@inf-monkeys-tech/monkeys 1.0.72 → 1.1.1

package/lib/contracts/declarative-control.js

@@ -1,11 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkbenchRuntimeBundleSchema = exports.ResolvedWorkbenchAppInstanceSchema = exports.PageRuntimeBundleSchema = exports.NavigationReleaseSchema = exports.UnavailableNavigationTargetSchema = exports.ResolvedNavigationTargetSchema = exports.NavigationSchema = exports.NavigationNodeSchema = exports.NavigationSeparatorNodeSchema = exports.NavigationTargetNodeSchema = exports.NavigationGroupNodeSchema = exports.WorkbenchReleaseSchema = exports.WorkbenchSchema = exports.WorkbenchAppInstanceSchema = exports.WorkbenchGroupSchema = exports.PageReleaseSchema = exports.PageSchema = exports.ActionBindingSchema = exports.OntologyBindingSchema = exports.CapabilityInstanceSchema = exports.BindingSourceSchema = exports.WorkbenchIdentitySchema = exports.PublicationPlanSchema = exports.PublicationPlanOperationSchema = exports.ReleaseEvidenceSchema = exports.ReleaseValidationSchema = exports.ReleaseDependencySchema = exports.ReleaseDependencyRoleSchema = exports.ReleaseOperationSchema = exports.CompiledRouteClaimSchema = exports.CompiledRouteMatcherSchema = exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema = exports.LegacyRouteClaimSchema = exports.RouteSpaceSchema = exports.RouteSpaceParameterSchema = exports.RoutePathTemplateSchema = exports.ManagementAccessSchema = exports.AccessPolicySchema = exports.ProductSurfaceSchema = exports.DeclarativeLifecycleSchema = exports.StableRefAliasMapSchema = exports.StableRefAliasSchema = exports.RevisionRefSchema = exports.StableRefSchema = exports.ReferenceVisibilitySchema = exports.TenantScopeSchema = exports.ScopedIdentityRefSchema = exports.I18nTextSchema = exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = void 0;
-exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = exports.DeclarativeControlOntologyDefinitionSchema = exports.NavigationRuntimeBundleSchema = exports.CompiledNavigationNodeSchema = exports.CompiledNavigationSeparatorNodeSchema = exports.CompiledNavigationTargetNodeSchema = exports.CompiledNavigationGroupNodeSchema = exports.CompiledNavigationResolvedTargetSchema = exports.CompiledNavigationDomainCommandTargetSchema = exports.CompiledNavigationRegisteredMenuActionTargetSchema = void 0;
+exports.CursorWindowBindingSchema = exports.DomainQueryDefinitionSchema = exports.DomainQueryDataSourceSchema = exports.RegisteredServiceDomainQueryDataSourceSchema = exports.GovernedCatalogDomainQueryDataSourceSchema = exports.GovernedCatalogResourceKindSchema = exports.InteractionBindingSchema = exports.PageStateDefinitionSchema = exports.LegacyBrowserPreferenceImportSchema = exports.ResolvedPageEntryTransitionSchema = exports.PageEntryTransitionSchema = exports.PageStateActivationSchema = exports.PageStateConditionSchema = exports.BindingSourceSchema = exports.DeclarativeRouteClaimSchema = exports.LegacyRouteTakeoverAuthorizationSchema = exports.LegacySlotRestorationSchema = exports.WorkbenchIdentitySchema = exports.PublicationPlanSchema = exports.PublicationPlanOperationSchema = exports.ReleaseEvidenceSchema = exports.ReleaseValidationSchema = exports.ReleaseDependencySchema = exports.ReleaseDependencyRoleSchema = exports.ReleaseOperationSchema = exports.CompiledRouteClaimSchema = exports.CompiledRouteMatcherSchema = exports.RouteClaimSchema = exports.LegacyRouteClaimSchema = exports.RouteSpaceSchema = exports.RouteSpaceParameterSchema = exports.RoutePathTemplateSchema = exports.ManagementAccessSchema = exports.PermissionAlternativePolicySchema = exports.AccessPolicySchema = exports.DeclarativeRuntimeShellDescriptorSchema = exports.DeclarativeShellSurfaceChromeSchema = exports.DeclarativeShellHeaderChromeSchema = exports.ProductSurfaceSchema = exports.DeclarativeLifecycleSchema = exports.StableRefAliasMapSchema = exports.StableRefAliasSchema = exports.RevisionRefSchema = exports.StableRefSchema = exports.ReferenceVisibilitySchema = exports.TenantScopeSchema = exports.ScopedIdentityRefSchema = exports.I18nTextSchema = exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = exports.analyzePageBindingDependencies = void 0;
+exports.DeclarativeControlOntologyDefinitionSchema = exports.NavigationRuntimeBundleSchema = exports.CompiledNavigationNodeSchema = exports.CompiledNavigationSeparatorNodeSchema = exports.CompiledNavigationTargetNodeSchema = exports.CompiledNavigationGroupNodeSchema = exports.CompiledNavigationResolvedTargetSchema = exports.CompiledNavigationDomainCommandTargetSchema = exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.WorkbenchRuntimeBundleSchema = exports.WorkbenchRuntimeIdentitySchema = exports.ResolvedWorkbenchAppInstanceSchema = exports.PageRuntimeBundleSchema = exports.DeclarativeWorkbenchCatalogSchema = exports.DeclarativeWorkbenchCatalogEntrySchema = exports.DeclarativeRouteOwnerIndexSchema = exports.DeclarativeRouteOwnerIndexEntrySchema = exports.NavigationReleaseSchema = exports.UnavailableNavigationTargetSchema = exports.ResolvedNavigationTargetSchema = exports.NavigationSchema = exports.NavigationNodeSchema = exports.NavigationSeparatorNodeSchema = exports.NavigationTargetNodeSchema = exports.NavigationGroupNodeSchema = exports.WorkbenchReleaseSchema = exports.WorkbenchSchema = exports.WorkbenchAppInstanceSchema = exports.WorkbenchGroupSchema = exports.PageReleaseSchema = exports.ResolvedPageSchema = exports.PageSchema = exports.PageNodeSchema = exports.PageActionSchema = exports.PageDataSchema = exports.PageInteractionSchema = exports.PageEntrySchema = exports.PageEntryTargetSchema = exports.PageStateSchema = exports.PageRouteStatePresentationSchema = exports.PageMigrationEquivalenceSchema = exports.PageMigrationEquivalenceDimensionSchema = exports.ActionBindingSchema = exports.ActionResultClipboardEffectSchema = exports.ActionResultBindingEffectSchema = exports.ActionResultBindingEffectSourceSchema = exports.OntologyBindingSchema = exports.CapabilityInstanceSchema = exports.QueryBindingSchema = exports.QueryResultStateBindingSchema = void 0;
+exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = void 0;
 const zod_1 = require("zod");
 const common_1 = require("./common");
 const data_1 = require("./data");
+const legacy_route_1 = require("./legacy-route");
+const file_1 = require("./file");
 const render_1 = require("./render");
+const page_expression_1 = require("./page-expression");
+const page_binding_dependencies_1 = require("./page-binding-dependencies");
+var page_binding_dependencies_2 = require("./page-binding-dependencies");
+Object.defineProperty(exports, "analyzePageBindingDependencies", { enumerable: true, get: function () { return page_binding_dependencies_2.analyzePageBindingDependencies; } });
 exports.DECLARATIVE_CONTROL_SCHEMA_VERSION = 1;
 const uniqueArray = (values, identity) => {
     const seen = new Set();
@@ -17,6 +24,10 @@ const uniqueArray = (values, identity) => {
     }
     return undefined;
 };
+const exactRevisionRef = (left, right) => stableRefIdentity(left) === stableRefIdentity(right) &&
+    left.revision === right.revision &&
+    left.schemaVersion === right.schemaVersion &&
+    left.contentHash === right.contentHash;
 exports.I18nTextSchema = zod_1.z
     .object({
     defaultLocale: common_1.LocaleIdentifierSchema,
@@ -26,9 +37,9 @@ exports.I18nTextSchema = zod_1.z
     .superRefine((value, context) => {
     if (!Object.prototype.hasOwnProperty.call(value.values, value.defaultLocale)) {
         context.addIssue({
-            code: 'custom',
-            path: ['values', value.defaultLocale],
-            message: 'I18nText values must contain the default locale.',
+            code: "custom",
+            path: ["values", value.defaultLocale],
+            message: "I18nText values must contain the default locale.",
         });
     }
 });
@@ -48,17 +59,21 @@ exports.TenantScopeSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     const expectedKinds = [
-        ['tenantRef', value.tenantRef, 'tenant'],
-        ['dataSpaceRef', value.dataSpaceRef, 'data-space'],
-        ['teamRef', value.teamRef, 'team'],
+        ["tenantRef", value.tenantRef, "tenant"],
+        ["dataSpaceRef", value.dataSpaceRef, "data-space"],
+        ["teamRef", value.teamRef, "team"],
     ];
     expectedKinds.forEach(([field, reference, expectedKind]) => {
         if (reference && reference.kind !== expectedKind) {
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: "custom",
+                path: [field, "kind"],
+                message: `${field} must reference ${expectedKind}.`,
+            });
         }
     });
 });
-exports.ReferenceVisibilitySchema = zod_1.z.enum(['tenant', 'global', 'public']);
+exports.ReferenceVisibilitySchema = zod_1.z.enum(["tenant", "global", "public"]);
 const StableRefShape = {
     kind: common_1.ContractIdentifierSchema,
     id: common_1.ContractIdentifierSchema,
@@ -67,11 +82,19 @@ const StableRefShape = {
     tenantScope: exports.TenantScopeSchema.optional(),
 };
 const validateReferenceScope = (value, context) => {
-    if (value.visibility === 'tenant' && !value.tenantScope) {
-        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Tenant references require an explicit tenant scope.' });
+    if (value.visibility === "tenant" && !value.tenantScope) {
+        context.addIssue({
+            code: "custom",
+            path: ["tenantScope"],
+            message: "Tenant references require an explicit tenant scope.",
+        });
     }
-    if (value.visibility !== 'tenant' && value.tenantScope) {
-        context.addIssue({ code: 'custom', path: ['tenantScope'], message: 'Global and public references cannot carry a tenant scope.' });
+    if (value.visibility !== "tenant" && value.tenantScope) {
+        context.addIssue({
+            code: "custom",
+            path: ["tenantScope"],
+            message: "Global and public references cannot carry a tenant scope.",
+        });
     }
 };
 exports.StableRefSchema = zod_1.z
@@ -88,12 +111,19 @@ exports.RevisionRefSchema = zod_1.z
     .strict()
     .superRefine(validateReferenceScope);
 const scopedIdentityKey = (reference) => `${reference.kind}:${reference.id}:${reference.ownerRepo}`;
-const tenantScopeKey = (scope) => `${scopedIdentityKey(scope.tenantRef)}:${scopedIdentityKey(scope.dataSpaceRef)}:${scope.teamRef ? scopedIdentityKey(scope.teamRef) : ''}`;
-const stableRefIdentity = (reference) => `${reference.visibility}:${reference.tenantScope ? tenantScopeKey(reference.tenantScope) : ''}:${reference.kind}:${reference.id}:${reference.ownerRepo}`;
-const exactRevisionRef = (left, right) => stableRefIdentity(left) === stableRefIdentity(right)
-    && left.revision === right.revision
-    && left.schemaVersion === right.schemaVersion
-    && left.contentHash === right.contentHash;
+const tenantScopeKey = (scope) => `${scopedIdentityKey(scope.tenantRef)}:${scopedIdentityKey(scope.dataSpaceRef)}:${scope.teamRef ? scopedIdentityKey(scope.teamRef) : ""}`;
+const stableRefIdentity = (reference) => `${reference.visibility}:${reference.tenantScope ? tenantScopeKey(reference.tenantScope) : ""}:${reference.kind}:${reference.id}:${reference.ownerRepo}`;
+const validateTenantCompatibleReference = (reference, tenantScope, path, context) => {
+    if (reference.visibility === "tenant" &&
+        reference.tenantScope &&
+        tenantScopeKey(reference.tenantScope) !== tenantScopeKey(tenantScope)) {
+        context.addIssue({
+            code: "custom",
+            path: [...path, "tenantScope"],
+            message: "Reference belongs to another tenant scope.",
+        });
+    }
+};
 exports.StableRefAliasSchema = zod_1.z
     .object({
     aliasRef: exports.StableRefSchema,
@@ -105,15 +135,23 @@ exports.StableRefAliasSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     if (value.aliasRef.kind !== value.canonicalRef.kind) {
-        context.addIssue({ code: 'custom', path: ['canonicalRef', 'kind'], message: 'Alias and canonical references must have the same kind.' });
+        context.addIssue({
+            code: "custom",
+            path: ["canonicalRef", "kind"],
+            message: "Alias and canonical references must have the same kind.",
+        });
     }
     if (value.validUntil && value.validUntil <= value.validFrom) {
-        context.addIssue({ code: 'custom', path: ['validUntil'], message: 'Alias validUntil must be later than validFrom.' });
+        context.addIssue({
+            code: "custom",
+            path: ["validUntil"],
+            message: "Alias validUntil must be later than validFrom.",
+        });
     }
 });
 exports.StableRefAliasMapSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('StableRefAliasMap'),
+    contract: zod_1.z.literal("StableRefAliasMap"),
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     tenantScope: exports.TenantScopeSchema,
     aliases: zod_1.z.array(exports.StableRefAliasSchema),
@@ -123,17 +161,78 @@ exports.StableRefAliasMapSchema = zod_1.z
     .superRefine((value, context) => {
     const duplicate = uniqueArray(value.aliases, (entry) => stableRefIdentity(entry.aliasRef));
     if (duplicate)
-        context.addIssue({ code: 'custom', path: ['aliases'], message: `Duplicate alias reference: ${duplicate}` });
+        context.addIssue({
+            code: "custom",
+            path: ["aliases"],
+            message: `Duplicate alias reference: ${duplicate}`,
+        });
+});
+exports.DeclarativeLifecycleSchema = zod_1.z.enum([
+    "active",
+    "deprecated",
+    "retired",
+]);
+exports.ProductSurfaceSchema = zod_1.z.enum(["studio", "kernel"]);
+exports.DeclarativeShellHeaderChromeSchema = zod_1.z.discriminatedUnion("enabled", [
+    zod_1.z.object({ enabled: zod_1.z.literal(false) }).strict(),
+    zod_1.z
+        .object({
+        enabled: zod_1.z.literal(true),
+        navigationPlacement: zod_1.z.enum([
+            "studio.headbar.primary",
+            "kernel.primary",
+        ]),
+    })
+        .strict(),
+]);
+exports.DeclarativeShellSurfaceChromeSchema = zod_1.z
+    .object({
+    surface: exports.ProductSurfaceSchema,
+    header: exports.DeclarativeShellHeaderChromeSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (!value.header.enabled)
+        return;
+    const expectedPlacement = value.surface === "studio" ? "studio.headbar.primary" : "kernel.primary";
+    if (value.header.navigationPlacement !== expectedPlacement) {
+        context.addIssue({
+            code: "custom",
+            path: ["header", "navigationPlacement"],
+            message: `The ${value.surface} shell header must use its governed primary Navigation placement.`,
+        });
+    }
+});
+exports.DeclarativeRuntimeShellDescriptorSchema = zod_1.z
+    .object({
+    shellRevisionRef: exports.RevisionRefSchema,
+    header: exports.DeclarativeShellHeaderChromeSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.shellRevisionRef.kind !== "shell") {
+        context.addIssue({
+            code: "custom",
+            path: ["shellRevisionRef", "kind"],
+            message: "Runtime shell descriptors require an exact Shell revision.",
+        });
+    }
 });
-exports.DeclarativeLifecycleSchema = zod_1.z.enum(['active', 'deprecated', 'retired']);
-exports.ProductSurfaceSchema = zod_1.z.enum(['studio', 'kernel']);
 const GroupRefSchema = exports.StableRefSchema.superRefine((value, context) => {
-    if (value.kind !== 'group')
-        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access group references must use kind group.' });
+    if (value.kind !== "group")
+        context.addIssue({
+            code: "custom",
+            path: ["kind"],
+            message: "Access group references must use kind group.",
+        });
 });
 const AccessConditionRefSchema = exports.RevisionRefSchema.superRefine((value, context) => {
-    if (value.kind !== 'access-condition') {
-        context.addIssue({ code: 'custom', path: ['kind'], message: 'Access condition references must use kind access-condition.' });
+    if (value.kind !== "access-condition") {
+        context.addIssue({
+            code: "custom",
+            path: ["kind"],
+            message: "Access condition references must use kind access-condition.",
+        });
     }
 });
 exports.AccessPolicySchema = zod_1.z
@@ -148,16 +247,74 @@ exports.AccessPolicySchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     const checks = [
-        ['groupAllOf', value.groupAllOf, (candidate) => stableRefIdentity(candidate)],
-        ['groupAnyOf', value.groupAnyOf, (candidate) => stableRefIdentity(candidate)],
-        ['permissionAllOf', value.permissionAllOf, String],
-        ['permissionAnyOf', value.permissionAnyOf, String],
-        ['conditionAllOf', value.conditionAllOf, (candidate) => `${stableRefIdentity(candidate)}@${candidate.revision}`],
+        [
+            "groupAllOf",
+            value.groupAllOf,
+            (candidate) => stableRefIdentity(candidate),
+        ],
+        [
+            "groupAnyOf",
+            value.groupAnyOf,
+            (candidate) => stableRefIdentity(candidate),
+        ],
+        ["permissionAllOf", value.permissionAllOf, String],
+        ["permissionAnyOf", value.permissionAnyOf, String],
+        [
+            "conditionAllOf",
+            value.conditionAllOf,
+            (candidate) => `${stableRefIdentity(candidate)}@${candidate.revision}`,
+        ],
     ];
     checks.forEach(([field, values, identity]) => {
         if (uniqueArray(values, identity))
-            context.addIssue({ code: 'custom', path: [field], message: `${field} entries must be unique.` });
+            context.addIssue({
+                code: "custom",
+                path: [field],
+                message: `${field} entries must be unique.`,
+            });
+    });
+});
+/**
+ * A finite set of permission conjunctions. An identity is authorized when it
+ * satisfies every permission in at least one alternative. This is deliberately
+ * separate from AccessPolicy: it models a versioned rollout compatibility
+ * bridge such as `new-permission OR (legacy-a AND legacy-b)` without turning
+ * individual legacy permissions into broad aliases.
+ */
+exports.PermissionAlternativePolicySchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("PermissionAlternativePolicy"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    policyId: common_1.ContractIdentifierSchema,
+    alternatives: zod_1.z.array(zod_1.z.array(common_1.ContractIdentifierSchema).min(1)).min(1),
+    retirementGate: zod_1.z
+        .object({
+        capability: common_1.ContractIdentifierSchema,
+        notBefore: common_1.IsoDateTimeSchema.optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const canonical = value.alternatives.map((set) => [...new Set(set)].sort());
+    canonical.forEach((set, index) => {
+        if (set.length !== value.alternatives[index].length) {
+            context.addIssue({
+                code: "custom",
+                path: ["alternatives", index],
+                message: "A permission alternative cannot contain duplicate permissions.",
+            });
+        }
     });
+    const identities = canonical.map((set) => set.join("\0"));
+    if (new Set(identities).size !== identities.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["alternatives"],
+            message: "Permission alternatives must be unique.",
+        });
+    }
 });
 exports.ManagementAccessSchema = zod_1.z
     .object({
@@ -172,81 +329,108 @@ exports.ManagementAccessSchema = zod_1.z
 exports.RoutePathTemplateSchema = zod_1.z
     .string()
     .trim()
-    .regex(/^\/(?!\/)/, 'Expected an application-relative path.')
+    .regex(/^\/(?!\/)/, "Expected an application-relative path.")
     .superRefine((value, context) => {
-    if (value.includes('?') || value.includes('#') || value.includes('\\')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain query strings, fragments, or backslashes.' });
+    if (value.includes("?") || value.includes("#") || value.includes("\\")) {
+        context.addIssue({
+            code: "custom",
+            message: "Route paths cannot contain query strings, fragments, or backslashes.",
+        });
     }
-    if (value.split('/').some((segment) => segment === '.' || segment === '..')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain traversal segments.' });
+    if (value.split("/").some((segment) => segment === "." || segment === "..")) {
+        context.addIssue({
+            code: "custom",
+            message: "Route paths cannot contain traversal segments.",
+        });
     }
-    if (/^[a-z][a-z0-9+.-]*:/i.test(value) || value.includes('://')) {
-        context.addIssue({ code: 'custom', message: 'Route paths cannot contain a scheme or host.' });
+    if (/^[a-z][a-z0-9+.-]*:/i.test(value) || value.includes("://")) {
+        context.addIssue({
+            code: "custom",
+            message: "Route paths cannot contain a scheme or host.",
+        });
     }
 });
 exports.RouteSpaceParameterSchema = zod_1.z
     .object({
     name: common_1.ContractIdentifierSchema,
-    type: zod_1.z.enum(['identifier', 'integer', 'slug', 'uuid']),
+    type: zod_1.z.enum(["identifier", "integer", "slug", "uuid"]),
     required: zod_1.z.boolean(),
 })
     .strict();
 exports.RouteSpaceSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('RouteSpace'),
+    contract: zod_1.z.literal("RouteSpace"),
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     routeSpaceId: common_1.ContractIdentifierSchema,
     supportedSurface: exports.ProductSurfaceSchema,
     basePath: exports.RoutePathTemplateSchema,
     caseSensitive: zod_1.z.boolean(),
-    trailingSlash: zod_1.z.enum(['preserve', 'remove', 'require']),
+    trailingSlash: zod_1.z.enum(["preserve", "remove", "require"]),
     reservedPaths: zod_1.z.array(exports.RoutePathTemplateSchema),
     parameters: zod_1.z.array(exports.RouteSpaceParameterSchema),
 })
     .strict()
     .superRefine((value, context) => {
     if (uniqueArray(value.parameters, (parameter) => parameter.name)) {
-        context.addIssue({ code: 'custom', path: ['parameters'], message: 'RouteSpace parameter names must be unique.' });
+        context.addIssue({
+            code: "custom",
+            path: ["parameters"],
+            message: "RouteSpace parameter names must be unique.",
+        });
     }
     if (uniqueArray(value.reservedPaths, (path) => path)) {
-        context.addIssue({ code: 'custom', path: ['reservedPaths'], message: 'RouteSpace reserved paths must be unique.' });
+        context.addIssue({
+            code: "custom",
+            path: ["reservedPaths"],
+            message: "RouteSpace reserved paths must be unique.",
+        });
     }
 });
 const RouteClaimBaseSchema = zod_1.z
     .object({
-    kind: zod_1.z.enum(['canonical', 'alias', 'redirect']),
+    kind: zod_1.z.enum(["canonical", "alias", "redirect"]),
     routeSpaceRevisionRef: exports.RevisionRefSchema,
     pathTemplate: exports.RoutePathTemplateSchema,
     redirectTargetRef: exports.StableRefSchema.optional(),
 })
     .strict()
     .superRefine((value, context) => {
-    if (value.routeSpaceRevisionRef.kind !== 'route-space') {
-        context.addIssue({ code: 'custom', path: ['routeSpaceRevisionRef', 'kind'], message: 'Route claims must reference a route-space revision.' });
+    if (value.routeSpaceRevisionRef.kind !== "route-space") {
+        context.addIssue({
+            code: "custom",
+            path: ["routeSpaceRevisionRef", "kind"],
+            message: "Route claims must reference a route-space revision.",
+        });
     }
-    if (value.kind === 'redirect' && !value.redirectTargetRef) {
-        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Redirect claims require a governed target reference.' });
+    if (value.kind === "redirect" && !value.redirectTargetRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["redirectTargetRef"],
+            message: "Redirect claims require a governed target reference.",
+        });
     }
-    if (value.kind !== 'redirect' && value.redirectTargetRef) {
-        context.addIssue({ code: 'custom', path: ['redirectTargetRef'], message: 'Only redirect claims may declare redirectTargetRef.' });
+    if (value.kind !== "redirect" && value.redirectTargetRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["redirectTargetRef"],
+            message: "Only redirect claims may declare redirectTargetRef.",
+        });
     }
 });
 /**
  * Read compatibility for schemaVersion 1 Page and Workbench records written
  * before route claims carried their owning product surface. New declarations
- * must use RouteClaimSchema; compilers infer this legacy form only from the
- * exact pinned RouteSpace.
