIBLE', `capabilityInstances[${index}]`, 'Capability/provider pair is not editor-eligible.');
+        if (!registration) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}]`, 'Capability/provider pair has no exact governed Design registration.');
         }
         if (instance.allowedSideEffects.some((sideEffect) => !registration.allowedSideEffects.includes(sideEffect))) {
             throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}].allowedSideEffects`, 'Page requests undeclared provider side effects.');
         }
+        if (!(0, exports.sameRevisionRef)(instance.propertySchemaRevisionRef, registration.propertySchemaRevisionRef)) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `capabilityInstances[${index}].propertySchemaRevisionRef`, 'Capability properties do not pin the exact schema registered by the active Design catalog.');
+        }
+        if (!(0, exports.accessPolicyChainImplies)([page.pageAccessPolicy, ...(instance.accessPolicy ? [instance.accessPolicy] : [])], registration.accessPolicy)) {
+            throw new DeclarativeControlCompilationError('AUDIENCE_WIDER_THAN_TARGET', `capabilityInstances[${index}]`, 'Page access is wider than the governed capability audience.');
+        }
+    });
+    if (instancesByNode.size !== page.capabilityInstances.length) {
+        throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', 'capabilityInstances', 'Each executable RenderTree node must be governed by at most one capability instance.');
+    }
+    renderTree.nodes.forEach((node, index) => {
+        if (!node.providerRef)
+            return;
+        if (!instancesByNode.has(node.nodeId)) {
+            throw new DeclarativeControlCompilationError('CAPABILITY_BINDING_MISMATCH', `renderTree.nodes[${index}]`, 'Every provider-backed RenderTree node must be governed by one capability instance.');
+        }
     });
     page.ontologyBindings.forEach((binding, index) => {
         const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.target.capabilityInstanceId);
-        const registration = instance && registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const registration = instance &&
+            registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
         const port = registration?.inputPorts.find((candidate) => candidate.name === binding.target.port);
         if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.renderModelSchemaRevisionRef)) {
             throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `ontologyBindings[${index}].target.port`, 'Ontology render model does not match the registered capability input port.');
         }
+        if (binding.cursorWindow) {
+            const sourceInstance = page.capabilityInstances.find(candidate => candidate.instanceId === (binding.cursorWindow.sourceCapabilityInstanceId ?? binding.target.capabilityInstanceId));
+            const sourceRegistration = sourceInstance && registrationsByPair.get(`${(0, exports.revisionRefKey)(sourceInstance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(sourceInstance.providerRevisionRef)}`);
+            const pageChangePort = sourceRegistration?.outputPorts.find((candidate) => candidate.name === binding.cursorWindow.pageChangePort);
+            if (!pageChangePort ||
+                !(0, exports.sameRevisionRef)(pageChangePort.schemaRevisionRef, binding.cursorWindow.pageChangeIntentSchemaRevisionRef)) {
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `ontologyBindings[${index}].cursorWindow.pageChangePort`, 'Cursor-window page-change intent does not match the registered capability output port.');
+            }
+        }
+    });
+    page.queryBindings.forEach((binding, index) => {
+        const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.target.capabilityInstanceId);
+        const registration = instance &&
+            registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const port = registration?.inputPorts.find((candidate) => candidate.name === binding.target.port);
+        if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, (binding.targetProjection?.schemaRevisionRef ?? binding.renderModelSchemaRevisionRef))) {
+            throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `queryBindings[${index}].target.port`, 'Domain Query render model does not match the registered capability input port.');
+        }
