@native-knowledge/cli 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/internal/contracts/tenant-resource.js

@@ -0,0 +1,118 @@
+/** 租户原生不可变信封保留类型事实；不以项目占位或审核状态判断原文读取。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { accessClassificationSchema, idSchema, isoDateTimeSchema, sha256Schema, stableUriSchema } from './common.js';
+import { artifactManifestSchema } from './artifact.js';
+import { evidenceRefSchema } from './evidence.js';
+import { referenceCorpusSummarySchema } from './reference-record.js';
+import { knowledgeActorContextSchema } from './project-intent.js';
+import { materialResourceTypeSchema } from './material-carrier.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantResourceIdentitySchema, tenantResourceRefs, tenantStorageKey, tenantResourceRefSchema } from './resource-scope.js';
+// 取原有字段验证器，旧 schema/DTO 原样保留；新信封的身份关系在下方集中验证。
+const artifactFacts = z.object({ ...artifactManifestSchema.shape }).omit({ schemaVersion: true, projectKey: true, projectRef: true, ref: true, identityRef: true, contentHash: true, mediaType: true, byteLength: true, access: true, createdAt: true }).extend({ sourceMaterialRefs: z.array(stableUriSchema).max(256).optional() }).strict();
+const evidenceFacts = z.object({ ...evidenceRefSchema.shape }).omit({ schemaVersion: true, projectKey: true, projectRef: true, recoveryProvenance: true, contentHash: true, mediaType: true, byteLength: true, access: true }).extend({ parentEvidenceRef: tenantResourceRefSchema.optional() }).strict();
+const referenceFacts = z.object({ ...referenceCorpusSummarySchema.shape }).omit({ schemaVersion: true, projectKey: true, projectRef: true, recordRef: true, access: true }).strict();
+export const tenantResourceFactsSchema = z.discriminatedUnion('type', [
+    z.object({ type: z.literal('ARTIFACT'), metadata: artifactFacts }).strict(),
+    z.object({ type: z.literal('EVIDENCE'), metadata: evidenceFacts }).strict(),
+    z.object({ type: z.literal('REFERENCE'), metadata: referenceFacts }).strict(),
+    z.object({ type: z.literal('CARRIER'), metadata: z.object({ kind: z.string().min(1).max(128), title: z.string().max(512), summary: z.string().max(1024), sourceRefs: z.array(stableUriSchema).min(1).max(128), observedAt: isoDateTimeSchema }).strict() }).strict(),
+]);
+export const tenantResourceOriginSchema = z.discriminatedUnion('type', [
+    z.object({ type: z.literal('TENANT_AUTHOR'), actor: knowledgeActorContextSchema, submittedAt: isoDateTimeSchema }).strict(),
+    z.object({ type: z.literal('TENANT_SOURCE'), sourceId: idSchema, sourceRef: stableUriSchema, sourceRevisionRef: stableUriSchema, collector: evidenceRefSchema.shape.collector, runtimeNodeId: idSchema, observedAt: isoDateTimeSchema }).strict(),
+]);
+export const tenantResourceManifestSchema = z.object({
+    schemaVersion: z.literal(2), ownerTenantId: materialTenantIdSchema,
+    resourceId: tenantResourceIdentitySchema.shape.resourceId, resourceType: materialResourceTypeSchema,
+    version: tenantResourceIdentitySchema.shape.version, ref: stableUriSchema, identityRef: stableUriSchema,
+    contentHash: sha256Schema, byteLength: z.number().int().nonnegative().safe(), mediaType: z.string().trim().min(1).max(256),
+    access: accessClassificationSchema, createdAt: isoDateTimeSchema,
+    origin: tenantResourceOriginSchema, facts: tenantResourceFactsSchema,
+}).strict().superRefine((value, ctx) => {
+    const expected = tenantResourceRefs({ tenantId: value.ownerTenantId, resourceType: value.resourceType, resourceId: value.resourceId, version: value.version });
+    for (const name of ['ref', 'identityRef'])
+        if (value[name] !== expected[name])
+            ctx.addIssue({ code: 'custom', path: [name], message: 'Tenant resource identity mismatch' });
+    const kind = value.facts.type.toLowerCase();
+    if (value.facts.type === 'CARRIER' ? ['artifact', 'evidence', 'reference', 'media'].includes(value.resourceType) : value.resourceType !== kind)
+        ctx.addIssue({ code: 'custom', path: ['resourceType'], message: 'Resource type must retain its factual carrier' });
+    if (value.origin.type === 'TENANT_AUTHOR') {
+        if (value.origin.actor.tenantId !== value.ownerTenantId)
+            ctx.addIssue({ code: 'custom', path: ['origin'], message: 'Author must belong to the resource Tenant' });
+    }
+    else {
+        const prefix = `tenant-source://${tenantStorageKey(value.ownerTenantId)}/${encodeURIComponent(value.origin.sourceId)}`;
+        if (value.origin.sourceRef !== prefix || !value.origin.sourceRevisionRef.startsWith(prefix + '/v/') || !/^[a-f0-9]{64}$/.test(value.origin.sourceRevisionRef.slice(prefix.length + 3)))
+            ctx.addIssue({ code: 'custom', path: ['origin'], message: 'Source must retain exact Tenant/source/revision identity' });
+    }
+    if (value.facts.type === 'ARTIFACT') {
+        const m = value.facts.metadata;
+        if (m.artifactId !== value.resourceId || m.version !== value.version)
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Artifact identity/version mismatch' });
+        if (m.validUntil && m.observedAt && Date.parse(m.validUntil) < Date.parse(m.observedAt))
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Invalid Artifact validity interval' });
+        if (m.kind === 'SIGNAL_GENERATION' && (m.version !== 1 || m.status !== 'GENERATED') || ['KNOWLEDGE', 'INSIGHT'].includes(m.kind) && m.status === 'GENERATED')
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Invalid Artifact lifecycle' });
+        const previous = value.version > 1 ? tenantResourceRefs({ tenantId: value.ownerTenantId, resourceType: value.resourceType, resourceId: value.resourceId, version: value.version - 1 }).ref : null;
+        if (m.supersedesRef !== previous)
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Artifact must retain immediate predecessor' });
+    }
+    if (value.facts.type === 'EVIDENCE') {
+        const m = value.facts.metadata;
+        if (m.parentEvidenceRef) {
+            const parent = new URL(m.parentEvidenceRef);
+            if (parent.hostname !== tenantStorageKey(value.ownerTenantId) || !parent.pathname.startsWith('/evidence/') || m.parentEvidenceRef === value.ref)
+                ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Media parent must be another native Tenant Evidence' });
+        }
+        if (m.evidenceId !== value.resourceId || value.version !== 1 || Boolean(m.sourceSetRef) !== Boolean(m.sourceItemId) || Boolean(m.collectionBatchRef) !== Boolean(m.collectionTaskId))
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Evidence identity/bindings mismatch' });
+        if (value.origin.type === 'TENANT_SOURCE' && (m.sourceId !== value.origin.sourceId || m.runtimeNodeId !== value.origin.runtimeNodeId || m.observedAt !== value.origin.observedAt || m.sourceRevisionRef !== value.origin.sourceRevisionRef || JSON.stringify(m.collector) !== JSON.stringify(value.origin.collector)))
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Evidence must preserve acquisition provenance' });
+    }
+    if (value.facts.type === 'REFERENCE') {
+        const m = value.facts.metadata;
+        if (m.version !== value.version || m.effectiveFrom && m.effectiveUntil && Date.parse(m.effectiveUntil) <= Date.parse(m.effectiveFrom))
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Reference version/validity mismatch' });
+        const previous = value.version > 1 ? tenantResourceRefs({ tenantId: value.ownerTenantId, resourceType: value.resourceType, resourceId: value.resourceId, version: value.version - 1 }).ref : null;
+        if (m.supersedesRef !== previous)
+            ctx.addIssue({ code: 'custom', path: ['facts'], message: 'Reference must retain immediate predecessor' });
+    }
+});
+export const tenantProjectionIntentSchema = z.object({ schemaVersion: z.literal(2), ref: tenantResourceRefSchema, manifestRevision: sha256Schema, createdAt: isoDateTimeSchema }).strict();
+/** 存储、Catalog 与 Identity 共用同一 manifest 身份；undefined 等价于 JSON 省略。 */
+export function tenantResourceManifestRevision(raw) {
+    const json = JSON.stringify(tenantResourceManifestSchema.parse(raw));
+    if (Buffer.byteLength(json + '\n') > 64 * 1024)
+        throw new Error('TENANT_RESOURCE_MANIFEST_TOO_LARGE');
+    const canonical = (value) => { if (value === null || typeof value !== 'object')
+        return JSON.stringify(value); if (Array.isArray(value))
+        return '[' + value.map(canonical).join(',') + ']'; const row = value; return '{' + Object.keys(row).sort().map(key => JSON.stringify(key) + ':' + canonical(row[key])).join(',') + '}'; };
+    return 'sha256:' + createHash('sha256').update(canonical(JSON.parse(json))).digest('hex');
+}
+/** Reference 语义摘要与 CAS 字节摘要分开；只正规化集合字段，不改原始 payload 字节。 */
+export function tenantReferenceRecordDigest(tenantId, access, metadata, payload) {
+    const parsed = tenantResourceFactsSchema.parse({ type: 'REFERENCE', metadata });
+    if (parsed.type !== 'REFERENCE')
+        throw new Error('TENANT_REFERENCE_FACTS_REQUIRED');
+    const m = parsed.metadata, selectors = m.selectors ? Object.fromEntries(Object.keys(m.selectors).sort().map(key => [key, [...new Set(m.selectors[key])].sort()])) : undefined;
+    const basis = { tenantId: materialTenantIdSchema.parse(tenantId), corpusKey: m.corpusKey, recordKey: m.recordKey, recordType: m.recordType, access: accessClassificationSchema.parse(access), authority: m.authority, jurisdiction: m.jurisdiction, ...(selectors ? { selectors } : {}), sourceRefs: [...new Set(m.sourceRefs)].sort(), effectiveFrom: m.effectiveFrom, effectiveUntil: m.effectiveUntil, payload };
+    let nodes = 0;
+    const canonical = (value, depth = 0) => {
+        if (++nodes > 1_000_000 || depth > 64)
+            throw new Error('TENANT_REFERENCE_JSON_BUDGET_EXCEEDED');
+        if (value === null || typeof value === 'string' || typeof value === 'boolean')
+            return JSON.stringify(value);
+        if (typeof value === 'number' && Number.isFinite(value))
+            return JSON.stringify(value);
+        if (Array.isArray(value))
+            return '[' + value.map(item => canonical(item, depth + 1)).join(',') + ']';
+        if (value && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) {
+            const row = value;
+            return '{' + Object.keys(row).sort().map(key => JSON.stringify(key) + ':' + canonical(row[key], depth + 1)).join(',') + '}';
+        }
+        throw new Error('TENANT_REFERENCE_JSON_INVALID');
+    };
+    return 'sha256:' + createHash('sha256').update(canonical(basis)).digest('hex');
+}