+ * must use RouteClaimSchema; compilers materialize this legacy form only from
+ * the exact pinned RouteSpace surface.
  */
 exports.LegacyRouteClaimSchema = RouteClaimBaseSchema;
 exports.RouteClaimSchema = RouteClaimBaseSchema.safeExtend({
     surface: exports.ProductSurfaceSchema,
 }).strict();
-exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema;
-const LegacyDeclarativeRouteClaimSchema = exports.LegacyRouteClaimSchema;
 const LegacyCompiledRouteMatcherSchema = zod_1.z
     .object({
     caseSensitive: zod_1.z.boolean(),
-    trailingSlash: zod_1.z.enum(['preserve', 'remove', 'require']),
+    trailingSlash: zod_1.z.enum(["preserve", "remove", "require"]),
     parameters: zod_1.z.array(exports.RouteSpaceParameterSchema),
 })
     .strict();
@@ -256,90 +440,98 @@ exports.CompiledRouteMatcherSchema = LegacyCompiledRouteMatcherSchema.safeExtend
 exports.CompiledRouteClaimSchema = exports.RouteClaimSchema.safeExtend({
     normalizedPath: exports.RoutePathTemplateSchema,
     matcher: exports.CompiledRouteMatcherSchema,
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.matcher.surface !== value.surface) {
+        context.addIssue({
+            code: "custom",
+            path: ["matcher", "surface"],
+            message: "A compiled route matcher must match its claim surface.",
+        });
+    }
+});
 const LegacyCompiledRouteClaimSchema = exports.LegacyRouteClaimSchema.safeExtend({
     normalizedPath: exports.RoutePathTemplateSchema,
     matcher: LegacyCompiledRouteMatcherSchema,
 }).strict();
-const validateDeclaredRouteSurfaces = (supportedSurfaces, routeClaims, context) => {
-    if (uniqueArray(supportedSurfaces, (surface) => surface)) {
-        context.addIssue({ code: 'custom', path: ['supportedSurfaces'], message: 'Supported surfaces must be unique.' });
-    }
-    const explicitClaims = routeClaims.filter((claim) => 'surface' in claim);
-    if (explicitClaims.length > 0 && explicitClaims.length < routeClaims.length) {
-        context.addIssue({ code: 'custom', path: ['routeClaims'], message: 'Route claims must either all declare surface or all omit it for legacy compatibility.' });
+const validateReleaseRouteSurface = (target, context) => {
+    const claimSurface = "surface" in target.routeClaim ? target.routeClaim.surface : undefined;
+    const matcherSurface = "surface" in target.routeClaim.matcher
+        ? target.routeClaim.matcher.surface
+        : undefined;
+    if (claimSurface === undefined && matcherSurface === undefined)
         return;
-    }
-    routeClaims.forEach((claim, index) => {
-        if ('surface' in claim && !supportedSurfaces.includes(claim.surface)) {
-            context.addIssue({ code: 'custom', path: ['routeClaims', index, 'surface'], message: 'Route claim surface must be declared by supportedSurfaces.' });
-        }
-    });
-    if (explicitClaims.length !== routeClaims.length)
+    if (claimSurface === target.surface && matcherSurface === target.surface)
         return;
-    supportedSurfaces.forEach((surface) => {
-        const canonicalCount = explicitClaims.filter((claim) => claim.surface === surface && claim.kind === 'canonical').length;
-        if (canonicalCount !== 1) {
-            context.addIssue({ code: 'custom', path: ['routeClaims'], message: `Surface ${surface} requires exactly one canonical route claim.` });
-        }
+    context.addIssue({
+        code: "custom",
+        path: ["target", "routeClaim"],
+        message: "A compiled Release route claim must either be fully legacy or bind both claim and matcher to the target surface.",
     });
 };
-exports.ReleaseOperationSchema = zod_1.z.enum(['activate', 'deactivate', 'rollback']);
+exports.ReleaseOperationSchema = zod_1.z.enum([
+    "activate",
+    "deactivate",
+    "rollback",
+]);
 exports.ReleaseDependencyRoleSchema = zod_1.z.enum([
-    'route-space',
-    'shell',
-    'page',
-    'page-release',
-    'workbench',
-    'workbench-release',
-    'navigation',
-    'navigation-release',
-    'menu-action',
-    'application-menu-catalog',
-    'capability',
-    'provider',
-    'ontology-definition',
-    'view',
-    'projection',
-    'action',
-    'token',
-    'schema',
-    'compiler',
-    'workflow',
-    'agent',
-    'built-in-application',
-    'design',
-    'layout-policy',
-    'performance-budget',
-    'observation-policy',
+    "route-space",
+    "shell",
+    "page",
+    "page-release",
+    "workbench",
+    "workbench-release",
+    "navigation",
+    "navigation-release",
+    "menu-action",
+    "application-menu-catalog",
+    "capability",
+    "provider",
+    "ontology-definition",
+    "query-definition",
+    "view",
+    "projection",
+    "action",
+    "token",
+    "schema",
+    "compiler",
+    "workflow",
+    "agent",
+    "built-in-application",
+    "design",
+    "layout-policy",
+    "performance-budget",
+    "observation-policy",
 ]);
 const DependencyKindByRole = {
-    'route-space': 'route-space',
-    shell: 'shell',
-    page: 'page',
-    'page-release': 'page-release',
-    workbench: 'workbench',
-    'workbench-release': 'workbench-release',
-    navigation: 'navigation',
-    'navigation-release': 'navigation-release',
-    'menu-action': 'menu-action',
-    'application-menu-catalog': 'application-menu-catalog',
-    capability: 'capability',
-    provider: 'view-provider',
-    'ontology-definition': 'ontology-definition',
-    view: 'view',
-    projection: 'projection',
-    action: 'domain-command',
-    token: 'design-token',
-    schema: 'schema',
-    compiler: 'compiler',
-    workflow: 'workflow',
-    agent: 'agent',
-    'built-in-application': 'built-in-application',
-    design: 'design',
-    'layout-policy': 'layout-policy',
-    'performance-budget': 'performance-budget',
-    'observation-policy': 'observation-policy',
+    "route-space": "route-space",
+    shell: "shell",
+    page: "page",
+    "page-release": "page-release",
+    workbench: "workbench",
+    "workbench-release": "workbench-release",
+    navigation: "navigation",
+    "navigation-release": "navigation-release",
+    "menu-action": "menu-action",
+    "application-menu-catalog": "application-menu-catalog",
+    capability: "capability",
+    provider: "view-provider",
+    "ontology-definition": "ontology-definition",
+    "query-definition": "domain-query-definition",
+    view: "view",
+    projection: "projection",
+    action: "domain-command",
+    token: "design-token",
+    schema: "schema",
+    compiler: "compiler",
+    workflow: "workflow",
+    agent: "agent",
+    "built-in-application": "built-in-application",
+    design: "design",
+    "layout-policy": "layout-policy",
+    "performance-budget": "performance-budget",
+    "observation-policy": "observation-policy",
 };
 exports.ReleaseDependencySchema = zod_1.z
     .object({
@@ -351,15 +543,15 @@ exports.ReleaseDependencySchema = zod_1.z
     const expectedKind = DependencyKindByRole[value.role];
     if (value.revisionRef.kind !== expectedKind) {
         context.addIssue({
-            code: 'custom',
-            path: ['revisionRef', 'kind'],
+            code: "custom",
+            path: ["revisionRef", "kind"],
             message: `Dependency role ${value.role} requires reference kind ${expectedKind}.`,
         });
     }
 });
 exports.ReleaseValidationSchema = zod_1.z
     .object({
-    result: zod_1.z.enum(['pass', 'fail']),
+    result: zod_1.z.enum(["pass", "fail"]),
     inputHash: common_1.Sha256Schema,
     diagnosticRefs: zod_1.z.array(exports.RevisionRefSchema),
 })
@@ -380,41 +572,71 @@ exports.ReleaseEvidenceSchema = zod_1.z
     .strict()
     .superRefine((value, context) => {
     const expectedKinds = [
-        ['publicationPlanRef', value.publicationPlanRef, 'publication-plan'],
-        ['approvalPolicyRevisionRef', value.approvalPolicyRevisionRef, 'approval-policy'],
-        ['approvalDecisionRevisionRef', value.approvalDecisionRevisionRef, 'approval-decision'],
-        ['actorRef', value.actorRef, 'actor'],
+        ["publicationPlanRef", value.publicationPlanRef, "publication-plan"],
+        [
+            "approvalPolicyRevisionRef",
+            value.approvalPolicyRevisionRef,
+            "approval-policy",
+        ],
+        [
+            "approvalDecisionRevisionRef",
+            value.approvalDecisionRevisionRef,
+            "approval-decision",
+        ],
+        ["actorRef", value.actorRef, "actor"],
     ];
     expectedKinds.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind) {
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: "custom",
+                path: [field, "kind"],
+                message: `${field} must reference ${expectedKind}.`,
+            });
         }
     });
     value.evidenceRefs.forEach((reference, index) => {
-        if (reference.kind !== 'evidence')
-            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Release evidenceRefs must reference evidence revisions.' });
+        if (reference.kind !== "evidence")
+            context.addIssue({
+                code: "custom",
+                path: ["evidenceRefs", index, "kind"],
+                message: "Release evidenceRefs must reference evidence revisions.",
+            });
     });
 });
 exports.PublicationPlanOperationSchema = zod_1.z
     .object({
-    releaseKind: zod_1.z.enum(['page-release', 'workbench-release', 'navigation-release']),
+    releaseKind: zod_1.z.enum([
+        "page-release",
+        "workbench-release",
+        "navigation-release",
+    ]),
     releaseSlotId: common_1.ContractIdentifierSchema,
     releaseRevisionRef: exports.RevisionRefSchema,
     expectedHeadRevisionRef: exports.RevisionRefSchema.nullable(),
 })
     .strict()
     .superRefine((value, context) => {
-    if (value.releaseRevisionRef.kind !== value.releaseKind || value.releaseRevisionRef.id !== value.releaseSlotId) {
-        context.addIssue({ code: 'custom', path: ['releaseRevisionRef'], message: 'Publication Plan operation must pin the exact release slot revision.' });
+    if (value.releaseRevisionRef.kind !== value.releaseKind ||
+        value.releaseRevisionRef.id !== value.releaseSlotId) {
+        context.addIssue({
+            code: "custom",
+            path: ["releaseRevisionRef"],
+            message: "Publication Plan operation must pin the exact release slot revision.",
+        });
     }
-    if (value.expectedHeadRevisionRef
-        && (value.expectedHeadRevisionRef.kind !== value.releaseKind || value.expectedHeadRevisionRef.id !== value.releaseSlotId)) {
-        context.addIssue({ code: 'custom', path: ['expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+    if (value.expectedHeadRevisionRef &&
+        (value.expectedHeadRevisionRef.kind !== value.releaseKind ||
+            value.expectedHeadRevisionRef.id !== value.releaseSlotId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["expectedHeadRevisionRef"],
+            message: "Expected head must identify the same release slot.",
+        });
     }
 });
 exports.PublicationPlanSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('PublicationPlan'),
+    contract: zod_1.z.literal("PublicationPlan"),
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     planId: common_1.ContractIdentifierSchema,
     tenantScope: exports.TenantScopeSchema,
@@ -430,31 +652,66 @@ exports.PublicationPlanSchema = zod_1.z
 })
     .strict()
     .superRefine((value, context) => {
-    if (value.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['environmentRef', 'kind'], message: 'Publication Plan requires an environment reference.' });
+    if (value.environmentRef.kind !== "environment")
+        context.addIssue({
+            code: "custom",
+            path: ["environmentRef", "kind"],
+            message: "Publication Plan requires an environment reference.",
+        });
+    validateTenantCompatibleReference(value.environmentRef, value.tenantScope, ["environmentRef"], context);
     const governedRefs = [
-        ['approvalPolicyRevisionRef', value.approvalPolicyRevisionRef, 'approval-policy'],
-        ['approvalDecisionRevisionRef', value.approvalDecisionRevisionRef, 'approval-decision'],
-        ['actorRef', value.actorRef, 'actor'],
+        [
+            "approvalPolicyRevisionRef",
+            value.approvalPolicyRevisionRef,
+            "approval-policy",
+        ],
+        [
+            "approvalDecisionRevisionRef",
+            value.approvalDecisionRevisionRef,
+            "approval-decision",
+        ],
+        ["actorRef", value.actorRef, "actor"],
     ];
     governedRefs.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind)
-            context.addIssue({ code: 'custom', path: [field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: "custom",
+                path: [field, "kind"],
+                message: `${field} must reference ${expectedKind}.`,
+            });
+        validateTenantCompatibleReference(reference, value.tenantScope, [field], context);
     });
     value.operations.forEach((operation, index) => {
         [operation.releaseRevisionRef, operation.expectedHeadRevisionRef].forEach((reference, referenceIndex) => {
-            if (reference?.tenantScope && tenantScopeKey(reference.tenantScope) !== tenantScopeKey(value.tenantScope)) {
-                const field = referenceIndex === 0 ? 'releaseRevisionRef' : 'expectedHeadRevisionRef';
-                context.addIssue({ code: 'custom', path: ['operations', index, field, 'tenantScope'], message: 'Publication Plan operation belongs to another tenant scope.' });
+            if (reference?.tenantScope &&
+                tenantScopeKey(reference.tenantScope) !==
+                    tenantScopeKey(value.tenantScope)) {
+                const field = referenceIndex === 0
+                    ? "releaseRevisionRef"
+                    : "expectedHeadRevisionRef";
+                context.addIssue({
+                    code: "custom",
+                    path: ["operations", index, field, "tenantScope"],
+                    message: "Publication Plan operation belongs to another tenant scope.",
+                });
             }
         });
     });
     value.evidenceRefs.forEach((reference, index) => {
-        if (reference.kind !== 'evidence')
-            context.addIssue({ code: 'custom', path: ['evidenceRefs', index, 'kind'], message: 'Publication Plan evidenceRefs must reference evidence revisions.' });
+        if (reference.kind !== "evidence")
+            context.addIssue({
+                code: "custom",
+                path: ["evidenceRefs", index, "kind"],
+                message: "Publication Plan evidenceRefs must reference evidence revisions.",
+            });
+        validateTenantCompatibleReference(reference, value.tenantScope, ["evidenceRefs", index], context);
     });
     if (uniqueArray(value.operations, (operation) => `${operation.releaseKind}:${operation.releaseSlotId}`)) {
-        context.addIssue({ code: 'custom', path: ['operations'], message: 'Publication Plan release slots must be unique.' });
+        context.addIssue({
+            code: "custom",
+            path: ["operations"],
+            message: "Publication Plan release slots must be unique.",
+        });
     }
 });
 const IdentitySchema = zod_1.z
@@ -464,205 +721,2826 @@ const IdentitySchema = zod_1.z
     tags: zod_1.z.array(common_1.ContractIdentifierSchema).default([]),
 })
     .strict();
-exports.WorkbenchIdentitySchema = IdentitySchema.extend({ iconRef: exports.StableRefSchema.optional() }).strict();
+exports.WorkbenchIdentitySchema = IdentitySchema.extend({
+    iconRef: exports.StableRefSchema.optional(),
+}).strict();
+exports.LegacySlotRestorationSchema = zod_1.z
+    .object({
+    legacyAdapterRevisionRef: exports.RevisionRefSchema,
+    sourceRevisionRef: exports.RevisionRefSchema,
+    inspectedSourceContentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.sourceRevisionRef.contentHash !== value.inspectedSourceContentHash) {
+        context.addIssue({
+            code: "custom",
+            path: ["inspectedSourceContentHash"],
+            message: "Legacy restoration must pin the exact inspected source revision hash.",
+        });
+    }
+});
+/**
+ * Exact, inspect-produced authority for taking over one predeclared legacy
+ * route. It is not a general reserved-route bypass: compiler validation binds
+ * it to one canonical claim, one target resource and the exact inspected
+ * source/adaptor revisions.
+ */
+exports.LegacyRouteTakeoverAuthorizationSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("LegacyRouteTakeoverAuthorization"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    routeSpaceRevisionRef: exports.RevisionRefSchema,
+    normalizedPath: exports.RoutePathTemplateSchema,
+    legacyAdapterRevisionRef: exports.RevisionRefSchema,
+    sourceRevisionRef: exports.RevisionRefSchema,
+    inspectedSourceContentHash: common_1.Sha256Schema,
+    targetResourceRef: exports.StableRefSchema,
+    workbenchCatalogDefaults: zod_1.z
+        .object({ order: zod_1.z.number().int(), isDefaultCandidate: zod_1.z.boolean() })
+        .strict()
+        .optional(),
+    contentHash: common_1.Sha256Schema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.routeSpaceRevisionRef.kind !== "route-space") {
+        context.addIssue({
+            code: "custom",
+            path: ["routeSpaceRevisionRef", "kind"],
+            message: "A route takeover must pin a RouteSpace revision.",
+        });
+    }
+    if (value.legacyAdapterRevisionRef.kind !== "legacy-route-adapter") {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyAdapterRevisionRef", "kind"],
+            message: "A route takeover must pin a legacy-route-adapter revision.",
+        });
+    }
+    if (!["page", "workbench"].includes(value.targetResourceRef.kind)) {
+        context.addIssue({
+            code: "custom",
+            path: ["targetResourceRef", "kind"],
+            message: "A route takeover target must be a Page or Workbench.",
+        });
+    }
+    if (value.sourceRevisionRef.contentHash !== value.inspectedSourceContentHash) {
+        context.addIssue({
+            code: "custom",
+            path: ["inspectedSourceContentHash"],
+            message: "A route takeover must pin the exact inspected legacy source hash.",
+        });
+    }
+    if (value.targetResourceRef.kind === "workbench" &&
+        !value.workbenchCatalogDefaults) {
+        context.addIssue({
+            code: "custom",
+            path: ["workbenchCatalogDefaults"],
+            message: "A Workbench takeover must preserve exact legacy catalog order and default semantics.",
+        });
+    }
+    if (value.targetResourceRef.kind === "page" &&
+        value.workbenchCatalogDefaults) {
+        context.addIssue({
+            code: "custom",
+            path: ["workbenchCatalogDefaults"],
+            message: "Page takeover provenance cannot carry Workbench catalog defaults.",
+        });
+    }
+});
+/** Authoring-only route evidence. Runtime compilation deliberately strips the takeover proof. */
+exports.DeclarativeRouteClaimSchema = exports.RouteClaimSchema.safeExtend({
+    legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+}).strict();
+const LegacyDeclarativeRouteClaimSchema = exports.LegacyRouteClaimSchema.safeExtend({
+    legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+}).strict();
+const validateDeclaredRouteSurfaces = (supportedSurfaces, routeClaims, context) => {
+    if (uniqueArray(supportedSurfaces, (surface) => surface)) {
+        context.addIssue({
+            code: "custom",
+            path: ["supportedSurfaces"],
+            message: "Supported surfaces must be unique.",
+        });
+    }
+    const explicitClaims = routeClaims.filter((claim) => "surface" in claim);
+    if (explicitClaims.length > 0 && explicitClaims.length < routeClaims.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["routeClaims"],
+            message: "Route claims must either all declare surface or all omit it for legacy compatibility.",
+        });
+        return;
+    }
+    routeClaims.forEach((claim, index) => {
+        if ("surface" in claim && !supportedSurfaces.includes(claim.surface)) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeClaims", index, "surface"],
+                message: "Route claim surface must be declared by supportedSurfaces.",
+            });
+        }
+    });
+    if (explicitClaims.length !== routeClaims.length)
+        return;
+    supportedSurfaces.forEach((surface) => {
+        const canonicalCount = explicitClaims.filter((claim) => claim.surface === surface && claim.kind === "canonical").length;
+        if (canonicalCount !== 1) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeClaims"],
+                message: `Surface ${surface} requires exactly one canonical route claim.`,
+            });
+        }
+    });
+};
 const ReleaseBaseShape = {
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     releaseSlotId: common_1.ContractIdentifierSchema,
     tenantScope: exports.TenantScopeSchema,
     operation: exports.ReleaseOperationSchema,
+    legacyRestoration: exports.LegacySlotRestorationSchema.optional(),
     dependencySnapshot: zod_1.z.array(exports.ReleaseDependencySchema),
     evidence: exports.ReleaseEvidenceSchema,
 };
+const validateLegacyRestoration = (value, expectedAdapterKind, context) => {
+    if (value.operation === "activate" && value.legacyRestoration) {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyRestoration"],
+            message: "An active declarative Release cannot also restore a legacy adapter.",
+        });
+    }
+    if (value.legacyRestoration?.legacyAdapterRevisionRef.kind !== undefined &&
+        value.legacyRestoration.legacyAdapterRevisionRef.kind !==
+            expectedAdapterKind) {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyRestoration", "legacyAdapterRevisionRef", "kind"],
+            message: `Legacy restoration requires adapter kind ${expectedAdapterKind}.`,
+        });
+    }
+};
 const validateDependencySnapshot = (snapshot, context) => {
     const duplicate = uniqueArray(snapshot, (dependency) => `${dependency.role}:${stableRefIdentity(dependency.revisionRef)}@${dependency.revisionRef.revision}`);
     if (duplicate)
-        context.addIssue({ code: 'custom', path: ['dependencySnapshot'], message: `Duplicate dependency: ${duplicate}` });
+        context.addIssue({
+            code: "custom",
+            path: ["dependencySnapshot"],
+            message: `Duplicate dependency: ${duplicate}`,
+        });
 };
-const validateReleaseExpectedHead = (value, expectedKind, context) => {
+const validateReleaseGovernanceScope = (value, expectedKind, context) => {
     const expectedHead = value.evidence.expectedHeadRevisionRef;
-    if (expectedHead && (expectedHead.kind !== expectedKind || expectedHead.id !== value.releaseSlotId)) {
-        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef'], message: 'Expected head must identify the same release slot.' });
+    if (expectedHead &&
+        (expectedHead.kind !== expectedKind ||
+            expectedHead.id !== value.releaseSlotId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["evidence", "expectedHeadRevisionRef"],
+            message: "Expected head must identify the same release slot.",
+        });
     }
-    if (expectedHead?.tenantScope && tenantScopeKey(expectedHead.tenantScope) !== tenantScopeKey(value.tenantScope)) {
-        context.addIssue({ code: 'custom', path: ['evidence', 'expectedHeadRevisionRef', 'tenantScope'], message: 'Expected head belongs to another tenant scope.' });
+    if (expectedHead?.tenantScope &&
+        tenantScopeKey(expectedHead.tenantScope) !==
+            tenantScopeKey(value.tenantScope)) {
+        context.addIssue({
+            code: "custom",
+            path: ["evidence", "expectedHeadRevisionRef", "tenantScope"],
+            message: "Expected head belongs to another tenant scope.",
+        });
     }
+    const governedEvidenceRefs = [
+        [["evidence", "publicationPlanRef"], value.evidence.publicationPlanRef],
+        [
+            ["evidence", "approvalPolicyRevisionRef"],
+            value.evidence.approvalPolicyRevisionRef,
+        ],
+        [
+            ["evidence", "approvalDecisionRevisionRef"],
+            value.evidence.approvalDecisionRevisionRef,
+        ],
+        [["evidence", "actorRef"], value.evidence.actorRef],
+        ...value.evidence.validation.diagnosticRefs.map((reference, index) => [
+            ["evidence", "validation", "diagnosticRefs", index],
+            reference,
+        ]),
+        ...value.evidence.evidenceRefs.map((reference, index) => [["evidence", "evidenceRefs", index], reference]),
+        ...(expectedHead
+            ? [[["evidence", "expectedHeadRevisionRef"], expectedHead]]
+            : []),
+        ...(value.legacyRestoration
+            ? [
+                [
+                    ["legacyRestoration", "legacyAdapterRevisionRef"],
+                    value.legacyRestoration.legacyAdapterRevisionRef,
+                ],
+                [
+                    ["legacyRestoration", "sourceRevisionRef"],
+                    value.legacyRestoration.sourceRevisionRef,
+                ],
+            ]
+            : []),
+    ];
+    governedEvidenceRefs.forEach(([path, reference]) => validateTenantCompatibleReference(reference, value.tenantScope, [...path], context));
 };
-exports.BindingSourceSchema = zod_1.z.discriminatedUnion('kind', [
-    zod_1.z.object({ kind: zod_1.z.literal('constant'), value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('route-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('query-parameter'), name: common_1.ContractIdentifierSchema }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('identity'), name: zod_1.z.enum(['tenantId', 'teamId', 'userId']) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('intent-field'), path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
-    zod_1.z.object({ kind: zod_1.z.literal('binding-field'), bindingId: common_1.ContractIdentifierSchema, path: zod_1.z.string().trim().regex(/^[A-Za-z0-9_.-]+$/) }).strict(),
+exports.BindingSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("scope-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .min(1)
+            .max(4096)
+            .regex(/^[A-Za-z0-9_.-]+$/)
+            .refine((path) => path.split(".").length <= 16 &&
+            path
+                .split(".")