+        if (binding.streamTargetProjection && (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.streamTargetProjection.schemaRevisionRef))) {
+            throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `queryBindings[${index}].streamTargetProjection`, 'Stream render model does not match the registered capability input port.');
+        }
+        if (binding.cursorWindow) {
+            const sourceInstance = page.capabilityInstances.find(candidate => candidate.instanceId === (binding.cursorWindow.sourceCapabilityInstanceId ?? binding.target.capabilityInstanceId));
+            const sourceRegistration = sourceInstance && registrationsByPair.get(`${(0, exports.revisionRefKey)(sourceInstance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(sourceInstance.providerRevisionRef)}`);
+            const pageChangePort = sourceRegistration?.outputPorts.find((candidate) => candidate.name === binding.cursorWindow.pageChangePort);
+            if (!pageChangePort ||
+                !(0, exports.sameRevisionRef)(pageChangePort.schemaRevisionRef, binding.cursorWindow.pageChangeIntentSchemaRevisionRef)) {
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `queryBindings[${index}].cursorWindow.pageChangePort`, 'Cursor-window page-change intent does not match the registered capability output port.');
+            }
+        }
+    });
+    page.capabilityInstances.forEach((instance, index) => {
+        const registration = registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        instance.eventPayloadBindings?.forEach((binding, bindingIndex) => {
+            if (!registration?.outputPorts.some((port) => port.name === binding.port))
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `capabilityInstances[${index}].eventPayloadBindings[${bindingIndex}]`, 'Event payload projection must reference a registered output port.');
+        });
+        instance.eventEffects?.forEach((effect, effectIndex) => {
+            const port = registration?.outputPorts.find((candidate) => candidate.name === effect.sourcePort);
+            if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, effect.sourceIntentSchemaRevisionRef))
+                throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `capabilityInstances[${index}].eventEffects[${effectIndex}]`, 'Event effect source must match an exact registered output port schema.');
+        });
+    });
+    page.interactionBindings.forEach((binding, index) => {
+        const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.source.capabilityInstanceId);
+        const registration = instance &&
+            registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const port = registration?.outputPorts.find((candidate) => candidate.name === binding.source.port);
+        if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.sourceIntentSchemaRevisionRef)) {
+            throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `interactionBindings[${index}].sourceIntentSchemaRevisionRef`, 'Interaction source intent does not match the registered capability output port.');
+        }
     });
     page.actionBindings.forEach((binding, index) => {
         const instance = page.capabilityInstances.find((candidate) => candidate.instanceId === binding.source.capabilityInstanceId);
-        const registration = instance && registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
+        const registration = instance &&
+            registrationsByPair.get(`${(0, exports.revisionRefKey)(instance.capabilityRevisionRef)}:${(0, exports.revisionRefKey)(instance.providerRevisionRef)}`);
         const port = registration?.outputPorts.find((candidate) => candidate.name === binding.source.port);
         if (!port || !(0, exports.sameRevisionRef)(port.schemaRevisionRef, binding.sourceIntentSchemaRevisionRef)) {
             throw new DeclarativeControlCompilationError('PORT_TYPE_MISMATCH', `actionBindings[${index}].sourceIntentSchemaRevisionRef`, 'Action source intent does not match the registered capability output port.');
         }
     });
-    const routeClaims = (0, exports.compileRouteClaims)({ claims: page.routeClaims, routeSpaces: input.routeSpaces, surface: release.target.surface });
+    const routeClaims = (0, exports.compileRouteClaims)({
+        claims: page.routeClaims,
+        routeSpaces: input.routeSpaces,
+        surface: release.target.surface,