package/dist/internal/contracts/tenant-rich-document.js

@@ -0,0 +1,17 @@
+/** 原生受治理正文引用真实资料类型；Reference/开放载体不被伪装为 Evidence。 */
+import { z } from 'zod';
+import { richDocumentSchema, publicationProfileSchema, validateRichDocumentContent } from './rich-document.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { stableUriSchema } from './common.js';
+export const TENANT_RICH_DOCUMENT_MEDIA_TYPE = 'application/vnd.knowledge-v2.tenant-rich-document+json';
+export const tenantDocumentCitationSchema = z.object({ blockOrdinal: z.number().int().nonnegative(), sourceRefs: z.array(stableUriSchema).min(1).max(32) }).strict().superRefine((value, ctx) => { if (new Set(value.sourceRefs).size !== value.sourceRefs.length)
+    ctx.addIssue({ code: 'custom', path: ['sourceRefs'], message: 'Citation refs must be unique' }); });
+export const tenantCompositionDraftSchema = z.object({ ...richDocumentSchema.shape }).pick({ summary: true, byline: true, language: true, blocks: true }).extend({ summary: z.string().trim().min(1).max(4000), byline: richDocumentSchema.shape.byline.optional(), language: richDocumentSchema.shape.language.optional(), blocks: richDocumentSchema.shape.blocks.min(1), citations: z.array(tenantDocumentCitationSchema).min(1).max(10000) }).strict();
+const base = z.object({ ...richDocumentSchema.shape }).omit({ projectKey: true, projectRef: true, format: true, role: true, publicationProfile: true, sourceEvidenceRefs: true, primarySourceEvidenceRef: true, citations: true });
+export const tenantRichDocumentSchema = base.extend({ format: z.literal('TENANT_RICH_DOCUMENT_V1'), tenantId: materialTenantIdSchema, role: z.enum(['KNOWLEDGE', 'INSIGHT']), publicationProfile: publicationProfileSchema, sourceRefs: z.array(stableUriSchema).min(1).max(256), primarySourceRef: stableUriSchema, representationRefs: z.array(stableUriSchema).max(64).default([]), citations: z.array(tenantDocumentCitationSchema).max(10000).default([]) }).strict().superRefine((value, ctx) => {
+    // 只把字段适配到共同结构规则；身份、真实载体类型与权限由应用层逐 ref 验证。
+    validateRichDocumentContent({ sourceEvidenceRefs: value.sourceRefs, primarySourceEvidenceRef: value.primarySourceRef, mediaEvidenceRefs: value.mediaEvidenceRefs, blocks: value.blocks, citations: value.citations.map(citation => ({ blockOrdinal: citation.blockOrdinal, evidenceRefs: citation.sourceRefs })) }, ctx, { primary: 'primarySourceRef', citation: 'sourceRefs' });
+    if (new Set(value.sourceRefs).size !== value.sourceRefs.length)
+        ctx.addIssue({ code: 'custom', path: ['sourceRefs'], message: 'Sources must be unique' });
+});
+export const tenantPublicationReadinessSchema = z.object({ schemaVersion: z.literal(2), profile: publicationProfileSchema, ready: z.boolean(), reasons: z.array(z.enum(['ROLE_MISMATCH', 'TITLE_REQUIRED', 'SUMMARY_REQUIRED', 'TEXT_TOO_SHORT', 'STRUCTURE_TOO_THIN', 'SOURCE_REQUIRED', 'CITATION_COVERAGE_REQUIRED', 'SOURCE_MISMATCH', 'MEDIA_UNAVAILABLE'])).max(16), metrics: z.object({ textCharacters: z.number().int().nonnegative(), blockCount: z.number().int().nonnegative(), textBlockCount: z.number().int().nonnegative(), mediaBlockCount: z.number().int().nonnegative(), sourceCount: z.number().int().nonnegative(), mediaEvidenceCount: z.number().int().nonnegative(), citationCount: z.number().int().nonnegative(), citedBlockCount: z.number().int().nonnegative() }).strict() }).strict();

