@native-knowledge/knowledge-sdk 0.0.0-stage → 0.1.0-rc.2

package/dist/internal/contracts/tenant-collection.d.ts

@@ -0,0 +1,199 @@
+import { z } from 'zod';
+import { type TenantSourceSnapshot } from './tenant-source.js';
+export declare const tenantCollectionCycleSchema: z.ZodString;
+export declare const tenantCollectionMaxBytesSchema: z.ZodNumber;
+export declare const tenantCollectionPlanSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    source: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        tenantId: z.ZodString;
+        sourceId: z.ZodString;
+        title: z.ZodString;
+        semantics: z.ZodObject<{
+            target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"URL">;
+                locator: z.ZodURL;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"FILE">;
+                rootBinding: z.ZodString;
+                relativePath: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"EXECUTOR">;
+                executorId: z.ZodString;
+                bindingRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>>;
+            }, z.core.$strict>], "kind">;
+            credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"PUBLIC">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"BOUND">;
+                bindingRef: z.ZodString;
+                revision: z.ZodString;
+            }, z.core.$strict>], "type">;
+            executionBinding: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                bindingRef: z.ZodString;
+                revision: z.ZodString;
+            }, z.core.$strict>>>;
+            access: z.ZodEnum<{
+                PUBLIC: "PUBLIC";
+                PUBLIC_METADATA: "PUBLIC_METADATA";
+                TENANT: "TENANT";
+                INTERNAL: "INTERNAL";
+                FDE_INTERNAL: "FDE_INTERNAL";
+                ACCESS_CONTROLLED: "ACCESS_CONTROLLED";
+                UNKNOWN: "UNKNOWN";
+            }>;
+            sourcePolicy: z.ZodObject<{
+                ref: z.ZodString;
+                revision: z.ZodString;
+                acquisition: z.ZodEnum<{
+                    ALLOW: "ALLOW";
+                    DENY: "DENY";
+                }>;
+                propagation: z.ZodEnum<{
+                    TENANT_ONLY: "TENANT_ONLY";
+                    SHARE_ALLOWED: "SHARE_ALLOWED";
+                    PUBLIC_ALLOWED: "PUBLIC_ALLOWED";
+                }>;
+            }, z.core.$strict>;
+            region: z.ZodNullable<z.ZodString>;
+            representation: z.ZodObject<{
+                format: z.ZodEnum<{
+                    RICH_DOCUMENT_V1: "RICH_DOCUMENT_V1";
+                    RAW: "RAW";
+                }>;
+                extractor: z.ZodNullable<z.ZodObject<{
+                    id: z.ZodString;
+                    version: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        sourceRef: z.ZodString;
+        revision: z.ZodString;
+        revisionRef: z.ZodString;
+        semanticKey: z.ZodString;
+        targetId: z.ZodString;
+    }, z.core.$strict>;
+    maxResourceBytes: z.ZodNumber;
+    revision: z.ZodString;
+    planRef: z.ZodString;
+    workloadId: z.ZodString;
+}, z.core.$strict>;
+export declare function createTenantCollectionPlan(raw: TenantSourceSnapshot, maxBytes?: number): {
+    schemaVersion: 1;
+    tenantId: string;
+    source: {
+        schemaVersion: 1;
+        tenantId: string;
+        sourceId: string;
+        title: string;
+        semantics: {
+            target: {
+                kind: "EXECUTOR";
+                executorId: string;
+                bindingRef: string | null;
+                parameters: Record<string, string | number | boolean | (string | number | boolean | null)[] | null>;
+            } | {
+                kind: "URL";
+                locator: string;
+            } | {
+                kind: "FILE";
+                rootBinding: string;
+                relativePath: string;
+            };
+            credential: {
+                type: "PUBLIC";
+            } | {
+                type: "BOUND";
+                bindingRef: string;
+                revision: string;
+            };
+            executionBinding: {
+                bindingRef: string;