+        legacyRouteTakeoverAuthorizations: release.target.legacyRouteTakeoverAuthorization
+            ? [release.target.legacyRouteTakeoverAuthorization]
+            : [],
+    });
     const releaseRoute = routeClaims.find((claim) => claim.kind === 'canonical' && claim.normalizedPath === release.target.normalizedPath);
     if (!releaseRoute || !(0, exports.sameRevisionRef)(releaseRoute.routeSpaceRevisionRef, release.target.routeSpaceRevisionRef)) {
-        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match a canonical Page route claim.');
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match an exact Page route claim.');
     }
     if (!page.supportedSurfaces.includes(release.target.surface)) {
         throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target.surface', 'Page does not support the release surface.');
     }
+    const routeTargets = (input.targetRegistry ?? []).map((registration, index) => ({
+        ...registration,
+        stableTargetRef: declarative_control_1.StableRefSchema.parse(registration.stableTargetRef),
+        targetRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.targetRevisionRef),
+        ...(registration.releaseRevisionRef
+            ? {
+                releaseRevisionRef: declarative_control_1.RevisionRefSchema.parse(registration.releaseRevisionRef),
+            }
+            : {}),
+        accessPolicy: declarative_control_1.AccessPolicySchema.parse(registration.accessPolicy),
+        routeClaim: declarative_control_1.CompiledRouteClaimSchema.parse(registration.routeClaim),
+        sourceIndex: index,
+    }));
+    assertUniqueRegistryKeys(routeTargets.map((registration) => (0, exports.stableRefKey)(registration.stableTargetRef)), 'targetRegistry');
+    const entryTransitions = page.entryTransitions.map((transition, index) => {
+        const matches = routeTargets.filter((registration) => registration.kind === 'route' &&
+            (0, exports.sameStableRef)(registration.stableTargetRef, transition.targetRef) &&
+            registration.surface === release.target.surface);
+        if (matches.length !== 1) {
+            throw new DeclarativeControlCompilationError('PAGE_ENTRY_TARGET_UNRELEASED', `entryTransitions[${index}].targetRef`, 'Entry transition target must resolve to one exact active route registration on the same surface.');
+        }
+        const target = matches[0];
+        if (target.releaseRevisionRef && !['page-release', 'workbench-release'].includes(target.releaseRevisionRef.kind)) {
+            throw new DeclarativeControlCompilationError('PAGE_ENTRY_TARGET_UNRELEASED', `entryTransitions[${index}].targetRef`, 'Entry transition Release provenance must identify a Page or Workbench Release.');
+        }
+        if (target.routeClaim.kind !== 'canonical') {
+            throw new DeclarativeControlCompilationError('PAGE_ENTRY_TARGET_UNRELEASED', `entryTransitions[${index}].targetRef`, 'Entry transition targets must expose one canonical route claim.');
+        }
+        if (!(0, exports.sameStableRef)(target.stableTargetRef, target.targetRevisionRef)) {
+            throw new DeclarativeControlCompilationError('PAGE_ENTRY_TARGET_UNRELEASED', `targetRegistry[${target.sourceIndex}]`, 'Entry transition target registration identity is not exact.');
+        }
+        // Entry transitions may narrow into a separately protected route. The target
+        // route remains authoritative and re-evaluates its own access policy after
+        // navigation, so a source Page must not inherit the target's permissions.
+        const requiredPathParameters = [...target.routeClaim.normalizedPath.matchAll(/:([A-Za-z][A-Za-z0-9_-]*)/g)].map((match) => match[1]);
+        const mappedPathParameters = Object.keys(transition.pathParameters);
+        const missing = requiredPathParameters.find((name) => !mappedPathParameters.includes(name));
+        const unknown = mappedPathParameters.find((name) => !requiredPathParameters.includes(name));
+        if (missing || unknown) {
+            throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', `entryTransitions[${index}].pathParameters`, missing
+                ? `Entry transition does not resolve target route parameter ${missing}.`
+                : `Entry transition maps unknown target route parameter ${unknown}.`);
+        }
+        requireDependencies(release.dependencySnapshot, [
+            {