package/dist/internal/contracts/tenant-source-binding.js

@@ -0,0 +1,33 @@
+/** 项目用途上下文不参与来源获取等价，不是授权 grant 或可执行过滤 DSL。 */
+import { z } from 'zod';
+import { idSchema, stableUriSchema } from './common.js';
+export const tenantSourceBindingContextSchema = z.object({
+    schemaVersion: z.literal(1), projectIntentRef: stableUriSchema.nullable().default(null),
+    scopeIds: z.array(idSchema).max(256).default([]), sourceFamilies: z.array(idSchema).max(256).default([]), attentionNotes: z.string().max(4000).nullable().default(null),
+}).strict().superRefine((value, ctx) => {
+    for (const key of ['scopeIds', 'sourceFamilies'])
+        if (new Set(value[key]).size !== value[key].length)
+            ctx.addIssue({ code: 'custom', path: [key], message: 'Project demand selectors must be unique' });
+    if ((value.scopeIds.length || value.sourceFamilies.length) && !value.projectIntentRef)
+        ctx.addIssue({ code: 'custom', path: ['projectIntentRef'], message: 'Scoped demand must retain an exact Project Intent revision' });
+    if (value.projectIntentRef && !/^project-intent:\/\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}\/[a-f0-9]{64}$/.test(value.projectIntentRef))
+        ctx.addIssue({ code: 'custom', path: ['projectIntentRef'], message: 'Exact Project Intent revision required' });
+});
+import { projectKeySchema, isoDateTimeSchema } from './common.js';
+import { knowledgeActorContextSchema, collectionRefreshSchema } from './project-intent.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantSourceIdSchema } from './tenant-source.js';
+import { tenantStorageKey } from './resource-scope.js';
+export const tenantSourceBindingRevisionSchema = z.object({
+    schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, projectKey: projectKeySchema, sourceId: tenantSourceIdSchema, revisionRef: stableUriSchema,
+    generation: z.number().int().positive().safe(), purpose: z.string().max(4000), refresh: collectionRefreshSchema, enabled: z.boolean(), demandContext: tenantSourceBindingContextSchema,
+    origin: z.enum(['MIGRATED_V13', 'EXPLICIT_V14']), actor: knowledgeActorContextSchema.nullable(), changedAt: isoDateTimeSchema.nullable(),
+}).strict().superRefine((v, ctx) => {
+    const prefix = `tenant-source://${tenantStorageKey(v.tenantId)}/${v.sourceId}/v/`;
+    if (!v.revisionRef.startsWith(prefix) || !/^[a-f0-9]{64}$/.test(v.revisionRef.slice(prefix.length)))
+        ctx.addIssue({ code: 'custom', path: ['revisionRef'], message: 'Binding must retain exact Tenant Source identity' });
+    if (v.demandContext.projectIntentRef && !v.demandContext.projectIntentRef.startsWith(`project-intent://${v.projectKey}/`))
+        ctx.addIssue({ code: 'custom', path: ['demandContext'], message: 'Demand context Project mismatch' });
+    if (v.origin === 'MIGRATED_V13' ? (v.actor !== null || v.changedAt !== null) : (!v.actor || v.actor.tenantId !== v.tenantId || !v.changedAt))
+        ctx.addIssue({ code: 'custom', path: ['origin'], message: 'Migration cannot invent actor/time; explicit changes require attribution' });
+});

package/dist/internal/contracts/tenant-source-bridge.js

@@ -0,0 +1,9 @@
+/** 显式桥接预检确认获取语义；该请求不授予启停或修改工作归属的权限。 */
+import { z } from 'zod';
+import { projectKeySchema, stableUriSchema } from './common.js';
+import { tenantSourceIdSchema, tenantSourceSemanticsSchema } from './tenant-source.js';
+export const tenantSourceBridgePreviewInputSchema = z.object({
+    projectKey: projectKeySchema, legacySourceId: tenantSourceIdSchema, expectedLegacyRevisionRef: stableUriSchema,
+    nativeSourceId: tenantSourceIdSchema, expectedNativeRevisionRef: stableUriSchema,
+    confirmAcquisitionSemantics: tenantSourceSemanticsSchema, maxResourceBytes: z.number().int().min(1024).max(64 * 1024 * 1024),
+}).strict();

package/dist/internal/contracts/tenant-source-cutover.js

@@ -0,0 +1,26 @@
+/** Host 维护切换的冻结事实；不从回执推断真实进程已退出。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { idSchema, isoDateTimeSchema, stableUriSchema } from './common.js';
+import { projectSourceSnapshotSchema, knowledgeActorContextSchema } from './project-intent.js';
+import { tenantCollectionPlanSchema } from './tenant-collection.js';
+import { tenantSourceBindingRevisionSchema, tenantSourceBindingContextSchema } from './tenant-source-binding.js';
+import { tenantStorageKey } from './resource-scope.js';
+import { materialTenantIdSchema } from './material-context.js';
+export const SOURCE_CUTOVER_FENCE_CAPABILITY = 'SOURCE_CUTOVER_FENCE_V1';
+export const sourceCutoverIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+export const sourceCutoverKey = (id) => createHash('sha256').update(sourceCutoverIdSchema.parse(id)).digest('hex');
+export const sourceCutoverRef = (tenantId, id) => `tenant-source-cutover://${tenantStorageKey(tenantId)}/${sourceCutoverKey(id)}`;
+export const sourceCutoverIntentSchema = z.object({
+    schemaVersion: z.literal(1), cutoverId: sourceCutoverIdSchema, cutoverRef: stableUriSchema, tenantId: materialTenantIdSchema, actor: knowledgeActorContextSchema, createdAt: isoDateTimeSchema,
+    legacySource: projectSourceSnapshotSchema, plan: tenantCollectionPlanSchema, existingBinding: tenantSourceBindingRevisionSchema.nullable(),
+    demandContext: tenantSourceBindingContextSchema,
+}).strict().superRefine((v, ctx) => {
+    if (v.cutoverRef !== sourceCutoverRef(v.tenantId, v.cutoverId) || v.actor.tenantId !== v.tenantId || v.legacySource.actor.tenantId !== v.tenantId || v.plan.tenantId !== v.tenantId || v.legacySource.targetId !== v.plan.source.targetId || v.legacySource.access !== v.plan.source.semantics.access || v.demandContext.projectIntentRef !== v.legacySource.projectIntentRef)
+        ctx.addIssue({ code: 'custom', message: 'Cutover must retain exact owner, source and Project demand' });
+    if (v.existingBinding && (v.existingBinding.tenantId !== v.tenantId || v.existingBinding.projectKey !== v.legacySource.projectKey || v.existingBinding.sourceId !== v.plan.source.sourceId))
+        ctx.addIssue({ code: 'custom', path: ['existingBinding'], message: 'Prior binding belongs to another context' });
+});
+export const sourceCutoverStepNameSchema = z.enum(['LEGACY_STOPPED', 'DRAINED', 'ACTIVATED', 'NATIVE_STOPPED', 'NATIVE_DRAINED', 'RESTORE_AUTHORIZED', 'LEGACY_RESTORED', 'ROLLED_BACK']);
+export const sourceCutoverStepSchema = z.object({ schemaVersion: z.literal(1), cutoverRef: stableUriSchema, step: sourceCutoverStepNameSchema, actor: knowledgeActorContextSchema, at: isoDateTimeSchema, details: z.record(z.string().max(64), z.union([z.string().max(4096), z.number().finite(), z.boolean(), z.null()])).refine(v => Object.keys(v).length <= 32) }).strict();
+export const sourceCutoverRuntimeProofSchema = z.object({ nodeId: idSchema, codeRevision: z.string().regex(/^[A-Za-z0-9._-]{7,64}$/), capability: z.literal(SOURCE_CUTOVER_FENCE_CAPABILITY), unmanagedExecutions: z.literal('QUIESCED'), observedAt: isoDateTimeSchema }).strict();