+                revision: string;
+            } | null;
+            access: "PUBLIC" | "PUBLIC_METADATA" | "TENANT" | "INTERNAL" | "FDE_INTERNAL" | "ACCESS_CONTROLLED" | "UNKNOWN";
+            sourcePolicy: {
+                ref: string;
+                revision: string;
+                acquisition: "ALLOW" | "DENY";
+                propagation: "TENANT_ONLY" | "SHARE_ALLOWED" | "PUBLIC_ALLOWED";
+            };
+            region: string | null;
+            representation: {
+                format: "RICH_DOCUMENT_V1" | "RAW";
+                extractor: {
+                    id: string;
+                    version: string;
+                } | null;
+            };
+        };
+        sourceRef: string;
+        revision: string;
+        revisionRef: string;
+        semanticKey: string;
+        targetId: string;
+    };
+    maxResourceBytes: number;
+    revision: string;
+    planRef: string;
+    workloadId: string;
+};
+export declare function parseTenantCollectionPlanRef(ref: string): {
+    storageKey: string;
+    revision: string;
+} | null;
+export declare function tenantCollectionBatchIdentity(tenantId: string, planRevision: string, trigger: 'MANUAL' | 'DUE', cycleId: string): {
+    batchId: string;
+    batchRef: string;
+};
+export declare function parseTenantCollectionBatchRef(ref: string): {
+    storageKey: string;
+    batchId: string;
+} | null;
+export declare function tenantCapturedEvidenceIdentity(input: {
+    tenantId: string;
+    batchRef: string;
+    sourceRevisionRef: string;
+}): {
+    identityRef: string;
+    ref: string;
+    resourceId: string;
+};
+export declare const tenantCollectionBatchSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    tenantId: z.ZodString;
+    sourceId: z.ZodString;
+    sourceRevisionRef: z.ZodString;
+    planRef: z.ZodString;
+    planRevision: z.ZodString;
+    cycleId: z.ZodString;
+    trigger: z.ZodEnum<{
+        MANUAL: "MANUAL";
+        DUE: "DUE";
+    }>;
+    createdAt: z.ZodISODateTime;
+    batchId: z.ZodString;
+    batchRef: z.ZodString;
+}, z.core.$strict>;
+export type TenantCollectionPlan = z.infer<typeof tenantCollectionPlanSchema>;
+export type TenantCollectionBatch = z.infer<typeof tenantCollectionBatchSchema>;
+/** ACQUIRED 是原件事实；Catalog、登记和派生状态由各自阶段回执报告。 */
+export declare const tenantCollectionCaptureSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    batchRef: z.ZodString;
+    sourceRevisionRef: z.ZodString;
+    taskId: z.ZodString;
+    evidenceRef: z.ZodString;
+    contentHash: z.ZodString;
+    byteLength: z.ZodNumber;
+    mediaType: z.ZodString;
+    observedAt: z.ZodISODateTime;
+    finalLocator: z.ZodString;
+    httpStatus: z.ZodNullable<z.ZodNumber>;
+    acquisitionRevision: z.ZodNullable<z.ZodString>;
+    headersRecorded: z.ZodBoolean;
+}, z.core.$strict>;
+export type TenantCollectionCapture = z.infer<typeof tenantCollectionCaptureSchema>;

package/dist/internal/contracts/tenant-collection.js

@@ -0,0 +1,66 @@
+/** 新批次只冻结真实 Tenant/Source/执行输入；用途和请求归因留在管理审计，collector 看不到它们。 */
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { isoDateTimeSchema, sha256Schema, stableUriSchema } from './common.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantStorageKey, tenantResourceRefs } from './resource-scope.js';
+import { tenantSourceSnapshotSchema, tenantSourceIdSchema, parseTenantSourceRevisionRef } from './tenant-source.js';
+export const tenantCollectionCycleSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+export const tenantCollectionMaxBytesSchema = z.number().int().min(1024).max(64 * 1024 * 1024);
+const hash = (value) => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+function planIdentity(tenantId, sourceRevisionRef, semanticKey, maxResourceBytes) {
+    const revision = 'sha256:' + hash(['TENANT_COLLECTION_PLAN_V1', sourceRevisionRef, semanticKey, maxResourceBytes]), key = tenantStorageKey(tenantId);
+    return { revision, planRef: `tenant-collection-plan://${key}/${revision.slice(7)}`, workloadId: `tenant:${key}:collect:${revision.slice(7)}` };
+}
+export const tenantCollectionPlanSchema = z.object({ schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, source: tenantSourceSnapshotSchema, maxResourceBytes: tenantCollectionMaxBytesSchema, revision: sha256Schema, planRef: stableUriSchema, workloadId: z.string().min(1).max(256) }).strict().superRefine((value, ctx) => {