+                role: target.targetRevisionRef.kind,
+                revisionRef: target.targetRevisionRef,
+            },
+            ...(target.releaseRevisionRef
+                ? [
+                    {
+                        role: target.releaseRevisionRef.kind,
+                        revisionRef: target.releaseRevisionRef,
+                    },
+                ]
+                : []),
+        ]);
+        return {
+            ...transition,
+            browsingContext: transition.browsingContext ?? 'same',
+            targetRevisionRef: target.targetRevisionRef,
+            ...(target.releaseRevisionRef ? { targetReleaseRevisionRef: target.releaseRevisionRef } : {}),
+            targetAccessPolicy: target.accessPolicy,
+            targetRouteClaim: target.routeClaim,
+        };
+    });
     const unsigned = {
         contract: 'PageRuntimeBundle',
         schemaVersion: 1,
@@ -476,10 +1127,17 @@ const compilePageRuntimeBundle = (input) => {
         pageRevisionRef,
         surface: release.target.surface,
         routeClaims,
+        routeStatePresentations: page.routeStatePresentations.filter((presentation) => presentation.surface === release.target.surface),
         shellRevisionRef: page.shellRevisionRef,
+        shellDescriptor,
         renderTree,
         capabilityInstances: page.capabilityInstances,
+        deniedCapabilityInstanceIds: [],
+        stateDefinitions: page.stateDefinitions,
+        entryTransitions,
+        interactionBindings: page.interactionBindings,
         ontologyBindings: page.ontologyBindings,
+        queryBindings: page.queryBindings,
         actionBindings: page.actionBindings,
         pageAccessPolicy: page.pageAccessPolicy,
         tokenRevisionRefs: page.tokenRevisionRefs,
@@ -487,32 +1145,59 @@ const compilePageRuntimeBundle = (input) => {
         observationPolicyRevisionRef: page.observationPolicyRevisionRef,
         privacyClassification: page.privacyClassification,
     };
-    return deepFreeze(declarative_control_1.PageRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+    return deepFreeze(declarative_control_1.PageRuntimeBundleSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(unsigned),
+    }));
 };
 exports.compilePageRuntimeBundle = compilePageRuntimeBundle;
 const workbenchDependencyRole = (kind) => {
     switch (kind) {
-        case 'workflow': return 'workflow';
-        case 'agent': return 'agent';
-        case 'capability': return 'capability';
-        case 'design': return 'design';
-        case 'built-in-application': return 'built-in-application';
-        default: return 'workflow';
+        case 'workflow':
+            return 'workflow';
+        case 'agent':
+            return 'agent';
+        case 'capability':
+            return 'capability';
+        case 'design':
+            return 'design';
+        case 'built-in-application':
+            return 'built-in-application';
+        default:
+            return 'workflow';
     }
 };
 const workbenchDependencies = (workbench, compilerRevisionRef) => [
-    ...workbench.routeClaims.map((claim) => ({ role: 'route-space', revisionRef: claim.routeSpaceRevisionRef })),
+    ...workbench.routeClaims.map((claim) => ({
+        role: 'route-space',
+        revisionRef: claim.routeSpaceRevisionRef,
+    })),
     ...workbench.appInstances.flatMap((instance) => [
-        { role: workbenchDependencyRole(instance.targetRevisionRef.kind), revisionRef: instance.targetRevisionRef },
+        {
+            role: workbenchDependencyRole(instance.targetRevisionRef.kind),
+            revisionRef: instance.targetRevisionRef,
+        },
         { role: 'provider', revisionRef: instance.providerRevisionRef },
         { role: 'schema', revisionRef: instance.inputSchemaRevisionRef },
     ]),
-    { role: 'capability', revisionRef: workbench.layout.hostCapabilityRevisionRef },
+    {
+        role: 'capability',
+        revisionRef: workbench.layout.hostCapabilityRevisionRef,
+    },
     { role: 'provider', revisionRef: workbench.layout.hostProviderRevisionRef },
-    { role: 'layout-policy', revisionRef: workbench.layout.layoutPolicyRevisionRef },
-    ...workbench.layout.tokenRevisionRefs.map((revisionRef) => ({ role: 'token', revisionRef })),
+    {
+        role: 'layout-policy',
+        revisionRef: workbench.layout.layoutPolicyRevisionRef,
+    },