package/dist/internal/contracts/tenant-source-document.js

@@ -0,0 +1,38 @@
+/** 原生来源投影保留抽取结构，不借用 Project 身份或知识审核状态。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { richDocumentSchema, validateRichDocumentContent } from './rich-document.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantResourceRefs, parseTenantResourceRef, tenantStorageKey } from './resource-scope.js';
+import { sha256Schema, stableUriSchema } from './common.js';
+export const TENANT_SOURCE_DOCUMENT_MEDIA_TYPE = 'application/vnd.knowledge-v2.tenant-source-document+json';
+const base = z.object({ ...richDocumentSchema.shape }).omit({ projectKey: true, projectRef: true, format: true, role: true, publicationProfile: true });
+export const tenantSourceDocumentSchema = base.extend({ format: z.literal('TENANT_RICH_SOURCE_DOCUMENT_V1'), role: z.literal('SOURCE_MIRROR'), tenantId: materialTenantIdSchema }).strict().superRefine((v, ctx) => {
+    validateRichDocumentContent(v, ctx);
+    const issue = (message) => ctx.addIssue({ code: 'custom', message });
+    if (v.sourceEvidenceRefs.length !== 1 || v.sourceEvidenceRefs[0] !== v.primarySourceEvidenceRef)
+        issue('Source mirror requires one exact parent');
+    const key = tenantStorageKey(v.tenantId), refs = [...v.sourceEvidenceRefs, ...v.mediaEvidenceRefs];
+    if (new Set(refs).size !== refs.length || refs.some(ref => { const p = parseTenantResourceRef(ref); return !p || p.storageKey !== key || p.resourceType !== 'evidence'; }))
+        issue('Source/media must retain exact Tenant Evidence identity');
+    const media = new Set(v.mediaEvidenceRefs);
+    for (const b of v.blocks) {
+        if ('availability' in b && (b.evidenceRef && (!media.has(b.evidenceRef) || b.mediaRef !== b.evidenceRef) || b.kind === 'VIDEO' && b.posterEvidenceRef && !media.has(b.posterEvidenceRef)))
+            issue('Media must identify a declared Evidence');
+    }
+});
+export function tenantSourceDocumentIdentity(tenantId, parentRef, documentContentHash) {
+    const parent = parseTenantResourceRef(parentRef);
+    if (!parent || parent.storageKey !== tenantStorageKey(tenantId) || parent.resourceType !== 'evidence')
+        throw new Error('TENANT_DERIVATION_PARENT_INVALID');
+    const resourceId = 'doc_' + createHash('sha256').update(JSON.stringify([parentRef, sha256Schema.parse(documentContentHash)])).digest('hex');
+    return { resourceId, ...tenantResourceRefs({ tenantId, resourceType: 'source_document', resourceId, version: 1 }) };
+}
+export function tenantSourceMediaIdentity(tenantId, parentRef, kind, url) {
+    stableUriSchema.parse(url);
+    const parent = parseTenantResourceRef(parentRef);
+    if (!parent || parent.storageKey !== tenantStorageKey(tenantId) || parent.resourceType !== 'evidence' || !['IMAGE', 'VIDEO', 'AUDIO'].includes(kind))
+        throw new Error('TENANT_DERIVATION_PARENT_INVALID');
+    const resourceId = 'media_' + createHash('sha256').update(JSON.stringify([parentRef, kind, url])).digest('hex');
+    return { resourceId, ...tenantResourceRefs({ tenantId, resourceType: 'evidence', resourceId, version: 1 }) };
+}

package/dist/internal/contracts/tenant-source-lease.js

@@ -0,0 +1,5 @@
+/** 预算和计划修订不能为同一 Tenant Source 创建并行获取 owner；复用 RuntimeStore 租约。 */
+import { createHash } from 'node:crypto';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantSourceIdSchema } from './tenant-source.js';
+export function tenantSourceLeaseKey(tenantId, sourceId) { return 'tenant-source:' + createHash('sha256').update(JSON.stringify(['TENANT_SOURCE_LEASE_V1', materialTenantIdSchema.parse(tenantId), tenantSourceIdSchema.parse(sourceId)])).digest('hex'); }