+                .every((part) => part.length > 0 &&
+                !["__proto__", "prototype", "constructor"].includes(part)), "Scope paths require safe own members."),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("binding-field"),
+        bindingId: common_1.ContractIdentifierSchema,
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("constant"),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("route-parameter"),
+        name: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("query-parameter"),
+        name: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("identity"),
+        name: zod_1.z.enum(["tenantId", "teamId", "userId"]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("intent-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("page-state"),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
 ]);
-exports.CapabilityInstanceSchema = zod_1.z
+const ExpressionBindingSourceSchema = zod_1.z
+    .object({ kind: zod_1.z.literal("expression"), expression: page_expression_1.PageExpressionSchema })
+    .strict()
+    .superRefine((value, context) => {
+    if ((0, page_expression_1.collectPageExpressionReads)(value.expression).some((read) => read.root === "actions"))
+        context.addIssue({
+            code: "custom",
+            path: ["expression"],
+            message: "Action runtime state is presentation-only and cannot influence an input or state transition.",
+        });
+});
+const FileFieldBindingSourceSchema = zod_1.z
     .object({
-    instanceId: common_1.ContractIdentifierSchema,
-    nodeId: common_1.ContractIdentifierSchema,
-    capabilityRevisionRef: exports.RevisionRefSchema,
-    providerRevisionRef: exports.RevisionRefSchema,
-    propertySchemaRevisionRef: exports.RevisionRefSchema,
-    properties: common_1.JsonObjectSchema,
-    allowedSideEffects: zod_1.z.array(zod_1.z.enum(['network', 'storage', 'navigation', 'worker', 'websocket'])),
+    kind: zod_1.z.literal("file-field"),
+    fileInputId: common_1.ContractIdentifierSchema,
+    path: zod_1.z.enum(["fileName", "content", "canonicalUri"]),
 })
     .strict();
-exports.OntologyBindingSchema = zod_1.z
+const ActionFileInputSchema = zod_1.z
     .object({
-    bindingId: common_1.ContractIdentifierSchema,
-    ontologyDefinitionRevisionRef: exports.RevisionRefSchema,
-    viewRevisionRef: exports.RevisionRefSchema.optional(),
-    projectionRevisionRef: exports.RevisionRefSchema.optional(),
-    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
-    target: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
-    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
-    pagination: zod_1.z.enum(['none', 'cursor', 'offset']),
-    cache: zod_1.z.enum(['none', 'identity-scoped', 'tenant-scoped']),
-    cancelOnChange: zod_1.z.boolean(),
+    inputId: common_1.ContractIdentifierSchema,
+    source: zod_1.z.discriminatedUnion("kind", [
+        zod_1.z
+            .object({
+            kind: zod_1.z.literal("page-state"),
+            stateId: common_1.ContractIdentifierSchema,
+        })
+            .strict(),
+        zod_1.z
+            .object({
+            kind: zod_1.z.literal("intent-field"),
+            path: zod_1.z
+                .string()
+                .trim()
+                .regex(/^[A-Za-z0-9_.-]+$/),
+        })
+            .strict(),
+    ]),
+    maxBytes: zod_1.z.number().int().min(1).max(5368709120),
+    upload: zod_1.z.object({ purpose: file_1.FilePurposeSchema }).strict().optional(),
+    accept: zod_1.z.string().min(1).max(256).optional(),
 })
     .strict()
     .superRefine((value, context) => {
-    if ((value.viewRevisionRef ? 1 : 0) + (value.projectionRevisionRef ? 1 : 0) !== 1) {
-        context.addIssue({ code: 'custom', path: ['viewRevisionRef'], message: 'Ontology bindings require exactly one View or Projection revision.' });
-    }
-    if (value.ontologyDefinitionRevisionRef.kind !== 'ontology-definition') {
-        context.addIssue({ code: 'custom', path: ['ontologyDefinitionRevisionRef', 'kind'], message: 'Expected an ontology-definition revision.' });
-    }
+    if (!value.upload && value.maxBytes > 1048576)
+        context.addIssue({
+            code: "custom",
+            path: ["maxBytes"],
+            message: "Inline text files are limited to one MiB.",
+        });
 });
-exports.ActionBindingSchema = zod_1.z
+const ActionInputBindingSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    ...exports.BindingSourceSchema.options,
+    ExpressionBindingSourceSchema,
+    FileFieldBindingSourceSchema,
+]);
+const InteractionBindingSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    ExpressionBindingSourceSchema,
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("constant"),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean(), zod_1.z.null()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("intent-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("result-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("page-state"),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+]);
+const PageStateComparableLiteralSchema = zod_1.z.union([
+    zod_1.z.string(),
+    zod_1.z.number().finite(),
+    zod_1.z.boolean(),
+    zod_1.z.null(),
+]);
+exports.PageStateConditionSchema = zod_1.z.discriminatedUnion("predicate", [
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal("equals"),
+        value: PageStateComparableLiteralSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal("not-equals"),
+        value: PageStateComparableLiteralSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        stateId: common_1.ContractIdentifierSchema,
+        predicate: zod_1.z.literal("truthy"),
+    })
+        .strict(),
+]);
+/**
+ * A recursive boolean expression over governed Page state. Keeping leaf
+ * conditions inside the original `conditions` array preserves the v1 flat
+ * declaration while allowing groups to be nested without a parallel DSL.
+ */
+exports.PageStateActivationSchema = zod_1.z.lazy(() => zod_1.z
     .object({
-    bindingId: common_1.ContractIdentifierSchema,
-    commandRevisionRef: exports.RevisionRefSchema,
-    source: zod_1.z.object({ capabilityInstanceId: common_1.ContractIdentifierSchema, port: common_1.ContractIdentifierSchema }).strict(),
-    sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
-    inputSchemaRevisionRef: exports.RevisionRefSchema,
-    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
-    accessPolicy: exports.AccessPolicySchema,
-    confirmation: exports.I18nTextSchema.optional(),
-    idempotencyKeySource: zod_1.z.enum(['interaction', 'record-and-interaction', 'caller-provided']),
-    compensationCommandRevisionRef: exports.RevisionRefSchema.optional(),
-    resultSchemaRevisionRef: exports.RevisionRefSchema,
-    success: zod_1.z.object({
-        refreshBindingIds: zod_1.z.array(common_1.ContractIdentifierSchema),
-        navigationTargetRef: exports.StableRefSchema.optional(),
-    }).strict(),
-    recovery: zod_1.z.enum(['retry-safe', 'compensating-command', 'manual-review']),
-    lineageRequired: zod_1.z.literal(true),
+    operator: zod_1.z.enum(["all", "any"]),
+    conditions: zod_1.z
+        .array(zod_1.z.union([exports.PageStateConditionSchema, exports.PageStateActivationSchema]))
+        .min(1),
+})
+    .strict());
+const forEachPageStateCondition = (activation, visit, path = []) => {
+    activation.conditions.forEach((candidate, index) => {
+        const candidatePath = [...path, "conditions", index];
+        if ("operator" in candidate) {
+            forEachPageStateCondition(candidate, visit, candidatePath);
+            return;
+        }
+        visit(candidate, candidatePath);
+    });
+};
+const PageRouteValueSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("route-parameter"),
+        name: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("constant"),
+        value: zod_1.z.union([zod_1.z.string(), zod_1.z.number().finite(), zod_1.z.boolean()]),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("page-state"),
+        stateId: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+]);
+/**
+ * Declares an ordered, state-driven route transition owned by one exact Page
+ * revision. The compiler resolves targetRef to one active governed Release;
+ * raw URLs and application-specific route switches are deliberately excluded.
+ */
+exports.PageEntryTransitionSchema = zod_1.z
+    .object({
+    browsingContext: zod_1.z.enum(["same", "new"]).optional(),
+    gestureSource: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict()
+        .optional(),
+    transitionId: common_1.ContractIdentifierSchema,
+    activation: exports.PageStateActivationSchema,
+    targetRef: exports.StableRefSchema,
+    pathParameters: zod_1.z.record(common_1.ContractIdentifierSchema, PageRouteValueSourceSchema),
+    query: zod_1.z
+        .object({
+        preserve: zod_1.z.boolean(),
+        remove: zod_1.z.array(common_1.ContractIdentifierSchema),
+        set: zod_1.z.record(common_1.ContractIdentifierSchema, PageRouteValueSourceSchema),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
-    if (value.commandRevisionRef.kind !== 'domain-command') {
-        context.addIssue({ code: 'custom', path: ['commandRevisionRef', 'kind'], message: 'Action bindings must reference a domain-command revision.' });
-    }
-    if (value.sourceIntentSchemaRevisionRef.kind !== 'schema') {
-        context.addIssue({ code: 'custom', path: ['sourceIntentSchemaRevisionRef', 'kind'], message: 'Action source intents must pin a schema revision.' });
+    if ((value.browsingContext === "new") !== Boolean(value.gestureSource)) {
+        context.addIssue({
+            code: "custom",
+            path: ["gestureSource"],
+            message: "New-context entry transitions require an exact gesture source; same-context transitions must omit it.",
+        });
     }
-    if (value.inputSchemaRevisionRef.kind !== 'schema') {
-        context.addIssue({ code: 'custom', path: ['inputSchemaRevisionRef', 'kind'], message: 'Action command inputs must pin a schema revision.' });
+    if (!["page", "workbench"].includes(value.targetRef.kind)) {
+        context.addIssue({
+            code: "custom",
+            path: ["targetRef", "kind"],
+            message: "Page entry transitions must reference a governed Page or Workbench.",
+        });
     }
-    if (value.recovery === 'compensating-command' && !value.compensationCommandRevisionRef) {
-        context.addIssue({ code: 'custom', path: ['compensationCommandRevisionRef'], message: 'Compensating recovery requires a compensation command.' });
+    if (new Set(value.query.remove).size !== value.query.remove.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["query", "remove"],
+            message: "Removed query parameter names must be unique.",
+        });
     }
 });
-exports.PageSchema = zod_1.z
+exports.ResolvedPageEntryTransitionSchema = exports.PageEntryTransitionSchema.safeExtend({
+    targetRevisionRef: exports.RevisionRefSchema,
+    targetReleaseRevisionRef: exports.RevisionRefSchema.optional(),
+    targetAccessPolicy: exports.AccessPolicySchema,
+    targetRouteClaim: exports.CompiledRouteClaimSchema,
+}).strict();
+exports.LegacyBrowserPreferenceImportSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('Page'),
-    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
-    pageId: common_1.ContractIdentifierSchema,
-    tenantScope: exports.TenantScopeSchema,
-    identity: IdentitySchema,
-    supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
-    lifecycle: exports.DeclarativeLifecycleSchema,
-    routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
-    shellRevisionRef: exports.RevisionRefSchema,
-    renderTree: render_1.RenderTreeSchema,
-    capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema).min(1),
-    ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
-    actionBindings: zod_1.z.array(exports.ActionBindingSchema),
-    pageAccessPolicy: exports.AccessPolicySchema,
-    managementAccess: exports.ManagementAccessSchema,
-    tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
-    performanceBudgetRef: exports.RevisionRefSchema,
-    observationPolicyRevisionRef: exports.RevisionRefSchema,
-    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+    storageKey: zod_1.z.string().trim().min(1).max(256),
+    jsonPath: zod_1.z
+        .array(zod_1.z.union([
+        zod_1.z.string().trim().min(1).max(128),
+        zod_1.z.object({ stateId: common_1.ContractIdentifierSchema }).strict(),
+    ]))
+        .min(1)
+        .max(16)
+        .optional(),
+    valueType: zod_1.z.enum(["string", "number", "boolean-01", "json"]),
+})
+    .strict();
+exports.PageStateDefinitionSchema = zod_1.z
+    .object({
+    stateId: common_1.ContractIdentifierSchema,
+    scopeNodeId: common_1.ContractIdentifierSchema.optional(),
+    initialValue: page_expression_1.PageExpressionSchema.optional(),
+    schemaRevisionRef: exports.RevisionRefSchema,
+    defaultValue: common_1.JsonValueSchema.optional(),
+    persistence: zod_1.z.enum([
+        "none",
+        "session",
+        "url",
+        "tenant-preference",
+        "url-with-tenant-preference",
+    ]),
+    urlWriteback: zod_1.z.enum(["synchronize", "never"]).optional(),
+    preferencePartitionStateId: common_1.ContractIdentifierSchema.optional(),
+    legacyBrowserPreferenceImport: exports.LegacyBrowserPreferenceImportSchema.optional(),
 })
     .strict()
     .superRefine((value, context) => {
-    validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
-    const uniqueness = [
-        ['capabilityInstances', value.capabilityInstances, (candidate) => String(candidate.instanceId)],
-        ['ontologyBindings', value.ontologyBindings, (candidate) => String(candidate.bindingId)],
-        ['actionBindings', value.actionBindings, (candidate) => String(candidate.bindingId)],
-    ];
-    uniqueness.forEach(([field, values, identity]) => {
+    if (value.scopeNodeId && value.persistence !== "none")
+        context.addIssue({
+            code: "custom",
+            path: ["persistence"],
+            message: "Repeated instance state must not persist outside its instance.",
+        });
+    if (value.initialValue &&
+        !value.scopeNodeId &&
+        (value.persistence !== "none" ||
+            value.initialValue.kind !== "read" ||
+            value.initialValue.root !== "state" ||
+            value.initialValue.path.length !== 1))
+        context.addIssue({
+            code: "custom",
+            path: ["initialValue"],
+            message: "Root initialization must directly read one persisted Page state into non-persistent state.",
+        });
+    if (value.schemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["schemaRevisionRef", "kind"],
+            message: "Page state must pin an exact schema revision.",
+        });
+    }
+    if (value.preferencePartitionStateId !== undefined &&
+        value.persistence !== "tenant-preference" &&
+        value.persistence !== "url-with-tenant-preference") {
+        context.addIssue({
+            code: "custom",
+            path: ["preferencePartitionStateId"],
+            message: "Preference partitioning requires tenant preference state.",
+        });
+    }
+    if (value.urlWriteback !== undefined &&
+        value.persistence !== "url" &&
+        value.persistence !== "url-with-tenant-preference") {
+        context.addIssue({
+            code: "custom",
+            path: ["urlWriteback"],
+            message: "URL writeback is only valid for URL-backed Page state.",
+        });
+    }
+});
+exports.InteractionBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    source: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+    sourceResultSchemaRevisionRef: exports.RevisionRefSchema.optional(),
+    targetStateId: common_1.ContractIdentifierSchema,
+    transition: zod_1.z.enum(["set", "merge", "toggle", "append", "remove", "reset"]),
+    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, InteractionBindingSourceSchema),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.sourceIntentSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceIntentSchemaRevisionRef", "kind"],
+            message: "Interaction source intents must pin a schema revision.",
+        });
+    }
+    const mapsResult = Object.values(value.inputMapping).some((source) => source.kind === "result-field" ||
+        (source.kind === "expression" &&
+            (0, page_expression_1.collectPageExpressionReads)(source.expression).some((read) => read.root === "result")));
+    if (mapsResult && !value.sourceResultSchemaRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceResultSchemaRevisionRef"],
+            message: "Result-field interactions must pin the exact Action result schema revision.",
+        });
+    }
+    if (value.sourceResultSchemaRevisionRef?.kind !== undefined &&
+        value.sourceResultSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceResultSchemaRevisionRef", "kind"],
+            message: "Interaction source results must pin a schema revision.",
+        });
+    }
+    if (!mapsResult && value.sourceResultSchemaRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceResultSchemaRevisionRef"],
+            message: "Interaction result schemas are only valid when inputMapping declares a result-field source.",
+        });
+    }
+    const mappedInputs = Object.keys(value.inputMapping);
+    if ((value.transition === "toggle" || value.transition === "reset") &&
+        mappedInputs.length > 0) {
+        context.addIssue({
+            code: "custom",
+            path: ["inputMapping"],
+            message: `${value.transition} transitions cannot declare mapped inputs.`,
+        });
+    }
+    if (value.transition !== "toggle" &&
+        value.transition !== "reset" &&
+        mappedInputs.length === 0) {
+        context.addIssue({
+            code: "custom",
+            path: ["inputMapping"],
+            message: `${value.transition} transitions require at least one mapped input.`,
+        });
+    }
+});
+exports.GovernedCatalogResourceKindSchema = zod_1.z.enum([
+    "tag",
+    "tag-group",
+    "feature-column",
+]);
+exports.GovernedCatalogDomainQueryDataSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal("governed-catalog"),
+    resourceKind: exports.GovernedCatalogResourceKindSchema,
+})
+    .strict();
+exports.RegisteredServiceDomainQueryDataSourceSchema = zod_1.z
+    .object({
+    kind: zod_1.z.literal("registered-service"),
+})
+    .strict();
+exports.DomainQueryDataSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    zod_1.z.object({ kind: zod_1.z.literal("exact-view") }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("tenant-catalog"),
+        resource: zod_1.z.enum(["ontology", "view"]),
+        ontologyIdParameter: common_1.ContractIdentifierSchema.optional(),
+    })
+        .strict()
+        .superRefine((source, context) => {
+        if (source.resource === "view" && !source.ontologyIdParameter) {
+            context.addIssue({
+                code: "custom",
+                path: ["ontologyIdParameter"],
+                message: "A tenant View catalog must declare the input parameter that scopes it to one Ontology.",
+            });
+        }
+        if (source.resource === "ontology" && source.ontologyIdParameter) {
+            context.addIssue({
+                code: "custom",
+                path: ["ontologyIdParameter"],
+                message: "An Ontology catalog cannot be pre-scoped by an Ontology input.",
+            });
+        }
+    }),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("tenant-current-view"),
+        ontologyIdParameter: common_1.ContractIdentifierSchema,
+        viewIdParameter: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    zod_1.z.object({ kind: zod_1.z.literal("page-state") }).strict(),
+    exports.GovernedCatalogDomainQueryDataSourceSchema,
+    exports.RegisteredServiceDomainQueryDataSourceSchema,
+]);
+exports.DomainQueryDefinitionSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("DomainQueryDefinition"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    queryId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    dataSource: exports.DomainQueryDataSourceSchema.optional(),
+    handlerRef: common_1.EntityRefSchema.optional(),
+    ontologyDefinitionRevisionRef: exports.RevisionRefSchema.optional(),
+    viewRevisionRef: exports.RevisionRefSchema.optional(),
+    canonicalDataViewRevisionRef: exports.RevisionRefSchema.optional(),
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    resultSchemaRevisionRef: exports.RevisionRefSchema,
+    accessPolicy: exports.AccessPolicySchema,
+    lineageRequired: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const sourceKind = value.dataSource?.kind ?? "exact-view";
+    const exactDataRefs = [
+        value.ontologyDefinitionRevisionRef,
+        value.viewRevisionRef,
+        value.canonicalDataViewRevisionRef,
+    ];
+    if (sourceKind === "exact-view" &&
+        exactDataRefs.some((reference) => !reference)) {
+        context.addIssue({
+            code: "custom",
+            path: ["dataSource"],
+            message: "An exact-view Domain Query must pin Ontology, governed View, and canonical Data View revisions.",
+        });
+    }
+    if (sourceKind !== "exact-view" && exactDataRefs.some(Boolean)) {
+        context.addIssue({
+            code: "custom",
+            path: ["dataSource"],
+            message: "A non-View Domain Query cannot also pin one fixed View.",
+        });
+    }
+    if (value.dataSource &&
+        (!value.handlerRef || value.handlerRef.version === undefined)) {
+        context.addIssue({
+            code: "custom",
+            path: ["handlerRef"],
+            message: "A source-aware Domain Query must pin its release-owned handler version.",
+        });
+    }
+    const refs = [
+        ...(sourceKind === "exact-view" && value.ontologyDefinitionRevisionRef
+            ? [
+                [
+                    "ontologyDefinitionRevisionRef",
+                    value.ontologyDefinitionRevisionRef,
+                    "ontology-definition",
+                ],
+            ]
+            : []),
+        ...(sourceKind === "exact-view" && value.viewRevisionRef
+            ? [["viewRevisionRef", value.viewRevisionRef, "view"]]
+            : []),
+        ...(sourceKind === "exact-view" && value.canonicalDataViewRevisionRef
+            ? [
+                [
+                    "canonicalDataViewRevisionRef",
+                    value.canonicalDataViewRevisionRef,
+                    "view",
+                ],
+            ]
+            : []),
+        ["inputSchemaRevisionRef", value.inputSchemaRevisionRef, "schema"],
+        ["resultSchemaRevisionRef", value.resultSchemaRevisionRef, "schema"],
+    ];
+    refs.forEach(([field, reference, expectedKind]) => {
+        if (reference.kind !== expectedKind) {
+            context.addIssue({
+                code: "custom",
+                path: [field, "kind"],
+                message: `${field} must reference ${expectedKind}.`,
+            });
+        }
+        validateTenantCompatibleReference(reference, value.tenantScope, [field], context);
+    });
+    [
+        ...value.accessPolicy.groupAllOf,
+        ...value.accessPolicy.groupAnyOf,
+    ].forEach((reference, index) => validateTenantCompatibleReference(reference, value.tenantScope, ["accessPolicy", "groups", index], context));
+    value.accessPolicy.conditionAllOf.forEach((reference, index) => validateTenantCompatibleReference(reference, value.tenantScope, ["accessPolicy", "conditionAllOf", index], context));
+    if (value.viewRevisionRef &&
+        value.canonicalDataViewRevisionRef &&
+        exactRevisionRef(value.viewRevisionRef, value.canonicalDataViewRevisionRef)) {
+        context.addIssue({
+            code: "custom",
+            path: ["canonicalDataViewRevisionRef"],
+            message: "Governed View adapter and canonical data.view revisions must be distinct.",
+        });
+    }
+});
+exports.CursorWindowBindingSchema = zod_1.z
+    .object({
+    sourceCapabilityInstanceId: common_1.ContractIdentifierSchema.optional(),
+    pageChangePort: common_1.ContractIdentifierSchema,
+    pageChangeIntentSchemaRevisionRef: exports.RevisionRefSchema,
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.pageChangeIntentSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["pageChangeIntentSchemaRevisionRef", "kind"],
+            message: "Cursor-window page-change intents must pin a schema revision.",