+    ...workbench.layout.tokenRevisionRefs.map((revisionRef) => ({
+        role: 'token',
+        revisionRef,
+    })),
     { role: 'performance-budget', revisionRef: workbench.performanceBudgetRef },
-    { role: 'observation-policy', revisionRef: workbench.observationPolicyRevisionRef },
+    {
+        role: 'observation-policy',
+        revisionRef: workbench.observationPolicyRevisionRef,
+    },
     { role: 'compiler', revisionRef: compilerRevisionRef },
 ];
 const compileWorkbenchRuntimeBundle = (input) => {
@@ -525,7 +1210,8 @@ const compileWorkbenchRuntimeBundle = (input) => {
     assertSameTenantScope(release.tenantScope, scope, 'release.tenantScope');
     if (workbench.purpose === 'template')
         throw new DeclarativeControlCompilationError('WORKBENCH_TEMPLATE_UNRELEASABLE', 'workbench.purpose', 'Workbench templates cannot be activated.');
-    if (workbench.groups.length > input.limits.maxWorkbenchGroups || workbench.appInstances.length > input.limits.maxWorkbenchInstances) {
+    if (workbench.groups.length > input.limits.maxWorkbenchGroups ||
+        workbench.appInstances.length > input.limits.maxWorkbenchInstances) {
         throw new DeclarativeControlCompilationError('WORKBENCH_INSTANCE_LIMIT_EXCEEDED', 'workbench', 'Workbench exceeds caller-approved compilation limits.');
     }
     assertRevisionIdentity(workbenchRevisionRef, 'workbench', workbench.workbenchId, scope, 'workbenchRevisionRef');
@@ -538,10 +1224,17 @@ const compileWorkbenchRuntimeBundle = (input) => {
     requireReleaseReady(release);
     requireDependencies(release.dependencySnapshot, workbenchDependencies(workbench, compilerRevisionRef));
     assertDependencyScopes(release.dependencySnapshot, scope);
-    const routeClaims = (0, exports.compileRouteClaims)({ claims: workbench.routeClaims, routeSpaces: input.routeSpaces, surface: release.target.surface });
+    const routeClaims = (0, exports.compileRouteClaims)({
+        claims: workbench.routeClaims,
+        routeSpaces: input.routeSpaces,
+        surface: release.target.surface,
+        legacyRouteTakeoverAuthorizations: release.target.legacyRouteTakeoverAuthorization
+            ? [release.target.legacyRouteTakeoverAuthorization]
+            : [],
+    });
     const releaseRoute = routeClaims.find((claim) => claim.kind === 'canonical' && claim.normalizedPath === release.target.normalizedPath);
     if (!releaseRoute || !(0, exports.sameRevisionRef)(releaseRoute.routeSpaceRevisionRef, release.target.routeSpaceRevisionRef)) {
-        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match a canonical Workbench route claim.');
+        throw new DeclarativeControlCompilationError('ROUTE_SPACE_MISMATCH', 'release.target', 'Release target does not match an exact Workbench route claim.');
     }
     const targetRegistry = input.targetRegistry.map((registration) => ({
         stableTargetRef: declarative_control_1.StableRefSchema.parse(registration.stableTargetRef),
@@ -560,13 +1253,18 @@ const compileWorkbenchRuntimeBundle = (input) => {
             ...(instance.targetRevisionRef.tenantScope ? { tenantScope: instance.targetRevisionRef.tenantScope } : {}),
         });
         const registration = targetsByStableRef.get((0, exports.stableRefKey)(stableTarget));
-        if (!registration || !(0, exports.sameStableRef)(registration.stableTargetRef, stableFromRevision(registration.targetRevisionRef))
-            || !(0, exports.sameRevisionRef)(registration.targetRevisionRef, instance.targetRevisionRef)) {
+        if (!registration ||
+            !(0, exports.sameStableRef)(registration.stableTargetRef, stableFromRevision(registration.targetRevisionRef)) ||
+            !(0, exports.sameRevisionRef)(registration.targetRevisionRef, instance.targetRevisionRef)) {
             throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', `appInstances[${index}].targetRevisionRef`, 'Workbench app target is not present at the exact registered revision.');
         }
         assertTenantCompatible(instance.targetRevisionRef, scope, `appInstances[${index}].targetRevisionRef`);
         const group = groupsById.get(instance.groupId);
-        const chain = [workbench.workbenchAccessPolicy, ...(group?.accessPolicy ? [group.accessPolicy] : []), instance.accessPolicy];
+        const chain = [
+            workbench.workbenchAccessPolicy,