package/dist/internal/contracts/tenant-source.js

@@ -0,0 +1,83 @@
+/** 来源获取语义不包含用途、Project、调度启用或秘密；同 URL 不代表同一次获取权限。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { acquisitionTargetSchema } from './project-intent.js';
+import { accessClassificationSchema, sha256Schema, stableUriSchema } from './common.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantStorageKey } from './resource-scope.js';
+export const tenantSourceIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+export const tenantSourceCredentialSchema = z.discriminatedUnion('type', [
+    z.object({ type: z.literal('PUBLIC') }).strict(),
+    z.object({ type: z.literal('BOUND'), bindingRef: stableUriSchema, revision: sha256Schema }).strict(),
+]);
+/** Shared Source/configuration rule: secrets never become acquisition locator parameters. */
+export const isTenantSourceCredentialParameter = (key) => /^(?:password|passwd|secret|cookie|authorization|auth|token|access[_-]?token|refresh[_-]?token|api[_-]?key|signature|x-amz-signature|x-goog-signature)$/i.test(key);
+export const tenantSourceSemanticsSchema = z.object({
+    target: acquisitionTargetSchema,
+    credential: tenantSourceCredentialSchema,
+    executionBinding: z.object({ bindingRef: stableUriSchema, revision: sha256Schema }).strict().nullable().default(null),
+    access: accessClassificationSchema,
+    sourcePolicy: z.object({ ref: stableUriSchema, revision: sha256Schema, acquisition: z.enum(['ALLOW', 'DENY']), propagation: z.enum(['TENANT_ONLY', 'SHARE_ALLOWED', 'PUBLIC_ALLOWED']) }).strict(),
+    region: z.string().trim().min(1).max(128).nullable(),
+    representation: z.object({ format: z.enum(['RAW', 'RICH_DOCUMENT_V1']), extractor: z.object({ id: z.string().trim().min(1).max(128), version: z.string().trim().min(1).max(128) }).strict().nullable() }).strict(),
+}).strict().superRefine((value, ctx) => {
+    if ((value.representation.format === 'RAW') !== (value.representation.extractor === null))
+        ctx.addIssue({ code: 'custom', path: ['representation'], message: 'Derived representation requires its exact registered extractor' });
+    if ((value.target.kind !== 'URL' || value.credential.type === 'BOUND') && value.executionBinding === null)
+        ctx.addIssue({ code: 'custom', path: ['executionBinding'], message: 'FILE, EXECUTOR and authenticated acquisition require an exact runtime binding revision' });
+    if (value.target.kind === 'URL') {
+        const url = new URL(value.target.locator);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || value.target.locator.length > 2048)
+            ctx.addIssue({ code: 'custom', path: ['target'], message: 'URL target must use bounded HTTP without embedded credentials' });
+        if ([...url.searchParams.keys()].some(isTenantSourceCredentialParameter))
+            ctx.addIssue({ code: 'custom', path: ['target'], message: 'Credential query parameters belong in a runtime binding' });
+    }
+    if (value.target.kind === 'EXECUTOR' && Object.keys(value.target.parameters).some(key => /(?:password|secret|cookie|authorization|access[_-]?token|refresh[_-]?token)/i.test(key)))
+        ctx.addIssue({ code: 'custom', path: ['target', 'parameters'], message: 'Secrets belong in a runtime credential binding' });
+});
+export const tenantSourceBasisSchema = z.object({
+    schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, sourceId: tenantSourceIdSchema,
+    title: z.string().trim().min(1).max(512), semantics: tenantSourceSemanticsSchema,
+}).strict().superRefine((value, ctx) => {
+    if (value.semantics.credential.type === 'BOUND') {
+        const prefix = `tenant-credential://${tenantStorageKey(value.tenantId)}/`, ref = value.semantics.credential.bindingRef;
+        if (!ref.startsWith(prefix) || !tenantSourceIdSchema.safeParse(ref.slice(prefix.length)).success)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'credential', 'bindingRef'], message: 'Credential reference must belong to the exact Tenant' });
+    }
+    if (value.semantics.executionBinding !== null) {
+        const prefix = `tenant-execution://${tenantStorageKey(value.tenantId)}/`, ref = value.semantics.executionBinding.bindingRef;
+        if (!ref.startsWith(prefix) || !tenantSourceIdSchema.safeParse(ref.slice(prefix.length)).success)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'executionBinding', 'bindingRef'], message: 'Execution binding must belong to the exact Tenant' });
+    }
+});
+export function tenantSourceRef(tenantId, sourceId) { return `tenant-source://${tenantStorageKey(tenantId)}/${tenantSourceIdSchema.parse(sourceId)}`; }
+export function parseTenantSourceRevisionRef(ref) {
+    const match = /^tenant-source:\/\/([a-f0-9]{64})\/([A-Za-z0-9][A-Za-z0-9._-]{0,127})\/v\/([a-f0-9]{64})$/.exec(ref);
+    return match ? { storageKey: match[1], sourceId: match[2], revision: `sha256:${match[3]}` } : null;
+}
+const canonical = (value) => { if (value === null || typeof value !== 'object')
+    return JSON.stringify(value); if (Array.isArray(value))
+    return '[' + value.map(canonical).join(',') + ']'; const row = value; return '{' + Object.keys(row).sort().map(key => JSON.stringify(key) + ':' + canonical(row[key])).join(',') + '}'; };
+const hash = (value) => 'sha256:' + createHash('sha256').update(canonical(value)).digest('hex');
+/** 已正规化 basis 的唯一指纹算法，canonical reader 与 Identity 关系校验共用。 */
+export function tenantSourceFingerprints(basis) {
+    const sourceRef = tenantSourceRef(basis.tenantId, basis.sourceId), revision = hash(basis);
+    return { sourceRef, revision, revisionRef: `${sourceRef}/v/${revision.slice(7)}`, semanticKey: hash({ tenantId: basis.tenantId, semantics: basis.semantics }), targetId: hash(basis.semantics.target) };
+}
+export const tenantSourceSnapshotSchema = tenantSourceBasisSchema.safeExtend({
+    sourceRef: stableUriSchema, revision: sha256Schema, revisionRef: stableUriSchema, semanticKey: sha256Schema, targetId: sha256Schema,
+}).strict().superRefine((value, ctx) => {
+    const ref = tenantSourceRef(value.tenantId, value.sourceId);
+    if (value.sourceRef !== ref || value.revisionRef !== `${ref}/v/${value.revision.slice(7)}`)
+        ctx.addIssue({ code: 'custom', path: ['revisionRef'], message: 'Source revision must retain exact Tenant and Source identity' });
+    if (value.semantics.target.kind === 'URL') {
+        const url = new URL(value.semantics.target.locator);
+        url.hash = '';
+        if (url.toString() !== value.semantics.target.locator)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'target'], message: 'Snapshot URL must be canonical' });
+    }
+    const { sourceRef, revision, revisionRef, semanticKey, targetId, ...basis } = value, expected = tenantSourceFingerprints(basis);
+    for (const key of ['sourceRef', 'revision', 'revisionRef', 'semanticKey', 'targetId'])
+        if (value[key] !== expected[key])
+            ctx.addIssue({ code: 'custom', path: [key], message: 'Source fingerprint mismatch' });
+});