+        });
+    }
+});
+exports.QueryResultStateBindingSchema = zod_1.z
+    .object({
+    targetStateId: common_1.ContractIdentifierSchema,
+    targetStateSchemaRevisionRef: exports.RevisionRefSchema,
+    source: zod_1.z
+        .object({ kind: zod_1.z.enum(["page-info-total", "model-total"]) })
+        .strict(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.targetStateSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["targetStateSchemaRevisionRef", "kind"],
+            message: "Query result state bindings must pin a Page-state schema revision.",
+        });
+    }
+});
+exports.QueryBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    queryDefinitionRevisionRef: exports.RevisionRefSchema,
+    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    target: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
+    targetProjection: zod_1.z
+        .object({
+        expression: page_expression_1.PageExpressionSchema,
+        schemaRevisionRef: exports.RevisionRefSchema,
+    })
+        .strict()
+        .optional(),
+    streamTargetProjection: zod_1.z
+        .object({
+        expression: page_expression_1.PageExpressionSchema,
+        schemaRevisionRef: exports.RevisionRefSchema,
+    })
+        .strict()
+        .optional(),
+    stateEffects: zod_1.z
+        .array(zod_1.z
+        .object({
+        targetStateId: common_1.ContractIdentifierSchema,
+        value: page_expression_1.PageExpressionSchema,
+        when: page_expression_1.PageExpressionSchema.optional(),
+    })
+        .strict())
+        .max(32)
+        .optional(),
+    queryWhen: exports.PageStateActivationSchema.optional(),
+    accessFailure: zod_1.z.literal("render-forbidden").optional(),
+    resultStateBindings: zod_1.z
+        .array(exports.QueryResultStateBindingSchema)
+        .max(32)
+        .optional(),
+    execution: zod_1.z.enum(["server", "local-state"]).default("server"),
+    pagination: zod_1.z.enum(["none", "cursor", "offset"]),
+    cursorWindow: exports.CursorWindowBindingSchema.optional(),
+    cache: zod_1.z.enum(["none", "identity-scoped", "tenant-scoped"]),
+    cancelOnChange: zod_1.z.boolean(),
+    refreshPolicy: zod_1.z
+        .object({
+        intervalMs: zod_1.z.number().int().min(1000).max(300000),
+        when: page_expression_1.PageExpressionSchema.optional(),
+    })
+        .strict()
+        .optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.targetProjection) {
+        if (value.targetProjection.schemaRevisionRef.kind !== "schema")
+            context.addIssue({
+                code: "custom",
+                path: ["targetProjection", "schemaRevisionRef"],
+                message: "Query target projections require an exact target schema revision.",
+            });
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(value.targetProjection.expression))
+            if (read.root !== "model")
+                context.addIssue({
+                    code: "custom",
+                    path: ["targetProjection", "expression"],
+                    message: "Query target projections may read only the validated raw model.",
+                });
+    }
+    if (value.streamTargetProjection) {
+        const projection = value.streamTargetProjection;
+        if (projection.schemaRevisionRef.kind !== "schema")
+            context.addIssue({
+                code: "custom",
+                path: ["streamTargetProjection", "schemaRevisionRef"],
+                message: "Stream target projections require an exact target schema revision.",
+            });
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(projection.expression))
+            if (read.root !== "model")
+                context.addIssue({
+                    code: "custom",
+                    path: ["streamTargetProjection", "expression"],
+                    message: "Stream target projections may read only the verified query and stream envelope.",
+                });
+        if (value.execution !== "server" || value.pagination !== "none")
+            context.addIssue({
+                code: "custom",
+                path: ["streamTargetProjection"],
+                message: "Stream target projections require a non-paginated Server query.",
+            });
+    }
+    const effects = value.stateEffects ?? [];
+    if (new Set(effects.map((effect) => effect.targetStateId)).size !==
+        effects.length)
+        context.addIssue({
+            code: "custom",
+            path: ["stateEffects"],
+            message: "A query completion may update each state only once.",
+        });
+    for (const [index, effect] of effects.entries())
+        for (const expression of [
+            effect.value,
+            ...(effect.when ? [effect.when] : []),
+        ]) {
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(expression))
+                if (!["model", "state", "scope"].includes(read.root))
+                    context.addIssue({
+                        code: "custom",
+                        path: ["stateEffects", index],
+                        message: "Query state effects may read only model, state, and scope.",
+                    });
+        }
+    if (effects.length &&
+        (value.execution !== "server" || value.pagination !== "none"))
+        context.addIssue({
+            code: "custom",
+            path: ["stateEffects"],
+            message: "Query state effects require a non-paginated Server query.",
+        });
+    if (value.refreshPolicy?.when) {
+        for (const read of (0, page_expression_1.collectExternalPageExpressionReads)(value.refreshPolicy.when)) {
+            if (read.root !== "model" &&
+                !(read.root === "actions" &&
+                    read.path.length === 2 &&
+                    read.path[1] === "pending"))
+                context.addIssue({
+                    code: "custom",
+                    path: ["refreshPolicy", "when"],
+                    message: "Automatic refresh conditions may read only the verified raw model and declared action pending state.",
+                });
+        }
+    }
+    if (value.refreshPolicy &&
+        (value.execution !== "server" || value.pagination !== "none")) {
+        context.addIssue({
+            code: "custom",
+            path: ["refreshPolicy"],
+            message: "Automatic refresh requires a non-paginated Server query.",
+        });
+    }
+    if (value.queryDefinitionRevisionRef.kind !== "domain-query-definition") {
+        context.addIssue({
+            code: "custom",
+            path: ["queryDefinitionRevisionRef", "kind"],
+            message: "Query bindings must pin a governed domain-query-definition revision.",
+        });
+    }
+    if (value.renderModelSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["renderModelSchemaRevisionRef", "kind"],
+            message: "Query bindings must pin a render-model schema revision.",
+        });
+    }
+    if (value.execution === "local-state" && value.pagination !== "none") {
+        context.addIssue({
+            code: "custom",
+            path: ["pagination"],
+            message: "Local Page-state queries cannot paginate.",
+        });
+    }
+    if (value.execution === "local-state" && value.accessFailure) {
+        context.addIssue({
+            code: "custom",
+            path: ["accessFailure"],
+            message: "Only a Server query can render an independently governed access failure.",
+        });
+    }
+    if (value.execution === "local-state" &&
+        (value.resultStateBindings?.length ?? 0) > 0) {
+        context.addIssue({
+            code: "custom",
+            path: ["resultStateBindings"],
+            message: "Only Server queries can project governed result totals into Page state.",
+        });
+    }
+    const targetStateIds = value.resultStateBindings?.map((binding) => binding.targetStateId) ?? [];
+    if (new Set(targetStateIds).size !== targetStateIds.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["resultStateBindings"],
+            message: "A Query binding can project a governed result total to each Page state at most once.",
+        });
+    }
+    if (value.cursorWindow && value.pagination !== "cursor") {
+        context.addIssue({
+            code: "custom",
+            path: ["cursorWindow"],
+            message: "Cursor-window navigation requires cursor pagination.",
+        });
+    }
+    if (value.cursorWindow && value.execution !== "server") {
+        context.addIssue({
+            code: "custom",
+            path: ["cursorWindow"],
+            message: "Cursor-window navigation requires Server query execution.",
+        });
+    }
+});
+exports.CapabilityInstanceSchema = zod_1.z
+    .object({
+    instanceId: common_1.ContractIdentifierSchema,
+    nodeId: common_1.ContractIdentifierSchema,
+    capabilityRevisionRef: exports.RevisionRefSchema,
+    providerRevisionRef: exports.RevisionRefSchema,
+    propertySchemaRevisionRef: exports.RevisionRefSchema,
+    properties: common_1.JsonObjectSchema,
+    propertyBindings: zod_1.z.array(page_expression_1.PagePropertyBindingSchema).max(128).optional(),
+    eventPayloadBindings: zod_1.z
+        .array(zod_1.z
+        .object({
+        port: common_1.ContractIdentifierSchema,
+        expression: page_expression_1.PageExpressionSchema,
+    })
+        .strict())
+        .max(32)
+        .optional(),
+    eventEffects: zod_1.z
+        .array(zod_1.z
+        .object({
+        sourcePort: common_1.ContractIdentifierSchema,
+        sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+        refreshBindingIds: zod_1.z
+            .array(common_1.ContractIdentifierSchema)
+            .min(1)
+            .max(128),
+    })
+        .strict())
+        .max(32)
+        .optional(),
+    accessPolicy: exports.AccessPolicySchema.optional(),
+    activationWhen: exports.PageStateActivationSchema.optional(),
+    allowedSideEffects: zod_1.z.array(zod_1.z.enum([
+        "network",
+        "storage",
+        "navigation",
+        "clipboard",
+        "worker",
+        "websocket",
+    ])),
+})
+    .strict();
+exports.OntologyBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    ontologyDefinitionRevisionRef: exports.RevisionRefSchema,
+    viewRevisionRef: exports.RevisionRefSchema,
+    canonicalDataViewRevisionRef: exports.RevisionRefSchema,
+    parameters: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
+    target: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    renderModelSchemaRevisionRef: exports.RevisionRefSchema,
+    pagination: zod_1.z.enum(["none", "cursor", "offset"]),
+    cursorWindow: exports.CursorWindowBindingSchema.optional(),
+    cache: zod_1.z.enum(["none", "identity-scoped", "tenant-scoped"]),
+    cancelOnChange: zod_1.z.boolean(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.viewRevisionRef.kind !== "view") {
+        context.addIssue({
+            code: "custom",
+            path: ["viewRevisionRef", "kind"],
+            message: "Ontology bindings require an exact governed View revision.",
+        });
+    }
+    if (value.canonicalDataViewRevisionRef.kind !== "view") {
+        context.addIssue({
+            code: "custom",
+            path: ["canonicalDataViewRevisionRef", "kind"],
+            message: "Ontology bindings require an exact canonical data.view revision.",
+        });
+    }
+    if (exactRevisionRef(value.viewRevisionRef, value.canonicalDataViewRevisionRef)) {
+        context.addIssue({
+            code: "custom",
+            path: ["canonicalDataViewRevisionRef"],
+            message: "Governed View adapter and canonical data.view revisions must be distinct.",
+        });
+    }
+    if (value.ontologyDefinitionRevisionRef.kind !== "ontology-definition") {
+        context.addIssue({
+            code: "custom",
+            path: ["ontologyDefinitionRevisionRef", "kind"],
+            message: "Expected an ontology-definition revision.",
+        });
+    }
+    if (value.cursorWindow && value.pagination !== "cursor") {
+        context.addIssue({
+            code: "custom",
+            path: ["cursorWindow"],
+            message: "Cursor-window navigation requires cursor pagination.",
+        });
+    }
+});
+exports.ActionResultBindingEffectSourceSchema = zod_1.z.discriminatedUnion("kind", [
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("result-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    zod_1.z.object({ kind: zod_1.z.literal("constant"), value: common_1.JsonValueSchema }).strict(),
+    zod_1.z
+        .object({
+        kind: zod_1.z.literal("collection-length"),
+        offset: zod_1.z.number().int().min(-1000).max(1000),
+    })
+        .strict(),
+]);
+exports.ActionResultBindingEffectSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    operation: zod_1.z.enum(["upsert-append", "remove-exact"]),
+    collectionPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+    identityPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+    mappings: zod_1.z
+        .array(zod_1.z
+        .object({
+        targetPath: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(8),
+        source: exports.ActionResultBindingEffectSourceSchema,
+    })
+        .strict())
+        .min(1)
+        .max(64),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const targetPaths = value.mappings.map(({ targetPath }) => targetPath.join("."));
+    if (new Set(targetPaths).size !== targetPaths.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["mappings"],
+            message: "Result binding effect target paths must be unique.",
+        });
+    }
+    if (!targetPaths.includes(value.identityPath.join("."))) {
+        context.addIssue({
+            code: "custom",
+            path: ["identityPath"],
+            message: "A result binding effect must map the exact identity path of the projected item.",
+        });
+    }
+    const identityMapping = value.mappings.find(({ targetPath }) => targetPath.join(".") === value.identityPath.join("."));
+    if (identityMapping?.source.kind === "collection-length") {
+        context.addIssue({
+            code: "custom",
+            path: ["identityPath"],
+            message: "A projected item identity must come from the verified result or a declared constant.",
+        });
+    }
+    if (value.operation === "remove-exact" && value.mappings.length !== 1) {
+        context.addIssue({
+            code: "custom",
+            path: ["mappings"],
+            message: "An exact removal declares only the verified identity mapping used to remove one item.",
+        });
+    }
+});
+exports.ActionResultClipboardEffectSchema = zod_1.z
+    .object({
+    source: zod_1.z
+        .object({
+        kind: zod_1.z.literal("result-field"),
+        path: zod_1.z
+            .string()
+            .trim()
+            .regex(/^[A-Za-z0-9_.-]+$/),
+    })
+        .strict(),
+    copiedToast: exports.I18nTextSchema.optional(),
+    fallbackToast: exports.I18nTextSchema.superRefine((value, context) => {
+        for (const [locale, message] of Object.entries(value.values)) {
+            if (!message.includes("{value}")) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["values", locale],
+                    message: "Clipboard fallback feedback must visibly include the exact verified value placeholder.",
+                });
+            }
+        }
+    }),
+})
+    .strict();
+exports.ActionBindingSchema = zod_1.z
+    .object({
+    bindingId: common_1.ContractIdentifierSchema,
+    commandRevisionRef: exports.RevisionRefSchema,
+    source: zod_1.z
+        .object({
+        capabilityInstanceId: common_1.ContractIdentifierSchema,
+        port: common_1.ContractIdentifierSchema,
+    })
+        .strict(),
+    sourceIntentSchemaRevisionRef: exports.RevisionRefSchema,
+    inputSchemaRevisionRef: exports.RevisionRefSchema,
+    when: page_expression_1.PageExpressionSchema.optional(),
+    fileInputs: zod_1.z.array(ActionFileInputSchema).min(1).max(4).optional(),
+    inputMapping: zod_1.z.record(common_1.ContractIdentifierSchema, ActionInputBindingSourceSchema),
+    sensitiveInputPaths: common_1.SensitiveResultPathsSchema.optional(),
+    accessPolicy: exports.AccessPolicySchema,
+    confirmation: exports.I18nTextSchema.optional(),
+    idempotencyKeySource: zod_1.z.enum([
+        "interaction",
+        "record-and-interaction",
+        "caller-provided",
+    ]),
+    compensationCommandRevisionRef: exports.RevisionRefSchema.optional(),
+    resultSchemaRevisionRef: exports.RevisionRefSchema,
+    success: zod_1.z
+        .object({
+        download: zod_1.z
+            .discriminatedUnion("kind", [
+            zod_1.z.object({ kind: zod_1.z.literal("native") }).strict(),
+            zod_1.z
+                .object({
+                kind: zod_1.z.literal("text-artifact"),
+                fileNamePath: page_expression_1.PageValuePathSchema.min(1),
+                mimeTypePath: page_expression_1.PageValuePathSchema.min(1),
+                contentPath: page_expression_1.PageValuePathSchema.min(1),
+                maxBytes: zod_1.z.number().int().min(1).max(1048576),
+            })
+                .strict(),
+        ])
+            .optional(),
+        refreshBindingIds: zod_1.z.array(common_1.ContractIdentifierSchema),
+        ephemeralResult: zod_1.z
+            .object({
+            kind: zod_1.z.literal("one-time-value"),
+            valuePath: common_1.SensitiveResultPathSchema,
+            labelPath: common_1.SensitiveResultPathSchema,
+            title: exports.I18nTextSchema,
+            description: exports.I18nTextSchema,
+            copySuccessToast: exports.I18nTextSchema,
+            copyFailureToast: exports.I18nTextSchema,
+        })
+            .strict()
+            .optional(),
+        resultBindingEffects: zod_1.z
+            .array(exports.ActionResultBindingEffectSchema)
+            .max(64)
+            .optional(),
+        clipboard: exports.ActionResultClipboardEffectSchema.optional(),
+        navigationTargetRef: exports.StableRefSchema.optional(),
+        toast: exports.I18nTextSchema.optional(),
+    })
+        .strict(),
+    recovery: zod_1.z.enum(["retry-safe", "compensating-command", "manual-review"]),
+    lineageRequired: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const fileIds = new Set();
+    for (const file of value.fileInputs ?? []) {
+        if (fileIds.has(file.inputId))
+            context.addIssue({
+                code: "custom",
+                path: ["fileInputs"],
+                message: "File input ids must be unique.",
+            });
+        fileIds.add(file.inputId);
+        if (!Object.values(value.inputMapping).some((source) => source.kind === "file-field" && source.fileInputId === file.inputId))
+            context.addIssue({
+                code: "custom",
+                path: ["fileInputs"],
+                message: "File inputs require an explicit governed input mapping.",
+            });
+    }
+    for (const [name, source] of Object.entries(value.inputMapping))
+        if (source.kind === "file-field") {
+            const file = value.fileInputs?.find((file) => file.inputId === source.fileInputId);
+            if ((source.path === "canonicalUri" && !file?.upload) ||
+                (source.path === "content" && file?.upload))
+                context.addIssue({
+                    code: "custom",
+                    path: ["inputMapping", name],
+                    message: "File field must match its declared transport mode.",
+                });
+            if (!fileIds.has(source.fileInputId))
+                context.addIssue({
+                    code: "custom",
+                    path: ["inputMapping", name],
+                    message: "File fields must reference a declared file input.",
+                });
+            if (source.path === "content" &&
+                !value.sensitiveInputPaths?.includes(`/${name}`))
+                context.addIssue({
+                    code: "custom",
+                    path: ["sensitiveInputPaths"],
+                    message: "File content must be declared as a sensitive command input.",
+                });
+        }
+    if (value.when)
+        for (const read of (0, page_expression_1.collectPageExpressionReads)(value.when)) {
+            if (!["intent", "state", "scope"].includes(read.root))
+                context.addIssue({
+                    code: "custom",
+                    path: ["when"],
+                    message: "Action conditions may read only intent, declared Page state, and instance scope.",
+                });
+        }
+    if (value.success.ephemeralResult) {
+        const { valuePath, labelPath } = value.success.ephemeralResult;
+        const segments = (path) => path.split("/").slice(1);
+        const valueSegments = segments(valuePath);
+        const labelSegments = segments(labelPath);
+        const sharedLength = Math.min(valueSegments.length, labelSegments.length);
+        if (valueSegments
+            .slice(0, sharedLength)
+            .every((segment, index) => segment === labelSegments[index])) {
+            context.addIssue({
+                code: "custom",
+                path: ["success", "ephemeralResult", "labelPath"],
+                message: "One-time result labels cannot overlap the sensitive value path.",
+            });
+        }
+    }
+    if (value.success.ephemeralResult &&
+        (value.success.resultBindingEffects?.length || 0) > 0) {
+        context.addIssue({
+            code: "custom",
+            path: ["success", "resultBindingEffects"],
+            message: "One-time result presentation cannot share a result with durable binding effects.",
+        });
+    }
+    if (value.commandRevisionRef.kind !== "domain-command") {
+        context.addIssue({
+            code: "custom",
+            path: ["commandRevisionRef", "kind"],
+            message: "Action bindings must reference a domain-command revision.",
+        });
+    }
+    if (value.sourceIntentSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceIntentSchemaRevisionRef", "kind"],
+            message: "Action source intents must pin a schema revision.",
+        });
+    }
+    if (value.inputSchemaRevisionRef.kind !== "schema") {
+        context.addIssue({
+            code: "custom",
+            path: ["inputSchemaRevisionRef", "kind"],
+            message: "Action command inputs must pin a schema revision.",
+        });
+    }
+    if (value.recovery === "compensating-command" &&
+        !value.compensationCommandRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["compensationCommandRevisionRef"],
+            message: "Compensating recovery requires a compensation command.",
+        });
+    }
+});
+exports.PageMigrationEquivalenceDimensionSchema = zod_1.z.enum([
+    "url",
+    "navigation",
+    "access",
+    "deep-link",
+    "layout",
+    "size",
+    "spacing",
+    "design-tokens",
+    "responsive",
+    "view-modes",
+    "search-filter",
+    "editing",
+    "detail",
+    "history",
+    "dialogs",
+    "keyboard",
+    "loading",
+    "empty",
+    "error",
+    "forbidden",
+]);
+exports.PageMigrationEquivalenceSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("PageMigrationEquivalence"),
+    schemaVersion: zod_1.z.literal(1),
+    policy: zod_1.z.literal("preserve-ui-ux"),
+    baseline: zod_1.z
+        .object({
+        repository: common_1.ContractIdentifierSchema,
+        revision: zod_1.z.string().regex(/^[0-9a-f]{40}$/),
+        pageId: common_1.ContractIdentifierSchema,
+        routePath: exports.RoutePathTemplateSchema,
+    })
+        .strict(),
+    protectedDimensions: zod_1.z
+        .array(exports.PageMigrationEquivalenceDimensionSchema)
+        .min(1),
+    viewports: zod_1.z
+        .array(zod_1.z
+        .object({
+        viewportId: common_1.ContractIdentifierSchema,
+        width: zod_1.z.number().int().min(320).max(7680),
+        height: zod_1.z.number().int().min(480).max(4320),
+    })
+        .strict())
+        .min(2),
+    scenarios: zod_1.z
+        .array(zod_1.z
+        .object({
+        scenarioId: common_1.ContractIdentifierSchema,
+        viewportIds: zod_1.z.array(common_1.ContractIdentifierSchema).min(1),
+    })
+        .strict())
+        .min(1),
+    evidence: zod_1.z
+        .object({
+        sideBySideVisual: zod_1.z.literal(true),
+        domSnapshot: zod_1.z.literal(true),
+        consoleErrors: zod_1.z.literal("none"),
+    })
+        .strict(),
+    allowedDifferences: zod_1.z.array(zod_1.z
+        .object({