+            ...(group?.accessPolicy ? [group.accessPolicy] : []),
+            instance.accessPolicy,
+        ];
         if (!(0, exports.accessPolicyChainImplies)(chain, registration.accessPolicy)) {
             throw new DeclarativeControlCompilationError('AUDIENCE_WIDER_THAN_TARGET', `appInstances[${index}].accessPolicy`, 'Workbench and instance audience is wider than the target audience.');
         }
@@ -584,6 +1282,10 @@ const compileWorkbenchRuntimeBundle = (input) => {
         diagnostics: [],
         workbenchId: workbench.workbenchId,
         workbenchRevisionRef,
+        identity: {
+            name: workbench.identity.name,
+            ...(workbench.identity.description ? { description: workbench.identity.description } : {}),
+        },
         surface: release.target.surface,
         routeClaims,
         groups: workbench.groups,
@@ -597,7 +1299,10 @@ const compileWorkbenchRuntimeBundle = (input) => {
         observationPolicyRevisionRef: workbench.observationPolicyRevisionRef,
         privacyClassification: workbench.privacyClassification,
     };
-    return deepFreeze(declarative_control_1.WorkbenchRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+    return deepFreeze(declarative_control_1.WorkbenchRuntimeBundleSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(unsigned),
+    }));
 };
 exports.compileWorkbenchRuntimeBundle = compileWorkbenchRuntimeBundle;
 const navigationDepth = (navigation) => {
@@ -634,11 +1339,26 @@ const orderedNavigationNodes = (navigation) => {
 };
 const navigationDependencies = (navigation, release, compilerRevisionRef) => [
     ...release.resolvedTargets.flatMap((target) => [
-        { role: target.targetRevisionRef.kind === 'domain-command' ? 'action' : target.targetRevisionRef.kind, revisionRef: target.targetRevisionRef },
-        ...(target.releaseRevisionRef ? [{ role: target.releaseRevisionRef.kind, revisionRef: target.releaseRevisionRef }] : []),
+        {
+            role: target.targetRevisionRef.kind === 'domain-command'
+                ? 'action'
+                : target.targetRevisionRef.kind,
+            revisionRef: target.targetRevisionRef,
+        },
+        ...(target.releaseRevisionRef
+            ? [
+                {
+                    role: target.releaseRevisionRef.kind,
+                    revisionRef: target.releaseRevisionRef,
+                },
+            ]
+            : []),
     ]),
     { role: 'performance-budget', revisionRef: navigation.performanceBudgetRef },
-    { role: 'observation-policy', revisionRef: navigation.observationPolicyRevisionRef },
+    {
+        role: 'observation-policy',
+        revisionRef: navigation.observationPolicyRevisionRef,
+    },
     { role: 'compiler', revisionRef: compilerRevisionRef },
 ];
 const compileNavigationRuntimeBundle = (input) => {
@@ -658,8 +1378,8 @@ const compileNavigationRuntimeBundle = (input) => {
     if (!(0, exports.sameRevisionRef)(navigationRevisionRef, release.navigationRevisionRef))
         throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.navigationRevisionRef', 'Release does not pin the supplied Navigation revision.');
     assertRevisionIdentity(releaseRevisionRef, 'navigation-release', release.releaseSlotId, scope, 'releaseRevisionRef');
-    if (release.target.surface !== navigation.supportedSurfaces.find((surface) => surface === release.target.surface)
-        || !navigation.placements.includes(release.target.placement)) {
+    if (release.target.surface !== navigation.supportedSurfaces.find((surface) => surface === release.target.surface) ||
+        !navigation.placements.includes(release.target.placement)) {
         throw new DeclarativeControlCompilationError('REVISION_MISMATCH', 'release.target', 'Navigation release target is not declared by the Navigation record.');
     }
     requireReleaseReady(release);
@@ -680,19 +1400,30 @@ const compileNavigationRuntimeBundle = (input) => {
             return {
                 ...common,
                 kind: 'route',
-                releaseRevisionRef: registration.releaseRevisionRef ? declarative_control_1.RevisionRefSchema.parse(registration.releaseRevisionRef) : undefined,
+                releaseRevisionRef: registration.releaseRevisionRef
+                    ? declarative_control_1.RevisionRefSchema.parse(registration.releaseRevisionRef)
+                    : undefined,
                 routeClaim,