package/dist/internal/contracts/tenant-web-collection.js

@@ -0,0 +1,118 @@
+/** Tenant 网站采集意图；范围和内容要求不携带 Project 或执行权限。 */
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { isoDateTimeSchema, sha256Schema } from './common.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantStorageKey } from './resource-scope.js';
+import { knowledgeActorContextSchema } from './project-intent.js';
+import { isTenantSourceCredentialParameter } from './tenant-source.js';
+import { tenantCollectionCycleSchema, tenantCollectionMaxBytesSchema } from './tenant-collection.js';
+import { tenantCollectionRequestAuthoritySchema } from './tenant-collection-request.js';
+export const TENANT_WEB_SPEC_CAPABILITY = 'TENANT_WEB_COLLECTION_SPEC_V1';
+export const tenantWebUrlSchema = z.string().url().max(2048).superRefine((raw, ctx) => {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        ctx.addIssue({ code: 'custom', message: 'A valid HTTP URL is required' });
+        return;
+    }
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.hash || url.port || [...url.searchParams.keys()].some(isTenantSourceCredentialParameter))
+        ctx.addIssue({ code: 'custom', message: 'Public HTTP URL without credentials, nonstandard port or fragment required' });
+});
+const originSchema = tenantWebUrlSchema.superRefine((value, ctx) => { try {
+    if (new URL(value).origin === value)
+        return;
+}
+catch { /* Report a schema issue, never an arbitrary URL parser error. */ } ctx.addIssue({ code: 'custom', message: 'An exact HTTP origin is required' }); });
+const pathSchema = z.string().min(1).max(512).superRefine((value, ctx) => {
+    let decoded = '';
+    try {
+        decoded = decodeURIComponent(value);
+    }
+    catch { /* Invalid encoding fails closed below. */ }
+    if (!decoded.startsWith('/') || decoded.startsWith('//') || /[?#\\\x00-\x1f]/.test(decoded) || decoded.split('/').some(part => part === '.' || part === '..') || decoded.replace(/\/\*\*$/, '').includes('*'))
+        ctx.addIssue({ code: 'custom', message: 'Absolute path or terminal /** prefix required' });
+});
+export const tenantWebScopeSchema = z.object({
+    mode: z.enum(['SINGLE_PAGE', 'URL_LIST', 'SITE_SECTION', 'SITEMAP', 'FEED']),
+    allowedOrigins: z.array(originSchema).max(16).default([]),
+    includePaths: z.array(pathSchema).max(32).default([]),
+    excludePaths: z.array(pathSchema).max(32).default([]),
+    urls: z.array(tenantWebUrlSchema).max(64).default([]),
+    followPagination: z.boolean().default(false),
+    followDetailLinks: z.boolean().default(false),
+}).strict();
+const field = z.object({ name: z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/), type: z.enum(['string', 'number', 'boolean', 'object', 'array']), required: z.boolean().default(false) }).strict();
+export const tenantWebRequirementsSchema = z.object({
+    instruction: z.string().trim().min(1).max(4000),
+    fields: z.array(field).max(64).default([]),
+    outputs: z.array(z.enum(['RAW', 'DOCUMENT', 'RECORDS'])).min(1).max(3).default(['RAW', 'DOCUMENT']),
+    attachments: z.array(z.enum(['PDF', 'IMAGE', 'AUDIO', 'VIDEO', 'OTHER'])).max(5).default([]),
+}).strict().superRefine((value, ctx) => { if (new Set(value.fields.map(f => f.name)).size !== value.fields.length)
+    ctx.addIssue({ code: 'custom', message: 'Field names must be unique' }); });
+export const tenantWebDefaultLimits = { maxPages: 100, maxDepth: 3, maxResourceBytes: 16 * 1024 * 1024, maxTotalBytes: 64 * 1024 * 1024, maxRuntimeMs: 300000, maxInteractions: 100, maxFiles: 100 };
+export const tenantWebLimitsSchema = z.object({
+    maxPages: z.number().int().min(1).max(10000).default(100),
+    maxDepth: z.number().int().min(0).max(10).default(3),
+    maxResourceBytes: tenantCollectionMaxBytesSchema.default(16 * 1024 * 1024),
+    maxTotalBytes: z.number().int().min(1024).max(1024 * 1024 * 1024).default(64 * 1024 * 1024),
+    maxRuntimeMs: z.number().int().min(1000).max(900000).default(300000),
+    maxInteractions: z.number().int().min(0).max(1000).default(100),
+    maxFiles: z.number().int().min(0).max(1000).default(100),
+}).strict();
+export const tenantWebSpecSchema = z.object({
+    schemaVersion: z.literal(1), url: tenantWebUrlSchema, scope: tenantWebScopeSchema,
+    requirements: tenantWebRequirementsSchema, limits: tenantWebLimitsSchema.default(tenantWebDefaultLimits),
+    refresh: z.object({ mode: z.literal('ONCE') }).strict().default({ mode: 'ONCE' }),
+}).strict().superRefine((value, ctx) => {
+    try {
+        const origins = value.scope.allowedOrigins.length ? value.scope.allowedOrigins : [new URL(value.url).origin];
+        if (!origins.includes(new URL(value.url).origin) || value.scope.urls.some(url => !origins.includes(new URL(url).origin)))
+            ctx.addIssue({ code: 'custom', path: ['scope'], message: 'Entry and explicit targets must remain in the declared origins' });
+    }
+    catch {
+        ctx.addIssue({ code: 'custom', path: ['scope'], message: 'Valid entry and target URLs are required' });
+    }
+    if ((value.scope.mode === 'URL_LIST') !== (value.scope.urls.length > 0))
+        ctx.addIssue({ code: 'custom', path: ['scope', 'urls'], message: 'Only URL_LIST requires explicit URLs' });
+    if (value.scope.mode === 'SITE_SECTION' && value.scope.includePaths.length === 0)
+        ctx.addIssue({ code: 'custom', path: ['scope', 'includePaths'], message: 'A site section requires an explicit path boundary' });
+    if (value.scope.mode === 'SINGLE_PAGE' && (value.scope.followPagination || value.scope.followDetailLinks))
+        ctx.addIssue({ code: 'custom', path: ['scope'], message: 'Single page cannot enable discovery' });
+});
+export function tenantWebCanonical(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return '[' + value.map(tenantWebCanonical).join(',') + ']';
+    const row = value;
+    return '{' + Object.keys(row).filter(key => row[key] !== undefined).sort().map(key => JSON.stringify(key) + ':' + tenantWebCanonical(row[key])).join(',') + '}';
+}
+const hash = (value) => createHash('sha256').update(tenantWebCanonical(value)).digest('hex');
+export function tenantWebSpecRevision(spec) { return 'sha256:' + hash(tenantWebSpecSchema.parse(spec)); }
+export function tenantWebRequestKey(requestId) { return hash(tenantCollectionCycleSchema.parse(requestId)); }
+export function tenantWebJobRef(tenantId, requestId) { return `tenant-web-collection://${tenantStorageKey(tenantId)}/${tenantWebRequestKey(requestId)}`; }
+export const tenantWebJobRefSchema = z.string().regex(/^tenant-web-collection:\/\/[a-f0-9]{64}\/[a-f0-9]{64}$/);
+export const tenantWebIntentSchema = z.object({
+    schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, requestId: tenantCollectionCycleSchema,
+    jobRef: tenantWebJobRefSchema, inputRevision: sha256Schema, specRevision: sha256Schema, requestedSpec: tenantWebSpecSchema, spec: tenantWebSpecSchema,
+    actor: knowledgeActorContextSchema, authority: tenantCollectionRequestAuthoritySchema, submittedAt: isoDateTimeSchema,
+}).strict().superRefine((value, ctx) => {
+    if (value.actor.tenantId !== value.tenantId || value.jobRef !== tenantWebJobRef(value.tenantId, value.requestId) || value.specRevision !== tenantWebSpecRevision(value.spec) || value.inputRevision !== tenantWebSpecRevision(value.requestedSpec))
+        ctx.addIssue({ code: 'custom', message: 'Intent must preserve exact Tenant and frozen specification identity' });
+    if (value.spec.limits.maxResourceBytes > Math.min(value.requestedSpec.limits.maxResourceBytes, value.requestedSpec.limits.maxTotalBytes) || tenantWebCanonical({ ...value.spec, limits: { ...value.spec.limits, maxResourceBytes: value.requestedSpec.limits.maxResourceBytes } }) !== tenantWebCanonical(value.requestedSpec))
+        ctx.addIssue({ code: 'custom', message: 'Intake may only narrow the resource byte limit' });
+});
+/** S1 仅证明意图持久化；不制造待采列表、原件、时效或准入成功。 */
+export const tenantWebSummarySchema = z.object({
+    requestId: tenantCollectionCycleSchema, jobRef: tenantWebJobRefSchema, specRevision: sha256Schema, submittedAt: isoDateTimeSchema,
+    phase: z.literal('WEB_INTENT_PERSISTED'), state: z.literal('ACCEPTED'), execution: z.literal('UNAVAILABLE'),
+    reason: z.literal('S2_NOT_IMPLEMENTED'), completion: z.null(), networkValidated: z.literal(false), budgetReserved: z.literal(false),
+    requirementsState: z.literal('DECLARED_NOT_EVALUATED'),
+    coverage: z.object({ state: z.literal('NOT_STARTED'), total: z.null(), discovered: z.literal(0), acquired: z.literal(0), extracted: z.literal(0), registered: z.literal(0) }).strict(),
+}).strict().superRefine((value, ctx) => {
+    if (new URL(value.jobRef).pathname !== `/${tenantWebRequestKey(value.requestId)}`)
+        ctx.addIssue({ code: 'custom', message: 'Summary request identity must match its exact intent reference' });
+});