+        differenceId: common_1.ContractIdentifierSchema,
+        requirementRevisionRef: exports.RevisionRefSchema,
+    })
+        .strict()),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (uniqueArray(value.protectedDimensions, (candidate) => candidate)) {
+        context.addIssue({
+            code: "custom",
+            path: ["protectedDimensions"],
+            message: "Protected UI/UX dimensions must be unique.",
+        });
+    }
+    if (uniqueArray(value.viewports, (candidate) => candidate.viewportId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["viewports"],
+            message: "Migration equivalence viewport identities must be unique.",
+        });
+    }
+    if (uniqueArray(value.scenarios, (candidate) => candidate.scenarioId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["scenarios"],
+            message: "Migration equivalence scenario identities must be unique.",
+        });
+    }
+    const viewportIds = new Set(value.viewports.map((viewport) => viewport.viewportId));
+    value.scenarios.forEach((scenario, index) => {
+        scenario.viewportIds.forEach((viewportId, viewportIndex) => {
+            if (!viewportIds.has(viewportId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["scenarios", index, "viewportIds", viewportIndex],
+                    message: `Migration equivalence scenario references unknown viewport ${viewportId}.`,
+                });
+            }
+        });
+    });
+});
+exports.PageRouteStatePresentationSchema = zod_1.z
+    .object({
+    surface: exports.ProductSurfaceSchema,
+    state: zod_1.z.literal("forbidden"),
+    kind: zod_1.z.literal("status"),
+    presentation: zod_1.z.enum(["panel", "page"]),
+    title: exports.I18nTextSchema,
+    description: exports.I18nTextSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const localizedFields = [
+        ["title", value.title, 160],
+        ["description", value.description, 1000],
+    ];
+    localizedFields.forEach(([field, copy, maxLength]) => {
+        if (!copy)
+            return;
+        const entries = Object.entries(copy.values);
+        if (entries.length > 16) {
+            context.addIssue({
+                code: "custom",
+                path: [field, "values"],
+                message: "Route-state presentation copy supports at most 16 locales.",
+            });
+        }
+        entries.forEach(([locale, text]) => {
+            if (text.length > maxLength) {
+                context.addIssue({
+                    code: "custom",
+                    path: [field, "values", locale],
+                    message: `Route-state ${field} copy must contain at most ${maxLength} characters.`,
+                });
+            }
+        });
+    });
+});
+exports.PageStateSchema = exports.PageStateDefinitionSchema.omit({
+    schemaRevisionRef: true,
+})
+    .extend({
+    stateId: common_1.ContractIdentifierSchema,
+    schema: common_1.ContractIdentifierSchema,
+})
+    .strict();
+exports.PageEntryTargetSchema = zod_1.z
+    .object({
+    kind: zod_1.z.enum(["page", "workbench"]),
+    id: common_1.ContractIdentifierSchema,
+})
+    .strict();
+exports.PageEntrySchema = exports.PageEntryTransitionSchema.omit({
+    targetRef: true,
+})
+    .extend({
+    target: exports.PageEntryTargetSchema,
+})
+    .strict();
+exports.PageInteractionSchema = exports.InteractionBindingSchema.omit({
+    source: true,
+    sourceIntentSchemaRevisionRef: true,
+    sourceResultSchemaRevisionRef: true,
+})
+    .extend({
+    port: common_1.ContractIdentifierSchema,
+})
+    .strict();
+const PageCursorWindowSchema = exports.CursorWindowBindingSchema.omit({
+    pageChangeIntentSchemaRevisionRef: true,
+}).strict();
+const PageResultStateBindingSchema = exports.QueryResultStateBindingSchema.omit({
+    targetStateSchemaRevisionRef: true,
+}).strict();
+exports.PageDataSchema = exports.QueryBindingSchema.omit({
+    queryDefinitionRevisionRef: true,
+    target: true,
+    renderModelSchemaRevisionRef: true,
+    targetProjection: true,
+    streamTargetProjection: true,
+    cursorWindow: true,
+    resultStateBindings: true,
+})
+    .extend({
+    query: common_1.ContractIdentifierSchema,
+    port: common_1.ContractIdentifierSchema,
+    targetProjection: zod_1.z
+        .object({ expression: page_expression_1.PageExpressionSchema })
+        .strict()
+        .optional(),
+    streamTargetProjection: zod_1.z
+        .object({ expression: page_expression_1.PageExpressionSchema })
+        .strict()
+        .optional(),
+    cursorWindow: PageCursorWindowSchema.optional(),
+    resultStateBindings: zod_1.z
+        .array(PageResultStateBindingSchema)
+        .max(32)
+        .optional(),
+})
+    .strict();
+exports.PageActionSchema = exports.ActionBindingSchema.omit({
+    commandRevisionRef: true,
+    source: true,
+    sourceIntentSchemaRevisionRef: true,
+    inputSchemaRevisionRef: true,
+    compensationCommandRevisionRef: true,
+    resultSchemaRevisionRef: true,
+})
+    .extend({
+    command: common_1.ContractIdentifierSchema,
+    port: common_1.ContractIdentifierSchema,
+    compensationCommand: common_1.ContractIdentifierSchema.optional(),
+})
+    .strict();
+const PageEventEffectSchema = zod_1.z
+    .object({
+    port: common_1.ContractIdentifierSchema,
+    refresh: zod_1.z.array(common_1.ContractIdentifierSchema).min(1).max(128),
+})
+    .strict();
+exports.PageNodeSchema = zod_1.z.lazy(() => zod_1.z
+    .object({
+    id: common_1.ContractIdentifierSchema,
+    component: common_1.ContractIdentifierSchema,
+    kind: render_1.RenderNodeKindSchema.optional(),
+    slot: common_1.ContractIdentifierSchema.optional(),
+    props: common_1.JsonObjectSchema.optional(),
+    bindings: zod_1.z.array(page_expression_1.PagePropertyBindingSchema).max(128).optional(),
+    model: common_1.JsonObjectSchema.optional(),
+    style: render_1.RenderStyleSchema.optional(),
+    layout: render_1.RenderLayoutSchema.optional(),
+    responsive: zod_1.z.array(render_1.RenderResponsiveRuleSchema).optional(),
+    surface: render_1.RenderSurfaceSchema.optional(),
+    scroll: render_1.RenderScrollSchema.optional(),
+    activation: render_1.RenderActivationSchema.optional(),
+    lifecycle: render_1.RenderLifecycleSchema.optional(),
+    state: render_1.RenderNodeStateSchema.optional(),
+    access: exports.AccessPolicySchema.optional(),
+    activeWhen: exports.PageStateActivationSchema.optional(),
+    repeat: zod_1.z
+        .object({
+        source: page_expression_1.PageExpressionSchema,
+        keyPath: page_expression_1.PageValuePathSchema.min(1),
+        limit: zod_1.z.number().int().min(1).max(1000).optional(),
+    })
+        .strict()
+        .optional(),
+    data: zod_1.z.array(exports.PageDataSchema).optional(),
+    actions: zod_1.z.array(exports.PageActionSchema).optional(),
+    on: zod_1.z.array(exports.PageInteractionSchema).optional(),
+    effects: zod_1.z.array(PageEventEffectSchema).optional(),
+    eventPayloads: zod_1.z
+        .array(zod_1.z
+        .object({
+        port: common_1.ContractIdentifierSchema,
+        expression: page_expression_1.PageExpressionSchema,
+    })
+        .strict())
+        .optional(),
+    children: zod_1.z.array(exports.PageNodeSchema).optional(),
+})
+    .strict());
+exports.PageSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("Page"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    pageId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    identity: IdentitySchema,
+    surface: exports.ProductSurfaceSchema,
+    route: exports.RoutePathTemplateSchema,
+    routeSpace: common_1.ContractIdentifierSchema.optional(),
+    lifecycle: exports.DeclarativeLifecycleSchema.default("active"),
+    routeStatePresentations: zod_1.z
+        .array(exports.PageRouteStatePresentationSchema)
+        .max(8)
+        .optional(),
+    shell: common_1.ContractIdentifierSchema.optional(),
+    body: exports.PageNodeSchema,
+    state: zod_1.z.array(exports.PageStateSchema).optional(),
+    entryTransitions: zod_1.z.array(exports.PageEntrySchema).optional(),
+    access: exports.AccessPolicySchema,
+    managementAccess: exports.ManagementAccessSchema,
+    tokens: zod_1.z.array(common_1.ContractIdentifierSchema).optional(),
+    performanceBudget: common_1.ContractIdentifierSchema.optional(),
+    observationPolicy: common_1.ContractIdentifierSchema.optional(),
+    privacyClassification: zod_1.z
+        .enum(["public", "internal", "confidential", "restricted"])
+        .default("internal"),
+})
+    .strict()
+    .superRefine((page, context) => {
+    const ids = new Set();
+    const dataIds = new Set();
+    const actionIds = new Set();
+    const interactionIds = new Set();
+    const visit = (node, path) => {
+        if (ids.has(node.id))
+            context.addIssue({
+                code: "custom",
+                path: [...path, "id"],
+                message: `Duplicate Page node id ${node.id}.`,
+            });
+        ids.add(node.id);
+        for (const [field, values, target] of [
+            ["data", node.data ?? [], dataIds],
+            ["actions", node.actions ?? [], actionIds],
+            ["on", node.on ?? [], interactionIds],
+        ])
+            for (const [index, value] of values.entries()) {
+                if (target.has(value.bindingId))
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, field, index, "bindingId"],
+                        message: `Duplicate Page binding id ${value.bindingId}.`,
+                    });
+                target.add(value.bindingId);
+            }
+        (node.children ?? []).forEach((child, index) => visit(child, [...path, "children", index]));
+    };
+    visit(page.body, ["body"]);
+    const stateIds = (page.state ?? []).map((entry) => entry.stateId);
+    if (new Set(stateIds).size !== stateIds.length)
+        context.addIssue({
+            code: "custom",
+            path: ["state"],
+            message: "Page state ids must be unique.",
+        });
+});
+exports.ResolvedPageSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("Page"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    pageId: common_1.ContractIdentifierSchema,
+    tenantScope: exports.TenantScopeSchema,
+    identity: IdentitySchema,
+    supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
+    lifecycle: exports.DeclarativeLifecycleSchema,
+    legacyRoutePolicy: legacy_route_1.LegacyRoutePolicySchema.optional(),
+    migrationEquivalence: exports.PageMigrationEquivalenceSchema.optional(),
+    routeStatePresentations: zod_1.z
+        .array(exports.PageRouteStatePresentationSchema)
+        .max(8)
+        .optional(),
+    routeClaims: zod_1.z
+        .array(zod_1.z.union([
+        exports.DeclarativeRouteClaimSchema,
+        LegacyDeclarativeRouteClaimSchema,
+    ]))
+        .min(1),
+    shellRevisionRef: exports.RevisionRefSchema,
+    renderTree: render_1.RenderTreeSchema,
+    capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema).min(1),
+    stateDefinitions: zod_1.z.array(exports.PageStateDefinitionSchema).optional(),
+    entryTransitions: zod_1.z.array(exports.PageEntryTransitionSchema).optional(),
+    interactionBindings: zod_1.z.array(exports.InteractionBindingSchema).optional(),
+    ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    queryBindings: zod_1.z.array(exports.QueryBindingSchema).optional(),
+    actionBindings: zod_1.z.array(exports.ActionBindingSchema),
+    pageAccessPolicy: exports.AccessPolicySchema,
+    managementAccess: exports.ManagementAccessSchema,
+    tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
+    performanceBudgetRef: exports.RevisionRefSchema,
+    observationPolicyRevisionRef: exports.RevisionRefSchema,
+    privacyClassification: zod_1.z.enum([
+        "public",
+        "internal",
+        "confidential",
+        "restricted",
+    ]),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
+    const routeStatePresentations = value.routeStatePresentations ?? [];
+    if (uniqueArray(routeStatePresentations, (candidate) => `${candidate.surface}:${candidate.state}`)) {
+        context.addIssue({
+            code: "custom",
+            path: ["routeStatePresentations"],
+            message: "Page route-state presentations must be unique per surface and state.",
+        });
+    }
+    routeStatePresentations.forEach((presentation, index) => {
+        if (!value.supportedSurfaces.includes(presentation.surface)) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeStatePresentations", index, "surface"],
+                message: "Page route-state presentation surface must be declared by supportedSurfaces.",
+            });
+        }
+    });
+    const stateDefinitions = value.stateDefinitions ?? [];
+    const entryTransitions = value.entryTransitions ?? [];
+    const interactionBindings = value.interactionBindings ?? [];
+    const queryBindings = value.queryBindings ?? [];
+    stateDefinitions.forEach((definition, index) => {
+        const partitionStateId = definition.preferencePartitionStateId;
+        const dynamicLegacySegments = definition.legacyBrowserPreferenceImport?.jsonPath?.filter((segment) => typeof segment !== "string") ?? [];
+        if (!partitionStateId) {
+            if (dynamicLegacySegments.length > 0) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "stateDefinitions",
+                        index,
+                        "legacyBrowserPreferenceImport",
+                        "jsonPath",
+                    ],
+                    message: "A dynamic legacy preference path requires a declared preference partition state.",
+                });
+            }
+            return;
+        }
+        const partitionDefinition = stateDefinitions.find((candidate) => candidate.stateId === partitionStateId);
+        if (partitionStateId === definition.stateId ||
+            !partitionDefinition ||
+            partitionDefinition.preferencePartitionStateId) {
+            context.addIssue({
+                code: "custom",
+                path: ["stateDefinitions", index, "preferencePartitionStateId"],
+                message: "Preference partitioning must reference a distinct, non-partitioned Page state.",
+            });
+        }
+        definition.legacyBrowserPreferenceImport?.jsonPath?.forEach((segment, segmentIndex) => {
+            if (typeof segment !== "string" &&
+                segment.stateId !== partitionStateId) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "stateDefinitions",
+                        index,
+                        "legacyBrowserPreferenceImport",
+                        "jsonPath",
+                        segmentIndex,
+                    ],
+                    message: "A dynamic legacy preference path must use the declared preference partition state.",
+                });
+            }
+        });
+    });
+    const uniqueness = [
+        [
+            "capabilityInstances",
+            value.capabilityInstances,
+            (candidate) => String(candidate.instanceId),
+        ],
+        [
+            "stateDefinitions",
+            stateDefinitions,
+            (candidate) => String(candidate.stateId),
+        ],
+        [
+            "entryTransitions",
+            entryTransitions,
+            (candidate) => String(candidate.transitionId),
+        ],
+        [
+            "interactionBindings",
+            interactionBindings,
+            (candidate) => String(candidate.bindingId),
+        ],
+        [
+            "ontologyBindings",
+            value.ontologyBindings,
+            (candidate) => String(candidate.bindingId),
+        ],
+        [
+            "queryBindings",
+            queryBindings,
+            (candidate) => String(candidate.bindingId),
+        ],
+        [
+            "actionBindings",
+            value.actionBindings,
+            (candidate) => String(candidate.bindingId),
+        ],
+    ];
+    uniqueness.forEach(([field, values, identity]) => {
         if (uniqueArray(values, identity))
-            context.addIssue({ code: 'custom', path: [field], message: `${field} identities must be unique.` });
+            context.addIssue({
+                code: "custom",
+                path: [field],
+                message: `${field} identities must be unique.`,
+            });
+    });
+    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
+    const stateIds = new Set(stateDefinitions.map((state) => state.stateId));
+    value.capabilityInstances.forEach((instance, index) => {
+        const ports = new Set();
+        const payloadPorts = new Set();
+        instance.eventPayloadBindings?.forEach((binding, bindingIndex) => {
+            const path = [
+                "capabilityInstances",
+                index,
+                "eventPayloadBindings",
+                bindingIndex,
+            ];
+            if (payloadPorts.has(binding.port))
+                context.addIssue({
+                    code: "custom",
+                    path,
+                    message: "An event payload can have only one declarative projection.",
+                });
+            payloadPorts.add(binding.port);
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(binding.expression)) {
+                if (read.root === "actions" ||
+                    read.root === "result" ||
+                    (read.root === "state" && !stateIds.has(read.path[0] ?? "")) ||
+                    (read.root === "bindings" &&
+                        ![...value.ontologyBindings, ...queryBindings].some((candidate) => candidate.bindingId === read.path[0])))
+                    context.addIssue({
+                        code: "custom",
+                        path,
+                        message: "Event payload projections require local event, model, scope, declared query results, or declared state.",
+                    });
+            }
+        });
+        instance.eventEffects?.forEach((effect, effectIndex) => {
+            const path = [
+                "capabilityInstances",
+                index,
+                "eventEffects",
+                effectIndex,
+            ];
+            if (effect.sourceIntentSchemaRevisionRef.kind !== "schema" ||
+                ports.has(effect.sourcePort))
+                context.addIssue({
+                    code: "custom",
+                    path,
+                    message: "Event effects require one exact source schema per output port.",
+                });
+            ports.add(effect.sourcePort);
+            if (value.actionBindings.some((binding) => binding.source.capabilityInstanceId === instance.instanceId &&
+                binding.source.port === effect.sourcePort))
+                context.addIssue({
+                    code: "custom",
+                    path,
+                    message: "An Action output port must declare refresh effects through Action.success.",
+                });
+            for (const id of effect.refreshBindingIds)
+                if (![...value.ontologyBindings, ...queryBindings].some((binding) => binding.bindingId === id))
+                    context.addIssue({
+                        code: "custom",
+                        path,
+                        message: "Event effect references an unknown query binding.",
+                    });
+        });
+    });
+    const repeatNodes = new Set(value.renderTree.nodes
+        .filter((node) => node.repeat)
+        .map((node) => node.nodeId));
+    stateDefinitions.forEach((definition, index) => {
+        if (definition.scopeNodeId && !repeatNodes.has(definition.scopeNodeId))
+            context.addIssue({
+                code: "custom",
+                path: ["stateDefinitions", index, "scopeNodeId"],
+                message: "Instance state must reference an existing repeated RenderNode.",
+            });
+        if (definition.initialValue && !definition.scopeNodeId) {
+            const expression = definition.initialValue;
+            const source = expression.kind === "read"
+                ? stateDefinitions.find((state) => state.stateId === expression.path[0] && !state.scopeNodeId)
+                : undefined;
+            if (!source ||
+                source.initialValue ||
+                !["tenant-preference", "url-with-tenant-preference"].includes(source.persistence))
+                context.addIssue({
+                    code: "custom",
+                    path: ["stateDefinitions", index, "initialValue"],
+                    message: "Root initialization requires an independently hydrated tenant preference; initialization chains are forbidden.",
+                });
+        }
+        if (definition.initialValue) {
+            for (const read of (0, page_expression_1.collectPageExpressionReads)(definition.initialValue)) {
+                if (!["scope", "state"].includes(read.root) ||
+                    (read.root === "state" &&
+                        !stateDefinitions.some((state) => state.stateId === read.path[0] && !state.scopeNodeId)))
+                    context.addIssue({
+                        code: "custom",
+                        path: ["stateDefinitions", index, "initialValue"],
+                        message: "Instance initial values can read only their item scope and declared Page state.",
+                    });
+            }
+        }
+    });
+    value.renderTree.nodes.forEach((node, index) => {
+        if (!node.repeat)
+            return;
+        for (const read of (0, page_expression_1.collectPageExpressionReads)(node.repeat.source)) {
+            if (read.root === "actions" ||
+                read.root === "intent" ||
+                read.root === "result" ||
+                read.root === "model" ||
+                (read.root === "state" && !stateIds.has(read.path[0] ?? "")) ||
+                (read.root === "bindings" &&
+                    ![...value.ontologyBindings, ...queryBindings].some((binding) => binding.bindingId === read.path[0])))
+                context.addIssue({
+                    code: "custom",
+                    path: ["renderTree", "nodes", index, "repeat", "source"],
+                    message: "Repeated nodes require declared Page state, query results, or parent item scope.",
+                });
+        }
+    });
+    // A declaration can consume its own instance or ancestors, never an arbitrary sibling row.
+    const renderNodesById = new Map(value.renderTree.nodes.map((node) => [node.nodeId, node]));
+    const instanceNodes = new Map(value.capabilityInstances.map((instance) => [
+        instance.instanceId,
+        instance.nodeId,
+    ]));
+    const scopesForNode = (nodeId) => {
+        const scopes = new Set();
+        const visited = new Set();
+        let node = nodeId ? renderNodesById.get(nodeId) : undefined;
+        while (node && !visited.has(node.nodeId)) {
+            visited.add(node.nodeId);
+            if (node.repeat)
+                scopes.add(node.nodeId);
+            node = node.parentNodeId
+                ? renderNodesById.get(node.parentNodeId)
+                : undefined;
+        }
+        return scopes;
+    };
+    const queryOwners = new Map([...value.ontologyBindings, ...queryBindings].map((binding) => [
+        binding.bindingId,
+        [
+            ...scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)),
+        ][0],
+    ]));
+    const actionScopes = new Map(value.actionBindings.map((binding) => [
+        binding.bindingId,
+        scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId)),
+    ]));
+    const actionOwners = new Map([...actionScopes].map(([id, scopes]) => [id, [...scopes][0]]));
+    if (actionOwners.size !== value.actionBindings.length)
+        context.addIssue({
+            code: "custom",
+            path: ["actionBindings"],
+            message: "Action binding identifiers must be unique.",
+        });
+    const checkScopedReads = (reads, scopes, path) => {
+        for (const read of reads) {
+            const owner = read.root === "state"
+                ? stateDefinitions.find((state) => state.stateId === read.path[0])
+                    ?.scopeNodeId
+                : read.root === "bindings"
+                    ? queryOwners.get(read.path[0])
+                    : read.root === "actions"
+                        ? actionOwners.get(read.path[0])
+                        : undefined;
+            // A parent may observe only aggregate pending for its descendant action scopes.
+            // Error codes and individual row state remain scoped; unrelated repeat branches cannot aggregate.