+    const expected = planIdentity(value.tenantId, value.source.revisionRef, value.source.semanticKey, value.maxResourceBytes);
+    if (value.source.tenantId !== value.tenantId)
+        ctx.addIssue({ code: 'custom', path: ['tenantId'], message: 'Plan Source must belong to the exact Tenant' });
+    for (const key of ['revision', 'planRef', 'workloadId'])
+        if (value[key] !== expected[key])
+            ctx.addIssue({ code: 'custom', path: [key], message: 'Frozen plan identity mismatch' });
+});
+export function createTenantCollectionPlan(raw, maxBytes = 16 * 1024 * 1024) {
+    const source = tenantSourceSnapshotSchema.parse(raw), maxResourceBytes = tenantCollectionMaxBytesSchema.parse(maxBytes);
+    return tenantCollectionPlanSchema.parse({ schemaVersion: 1, tenantId: source.tenantId, source, maxResourceBytes, ...planIdentity(source.tenantId, source.revisionRef, source.semanticKey, maxResourceBytes) });
+}
+export function parseTenantCollectionPlanRef(ref) { const match = /^tenant-collection-plan:\/\/([a-f0-9]{64})\/([a-f0-9]{64})$/.exec(ref); return match ? { storageKey: match[1], revision: 'sha256:' + match[2] } : null; }
+export function tenantCollectionBatchIdentity(tenantId, planRevision, trigger, cycleId) {
+    const batchId = 'batch_' + hash(['TENANT_COLLECTION_BATCH_V1', tenantId, sha256Schema.parse(planRevision), trigger, tenantCollectionCycleSchema.parse(cycleId)]);
+    return { batchId, batchRef: `tenant-collection-batch://${tenantStorageKey(tenantId)}/${batchId}` };
+}
+export function parseTenantCollectionBatchRef(ref) { const match = /^tenant-collection-batch:\/\/([a-f0-9]{64})\/(batch_[a-f0-9]{64})$/.exec(ref); return match ? { storageKey: match[1], batchId: match[2] } : null; }
+export function tenantCapturedEvidenceIdentity(input) {
+    const batch = parseTenantCollectionBatchRef(input.batchRef), source = parseTenantSourceRevisionRef(input.sourceRevisionRef), key = tenantStorageKey(input.tenantId);
+    if (!batch || !source || batch.storageKey !== key || source.storageKey !== key)
+        throw new Error('TENANT_CAPTURE_IDENTITY_MISMATCH');
+    const resourceId = 'ev_' + hash(['TENANT_CAPTURE_V1', input.batchRef, input.sourceRevisionRef]);
+    return { resourceId, ...tenantResourceRefs({ tenantId: input.tenantId, resourceType: 'evidence', resourceId, version: 1 }) };
+}
+export const tenantCollectionBatchSchema = z.object({
+    schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, sourceId: tenantSourceIdSchema, sourceRevisionRef: stableUriSchema,
+    planRef: stableUriSchema, planRevision: sha256Schema, cycleId: tenantCollectionCycleSchema, trigger: z.enum(['MANUAL', 'DUE']), createdAt: isoDateTimeSchema,
+    batchId: z.string().regex(/^batch_[a-f0-9]{64}$/), batchRef: stableUriSchema,
+}).strict().superRefine((value, ctx) => {
+    const source = parseTenantSourceRevisionRef(value.sourceRevisionRef), plan = parseTenantCollectionPlanRef(value.planRef), key = tenantStorageKey(value.tenantId), expected = tenantCollectionBatchIdentity(value.tenantId, value.planRevision, value.trigger, value.cycleId);
+    if (!source || source.storageKey !== key || source.sourceId !== value.sourceId || !plan || plan.storageKey !== key || plan.revision !== value.planRevision)
+        ctx.addIssue({ code: 'custom', path: ['sourceRevisionRef'], message: 'Batch must retain exact Tenant Source and plan identity' });
+    if (value.batchId !== expected.batchId || value.batchRef !== expected.batchRef)
+        ctx.addIssue({ code: 'custom', path: ['batchRef'], message: 'Batch identity mismatch' });
+});
+/** ACQUIRED 是原件事实；Catalog、登记和派生状态由各自阶段回执报告。 */
+export const tenantCollectionCaptureSchema = z.object({
+    schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, batchRef: stableUriSchema, sourceRevisionRef: stableUriSchema, taskId: z.string().regex(/^task_[a-f0-9]{64}$/),
+    evidenceRef: stableUriSchema, contentHash: sha256Schema, byteLength: z.number().int().nonnegative().max(64 * 1024 * 1024), mediaType: z.string().trim().min(1).max(256),