             };
         }
         if (registration.kind === 'registered-menu-action') {
             const sourceCatalogRevisionRef = declarative_control_1.RevisionRefSchema.parse(registration.sourceCatalogRevisionRef);
-            if (sourceCatalogRevisionRef.kind !== 'application-menu-catalog' || registration.targetRevisionRef.kind !== 'menu-action') {
+            if (sourceCatalogRevisionRef.kind !== 'application-menu-catalog' ||
+                registration.targetRevisionRef.kind !== 'menu-action') {
                 throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Registered Menu Actions require exact menu-action and application-menu-catalog revisions.');
             }
             if (registration.inputSchemaRef && !registration.validateInput) {
                 throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Registered Menu Actions with input schemas require the active catalog validator.');
             }
-            return { ...common, kind: 'registered-menu-action', applicationId: registration.applicationId, actionRef: registration.actionRef, inputSchemaRef: registration.inputSchemaRef, validateInput: registration.validateInput, sourceCatalogRevisionRef };
+            return {
+                ...common,
+                kind: 'registered-menu-action',
+                applicationId: registration.applicationId,
+                actionRef: registration.actionRef,
+                inputSchemaRef: registration.inputSchemaRef,
+                validateInput: registration.validateInput,
+                sourceCatalogRevisionRef,
+            };
         }
         if (registration.targetRevisionRef.kind !== 'domain-command') {
             throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Governed DomainCommand actions require an exact domain-command revision.');
@@ -701,10 +1432,16 @@ const compileNavigationRuntimeBundle = (input) => {
         const resultSchemaRevisionRef = registration.resultSchemaRevisionRef
             ? declarative_control_1.RevisionRefSchema.parse(registration.resultSchemaRevisionRef)
             : undefined;
-        if (inputSchemaRevisionRef.kind !== 'schema' || (resultSchemaRevisionRef && resultSchemaRevisionRef.kind !== 'schema')) {
+        if (inputSchemaRevisionRef.kind !== 'schema' ||
+            (resultSchemaRevisionRef && resultSchemaRevisionRef.kind !== 'schema')) {
             throw new DeclarativeControlCompilationError('NAV_TARGET_UNRELEASED', 'targetRegistry', 'Governed DomainCommand actions require exact input and output Schema revisions.');
         }
-        return { ...common, kind: 'governed-domain-command', inputSchemaRevisionRef, resultSchemaRevisionRef };
+        return {
+            ...common,
+            kind: 'governed-domain-command',
+            inputSchemaRevisionRef,
+            resultSchemaRevisionRef,
+        };
     });
     assertUniqueRegistryKeys(targetRegistry.map((registration) => (0, exports.stableRefKey)(registration.stableTargetRef)), 'targetRegistry');
     const targetsByStableRef = new Map(targetRegistry.map((registration) => [(0, exports.stableRefKey)(registration.stableTargetRef), registration]));
@@ -775,7 +1512,12 @@ const compileNavigationRuntimeBundle = (input) => {
         }));
         let resolvedTarget;
         if (registration.kind === 'route') {
-            resolvedTarget = { ...released, kind: 'route', accessPolicy: registration.accessPolicy, routeClaim: registration.routeClaim };
+            resolvedTarget = {
+                ...released,
+                kind: 'route',
+                accessPolicy: registration.accessPolicy,
+                routeClaim: registration.routeClaim,
+            };
         }
         else if (registration.kind === 'registered-menu-action') {
             if (!registration.inputSchemaRef && Object.keys(mappedInput).length > 0) {
@@ -788,7 +1530,8 @@ const compileNavigationRuntimeBundle = (input) => {
             catch (error) {
                 throw new DeclarativeControlCompilationError('NAV_ACTION_INPUT_INVALID', `nodes[${index}].parameterMapping`, `Registered Menu Action input failed its active catalog schema: ${error instanceof Error ? error.message : String(error)}`);
             }
-            const sourceDependency = release.dependencySnapshot.find((dependency) => dependency.role === 'application-menu-catalog' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.sourceCatalogRevisionRef));