+            const pendingAggregate = read.root === "actions" &&
+                read.path.length === 2 &&
+                read.path[1] === "pending" &&
+                actionScopes.has(read.path[0]) &&
+                [...scopes].every((scope) => actionScopes.get(read.path[0]).has(scope));
+            if (owner && !scopes.has(owner) && !pendingAggregate)
+                context.addIssue({
+                    code: "custom",
+                    path,
+                    message: "A binding cannot read state, query results, or individual action status from a sibling or descendant instance.",
+                });
+        }
+    };
+    const checkScopedSources = (sources, scopes, path) => {
+        Object.entries(sources).forEach(([name, source]) => {
+            if (source.kind === "expression")
+                checkScopedReads((0, page_expression_1.collectPageExpressionReads)(source.expression), scopes, [...path, name]);
+            if (source.kind === "page-state")
+                checkScopedReads([{ kind: "read", root: "state", path: [source.stateId] }], scopes, [...path, name]);
+            if (source.kind === "binding-field")
+                checkScopedReads([{ kind: "read", root: "bindings", path: [source.bindingId] }], scopes, [...path, name]);
+            if (source.kind === "scope-field" && scopes.size === 0)
+                context.addIssue({
+                    code: "custom",
+                    path: [...path, name],
+                    message: "A scope field requires a repeated instance.",
+                });
+        });
+    };
+    value.capabilityInstances.forEach((instance, index) => instance.eventPayloadBindings?.forEach((binding, bindingIndex) => checkScopedReads((0, page_expression_1.collectPageExpressionReads)(binding.expression), scopesForNode(instance.nodeId), ["capabilityInstances", index, "eventPayloadBindings", bindingIndex])));
+    value.capabilityInstances.forEach((instance, index) => instance.propertyBindings?.forEach((binding, bindingIndex) => {
+        checkScopedReads((0, page_expression_1.collectPageExpressionReads)(binding.expression), scopesForNode(instance.nodeId), ["capabilityInstances", index, "propertyBindings", bindingIndex]);
+    }));
+    for (const [collection, bindings] of [
+        ["ontologyBindings", value.ontologyBindings],
+        ["queryBindings", queryBindings],
+    ]) {
+        bindings.forEach((binding, index) => checkScopedSources(binding.parameters, scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)), [collection, index, "parameters"]));
+    }
+    value.actionBindings.forEach((binding, index) => {
+        const scopes = scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId));
+        checkScopedSources(binding.inputMapping, scopes, [
+            "actionBindings",
+            index,
+            "inputMapping",
+        ]);
+        for (const [fileIndex, file] of (binding.fileInputs ?? []).entries()) {
+            if (file.source.kind === "page-state") {
+                const stateId = file.source.stateId;
+                const state = stateDefinitions.find((candidate) => candidate.stateId === stateId);
+                if (!state || state.persistence !== "none")
+                    context.addIssue({
+                        code: "custom",
+                        path: ["actionBindings", index, "fileInputs", fileIndex],
+                        message: "File handles require declared nonpersistent Page state.",
+                    });
+                checkScopedSources({ file: file.source }, scopes, [
+                    "actionBindings",
+                    index,
+                    "fileInputs",
+                    fileIndex,
+                ]);
+            }
+        }
+        if (binding.when) {
+            const reads = (0, page_expression_1.collectPageExpressionReads)(binding.when);
+            checkScopedReads(reads, scopes, ["actionBindings", index, "when"]);
+            for (const read of reads)
+                if (read.root === "state" && !stateIds.has(read.path[0]))
+                    context.addIssue({
+                        code: "custom",
+                        path: ["actionBindings", index, "when"],
+                        message: "Action condition references an unknown Page state.",
+                    });
+        }
+    });
+    interactionBindings.forEach((binding, index) => {
+        const sourceScopes = scopesForNode(instanceNodes.get(binding.source.capabilityInstanceId));
+        const targetScope = stateDefinitions.find((state) => state.stateId === binding.targetStateId)?.scopeNodeId;
+        if (targetScope && !sourceScopes.has(targetScope))
+            context.addIssue({
+                code: "custom",
+                path: ["interactionBindings", index, "targetStateId"],
+                message: "An interaction must target its own instance or an ancestor.",
+            });
+        checkScopedSources(binding.inputMapping, targetScope ? scopesForNode(targetScope) : new Set(), ["interactionBindings", index, "inputMapping"]);
+    });
+    value.renderTree.nodes.forEach((node, index) => {
+        if (node.repeat)
+            checkScopedReads((0, page_expression_1.collectPageExpressionReads)(node.repeat.source), scopesForNode(node.parentNodeId), ["renderTree", "nodes", index, "repeat", "source"]);
+    });
+    entryTransitions.forEach((transition, transitionIndex) => {
+        if (transition.gestureSource &&
+            (!instanceIds.has(transition.gestureSource.capabilityInstanceId) ||
+                !interactionBindings.some((binding) => binding.source.capabilityInstanceId ===
+                    transition.gestureSource.capabilityInstanceId &&
+                    binding.source.port === transition.gestureSource.port))) {
+            context.addIssue({
+                code: "custom",
+                path: ["entryTransitions", transitionIndex, "gestureSource"],
+                message: "Entry gesture source must match an existing capability interaction source.",
+            });
+        }
+        if (transition.targetRef.kind === "page" &&
+            transition.targetRef.id === value.pageId) {
+            context.addIssue({
+                code: "custom",
+                path: ["entryTransitions", transitionIndex, "targetRef"],
+                message: "A Page cannot route into itself on entry.",
+            });
+        }
+        forEachPageStateCondition(transition.activation, (condition, conditionPath) => {
+            if (!stateIds.has(condition.stateId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "entryTransitions",
+                        transitionIndex,
+                        "activation",
+                        ...conditionPath,
+                        "stateId",
+                    ],
+                    message: `Entry transition references unknown Page state ${condition.stateId}.`,
+                });
+            }
+        });
+        const declaredRouteParameters = new Set(value.routeClaims.flatMap((claim) => [...claim.pathTemplate.matchAll(/:([A-Za-z][A-Za-z0-9_-]*)/g)].map((match) => match[1])));
+        for (const source of [
+            ...Object.values(transition.pathParameters),
+            ...Object.values(transition.query.set),
+        ]) {
+            if (source.kind === "route-parameter" &&
+                !declaredRouteParameters.has(source.name)) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["entryTransitions", transitionIndex],
+                    message: `Entry transition references unknown source route parameter ${source.name}.`,
+                });
+            }
+        }
+        const stateSources = [
+            ...Object.values(transition.pathParameters).flatMap((source) => source.kind === "page-state" ? [source.stateId] : []),
+            ...Object.values(transition.query.set).flatMap((source) => source.kind === "page-state" ? [source.stateId] : []),
+        ];
+        stateSources.forEach((stateId) => {
+            if (!stateIds.has(stateId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["entryTransitions", transitionIndex],
+                    message: `Entry transition references unknown Page state ${stateId}.`,
+                });
+            }
+        });
+    });
+    const validatePageStateSources = (sources, path) => {
+        Object.entries(sources).forEach(([name, source]) => {
+            if (source.kind === "expression") {
+                for (const read of (0, page_expression_1.collectPageExpressionReads)(source.expression)) {
+                    if ((read.root === "state" &&
+                        (!read.path[0] || !stateIds.has(read.path[0]))) ||
+                        read.root === "model" ||
+                        read.root === "bindings" ||
+                        (read.root === "result" && path[0] !== "interactionBindings")) {
+                        context.addIssue({
+                            code: "custom",
+                            path: [...path, name, "expression"],
+                            message: "Expression references unavailable context or an undeclared Page state.",
+                        });
+                    }
+                }
+            }
+            if (source.kind === "page-state" && !stateIds.has(source.stateId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [...path, name, "stateId"],
+                    message: `Unknown Page state: ${source.stateId}`,
+                });
+            }
+        });
+    };
+    interactionBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.source.capabilityInstanceId)) {
+            context.addIssue({
+                code: "custom",
+                path: [
+                    "interactionBindings",
+                    index,
+                    "source",
+                    "capabilityInstanceId",
+                ],
+                message: "Interaction binding sources an unknown capability instance.",
+            });
+        }
+        if (!stateIds.has(binding.targetStateId)) {
+            context.addIssue({
+                code: "custom",
+                path: ["interactionBindings", index, "targetStateId"],
+                message: "Interaction binding targets an unknown Page state.",
+            });
+        }
+        validatePageStateSources(binding.inputMapping, [
+            "interactionBindings",
+            index,
+            "inputMapping",
+        ]);
+        if (Object.values(binding.inputMapping).some((source) => source.kind === "result-field" ||
+            (source.kind === "expression" &&
+                (0, page_expression_1.collectPageExpressionReads)(source.expression).some((read) => read.root === "result")))) {
+            const action = value.actionBindings.find((candidate) => candidate.source.capabilityInstanceId ===
+                binding.source.capabilityInstanceId &&
+                candidate.source.port === binding.source.port);
+            if (!action) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["interactionBindings", index, "source"],
+                    message: "Result-field interactions must source one declared Action binding.",
+                });
+            }
+            else if (!binding.sourceResultSchemaRevisionRef ||
+                !exactRevisionRef(binding.sourceResultSchemaRevisionRef, action.resultSchemaRevisionRef)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "interactionBindings",
+                        index,
+                        "sourceResultSchemaRevisionRef",
+                    ],
+                    message: "Interaction result schema must exactly match the sourced Action result schema.",
+                });
+            }
+        }
+    });
+    value.capabilityInstances.forEach((instance, index) => {
+        const paths = [];
+        instance.propertyBindings?.forEach((binding, bindingIndex) => {
+            const path = [
+                "capabilityInstances",
+                index,
+                "propertyBindings",
+                bindingIndex,
+            ];
+            if (instance.capabilityRevisionRef.id.startsWith("monkeys.design.component.")) {
+                const [group, member, field] = binding.targetPath;
+                const messages = instance.properties.messages;
+                const message = messages && typeof messages === "object" && !Array.isArray(messages)
+                    ? messages[member]
+                    : undefined;
+                const declaredMessage = message && typeof message === "object" && !Array.isArray(message);
+                const allowed = (group === "props" && binding.targetPath.length >= 2) ||
+                    (group === "messages" &&
+                        declaredMessage &&
+                        ((field === "values" && binding.targetPath.length >= 3) ||
+                            (binding.targetPath.length === 3 &&
+                                (field === "key" || field === "textI18n") &&
+                                Object.prototype.hasOwnProperty.call(message, field))));
+                if (!allowed)
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, "targetPath"],
+                        message: "Component expressions can update property values or declared message fields, never executable wiring.",
+                    });
+            }
+            if (paths.some((previous) => previous
+                .slice(0, Math.min(previous.length, binding.targetPath.length))
+                .every((key, i) => key === binding.targetPath[i]))) {
+                context.addIssue({
+                    code: "custom",
+                    path: [...path, "targetPath"],
+                    message: "Dynamic property targets must not overlap.",
+                });
+            }
+            paths.push(binding.targetPath);
+            (0, page_expression_1.visitPageExpression)(binding.expression, (expression) => {
+                if (expression.kind !== "read")
+                    return;
+                if (expression.root === "state" &&
+                    (!expression.path[0] || !stateIds.has(expression.path[0]))) {
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, "expression"],
+                        message: "Property expressions must reference a declared Page state.",
+                    });
+                }
+                if (expression.root === "bindings" &&
+                    ![...value.ontologyBindings, ...queryBindings].some((candidate) => candidate.bindingId === expression.path[0])) {
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, "expression"],
+                        message: "Property expressions must reference a declared Page query binding.",
+                    });
+                }
+                if (expression.root === "actions" &&
+                    (expression.path.length !== 2 ||
+                        !actionOwners.has(expression.path[0]) ||
+                        !["pending", "errorCode"].includes(expression.path[1]))) {
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, "expression"],
+                        message: "Property expressions may read only pending or errorCode from a declared Action binding.",
+                    });
+                }
+                if (expression.root === "intent" || expression.root === "result") {
+                    context.addIssue({
+                        code: "custom",
+                        path: [...path, "expression"],
+                        message: "Property expressions cannot read transient event or Action results.",
+                    });
+                }
+            });
+        });
+        if (!instance.activationWhen)
+            return;
+        forEachPageStateCondition(instance.activationWhen, (condition, conditionPath) => {
+            if (!stateIds.has(condition.stateId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "capabilityInstances",
+                        index,
+                        "activationWhen",
+                        ...conditionPath,
+                        "stateId",
+                    ],
+                    message: "Capability activation condition references an unknown Page state.",
+                });
+            }
+        });
     });
-    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
     value.ontologyBindings.forEach((binding, index) => {
         if (!instanceIds.has(binding.target.capabilityInstanceId)) {
-            context.addIssue({ code: 'custom', path: ['ontologyBindings', index, 'target', 'capabilityInstanceId'], message: 'Ontology binding targets an unknown capability instance.' });
+            context.addIssue({
+                code: "custom",
+                path: ["ontologyBindings", index, "target", "capabilityInstanceId"],
+                message: "Ontology binding targets an unknown capability instance.",
+            });
+        }
+        validatePageStateSources(binding.parameters, [
+            "ontologyBindings",
+            index,
+            "parameters",
+        ]);
+    });
+    queryBindings.forEach((binding, index) => {
+        if (!instanceIds.has(binding.target.capabilityInstanceId)) {
+            context.addIssue({
+                code: "custom",
+                path: ["queryBindings", index, "target", "capabilityInstanceId"],
+                message: "Query binding targets an unknown capability instance.",
+            });
+        }
+        validatePageStateSources(binding.parameters, [
+            "queryBindings",
+            index,
+            "parameters",
+        ]);
+        if (binding.queryWhen) {
+            forEachPageStateCondition(binding.queryWhen, (condition, conditionPath) => {
+                if (!stateIds.has(condition.stateId)) {
+                    context.addIssue({
+                        code: "custom",
+                        path: [
+                            "queryBindings",
+                            index,
+                            "queryWhen",
+                            ...conditionPath,
+                            "stateId",
+                        ],
+                        message: "Query activation condition references an unknown Page state.",
+                    });
+                }
+            });
+        }
+        if (binding.refreshPolicy?.when) {
+            const path = ["queryBindings", index, "refreshPolicy", "when"];
+            const reads = (0, page_expression_1.collectExternalPageExpressionReads)(binding.refreshPolicy.when);
+            checkScopedReads(reads, scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)), path);
+            for (const read of reads)
+                if (read.root === "actions" && !actionScopes.has(read.path[0]))
+                    context.addIssue({
+                        code: "custom",
+                        path,
+                        message: "Automatic refresh condition references an unknown action binding.",
+                    });
+        }
+        const effectOwners = new Set(binding.stateEffects?.map((effect) => stateDefinitions.find((definition) => definition.stateId === effect.targetStateId)?.scopeNodeId ?? "") ?? []);
+        if (effectOwners.size > 1)
+            context.addIssue({
+                code: "custom",
+                path: ["queryBindings", index, "stateEffects"],
+                message: "A query completion must update a single state owner atomically.",
+            });
+        binding.stateEffects?.forEach((effect, effectIndex) => {
+            const path = ["queryBindings", index, "stateEffects", effectIndex];
+            const state = stateDefinitions.find((definition) => definition.stateId === effect.targetStateId);
+            const scopes = scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId));
+            if (!state || (state.scopeNodeId && !scopes.has(state.scopeNodeId)))
+                context.addIssue({
+                    code: "custom",
+                    path: [...path, "targetStateId"],
+                    message: "A query effect must target declared state in its own scope or an ancestor.",
+                });
+            for (const expression of [
+                effect.value,
+                ...(effect.when ? [effect.when] : []),
+            ]) {
+                const reads = (0, page_expression_1.collectPageExpressionReads)(expression);
+                checkScopedReads(reads, state?.scopeNodeId ? scopesForNode(state.scopeNodeId) : new Set(), path);
+                for (const read of reads)
+                    if (read.root === "state" && !stateIds.has(read.path[0]))
+                        context.addIssue({
+                            code: "custom",
+                            path,
+                            message: "Query effect references an unknown Page state.",
+                        });
+            }
+        });
+        binding.resultStateBindings?.forEach((resultBinding, resultIndex) => {
+            const stateDefinition = stateDefinitions.find((definition) => definition.stateId === resultBinding.targetStateId);
+            if (!stateDefinition) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "queryBindings",
+                        index,
+                        "resultStateBindings",
+                        resultIndex,
+                        "targetStateId",
+                    ],
+                    message: "Query result binding targets an unknown Page state.",
+                });
+                return;
+            }
+            if (!exactRevisionRef(resultBinding.targetStateSchemaRevisionRef, stateDefinition.schemaRevisionRef)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "queryBindings",
+                        index,
+                        "resultStateBindings",
+                        resultIndex,
+                        "targetStateSchemaRevisionRef",
+                    ],
+                    message: "Query result binding must pin the exact target Page-state schema revision.",
+                });
+            }
+            if (stateDefinition.persistence !== "none") {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "queryBindings",
+                        index,
+                        "resultStateBindings",
+                        resultIndex,
+                        "targetStateId",
+                    ],
+                    message: "Query result state projections must target non-persistent Page state.",
+                });
+            }
+        });
+    });
+    const dependencyBindings = [...value.ontologyBindings, ...queryBindings];
+    (0, page_binding_dependencies_1.analyzePageBindingDependencies)(dependencyBindings).errors.forEach((error) => {
+        const ontologyIndex = value.ontologyBindings.findIndex((binding) => binding.bindingId === error.bindingId);
+        const collection = ontologyIndex >= 0 ? "ontologyBindings" : "queryBindings";
+        const index = ontologyIndex >= 0
+            ? ontologyIndex
+            : queryBindings.findIndex((binding) => binding.bindingId === error.bindingId);
+        context.addIssue({
+            code: "custom",
+            path: [collection, index, "parameters"],
+            message: `Page binding dependency ${error.code}: ${error.dependencyId ?? error.bindingId}`,
+        });
+    });
+    const projectedQueryStateIds = new Set();
+    queryBindings.forEach((binding, index) => {
+        binding.resultStateBindings?.forEach((resultBinding, resultIndex) => {
+            if (projectedQueryStateIds.has(resultBinding.targetStateId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "queryBindings",
+                        index,
+                        "resultStateBindings",
+                        resultIndex,
+                        "targetStateId",
+                    ],
+                    message: "One Page state can have only one Server Query result owner.",
+                });
+            }
+            projectedQueryStateIds.add(resultBinding.targetStateId);
+        });
+    });
+    queryBindings.forEach((binding, index) => {
+        if (binding.execution !== "server")
+            return;
+        const readStateIds = new Set(Object.values(binding.parameters).flatMap((source) => source.kind === "page-state" ? [source.stateId] : []));
+        if (binding.queryWhen) {
+            forEachPageStateCondition(binding.queryWhen, (condition) => readStateIds.add(condition.stateId));
+        }
+        const feedbackStateId = [...readStateIds].find((stateId) => projectedQueryStateIds.has(stateId));
+        if (feedbackStateId) {
+            context.addIssue({
+                code: "custom",
+                path: ["queryBindings", index],
+                message: `Server Query bindings cannot read projected Query result state: ${feedbackStateId}`,
+            });
+        }
+    });
+    const cursorWindowBindings = [
+        ...value.ontologyBindings.map((binding, index) => ({
+            binding,
+            index,
+            collection: "ontologyBindings",
+        })),
+        ...queryBindings.map((binding, index) => ({
+            binding,
+            index,
+            collection: "queryBindings",
+        })),
+    ].filter((candidate) => candidate.binding.cursorWindow !== undefined);
+    const cursorWindowSources = new Set();
+    cursorWindowBindings.forEach(({ binding, index, collection }) => {
+        const sourceId = binding.cursorWindow.sourceCapabilityInstanceId ??
+            binding.target.capabilityInstanceId;
+        if (!instanceIds.has(sourceId))
+            context.addIssue({
+                code: "custom",
+                path: [
+                    collection,
+                    index,
+                    "cursorWindow",
+                    "sourceCapabilityInstanceId",
+                ],
+                message: "Cursor-window source must reference a declared capability instance.",
+            });
+        const sourceScopes = [...scopesForNode(instanceNodes.get(sourceId))];
+        const targetScopes = [
+            ...scopesForNode(instanceNodes.get(binding.target.capabilityInstanceId)),
+        ];
+        if (sourceScopes.length !== targetScopes.length ||
+            sourceScopes.some((id, index) => id !== targetScopes[index]))
+            context.addIssue({
+                code: "custom",
+                path: [
+                    collection,
+                    index,
+                    "cursorWindow",
+                    "sourceCapabilityInstanceId",
+                ],
+                message: "Cursor-window source and query target must share the same repeated scope.",
+            });
+        const sourceKey = `${sourceId}:${binding.cursorWindow.pageChangePort}`;
+        if (cursorWindowSources.has(sourceKey)) {
+            context.addIssue({
+                code: "custom",
+                path: [collection, index, "cursorWindow", "pageChangePort"],
+                message: "A capability output port can govern at most one cursor-window binding.",
+            });
+        }
+        cursorWindowSources.add(sourceKey);
+        const conflictingInteraction = interactionBindings.some((candidate) => candidate.source.capabilityInstanceId === sourceId &&
+            candidate.source.port === binding.cursorWindow.pageChangePort);
+        const conflictingAction = value.actionBindings.some((candidate) => candidate.source.capabilityInstanceId === sourceId &&
+            candidate.source.port === binding.cursorWindow.pageChangePort);
+        if (conflictingInteraction || conflictingAction) {
+            context.addIssue({
+                code: "custom",
+                path: [collection, index, "cursorWindow", "pageChangePort"],
+                message: "Cursor-window page-change ports cannot also drive Page state or Domain Actions.",
+            });
         }
     });
     value.actionBindings.forEach((binding, index) => {
         if (!instanceIds.has(binding.source.capabilityInstanceId)) {
-            context.addIssue({ code: 'custom', path: ['actionBindings', index, 'source', 'capabilityInstanceId'], message: 'Action binding sources an unknown capability instance.' });
+            context.addIssue({
+                code: "custom",
+                path: ["actionBindings", index, "source", "capabilityInstanceId"],
+                message: "Action binding sources an unknown capability instance.",
+            });
         }
+        validatePageStateSources(binding.inputMapping, [
+            "actionBindings",
+            index,
+            "inputMapping",
+        ]);
         binding.success.refreshBindingIds.forEach((bindingId) => {