+    observedAt: isoDateTimeSchema, finalLocator: stableUriSchema, httpStatus: z.number().int().min(100).max(599).nullable(), acquisitionRevision: z.string().max(4096).nullable(), headersRecorded: z.boolean(),
+}).strict().superRefine((value, ctx) => {
+    try {
+        if (tenantCapturedEvidenceIdentity(value).ref !== value.evidenceRef)
+            ctx.addIssue({ code: 'custom', path: ['evidenceRef'], message: 'Capture must retain exact batch/source Evidence identity' });
+    }
+    catch {
+        ctx.addIssue({ code: 'custom', path: ['batchRef'], message: 'Capture Tenant identity mismatch' });
+    }
+    if (!value.headersRecorded && (value.httpStatus !== null || value.acquisitionRevision !== null))
+        ctx.addIssue({ code: 'custom', path: ['headersRecorded'], message: 'Recovery cannot invent missing acquisition headers' });
+});

package/dist/internal/contracts/tenant-currentness.d.ts

@@ -0,0 +1,117 @@
+/** 原生资料的快照时效不把 raw carrier 冒充 Evidence，也不证明外部业务事实。 */
+import { z } from 'zod';
+export declare function tenantSnapshotDeclarationRef(tenantId: string, subjectRef: string): string;
+export declare const tenantSnapshotDeclarationSchema: z.ZodObject<{
+    basis: z.ZodLiteral<"RETAINED_SNAPSHOT">;
+    snapshotAt: z.ZodISODateTime;
+    sourceRevisionRef: z.ZodOptional<z.ZodString>;
+    policy: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        dueAfterSeconds: z.ZodNumber;
+        staleAfterSeconds: z.ZodNumber;
+        staleAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+        unknownAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+        blockedAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+    }, z.core.$strict>;
+    declaredAt: z.ZodISODateTime;
+    actor: z.ZodObject<{
+        tenantId: z.ZodString;
+        userId: z.ZodString;
+        agentId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>;
+    authority: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"HOST">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"OAUTH">;
+        authorityVersion: z.ZodLiteral<2>;
+        clientId: z.ZodString;
+        grantId: z.ZodString;
+        resource: z.ZodString;
+    }, z.core.$strict>], "type">;
+    tenantId: z.ZodString;
+    subjectRef: z.ZodString;
+    resourceType: z.ZodString;
+    contentHash: z.ZodString;
+    schemaVersion: z.ZodLiteral<1>;
+    ref: z.ZodString;
+}, z.core.$strict>;
+export declare const tenantMaterialCurrentnessSchema: z.ZodObject<{
+    observedAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    sourceRevisionRef: z.ZodOptional<z.ZodString>;
+    lastAttemptAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    assessedAt: z.ZodISODateTime;
+    state: z.ZodEnum<{
+        UNKNOWN: "UNKNOWN";
+        DUE: "DUE";
+        CURRENT: "CURRENT";
+        STALE: "STALE";
+        BLOCKED: "BLOCKED";
+    }>;
+    action: z.ZodEnum<{
+        ALLOW: "ALLOW";
+        REVIEW_REQUIRED: "REVIEW_REQUIRED";
+        DENY: "DENY";
+    }>;
+    reasonCode: z.ZodEnum<{
+        CURRENT_WITHIN_CADENCE: "CURRENT_WITHIN_CADENCE";
+        REFRESH_DUE: "REFRESH_DUE";
+        STALE_AFTER_THRESHOLD: "STALE_AFTER_THRESHOLD";
+        SOURCE_BLOCKED: "SOURCE_BLOCKED";
+        SOURCE_CONTENT_CHANGED: "SOURCE_CONTENT_CHANGED";
+        NO_SUCCESSFUL_OBSERVATION: "NO_SUCCESSFUL_OBSERVATION";
+    }>;
+    policy: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        dueAfterSeconds: z.ZodNumber;
+        staleAfterSeconds: z.ZodNumber;
+        staleAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+        unknownAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+        blockedAction: z.ZodDefault<z.ZodEnum<{
+            ALLOW: "ALLOW";
+            REVIEW_REQUIRED: "REVIEW_REQUIRED";
+            DENY: "DENY";
+        }>>;
+    }, z.core.$strict>;
+    lastSuccessAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    dueAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    staleAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+    ageSeconds: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    basis: z.ZodLiteral<"RETAINED_SNAPSHOT">;
+    basisRef: z.ZodString;
+    declarationRef: z.ZodString;
+    tenantId: z.ZodString;
+    subjectRef: z.ZodString;
+    resourceType: z.ZodString;
+    contentHash: z.ZodString;