+            const sourceDependency = release.dependencySnapshot.find((dependency) => dependency.role === 'application-menu-catalog' &&
+                (0, exports.sameRevisionRef)(dependency.revisionRef, registration.sourceCatalogRevisionRef));
             if (!sourceDependency)
                 throw new DeclarativeControlCompilationError('DEPENDENCY_MISSING', `nodes[${index}].targetRef`, 'Registered Menu Action source catalog is not pinned by NavigationRelease.');
             resolvedTarget = {
@@ -806,7 +1549,8 @@ const compileNavigationRuntimeBundle = (input) => {
         else {
             const inputDependency = release.dependencySnapshot.find((dependency) => dependency.role === 'schema' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.inputSchemaRevisionRef));
             const resultDependency = registration.resultSchemaRevisionRef
-                ? release.dependencySnapshot.find((dependency) => dependency.role === 'schema' && (0, exports.sameRevisionRef)(dependency.revisionRef, registration.resultSchemaRevisionRef))
+                ? release.dependencySnapshot.find((dependency) => dependency.role === 'schema' &&
+                    (0, exports.sameRevisionRef)(dependency.revisionRef, registration.resultSchemaRevisionRef))
                 : undefined;
             if (!inputDependency || (registration.resultSchemaRevisionRef && !resultDependency)) {
                 throw new DeclarativeControlCompilationError('DEPENDENCY_MISSING', `nodes[${index}].targetRef`, 'Governed DomainCommand schemas are not pinned by NavigationRelease.');
@@ -818,7 +1562,9 @@ const compileNavigationRuntimeBundle = (input) => {
                 execution: 'server',
                 commandRevisionRef: registration.targetRevisionRef,
                 inputSchemaRevisionRef: registration.inputSchemaRevisionRef,
-                ...(registration.resultSchemaRevisionRef ? { resultSchemaRevisionRef: registration.resultSchemaRevisionRef } : {}),
+                ...(registration.resultSchemaRevisionRef
+                    ? { resultSchemaRevisionRef: registration.resultSchemaRevisionRef }
+                    : {}),
                 input: common_1.JsonObjectSchema.parse(mappedInput),
             };
         }
@@ -846,7 +1592,10 @@ const compileNavigationRuntimeBundle = (input) => {
         performanceBudgetRef: navigation.performanceBudgetRef,
         observationPolicyRevisionRef: navigation.observationPolicyRevisionRef,
     };
-    return deepFreeze(declarative_control_1.NavigationRuntimeBundleSchema.parse({ ...unsigned, contentHash: (0, exports.canonicalContentHash)(unsigned) }));
+    return deepFreeze(declarative_control_1.NavigationRuntimeBundleSchema.parse({
+        ...unsigned,
+        contentHash: (0, exports.canonicalContentHash)(unsigned),
+    }));
 };
 exports.compileNavigationRuntimeBundle = compileNavigationRuntimeBundle;
 const validateWorkbenchRuntimeSet = (bundleInputs) => {
@@ -859,9 +1608,9 @@ const validateWorkbenchRuntimeSet = (bundleInputs) => {
     const seenOrders = new Set();
     let defaultCount = 0;
     bundles.forEach((bundle, index) => {
-        if (scopeKey(bundle.tenantScope) !== scopeKey(first.tenantScope)
-            || bundle.surface !== first.surface
-            || !(0, exports.sameStableRef)(bundle.target.environmentRef, first.target.environmentRef)) {
+        if (scopeKey(bundle.tenantScope) !== scopeKey(first.tenantScope) ||
+            bundle.surface !== first.surface ||
+            !(0, exports.sameStableRef)(bundle.target.environmentRef, first.target.environmentRef)) {
             throw new DeclarativeControlCompilationError('WORKBENCH_RELEASE_SET_INVALID', `bundles[${index}]`, 'Workbench release set entries must share tenant, environment, and surface.');
         }
         if (seenIds.has(bundle.workbenchId))
@@ -894,7 +1643,11 @@ const resolveWorkbenchEntry = (input) => {
     if (defaultBundle)
         return { status: 'resolved', bundle: defaultBundle, source: 'default' };
     if (allowed[0])
-        return { status: 'resolved', bundle: allowed[0], source: 'first-accessible' };
+        return {
+            status: 'resolved',
+            bundle: allowed[0],
+            source: 'first-accessible',
+        };
     return { status: 'forbidden', workbenchId: '' };
 };
 exports.resolveWorkbenchEntry = resolveWorkbenchEntry;