-            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === bindingId)) {
-                context.addIssue({ code: 'custom', path: ['actionBindings', index, 'success', 'refreshBindingIds'], message: `Unknown refresh binding: ${bindingId}` });
+            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === bindingId) &&
+                !queryBindings.some((candidate) => candidate.bindingId === bindingId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: ["actionBindings", index, "success", "refreshBindingIds"],
+                    message: `Unknown refresh binding: ${bindingId}`,
+                });
             }
         });
+        const effectBindingIds = binding.success.resultBindingEffects?.map((effect) => effect.bindingId) ?? [];
+        if (new Set(effectBindingIds).size !== effectBindingIds.length) {
+            context.addIssue({
+                code: "custom",
+                path: ["actionBindings", index, "success", "resultBindingEffects"],
+                message: "An Action can declare at most one result effect for each target binding.",
+            });
+        }
+        binding.success.resultBindingEffects?.forEach((effect, effectIndex) => {
+            if (!value.ontologyBindings.some((candidate) => candidate.bindingId === effect.bindingId) &&
+                !queryBindings.some((candidate) => candidate.bindingId === effect.bindingId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "actionBindings",
+                        index,
+                        "success",
+                        "resultBindingEffects",
+                        effectIndex,
+                        "bindingId",
+                    ],
+                    message: `Unknown result effect binding: ${effect.bindingId}`,
+                });
+            }
+            if (binding.success.refreshBindingIds.includes(effect.bindingId)) {
+                context.addIssue({
+                    code: "custom",
+                    path: [
+                        "actionBindings",
+                        index,
+                        "success",
+                        "resultBindingEffects",
+                        effectIndex,
+                        "bindingId",
+                    ],
+                    message: "A result-projected binding cannot also be refreshed by the same Action.",
+                });
+            }
+        });
+        if (binding.success.clipboard) {
+            const sourceInstance = value.capabilityInstances.find((instance) => instance.instanceId === binding.source.capabilityInstanceId);
+            if (!sourceInstance?.allowedSideEffects.includes("clipboard"))
+                context.addIssue({
+                    code: "custom",
+                    path: ["actionBindings", index, "success", "clipboard"],
+                    message: "An Action result clipboard effect requires clipboard permission on its source capability instance.",
+                });
+        }
     });
-    if (value.shellRevisionRef.kind !== 'shell')
-        context.addIssue({ code: 'custom', path: ['shellRevisionRef', 'kind'], message: 'Page shellRevisionRef must reference a shell.' });
+    if (value.shellRevisionRef.kind !== "shell")
+        context.addIssue({
+            code: "custom",
+            path: ["shellRevisionRef", "kind"],
+            message: "Page shellRevisionRef must reference a shell.",
+        });
     value.capabilityInstances.forEach((instance, index) => {
+        if (instance.accessPolicy) {
+            [
+                ...instance.accessPolicy.groupAllOf,
+                ...instance.accessPolicy.groupAnyOf,
+                ...instance.accessPolicy.conditionAllOf,
+            ].forEach((reference, refIndex) => validateTenantCompatibleReference(reference, value.tenantScope, ["capabilityInstances", index, "accessPolicy", refIndex], context));
+        }
         const refs = [
-            ['capabilityRevisionRef', instance.capabilityRevisionRef, 'capability'],
-            ['providerRevisionRef', instance.providerRevisionRef, 'view-provider'],
-            ['propertySchemaRevisionRef', instance.propertySchemaRevisionRef, 'schema'],
+            ["capabilityRevisionRef", instance.capabilityRevisionRef, "capability"],
+            ["providerRevisionRef", instance.providerRevisionRef, "view-provider"],
+            [
+                "propertySchemaRevisionRef",
+                instance.propertySchemaRevisionRef,
+                "schema",
+            ],
         ];
         refs.forEach(([field, reference, expectedKind]) => {
             if (reference.kind !== expectedKind)
-                context.addIssue({ code: 'custom', path: ['capabilityInstances', index, field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+                context.addIssue({
+                    code: "custom",
+                    path: ["capabilityInstances", index, field, "kind"],
+                    message: `${field} must reference ${expectedKind}.`,
+                });
         });
     });
     value.tokenRevisionRefs.forEach((reference, index) => {
-        if (reference.kind !== 'design-token')
-            context.addIssue({ code: 'custom', path: ['tokenRevisionRefs', index, 'kind'], message: 'Page token references must use kind design-token.' });
+        if (reference.kind !== "design-token")
+            context.addIssue({
+                code: "custom",
+                path: ["tokenRevisionRefs", index, "kind"],
+                message: "Page token references must use kind design-token.",
+            });
     });
-    if (value.performanceBudgetRef.kind !== 'performance-budget')
-        context.addIssue({ code: 'custom', path: ['performanceBudgetRef', 'kind'], message: 'Page requires a performance-budget revision.' });
-    if (value.observationPolicyRevisionRef.kind !== 'observation-policy')
-        context.addIssue({ code: 'custom', path: ['observationPolicyRevisionRef', 'kind'], message: 'Page requires an observation-policy revision.' });
+    if (value.performanceBudgetRef.kind !== "performance-budget")
+        context.addIssue({
+            code: "custom",
+            path: ["performanceBudgetRef", "kind"],
+            message: "Page requires a performance-budget revision.",
+        });
+    if (value.observationPolicyRevisionRef.kind !== "observation-policy")
+        context.addIssue({
+            code: "custom",
+            path: ["observationPolicyRevisionRef", "kind"],
+            message: "Page requires an observation-policy revision.",
+        });
 });
 exports.PageReleaseSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('PageRelease'),
+    contract: zod_1.z.literal("PageRelease"),
     ...ReleaseBaseShape,
     pageRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         routeSpaceRevisionRef: exports.RevisionRefSchema,
         normalizedPath: exports.RoutePathTemplateSchema,
-        routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
-    }).strict(),
+        routeClaim: zod_1.z.union([
+            exports.CompiledRouteClaimSchema,
+            LegacyCompiledRouteClaimSchema,
+        ]),
+        legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, "legacy-route-adapter", context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'page-release', context);
-    if (value.pageRevisionRef.kind !== 'page')
-        context.addIssue({ code: 'custom', path: ['pageRevisionRef', 'kind'], message: 'Expected a page revision.' });
-    if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Page release target requires an environment reference.' });
-    if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
-        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Page release target requires a route-space revision.' });
-    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Page Release route authority must pin the exact compiled claim and normalized path.' });
-    }
-    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Page Release route claim must match the target surface.' });
+    validateReleaseGovernanceScope(value, "page-release", context);
+    if (value.pageRevisionRef.kind !== "page")
+        context.addIssue({
+            code: "custom",
+            path: ["pageRevisionRef", "kind"],
+            message: "Expected a page revision.",
+        });
+    if (value.target.environmentRef.kind !== "environment")
+        context.addIssue({
+            code: "custom",
+            path: ["target", "environmentRef", "kind"],
+            message: "Page release target requires an environment reference.",
+        });
+    if (value.target.routeSpaceRevisionRef.kind !== "route-space")
+        context.addIssue({
+            code: "custom",
+            path: ["target", "routeSpaceRevisionRef", "kind"],
+            message: "Page release target requires a route-space revision.",
+        });
+    validateReleaseRouteSurface(value.target, context);
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath ||
+        !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({
+            code: "custom",
+            path: ["target", "routeClaim"],
+            message: "Page Release route authority must pin the exact compiled claim and normalized path.",
+        });
+    }
+    const takeover = value.target.legacyRouteTakeoverAuthorization;
+    if (takeover &&
+        (value.target.routeClaim.kind !== "canonical" ||
+            takeover.normalizedPath !== value.target.normalizedPath ||
+            !exactRevisionRef(takeover.routeSpaceRevisionRef, value.target.routeSpaceRevisionRef) ||
+            takeover.targetResourceRef.kind !== "page" ||
+            takeover.targetResourceRef.id !== value.pageRevisionRef.id ||
+            takeover.targetResourceRef.ownerRepo !==
+                value.pageRevisionRef.ownerRepo)) {
+        context.addIssue({
+            code: "custom",
+            path: ["target", "legacyRouteTakeoverAuthorization"],
+            message: "A Page route takeover must bind the exact canonical claim, RouteSpace and target Page.",
+        });
     }
 });
 exports.WorkbenchGroupSchema = zod_1.z
@@ -678,130 +3556,253 @@ exports.WorkbenchGroupSchema = zod_1.z
 exports.WorkbenchAppInstanceSchema = zod_1.z
     .object({
     instanceId: common_1.ContractIdentifierSchema,
-    kind: zod_1.z.enum(['built-in-application', 'workflow-form', 'workflow', 'agent', 'design', 'capability']),
+    kind: zod_1.z.enum([
+        "built-in-application",
+        "workflow-form",
+        "workflow",
+        "agent",
+        "design",
+        "capability",
+    ]),
     targetRevisionRef: exports.RevisionRefSchema,
     providerRevisionRef: exports.RevisionRefSchema,
     inputSchemaRevisionRef: exports.RevisionRefSchema,
     input: common_1.JsonObjectSchema,
     groupId: common_1.ContractIdentifierSchema,
     order: zod_1.z.number().int(),
-    display: zod_1.z.object({ name: exports.I18nTextSchema.optional(), iconRef: exports.StableRefSchema.optional() }).strict(),
+    display: zod_1.z
+        .object({
+        name: exports.I18nTextSchema.optional(),
+        iconRef: exports.StableRefSchema.optional(),
+    })
+        .strict(),
     accessPolicy: exports.AccessPolicySchema,
 })
     .strict();
 exports.WorkbenchSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('Workbench'),
+    contract: zod_1.z.literal("Workbench"),
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     workbenchId: common_1.ContractIdentifierSchema,
     tenantScope: exports.TenantScopeSchema,
-    purpose: zod_1.z.enum(['instance', 'template']),
+    purpose: zod_1.z.enum(["instance", "template"]),
     sourceTemplateRevisionRef: exports.RevisionRefSchema.optional(),
     identity: exports.WorkbenchIdentitySchema,
     supportedSurfaces: zod_1.z.array(exports.ProductSurfaceSchema).min(1),
     lifecycle: exports.DeclarativeLifecycleSchema,
-    routeClaims: zod_1.z.array(zod_1.z.union([exports.DeclarativeRouteClaimSchema, LegacyDeclarativeRouteClaimSchema])).min(1),
+    routeClaims: zod_1.z
+        .array(zod_1.z.union([
+        exports.DeclarativeRouteClaimSchema,
+        LegacyDeclarativeRouteClaimSchema,
+    ]))
+        .min(1),
     groups: zod_1.z.array(exports.WorkbenchGroupSchema).min(1),
     appInstances: zod_1.z.array(exports.WorkbenchAppInstanceSchema).min(1),
-    defaultEntry: zod_1.z.object({ groupId: common_1.ContractIdentifierSchema, instanceId: common_1.ContractIdentifierSchema, showDefaultGroup: zod_1.z.boolean() }).strict(),
-    layout: zod_1.z.object({
+    defaultEntry: zod_1.z
+        .object({
+        groupId: common_1.ContractIdentifierSchema,
+        instanceId: common_1.ContractIdentifierSchema,
+        showDefaultGroup: zod_1.z.boolean(),
+    })
+        .strict(),
+    layout: zod_1.z
+        .object({
         hostCapabilityRevisionRef: exports.RevisionRefSchema,
         hostProviderRevisionRef: exports.RevisionRefSchema,
         layoutPolicyRevisionRef: exports.RevisionRefSchema,
         tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema).min(1),
-    }).strict(),
+    })
+        .strict(),
     workbenchAccessPolicy: exports.AccessPolicySchema,
     managementAccess: exports.ManagementAccessSchema,
-    personalPreferencesPolicy: zod_1.z.object({
-        allowed: zod_1.z.array(zod_1.z.enum(['collapsed-groups', 'recent-entry', 'layout-density'])),
-        authority: zod_1.z.literal('identity-overlay'),
-    }).strict(),
+    personalPreferencesPolicy: zod_1.z
+        .object({
+        allowed: zod_1.z.array(zod_1.z.enum(["collapsed-groups", "recent-entry", "layout-density"])),
+        authority: zod_1.z.literal("identity-overlay"),
+    })
+        .strict(),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
-    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
+    privacyClassification: zod_1.z.enum([
+        "public",
+        "internal",
+        "confidential",
+        "restricted",
+    ]),
 })
     .strict()
     .superRefine((value, context) => {
     validateDeclaredRouteSurfaces(value.supportedSurfaces, value.routeClaims, context);
-    if (value.purpose === 'template' && value.sourceTemplateRevisionRef) {
-        context.addIssue({ code: 'custom', path: ['sourceTemplateRevisionRef'], message: 'Templates cannot derive from another template at runtime.' });
+    if (value.purpose === "template" && value.sourceTemplateRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["sourceTemplateRevisionRef"],
+            message: "Templates cannot derive from another template at runtime.",
+        });
     }
     const duplicateGroup = uniqueArray(value.groups, (group) => group.groupId);
     if (duplicateGroup)
-        context.addIssue({ code: 'custom', path: ['groups'], message: `Duplicate Workbench group: ${duplicateGroup}` });
+        context.addIssue({
+            code: "custom",
+            path: ["groups"],
+            message: `Duplicate Workbench group: ${duplicateGroup}`,
+        });
     const duplicateInstance = uniqueArray(value.appInstances, (instance) => instance.instanceId);
     if (duplicateInstance)
-        context.addIssue({ code: 'custom', path: ['appInstances'], message: `Duplicate Workbench instance: ${duplicateInstance}` });
+        context.addIssue({
+            code: "custom",
+            path: ["appInstances"],
+            message: `Duplicate Workbench instance: ${duplicateInstance}`,
+        });
     const groupIds = new Set(value.groups.map((group) => group.groupId));
     value.appInstances.forEach((instance, index) => {
         if (!groupIds.has(instance.groupId))
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'groupId'], message: 'Workbench app references an unknown group.' });
+            context.addIssue({
+                code: "custom",
+                path: ["appInstances", index, "groupId"],
+                message: "Workbench app references an unknown group.",
+            });
     });
     const defaultInstance = value.appInstances.find((instance) => instance.instanceId === value.defaultEntry.instanceId);
-    if (!defaultInstance || defaultInstance.groupId !== value.defaultEntry.groupId) {
-        context.addIssue({ code: 'custom', path: ['defaultEntry'], message: 'Workbench default entry must reference an app in the declared group.' });
+    if (!defaultInstance ||
+        defaultInstance.groupId !== value.defaultEntry.groupId) {
+        context.addIssue({
+            code: "custom",
+            path: ["defaultEntry"],
+            message: "Workbench default entry must reference an app in the declared group.",
+        });
     }
     const targetKindByInstanceKind = {
-        'built-in-application': 'built-in-application',
-        'workflow-form': 'workflow',
-        workflow: 'workflow',
-        agent: 'agent',
-        design: 'design',
-        capability: 'capability',
+        "built-in-application": "built-in-application",
+        "workflow-form": "workflow",
+        workflow: "workflow",
+        agent: "agent",
+        design: "design",
+        capability: "capability",
     };
     value.appInstances.forEach((instance, index) => {
-        if (instance.targetRevisionRef.kind !== targetKindByInstanceKind[instance.kind])
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'targetRevisionRef', 'kind'], message: `Workbench ${instance.kind} target has an incompatible reference kind.` });
-        if (instance.providerRevisionRef.kind !== 'view-provider')
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'providerRevisionRef', 'kind'], message: 'Workbench app provider must use kind view-provider.' });
-        if (instance.inputSchemaRevisionRef.kind !== 'schema')
-            context.addIssue({ code: 'custom', path: ['appInstances', index, 'inputSchemaRevisionRef', 'kind'], message: 'Workbench app input must pin a schema revision.' });
+        if (instance.targetRevisionRef.kind !==
+            targetKindByInstanceKind[instance.kind])
+            context.addIssue({
+                code: "custom",
+                path: ["appInstances", index, "targetRevisionRef", "kind"],
+                message: `Workbench ${instance.kind} target has an incompatible reference kind.`,
+            });
+        if (instance.providerRevisionRef.kind !== "view-provider")
+            context.addIssue({
+                code: "custom",
+                path: ["appInstances", index, "providerRevisionRef", "kind"],
+                message: "Workbench app provider must use kind view-provider.",
+            });
+        if (instance.inputSchemaRevisionRef.kind !== "schema")
+            context.addIssue({
+                code: "custom",
+                path: ["appInstances", index, "inputSchemaRevisionRef", "kind"],
+                message: "Workbench app input must pin a schema revision.",
+            });
     });
     const layoutRefs = [
-        ['hostCapabilityRevisionRef', value.layout.hostCapabilityRevisionRef, 'capability'],
-        ['hostProviderRevisionRef', value.layout.hostProviderRevisionRef, 'view-provider'],
-        ['layoutPolicyRevisionRef', value.layout.layoutPolicyRevisionRef, 'layout-policy'],
+        [
+            "hostCapabilityRevisionRef",
+            value.layout.hostCapabilityRevisionRef,
+            "capability",
+        ],
+        [
+            "hostProviderRevisionRef",
+            value.layout.hostProviderRevisionRef,
+            "view-provider",
+        ],
+        [
+            "layoutPolicyRevisionRef",
+            value.layout.layoutPolicyRevisionRef,
+            "layout-policy",
+        ],
     ];
     layoutRefs.forEach(([field, reference, expectedKind]) => {
         if (reference.kind !== expectedKind)
-            context.addIssue({ code: 'custom', path: ['layout', field, 'kind'], message: `${field} must reference ${expectedKind}.` });
+            context.addIssue({
+                code: "custom",
+                path: ["layout", field, "kind"],
+                message: `${field} must reference ${expectedKind}.`,
+            });
     });
     value.layout.tokenRevisionRefs.forEach((reference, index) => {
-        if (reference.kind !== 'design-token')
-            context.addIssue({ code: 'custom', path: ['layout', 'tokenRevisionRefs', index, 'kind'], message: 'Workbench token references must use kind design-token.' });
+        if (reference.kind !== "design-token")
+            context.addIssue({
+                code: "custom",
+                path: ["layout", "tokenRevisionRefs", index, "kind"],
+                message: "Workbench token references must use kind design-token.",
+            });
     });
 });
 exports.WorkbenchReleaseSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('WorkbenchRelease'),
+    contract: zod_1.z.literal("WorkbenchRelease"),
     ...ReleaseBaseShape,
     workbenchRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         workbenchId: common_1.ContractIdentifierSchema,
         routeSpaceRevisionRef: exports.RevisionRefSchema,
         normalizedPath: exports.RoutePathTemplateSchema,
-        routeClaim: zod_1.z.union([exports.CompiledRouteClaimSchema, LegacyCompiledRouteClaimSchema]),
+        routeClaim: zod_1.z.union([
+            exports.CompiledRouteClaimSchema,
+            LegacyCompiledRouteClaimSchema,
+        ]),
+        legacyRouteTakeoverAuthorization: exports.LegacyRouteTakeoverAuthorizationSchema.optional(),
         order: zod_1.z.number().int(),
         isDefaultCandidate: zod_1.z.boolean(),
-    }).strict(),
+    })
+        .strict(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, "legacy-workbench-adapter", context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'workbench-release', context);
-    if (value.workbenchRevisionRef.kind !== 'workbench')
-        context.addIssue({ code: 'custom', path: ['workbenchRevisionRef', 'kind'], message: 'Expected a workbench revision.' });
-    if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Workbench release target requires an environment reference.' });
-    if (value.target.routeSpaceRevisionRef.kind !== 'route-space')
-        context.addIssue({ code: 'custom', path: ['target', 'routeSpaceRevisionRef', 'kind'], message: 'Workbench release target requires a route-space revision.' });
-    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath || !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim'], message: 'Workbench Release route authority must pin the exact compiled claim and normalized path.' });
-    }
-    if ('surface' in value.target.routeClaim && value.target.routeClaim.surface !== value.target.surface) {
-        context.addIssue({ code: 'custom', path: ['target', 'routeClaim', 'surface'], message: 'Workbench Release route claim must match the target surface.' });
+    validateReleaseGovernanceScope(value, "workbench-release", context);
+    if (value.workbenchRevisionRef.kind !== "workbench")
+        context.addIssue({
+            code: "custom",
+            path: ["workbenchRevisionRef", "kind"],
+            message: "Expected a workbench revision.",
+        });
+    if (value.target.environmentRef.kind !== "environment")
+        context.addIssue({
+            code: "custom",
+            path: ["target", "environmentRef", "kind"],
+            message: "Workbench release target requires an environment reference.",
+        });
+    if (value.target.routeSpaceRevisionRef.kind !== "route-space")
+        context.addIssue({
+            code: "custom",
+            path: ["target", "routeSpaceRevisionRef", "kind"],
+            message: "Workbench release target requires a route-space revision.",
+        });
+    validateReleaseRouteSurface(value.target, context);
+    if (value.target.normalizedPath !== value.target.routeClaim.normalizedPath ||
+        !exactRevisionRef(value.target.routeSpaceRevisionRef, value.target.routeClaim.routeSpaceRevisionRef)) {
+        context.addIssue({
+            code: "custom",
+            path: ["target", "routeClaim"],
+            message: "Workbench Release route authority must pin the exact compiled claim and normalized path.",
+        });
+    }
+    const takeover = value.target.legacyRouteTakeoverAuthorization;
+    if (takeover &&
+        (value.target.routeClaim.kind !== "canonical" ||
+            takeover.normalizedPath !== value.target.normalizedPath ||
+            !exactRevisionRef(takeover.routeSpaceRevisionRef, value.target.routeSpaceRevisionRef) ||
+            takeover.targetResourceRef.kind !== "workbench" ||
+            takeover.targetResourceRef.id !== value.workbenchRevisionRef.id ||
+            takeover.targetResourceRef.ownerRepo !==
+                value.workbenchRevisionRef.ownerRepo)) {
+        context.addIssue({
+            code: "custom",
+            path: ["target", "legacyRouteTakeoverAuthorization"],
+            message: "A Workbench route takeover must bind the exact canonical claim, RouteSpace and target Workbench.",
+        });
     }
 });
 const NavigationNodeBaseShape = {
@@ -810,29 +3811,35 @@ const NavigationNodeBaseShape = {
     order: zod_1.z.number().int(),
     disabled: zod_1.z.boolean().optional(),
 };
-exports.NavigationGroupNodeSchema = zod_1.z.object({
+exports.NavigationGroupNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
-    kind: zod_1.z.literal('group'),
+    kind: zod_1.z.literal("group"),
     label: exports.I18nTextSchema,
     iconRef: exports.StableRefSchema.optional(),
     collapsedByDefault: zod_1.z.boolean(),
     audience: exports.AccessPolicySchema,
-}).strict();
-exports.NavigationTargetNodeSchema = zod_1.z.object({
+})
+    .strict();
+exports.NavigationTargetNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
-    kind: zod_1.z.literal('target'),
+    kind: zod_1.z.literal("target"),
     label: exports.I18nTextSchema,
     iconRef: exports.StableRefSchema.optional(),
-    tone: zod_1.z.enum(['default', 'danger']).optional(),
+    tone: zod_1.z.enum(["default", "danger"]).optional(),
     targetRef: exports.StableRefSchema,
     parameterMapping: zod_1.z.record(common_1.ContractIdentifierSchema, exports.BindingSourceSchema),
     audience: exports.AccessPolicySchema,
-}).strict();
-exports.NavigationSeparatorNodeSchema = zod_1.z.object({
+})
+    .strict();
+exports.NavigationSeparatorNodeSchema = zod_1.z
+    .object({
     ...NavigationNodeBaseShape,
-    kind: zod_1.z.literal('separator'),
-}).strict();
-exports.NavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
+    kind: zod_1.z.literal("separator"),
+})
+    .strict();
+exports.NavigationNodeSchema = zod_1.z.discriminatedUnion("kind", [
     exports.NavigationGroupNodeSchema,
     exports.NavigationTargetNodeSchema,
     exports.NavigationSeparatorNodeSchema,
@@ -841,28 +3848,48 @@ const validateNavigationTree = (nodes, context) => {
     const byId = new Map();
     nodes.forEach((node, index) => {
         if (byId.has(node.nodeId))
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'nodeId'], message: `Duplicate Navigation node: ${node.nodeId}` });
+            context.addIssue({
+                code: "custom",
+                path: ["nodes", index, "nodeId"],
+                message: `Duplicate Navigation node: ${node.nodeId}`,
+            });
         else
             byId.set(node.nodeId, { node, index });
     });
     const siblingOrders = new Set();
     nodes.forEach((node, index) => {
-        const orderKey = `${node.parentNodeId ?? ''}:${node.order}`;
+        const orderKey = `${node.parentNodeId ?? ""}:${node.order}`;
         if (siblingOrders.has(orderKey))
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'order'], message: 'Sibling Navigation order values must be unique.' });
+            context.addIssue({
+                code: "custom",
+                path: ["nodes", index, "order"],
+                message: "Sibling Navigation order values must be unique.",
+            });
         siblingOrders.add(orderKey);
         if (node.parentNodeId) {
             const parent = byId.get(node.parentNodeId)?.node;
             if (!parent)
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation node has an unknown parent.' });
-            else if (parent.kind !== 'group')
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: 'Navigation parents must be groups.' });
+                context.addIssue({
+                    code: "custom",
+                    path: ["nodes", index, "parentNodeId"],
+                    message: "Navigation node has an unknown parent.",
+                });
+            else if (parent.kind !== "group")
+                context.addIssue({
+                    code: "custom",
+                    path: ["nodes", index, "parentNodeId"],