package/dist/internal/contracts/tenant-web-content-plan.js

@@ -0,0 +1,39 @@
+/** Read-only extraction plans; no executable selectors, scripts, prompts or authority. */
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { tenantWebCanonical, tenantWebRequirementsSchema } from './tenant-web-collection.js';
+export const TENANT_WEB_CONTENT_CAPABILITY = 'TENANT_WEB_CONTENT_V1';
+export const TENANT_WEB_CONTENT_EXTRACTOR = { id: 'native-knowledge.web-content', version: '1.0.0' };
+// A deliberately bounded CSS subset: compound tag/id/classes, descendant and child only.
+const atom = '(?:[A-Za-z][A-Za-z0-9_-]*|\\*)?(?:[.#][A-Za-z_][A-Za-z0-9_-]*)*';
+export const tenantWebContentSelectorSchema = z.string().trim().min(1).max(256).refine(s => s.split(/\s*>\s*|\s+/).length <= 8 && new RegExp('^' + atom + '(?:\\s*>\\s*' + atom + '|\\s+' + atom + ')*$').test(s) && s.split(/\s*>\s*|\s+/).every(Boolean), 'Unsupported read-only selector').describe('Read-only CSS subset: tag/id/classes, descendant or child (>) only; max 8 segments, no pseudos or scripts');
+const rule = z.object({ name: z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/), selector: tenantWebContentSelectorSchema, value: z.enum(['TEXT', 'ATTRIBUTE', 'JSON']).default('TEXT'), attribute: z.enum(['href', 'src', 'content', 'datetime', 'value', 'title', 'alt']).nullable().default(null) }).strict().refine(v => (v.value === 'ATTRIBUTE') === (v.attribute !== null));
+export const tenantWebContentPlanSchema = z.object({ schemaVersion: z.literal(1), compiler: z.enum(['CALLER_PLAN_V1', 'BOUNDED_LANGUAGE_V1']), extractor: z.object({ id: z.literal('native-knowledge.web-content'), version: z.literal('1.0.0') }).strict(), body: z.boolean(), tables: z.boolean(), links: z.boolean(), recordSelector: tenantWebContentSelectorSchema.nullable(), fields: z.array(z.object({ ...tenantWebRequirementsSchema.shape.fields.unwrap().element.shape, ...rule.shape })).max(64), maxRecords: z.number().int().min(1).max(100).default(50) }).strict().superRefine((v, c) => { if (v.fields.some(f => (f.value === 'ATTRIBUTE') !== (f.attribute !== null)) || new Set(v.fields.map(f => f.name)).size !== v.fields.length)
+    c.addIssue({ code: 'custom', message: 'Invalid field rule' }); });
+export const tenantWebContentInputSchema = z.discriminatedUnion('mode', [z.object({ mode: z.literal('NATURAL_LANGUAGE') }).strict(), z.object({ mode: z.literal('COMPILED'), extractor: z.object({ id: z.literal('native-knowledge.web-content'), version: z.literal('1.0.0') }).strict().default(TENANT_WEB_CONTENT_EXTRACTOR), body: z.boolean().default(false), tables: z.boolean().default(false), links: z.boolean().default(false), recordSelector: tenantWebContentSelectorSchema.nullable().default(null), fields: z.array(rule).max(64).default([]), maxRecords: z.number().int().min(1).max(100).default(50) }).strict()]).describe('NATURAL_LANGUAGE supports bounded body/tables/links combinations in Chinese or English. Otherwise provide COMPILED rules; no model calls.');
+export function compileTenantWebContent(requirements, raw) {
+    const input = tenantWebContentInputSchema.parse(raw);
+    let body = false, tables = false, links = false;
+    if (input.mode === 'NATURAL_LANGUAGE') {
+        const words = requirements.instruction.toLowerCase().replace(/^(?:请)?(?:采集|提取|获取|collect|extract)\s*/, '').split(/\s*(?:、|，|,|和|及|与|\band\b)\s*/).map(w => w.trim()).filter(Boolean);
+        for (const word of words) {
+            if (['正文', 'body', 'text', 'body text'].includes(word))
+                body = true;
+            else if (['表格', 'tables', 'table'].includes(word))
+                tables = true;
+            else if (['链接', 'links'].includes(word))
+                links = true;
+            else
+                throw new Error('TENANT_WEB_SEMANTIC_COMPILER_UNAVAILABLE');
+        }
+        if (!words.length || requirements.fields.length)
+            throw new Error('TENANT_WEB_SEMANTIC_COMPILER_UNAVAILABLE');
+    }
+    const rules = input.mode === 'COMPILED' ? input.fields : [];
+    if (rules.length !== requirements.fields.length || rules.some(f => !requirements.fields.some(v => v.name === f.name)))
+        throw new Error('TENANT_WEB_CONTENT_FIELD_PLAN_REQUIRED');
+    if (requirements.outputs.includes('RECORDS') && !requirements.fields.length)
+        throw new Error('TENANT_WEB_CONTENT_FIELD_PLAN_REQUIRED');
+    return tenantWebContentPlanSchema.parse({ schemaVersion: 1, compiler: input.mode === 'COMPILED' ? 'CALLER_PLAN_V1' : 'BOUNDED_LANGUAGE_V1', extractor: TENANT_WEB_CONTENT_EXTRACTOR, body: input.mode === 'COMPILED' ? input.body : body, tables: input.mode === 'COMPILED' ? input.tables : tables, links: input.mode === 'COMPILED' ? input.links : links, recordSelector: input.mode === 'COMPILED' ? input.recordSelector : null, fields: requirements.fields.map(f => ({ ...f, ...rules.find(r => r.name === f.name) })), maxRecords: input.mode === 'COMPILED' ? input.maxRecords : 50 });
+}
+export const tenantWebContentRevision = (plan) => 'sha256:' + createHash('sha256').update(tenantWebCanonical(tenantWebContentPlanSchema.parse(plan))).digest('hex');