+    schemaVersion: z.ZodLiteral<2>;
+    subjectKind: z.ZodLiteral<"MATERIAL">;
+}, z.core.$strict>;
+export declare const tenantSnapshotInputSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    subjectRef: z.ZodString;
+    expectedContentHash: z.ZodString;
+    freshnessSeconds: z.ZodNumber;
+}, z.core.$strict>;
+export type TenantSnapshotDeclaration = z.infer<typeof tenantSnapshotDeclarationSchema>;
+export type TenantMaterialCurrentness = z.infer<typeof tenantMaterialCurrentnessSchema>;
+export declare function tenantMaterialCurrentnessRevision(raw: TenantMaterialCurrentness): string;

package/dist/internal/contracts/tenant-currentness.js

@@ -0,0 +1,26 @@
+/** 原生资料的快照时效不把 raw carrier 冒充 Evidence，也不证明外部业务事实。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { currentnessAssessmentSchema, currentnessPolicySchema } from './currentness.js';
+import { knowledgeActorContextSchema } from './project-intent.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantStorageKey, tenantResourceRefSchema, parseTenantResourceRef } from './resource-scope.js';
+import { sha256Schema, isoDateTimeSchema, stableUriSchema } from './common.js';
+import { tenantInvocationAuthoritySchema, tenantManagementRequestIdSchema } from './tenant-management.js';
+export function tenantSnapshotDeclarationRef(tenantId, subjectRef) { return `tenant-currentness://${tenantStorageKey(tenantId)}/snapshot/${createHash('sha256').update(tenantResourceRefSchema.parse(subjectRef)).digest('hex')}`; }
+const identity = { tenantId: materialTenantIdSchema, subjectRef: tenantResourceRefSchema, resourceType: z.string().regex(/^[a-z][a-z0-9._-]{0,63}$/), contentHash: sha256Schema };
+const identityValid = (value) => { const ref = parseTenantResourceRef(value.subjectRef); return ref?.storageKey === tenantStorageKey(value.tenantId) && ref.resourceType === value.resourceType; };
+export const tenantSnapshotDeclarationSchema = z.object({ schemaVersion: z.literal(1), ref: stableUriSchema, ...identity, basis: z.literal('RETAINED_SNAPSHOT'), snapshotAt: isoDateTimeSchema, sourceRevisionRef: stableUriSchema.optional(), policy: currentnessPolicySchema, declaredAt: isoDateTimeSchema, actor: knowledgeActorContextSchema, authority: tenantInvocationAuthoritySchema }).strict().superRefine((v, ctx) => {
+    if (!identityValid(v) || v.ref !== tenantSnapshotDeclarationRef(v.tenantId, v.subjectRef) || v.actor.tenantId !== v.tenantId || !v.actor.userId || Date.parse(v.snapshotAt) > Date.parse(v.declaredAt))
+        ctx.addIssue({ code: 'custom', message: 'Snapshot declaration retains actual resource, actor and original observation time' });
+    if ([v.policy.staleAction, v.policy.unknownAction, v.policy.blockedAction].includes('ALLOW'))
+        ctx.addIssue({ code: 'custom', message: 'Unknown, blocked and stale snapshots cannot become ALLOW' });
+});
+export const tenantMaterialCurrentnessSchema = z.object({ ...currentnessAssessmentSchema.shape }).omit({ schemaVersion: true, subjectKind: true, projectRef: true }).extend({ schemaVersion: z.literal(2), subjectKind: z.literal('MATERIAL'), ...identity, basis: z.literal('RETAINED_SNAPSHOT'), basisRef: tenantResourceRefSchema, declarationRef: stableUriSchema }).strict().superRefine((v, ctx) => {
+    if (!identityValid(v) || v.basisRef !== v.subjectRef || v.declarationRef !== tenantSnapshotDeclarationRef(v.tenantId, v.subjectRef) || v.lastSuccessAt === null || v.observedAt !== v.lastSuccessAt || v.lastAttemptAt !== v.lastSuccessAt || Date.parse(v.lastSuccessAt) > Date.parse(v.assessedAt))
+        ctx.addIssue({ code: 'custom', message: 'Currentness retains exact saved snapshot identity and original time' });
+    if ([v.policy.staleAction, v.policy.unknownAction, v.policy.blockedAction].includes('ALLOW'))
+        ctx.addIssue({ code: 'custom', message: 'Snapshot policy fails closed' });
+});
+export const tenantSnapshotInputSchema = z.object({ requestId: tenantManagementRequestIdSchema, subjectRef: tenantResourceRefSchema, expectedContentHash: sha256Schema, freshnessSeconds: z.number().int().min(60).max(86400) }).strict();
+export function tenantMaterialCurrentnessRevision(raw) { return 'sha256:' + createHash('sha256').update(JSON.stringify(tenantMaterialCurrentnessSchema.parse(raw))).digest('hex'); }