+                    message: "Navigation parents must be groups.",
+                });
         }
         const ancestors = new Set([node.nodeId]);
         let parentId = node.parentNodeId;
         while (parentId) {
             if (ancestors.has(parentId)) {
-                context.addIssue({ code: 'custom', path: ['nodes', index, 'parentNodeId'], message: `Navigation cycle contains ${node.nodeId}.` });
+                context.addIssue({
+                    code: "custom",
+                    path: ["nodes", index, "parentNodeId"],
+                    message: `Navigation cycle contains ${node.nodeId}.`,
+                });
                 break;
             }
             ancestors.add(parentId);
@@ -872,7 +3899,7 @@ const validateNavigationTree = (nodes, context) => {
 };
 exports.NavigationSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('Navigation'),
+    contract: zod_1.z.literal("Navigation"),
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     navigationId: common_1.ContractIdentifierSchema,
     tenantScope: exports.TenantScopeSchema,
@@ -889,8 +3916,13 @@ exports.NavigationSchema = zod_1.z
     .superRefine((value, context) => {
     validateNavigationTree(value.nodes, context);
     value.nodes.forEach((node, index) => {
-        if (node.kind === 'target' && !['page', 'workbench', 'menu-action', 'domain-command'].includes(node.targetRef.kind)) {
-            context.addIssue({ code: 'custom', path: ['nodes', index, 'targetRef', 'kind'], message: 'Navigation targets must reference Page, Workbench, registered Menu Action, or DomainCommand identities.' });
+        if (node.kind === "target" &&
+            !["page", "workbench", "menu-action", "domain-command"].includes(node.targetRef.kind)) {
+            context.addIssue({
+                code: "custom",
+                path: ["nodes", index, "targetRef", "kind"],
+                message: "Navigation targets must reference Page, Workbench, registered Menu Action, or DomainCommand identities.",
+            });
         }
     });
 });
@@ -903,45 +3935,68 @@ exports.ResolvedNavigationTargetSchema = zod_1.z
 })
     .strict();
 /** A reviewed missing Page reference is retained without inventing an executable revision. */
-exports.UnavailableNavigationTargetSchema = zod_1.z.object({
+exports.UnavailableNavigationTargetSchema = zod_1.z
+    .object({
     nodeId: common_1.ContractIdentifierSchema,
-    stableTargetRef: exports.StableRefSchema.refine((reference) => reference.kind === 'page', 'Only missing Pages can be isolated.'),
-    reason: zod_1.z.literal('page-missing'),
+    stableTargetRef: exports.StableRefSchema.refine((reference) => reference.kind === "page", "Only missing Pages can be isolated."),
+    reason: zod_1.z.literal("page-missing"),
     accessPolicy: exports.AccessPolicySchema.nullable(),
-}).strict();
+})
+    .strict();
 exports.NavigationReleaseSchema = zod_1.z
     .object({
-    contract: zod_1.z.literal('NavigationRelease'),
+    contract: zod_1.z.literal("NavigationRelease"),
     ...ReleaseBaseShape,
     navigationRevisionRef: exports.RevisionRefSchema,
-    target: zod_1.z.object({
+    target: zod_1.z
+        .object({
         environmentRef: exports.StableRefSchema,
         surface: exports.ProductSurfaceSchema,
         placement: common_1.ContractIdentifierSchema,
-    }).strict(),
+    })
+        .strict(),
     resolvedTargets: zod_1.z.array(exports.ResolvedNavigationTargetSchema),
     unavailableTargets: zod_1.z.array(exports.UnavailableNavigationTargetSchema).optional(),
 })
     .strict()
     .superRefine((value, context) => {
+    validateLegacyRestoration(value, "legacy-navigation-adapter", context);
     validateDependencySnapshot(value.dependencySnapshot, context);
-    validateReleaseExpectedHead(value, 'navigation-release', context);
-    if (value.navigationRevisionRef.kind !== 'navigation')
-        context.addIssue({ code: 'custom', path: ['navigationRevisionRef', 'kind'], message: 'Expected a navigation revision.' });
-    if (value.target.environmentRef.kind !== 'environment')
-        context.addIssue({ code: 'custom', path: ['target', 'environmentRef', 'kind'], message: 'Navigation release target requires an environment reference.' });
+    validateReleaseGovernanceScope(value, "navigation-release", context);
+    if (value.navigationRevisionRef.kind !== "navigation")
+        context.addIssue({
+            code: "custom",
+            path: ["navigationRevisionRef", "kind"],
+            message: "Expected a navigation revision.",
+        });
+    if (value.target.environmentRef.kind !== "environment")
+        context.addIssue({
+            code: "custom",
+            path: ["target", "environmentRef", "kind"],
+            message: "Navigation release target requires an environment reference.",
+        });
     if (uniqueArray(value.resolvedTargets, (target) => target.nodeId))
-        context.addIssue({ code: 'custom', path: ['resolvedTargets'], message: 'Resolved Navigation node IDs must be unique.' });
+        context.addIssue({
+            code: "custom",
+            path: ["resolvedTargets"],
+            message: "Resolved Navigation node IDs must be unique.",
+        });
     if (uniqueArray([...value.resolvedTargets, ...(value.unavailableTargets ?? [])], (target) => target.nodeId)) {
-        context.addIssue({ code: 'custom', path: ['unavailableTargets'], message: 'Navigation target resolutions must have unique node IDs.' });
+        context.addIssue({
+            code: "custom",
+            path: ["unavailableTargets"],
+            message: "Navigation target resolutions must have unique node IDs.",
+        });
     }
 });
-const RuntimeDiagnosticSchema = zod_1.z.object({
+const RuntimeDiagnosticSchema = zod_1.z
+    .object({
     code: common_1.ContractIdentifierSchema,
-    severity: zod_1.z.enum(['info', 'warning', 'error']),
+    severity: zod_1.z.enum(["info", "warning", "error"]),
     path: zod_1.z.string().trim().min(1),
     message: zod_1.z.string().trim().min(1),
-}).strict();
+})
+    .strict();
 const RuntimeBundleBaseShape = {
     schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
     tenantScope: exports.TenantScopeSchema,
@@ -953,57 +4008,344 @@ const RuntimeBundleBaseShape = {
     rebuildable: zod_1.z.literal(true),
     diagnostics: zod_1.z.array(RuntimeDiagnosticSchema),
 };
-exports.PageRuntimeBundleSchema = zod_1.z.object({
-    contract: zod_1.z.literal('PageRuntimeBundle'),
+const validateRuntimeBundleReference = (reference, tenantScope, path, expectedKind, expectedId, context) => {
+    if (reference.kind !== expectedKind) {
+        context.addIssue({
+            code: "custom",
+            path: [path, "kind"],
+            message: `${path} must reference ${expectedKind}.`,
+        });
+    }
+    if (expectedId !== undefined && reference.id !== expectedId) {
+        context.addIssue({
+            code: "custom",
+            path: [path, "id"],
+            message: `${path} must identify ${expectedId}.`,
+        });
+    }
+    validateTenantCompatibleReference(reference, tenantScope, [path], context);
+};
+const validateRuntimeBundleBase = (value, expectedReleaseKind, context) => {
+    validateRuntimeBundleReference(value.releaseRevisionRef, value.tenantScope, "releaseRevisionRef", expectedReleaseKind, undefined, context);
+    validateRuntimeBundleReference(value.compilerRevisionRef, value.tenantScope, "compilerRevisionRef", "compiler", undefined, context);
+};
+exports.DeclarativeRouteOwnerIndexEntrySchema = zod_1.z
+    .object({
+    resourceKind: zod_1.z.enum(["page", "workbench"]),
+    releaseSlotId: common_1.ContractIdentifierSchema,
+    activeReleaseRevisionRef: exports.RevisionRefSchema,
+    routeClaim: exports.CompiledRouteClaimSchema,
+    authority: zod_1.z.enum(["declarative", "legacy", "unavailable"]),
+    legacyRestoration: exports.LegacySlotRestorationSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.authority === "legacy" && !value.legacyRestoration) {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyRestoration"],
+            message: "A restored legacy route must pin its exact inspected source and adapter revisions.",
+        });
+    }
+    if (value.authority !== "legacy" && value.legacyRestoration) {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyRestoration"],
+            message: "Only a restored legacy route can carry legacy restoration provenance.",
+        });
+    }
+});
+exports.DeclarativeRouteOwnerIndexSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("DeclarativeRouteOwnerIndex"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    environmentRef: exports.StableRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    generation: zod_1.z.number().int().positive(),
+    entries: zod_1.z.array(exports.DeclarativeRouteOwnerIndexEntrySchema).max(4096),
+    contentHash: common_1.Sha256Schema,
+    rebuildable: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const identities = value.entries.map((entry) => `${entry.resourceKind}:${entry.releaseSlotId}`);
+    if (new Set(identities).size !== identities.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["entries"],
+            message: "Route owner index entries must be unique by Release slot.",
+        });
+    }
+    if (identities.some((identity, index) => index > 0 && identities[index - 1].localeCompare(identity) > 0)) {
+        context.addIssue({
+            code: "custom",
+            path: ["entries"],
+            message: "Route owner index entries must use deterministic Release-slot order.",
+        });
+    }
+});
+exports.DeclarativeWorkbenchCatalogEntrySchema = zod_1.z
+    .object({
+    workbenchId: common_1.ContractIdentifierSchema,
+    authority: zod_1.z.enum(["declarative", "legacy", "unavailable"]),
+    identity: exports.WorkbenchIdentitySchema,
+    order: zod_1.z.number().int(),
+    isDefaultCandidate: zod_1.z.boolean(),
+    activeReleaseRevisionRef: exports.RevisionRefSchema.optional(),
+    legacyAdapterRevisionRef: exports.RevisionRefSchema.optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.authority === "declarative") {
+        if (value.activeReleaseRevisionRef?.kind !== "workbench-release") {
+            context.addIssue({
+                code: "custom",
+                path: ["activeReleaseRevisionRef"],
+                message: "A declarative Workbench catalog entry requires an exact Workbench Release.",
+            });
+        }
+        if (value.legacyAdapterRevisionRef) {
+            context.addIssue({
+                code: "custom",
+                path: ["legacyAdapterRevisionRef"],
+                message: "A declarative Workbench catalog entry cannot carry a legacy adapter.",
+            });
+        }
+        return;
+    }
+    if (value.activeReleaseRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["activeReleaseRevisionRef"],
+            message: "A non-declarative Workbench entry cannot expose a Workbench Release.",
+        });
+    }
+    if (value.authority === "legacy" &&
+        value.legacyAdapterRevisionRef?.kind !== "legacy-workbench-adapter") {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyAdapterRevisionRef"],
+            message: "A legacy Workbench entry requires an exact legacy-workbench-adapter revision.",
+        });
+    }
+    if (value.authority === "unavailable" && value.legacyAdapterRevisionRef) {
+        context.addIssue({
+            code: "custom",
+            path: ["legacyAdapterRevisionRef"],
+            message: "An unavailable Workbench entry cannot carry a legacy adapter.",
+        });
+    }
+});
+exports.DeclarativeWorkbenchCatalogSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("DeclarativeWorkbenchCatalog"),
+    schemaVersion: zod_1.z.literal(exports.DECLARATIVE_CONTROL_SCHEMA_VERSION),
+    tenantScope: exports.TenantScopeSchema,
+    environmentRef: exports.StableRefSchema,
+    surface: exports.ProductSurfaceSchema,
+    generation: zod_1.z.number().int().positive(),
+    entries: zod_1.z.array(exports.DeclarativeWorkbenchCatalogEntrySchema).max(4096),
+    contentHash: common_1.Sha256Schema,
+    rebuildable: zod_1.z.literal(true),
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.environmentRef.kind !== "environment") {
+        context.addIssue({
+            code: "custom",
+            path: ["environmentRef", "kind"],
+            message: "A Workbench catalog requires an Environment reference.",
+        });
+    }
+    const ids = value.entries.map((entry) => entry.workbenchId);
+    if (new Set(ids).size !== ids.length) {
+        context.addIssue({
+            code: "custom",
+            path: ["entries"],
+            message: "Workbench catalog identities must be unique.",
+        });
+    }
+    if (value.entries.filter((entry) => entry.authority !== "unavailable" && entry.isDefaultCandidate).length > 1) {
+        context.addIssue({
+            code: "custom",
+            path: ["entries"],
+            message: "The effective Workbench catalog may have at most one default.",
+        });
+    }
+    const sorted = [...value.entries].sort((left, right) => left.order - right.order ||
+        left.workbenchId.localeCompare(right.workbenchId));
+    if (sorted.some((entry, index) => entry.workbenchId !== value.entries[index]?.workbenchId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["entries"],
+            message: "Workbench catalog entries must use deterministic order plus Workbench identity.",
+        });
+    }
+});
+exports.PageRuntimeBundleSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("PageRuntimeBundle"),
     ...RuntimeBundleBaseShape,
     pageId: common_1.ContractIdentifierSchema,
     pageRevisionRef: exports.RevisionRefSchema,
     surface: exports.ProductSurfaceSchema,
     routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
+    routeStatePresentations: zod_1.z
+        .array(exports.PageRouteStatePresentationSchema)
+        .default([]),
     shellRevisionRef: exports.RevisionRefSchema,
+    shellDescriptor: exports.DeclarativeRuntimeShellDescriptorSchema,
     renderTree: render_1.RenderTreeSchema,
     capabilityInstances: zod_1.z.array(exports.CapabilityInstanceSchema),
+    deniedCapabilityInstanceIds: zod_1.z.array(common_1.ContractIdentifierSchema).default([]),
+    capabilityAccessEvaluated: zod_1.z.literal(true).optional(),
+    stateDefinitions: zod_1.z.array(exports.PageStateDefinitionSchema).default([]),
+    entryTransitions: zod_1.z.array(exports.ResolvedPageEntryTransitionSchema).default([]),
+    interactionBindings: zod_1.z.array(exports.InteractionBindingSchema).default([]),
     ontologyBindings: zod_1.z.array(exports.OntologyBindingSchema),
+    queryBindings: zod_1.z.array(exports.QueryBindingSchema).default([]),
     actionBindings: zod_1.z.array(exports.ActionBindingSchema),
     pageAccessPolicy: exports.AccessPolicySchema,
     tokenRevisionRefs: zod_1.z.array(exports.RevisionRefSchema),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
-    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
-}).strict();
+    privacyClassification: zod_1.z.enum([
+        "public",
+        "internal",
+        "confidential",
+        "restricted",
+    ]),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const instanceIds = new Set(value.capabilityInstances.map((instance) => instance.instanceId));
+    if (new Set(value.deniedCapabilityInstanceIds).size !==
+        value.deniedCapabilityInstanceIds.length ||
+        value.deniedCapabilityInstanceIds.some((id) => !instanceIds.has(id))) {
+        context.addIssue({
+            code: "custom",
+            path: ["deniedCapabilityInstanceIds"],
+            message: "Denied capability identities must be unique declared instances.",
+        });
+    }
+    validateRuntimeBundleBase(value, "page-release", context);
+    value.routeClaims.forEach((claim, index) => {
+        if (claim.surface !== value.surface) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeClaims", index, "surface"],
+                message: "Runtime route claims must match the bundle surface.",
+            });
+        }
+    });
+    validateRuntimeBundleReference(value.pageRevisionRef, value.tenantScope, "pageRevisionRef", "page", value.pageId, context);
+    value.routeStatePresentations.forEach((presentation, index) => {
+        if (presentation.surface !== value.surface) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeStatePresentations", index, "surface"],
+                message: "Runtime route-state presentations must match the compiled Page surface.",
+            });
+        }
+    });
+});
 exports.ResolvedWorkbenchAppInstanceSchema = exports.WorkbenchAppInstanceSchema.extend({
     targetAccessPolicy: exports.AccessPolicySchema,
 }).strict();
-const WorkbenchRuntimeTargetSchema = exports.WorkbenchReleaseSchema.shape.target.safeExtend({
+exports.WorkbenchRuntimeIdentitySchema = zod_1.z
+    .object({
+    name: exports.I18nTextSchema,
+    description: exports.I18nTextSchema.optional(),
+})
+    .strict();
+const WorkbenchRuntimeTargetSchema = exports.WorkbenchReleaseSchema.shape.target
+    .safeExtend({
     routeClaim: exports.CompiledRouteClaimSchema,
-}).strict();
-exports.WorkbenchRuntimeBundleSchema = zod_1.z.object({
-    contract: zod_1.z.literal('WorkbenchRuntimeBundle'),
+})
+    .strict();
+exports.WorkbenchRuntimeBundleSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("WorkbenchRuntimeBundle"),
     ...RuntimeBundleBaseShape,
     workbenchId: common_1.ContractIdentifierSchema,
     workbenchRevisionRef: exports.RevisionRefSchema,
+    identity: exports.WorkbenchRuntimeIdentitySchema,
     surface: exports.ProductSurfaceSchema,
     routeClaims: zod_1.z.array(exports.CompiledRouteClaimSchema),
     groups: zod_1.z.array(exports.WorkbenchGroupSchema),
     appInstances: zod_1.z.array(exports.ResolvedWorkbenchAppInstanceSchema),
-    defaultEntry: exports.WorkbenchSchema.shape.defaultEntry,
+    defaultEntry: exports.WorkbenchSchema.shape.defaultEntry.nullable(),
     layout: exports.WorkbenchSchema.shape.layout,
     workbenchAccessPolicy: exports.AccessPolicySchema,
     personalPreferencesPolicy: exports.WorkbenchSchema.shape.personalPreferencesPolicy,
     target: WorkbenchRuntimeTargetSchema,
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
-    privacyClassification: zod_1.z.enum(['public', 'internal', 'confidential', 'restricted']),
-}).strict();
+    privacyClassification: zod_1.z.enum([
+        "public",
+        "internal",
+        "confidential",
+        "restricted",
+    ]),
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateRuntimeBundleBase(value, "workbench-release", context);
+    value.routeClaims.forEach((claim, index) => {
+        if (claim.surface !== value.surface) {
+            context.addIssue({
+                code: "custom",
+                path: ["routeClaims", index, "surface"],
+                message: "Runtime route claims must match the bundle surface.",
+            });
+        }
+    });
+    validateRuntimeBundleReference(value.workbenchRevisionRef, value.tenantScope, "workbenchRevisionRef", "workbench", value.workbenchId, context);
+    if (value.appInstances.length === 0) {
+        if (value.defaultEntry !== null) {
+            context.addIssue({
+                code: "custom",
+                path: ["defaultEntry"],
+                message: "An empty Workbench runtime bundle must use a null default entry.",
+            });
+        }
+        return;
+    }
+    if (value.defaultEntry === null) {
+        context.addIssue({
+            code: "custom",
+            path: ["defaultEntry"],
+            message: "A non-empty Workbench runtime bundle requires a default entry.",
+        });
+        return;
+    }
+    const defaultInstance = value.appInstances.find((instance) => instance.instanceId === value.defaultEntry?.instanceId);
+    if (!defaultInstance ||
+        defaultInstance.groupId !== value.defaultEntry.groupId) {
+        context.addIssue({
+            code: "custom",
+            path: ["defaultEntry"],
+            message: "Workbench runtime default entry must reference a visible app in the declared group.",
+        });
+    }
+    if (!value.groups.some((group) => group.groupId === value.defaultEntry?.groupId)) {
+        context.addIssue({
+            code: "custom",
+            path: ["defaultEntry", "groupId"],
+            message: "Workbench runtime default entry must reference a visible group.",
+        });
+    }
+});
 const CompiledNavigationTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
-    kind: zod_1.z.literal('route'),
+    kind: zod_1.z.literal("route"),
     accessPolicy: exports.AccessPolicySchema,
     routeClaim: exports.CompiledRouteClaimSchema,
 }).strict();
 exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
-    kind: zod_1.z.literal('registered-menu-action'),
+    kind: zod_1.z.literal("registered-menu-action"),
     accessPolicy: exports.AccessPolicySchema,
-    execution: zod_1.z.literal('client'),
+    execution: zod_1.z.literal("client"),
     applicationId: common_1.ContractIdentifierSchema,
     actionRef: common_1.ContractIdentifierSchema,
     inputSchemaRef: common_1.ContractIdentifierSchema.optional(),
@@ -1011,19 +4353,21 @@ exports.CompiledNavigationRegisteredMenuActionTargetSchema = exports.ResolvedNav
     sourceCatalogRevisionRef: exports.RevisionRefSchema,
 }).strict();
 exports.CompiledNavigationDomainCommandTargetSchema = exports.ResolvedNavigationTargetSchema.extend({
-    kind: zod_1.z.literal('governed-domain-command'),
+    kind: zod_1.z.literal("governed-domain-command"),
     accessPolicy: exports.AccessPolicySchema,
-    execution: zod_1.z.literal('server'),
+    execution: zod_1.z.literal("server"),
     commandRevisionRef: exports.RevisionRefSchema,
     inputSchemaRevisionRef: exports.RevisionRefSchema,
     resultSchemaRevisionRef: exports.RevisionRefSchema.optional(),
     input: common_1.JsonObjectSchema,
 }).strict();
-exports.CompiledNavigationResolvedTargetSchema = zod_1.z.discriminatedUnion('kind', [
+exports.CompiledNavigationResolvedTargetSchema = zod_1.z.discriminatedUnion("kind", [
     CompiledNavigationTargetSchema,
     exports.CompiledNavigationRegisteredMenuActionTargetSchema,
     exports.CompiledNavigationDomainCommandTargetSchema,
-    exports.UnavailableNavigationTargetSchema.omit({ reason: true }).extend({ kind: zod_1.z.literal('unavailable') }).strict(),
+    exports.UnavailableNavigationTargetSchema.omit({ reason: true })
+        .extend({ kind: zod_1.z.literal("unavailable") })
+        .strict(),
 ]);
 exports.CompiledNavigationGroupNodeSchema = exports.NavigationGroupNodeSchema.extend({
     ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
@@ -1031,24 +4375,39 @@ exports.CompiledNavigationGroupNodeSchema = exports.NavigationGroupNodeSchema.ex
 exports.CompiledNavigationTargetNodeSchema = exports.NavigationTargetNodeSchema.extend({
     ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
     resolvedTarget: exports.CompiledNavigationResolvedTargetSchema,
-}).strict().superRefine((node, context) => {
-    if (node.resolvedTarget.nodeId !== node.nodeId || stableRefIdentity(node.resolvedTarget.stableTargetRef) !== stableRefIdentity(node.targetRef)) {
-        context.addIssue({ code: 'custom', path: ['resolvedTarget'], message: 'Resolved target identity must match the source node.' });
+})
+    .strict()
+    .superRefine((node, context) => {
+    if (node.resolvedTarget.nodeId !== node.nodeId ||
+        stableRefIdentity(node.resolvedTarget.stableTargetRef) !==
+            stableRefIdentity(node.targetRef)) {
+        context.addIssue({
+            code: "custom",
+            path: ["resolvedTarget"],
+            message: "Resolved target identity must match the source node.",
+        });
     }
-    if (node.resolvedTarget.kind === 'unavailable' && (node.disabled !== true || Object.keys(node.parameterMapping).length > 0)) {
-        context.addIssue({ code: 'custom', path: ['resolvedTarget'], message: 'Unavailable targets must be disabled and contain no executable input.' });
+    if (node.resolvedTarget.kind === "unavailable" &&
+        (node.disabled !== true ||
+            Object.keys(node.parameterMapping).length > 0)) {
+        context.addIssue({
+            code: "custom",
+            path: ["resolvedTarget"],
+            message: "Unavailable targets must be disabled and contain no executable input.",
+        });
     }
 });
 exports.CompiledNavigationSeparatorNodeSchema = exports.NavigationSeparatorNodeSchema.extend({
     ancestorAccessPolicies: zod_1.z.array(exports.AccessPolicySchema),
 }).strict();
-exports.CompiledNavigationNodeSchema = zod_1.z.discriminatedUnion('kind', [
+exports.CompiledNavigationNodeSchema = zod_1.z.discriminatedUnion("kind", [
     exports.CompiledNavigationGroupNodeSchema,
     exports.CompiledNavigationTargetNodeSchema,
     exports.CompiledNavigationSeparatorNodeSchema,
 ]);
-exports.NavigationRuntimeBundleSchema = zod_1.z.object({
-    contract: zod_1.z.literal('NavigationRuntimeBundle'),
+exports.NavigationRuntimeBundleSchema = zod_1.z
+    .object({
+    contract: zod_1.z.literal("NavigationRuntimeBundle"),
     ...RuntimeBundleBaseShape,
     navigationId: common_1.ContractIdentifierSchema,
     navigationRevisionRef: exports.RevisionRefSchema,
@@ -1057,27 +4416,38 @@ exports.NavigationRuntimeBundleSchema = zod_1.z.object({
     nodes: zod_1.z.array(exports.CompiledNavigationNodeSchema),
     performanceBudgetRef: exports.RevisionRefSchema,
     observationPolicyRevisionRef: exports.RevisionRefSchema,
-}).strict();
+})
+    .strict()
+    .superRefine((value, context) => {
+    validateRuntimeBundleBase(value, "navigation-release", context);
+    validateRuntimeBundleReference(value.navigationRevisionRef, value.tenantScope, "navigationRevisionRef", "navigation", value.navigationId, context);
+});
 exports.DeclarativeControlOntologyDefinitionSchema = data_1.OntologyDefinitionSchema.extend({
-    classification: zod_1.z.literal('control'),
-    discovery: zod_1.z.object({
+    classification: zod_1.z.literal("control"),
+    discovery: zod_1.z
+        .object({
         ordinaryDataBrowser: zod_1.z.literal(false),
         businessSearch: zod_1.z.literal(false),
         businessStatistics: zod_1.z.literal(false),
         ordinaryExport: zod_1.z.literal(false),
         genericWrite: zod_1.z.literal(false),
-    }).strict(),
+    })
+        .strict(),
 }).strict();
 const controlDefinition = (ontologyId, bodySchemaRef) => exports.DeclarativeControlOntologyDefinitionSchema.parse({
-    contract: 'OntologyDefinition',
+    contract: "OntologyDefinition",
     ontologyId,
-    dataSpaceId: 'monkeys.control',
-    ownerRepo: 'monkeys-js-sdk',
+    dataSpaceId: "monkeys.control",
+    ownerRepo: "monkeys-js-sdk",
     bodySchemaRef,
-    authority: { service: 'monkeys-data-server', storage: 'domain-record', scope: 'tenant' },
+    authority: {
+        service: "monkeys-data-server",
+        storage: "domain-record",
+        scope: "tenant",
+    },
     relationKinds: [],
     metricKinds: [],
-    classification: 'control',
+    classification: "control",
     discovery: {
         ordinaryDataBrowser: false,
         businessSearch: false,
@@ -1087,11 +4457,11 @@ const controlDefinition = (ontologyId, bodySchemaRef) => exports.DeclarativeCont
     },
 });
 exports.DECLARATIVE_CONTROL_ONTOLOGY_DEFINITIONS = Object.freeze([
-    controlDefinition('monkeys.system.page', 'monkeys.system.page/v1'),
-    controlDefinition('monkeys.system.page-release', 'monkeys.system.page-release/v1'),
-    controlDefinition('monkeys.system.workbench', 'monkeys.system.workbench/v1'),
-    controlDefinition('monkeys.system.workbench-release', 'monkeys.system.workbench-release/v1'),
-    controlDefinition('monkeys.system.navigation', 'monkeys.system.navigation/v1'),
-    controlDefinition('monkeys.system.navigation-release', 'monkeys.system.navigation-release/v1'),
+    controlDefinition("monkeys.system.page", "monkeys.system.page/v1"),
+    controlDefinition("monkeys.system.page-release", "monkeys.system.page-release/v1"),
+    controlDefinition("monkeys.system.workbench", "monkeys.system.workbench/v1"),
+    controlDefinition("monkeys.system.workbench-release", "monkeys.system.workbench-release/v1"),
+    controlDefinition("monkeys.system.navigation", "monkeys.system.navigation/v1"),
+    controlDefinition("monkeys.system.navigation-release", "monkeys.system.navigation-release/v1"),
 ]);
 //# sourceMappingURL=declarative-control.js.map