package/dist/internal/contracts/tenant-web-content-result.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { isoDateTimeSchema, sha256Schema } from './common.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantResourceRefSchema, parseTenantResourceRef, tenantStorageKey } from './resource-scope.js';
+import { tenantWebJobRefSchema, tenantWebUrlSchema } from './tenant-web-collection.js';
+import { tenantWebFieldResultSchema } from './tenant-web-results.js';
+import { TENANT_WEB_CONTENT_EXTRACTOR } from './tenant-web-content-plan.js';
+export const TENANT_WEB_CONTENT_MEDIA_TYPE = 'application/vnd.knowledge-v2.tenant-web-content+json';
+export const tenantWebContentDocumentSchema = z.object({ schemaVersion: z.literal(1), format: z.literal('TENANT_WEB_CONTENT_V1'), tenantId: materialTenantIdSchema, jobRef: tenantWebJobRefSchema, planRevision: sha256Schema, extractor: z.object({ id: z.literal(TENANT_WEB_CONTENT_EXTRACTOR.id), version: z.literal(TENANT_WEB_CONTENT_EXTRACTOR.version) }).strict(), dependencies: z.array(z.object({ id: z.string().min(1).max(128), version: z.string().min(1).max(64) }).strict()).min(1).max(8), propagation: z.literal('TENANT_ONLY'), reviewState: z.literal('UNREVIEWED'), parentEvidenceRef: tenantResourceRefSchema, sourceContentHash: sha256Schema, sourceByteLength: z.number().int().nonnegative(), sourceMediaType: z.string().min(1).max(256), sourceUri: tenantWebUrlSchema, observedAt: isoDateTimeSchema, extractedAt: isoDateTimeSchema, outputs: z.array(tenantWebFieldResultSchema).max(4), records: z.array(z.object({ ordinal: z.number().int().min(0).max(99), fields: z.array(tenantWebFieldResultSchema).max(64) }).strict()).max(100), gaps: z.array(z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/)).max(32) }).strict().superRefine((v, c) => {
+    const key = tenantStorageKey(v.tenantId), parent = parseTenantResourceRef(v.parentEvidenceRef);
+    if (parent?.storageKey !== key || parent.resourceType !== 'evidence' || new URL(v.jobRef).hostname !== key || [...v.outputs, ...v.records.flatMap(r => r.fields)].some(f => f.citations.some(cite => cite.evidenceRef !== v.parentEvidenceRef || cite.contentHash !== v.sourceContentHash)))
+        c.addIssue({ code: 'custom', message: 'Content must cite its exact Tenant original' });
+    if (v.records.some((r, i) => r.ordinal !== i))
+        c.addIssue({ code: 'custom', message: 'Record order must be exact' });
+});

package/dist/internal/contracts/tenant-web-content.js

@@ -0,0 +1,16 @@
+/** S4 composes frozen S3 acquisition with a separately versioned derived plan. */
+import { z } from 'zod';
+import { sha256Schema, isoDateTimeSchema } from './common.js';
+import { tenantWebDynamicJobSchema, tenantWebDynamicHeadSchema, tenantWebDynamicStatusSchema, tenantWebDynamicStatus } from './tenant-web-dynamic.js';
+import { tenantWebJobRefSchema } from './tenant-web-collection.js';
+import { tenantWebContentPlanSchema, tenantWebContentRevision } from './tenant-web-content-plan.js';
+import { tenantResourceRefSchema, parseTenantResourceRef } from './resource-scope.js';
+export const tenantWebContentJobSchema = z.object({ ...tenantWebDynamicJobSchema.shape, schemaVersion: z.literal(4), contentPlan: tenantWebContentPlanSchema, contentRevision: sha256Schema, retainedFrom: tenantWebJobRefSchema.nullable() }).strict().superRefine((v, c) => {
+    if (v.contentRevision !== tenantWebContentRevision(v.contentPlan) || v.retainedFrom && (v.retainedFrom === v.intent.jobRef || new URL(v.retainedFrom).hostname !== new URL(v.intent.jobRef).hostname) || JSON.stringify(v.contentPlan.fields.map(({ name, type, required }) => ({ name, type, required }))) !== JSON.stringify(v.intent.spec.requirements.fields))
+        c.addIssue({ code: 'custom', message: 'Frozen content plan identity mismatch' });
+});
+const count = z.number().int().min(0).max(22000);
+export const tenantWebContentHeadSchema = z.object({ schemaVersion: z.literal(1), seq: z.number().int().nonnegative(), cursor: count, variant: z.number().int().min(-1).max(100), processed: count, registered: count, missing: count, attempts: z.number().int().min(0).max(3), chargedBytes: z.number().int().nonnegative(), chargedMs: z.number().int().nonnegative(), reservation: z.object({ bytes: z.number().int().nonnegative(), ms: z.number().int().nonnegative() }).strict().nullable(), state: z.enum(['QUEUED', 'RUNNING', 'COMPLETE', 'PARTIAL']), gaps: z.array(z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/)).max(32), finishedAt: isoDateTimeSchema.nullable() }).strict().refine(v => v.registered <= v.processed && v.missing <= v.processed && (['COMPLETE', 'PARTIAL'].includes(v.state) === (v.finishedAt !== null)) && (v.state !== 'COMPLETE' || !v.gaps.length && !v.missing && !v.reservation) && (v.state !== 'PARTIAL' || v.gaps.length > 0));
+export const tenantWebContentOutcomeSchema = z.object({ schemaVersion: z.literal(1), index: count, ordinal: z.number().int().min(0).max(10999), variant: z.number().int().min(-1).max(100), documentRef: tenantResourceRefSchema.nullable(), gaps: tenantWebContentHeadSchema.shape.gaps }).strict().refine(v => !v.documentRef || parseTenantResourceRef(v.documentRef)?.resourceType === 'source_document');
+export const tenantWebContentStatusSchema = z.object({ ...tenantWebDynamicStatusSchema.shape, phase: z.enum(['DYNAMIC_ACQUISITION', 'CONTENT_DERIVATION']), requirementsState: z.enum(['PENDING', 'SATISFIED', 'PARTIAL']), contentRevision: sha256Schema, content: z.object({ processed: count, registered: count, missing: count, gaps: tenantWebContentHeadSchema.shape.gaps, compiler: tenantWebContentPlanSchema.shape.compiler, model: z.literal('DISABLED_NO_MODEL_CALLS') }).strict() }).strict();
+export function tenantWebContentStatus(job, a, h) { const base = tenantWebDynamicStatus(tenantWebDynamicJobSchema.parse({ schemaVersion: 3, intent: job.intent, policy: job.policy }), a), acquiring = !['COMPLETE', 'PARTIAL'].includes(a.state) && !job.retainedFrom; return tenantWebContentStatusSchema.parse({ ...base, contentRevision: job.contentRevision, phase: acquiring ? 'DYNAMIC_ACQUISITION' : 'CONTENT_DERIVATION', state: acquiring ? a.state : h.state, requirementsState: ['COMPLETE', 'PARTIAL'].includes(h.state) ? h.state === 'COMPLETE' && a.state === 'COMPLETE' ? 'SATISFIED' : 'PARTIAL' : 'PENDING', content: { processed: h.processed, registered: h.registered, missing: h.missing, gaps: h.gaps, compiler: job.contentPlan.compiler, model: 'DISABLED_NO_MODEL_CALLS' }, budget: { chargedBytes: (job.retainedFrom ? 0 : a.chargedBytes) + h.chargedBytes, chargedMs: (job.retainedFrom ? 0 : a.chargedMs) + h.chargedMs, conservativeReservation: !job.retainedFrom && a.reservation !== null || h.reservation !== null }, finishedAt: h.finishedAt, nextEligibleAt: acquiring ? a.notBefore : null }); }