@native-knowledge/knowledge-sdk 0.0.0-stage → 0.1.0-rc.2

package/dist/internal/contracts/tenant-source.d.ts

@@ -0,0 +1,223 @@
+/** 来源获取语义不包含用途、Project、调度启用或秘密；同 URL 不代表同一次获取权限。 */
+import { z } from 'zod';
+export declare const tenantSourceIdSchema: z.ZodString;
+export declare const tenantSourceCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"PUBLIC">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"BOUND">;
+    bindingRef: z.ZodString;
+    revision: z.ZodString;
+}, z.core.$strict>], "type">;
+/** Shared Source/configuration rule: secrets never become acquisition locator parameters. */
+export declare const isTenantSourceCredentialParameter: (key: string) => boolean;
+export declare const tenantSourceSemanticsSchema: z.ZodObject<{
+    target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"URL">;
+        locator: z.ZodURL;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"FILE">;
+        rootBinding: z.ZodString;
+        relativePath: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"EXECUTOR">;
+        executorId: z.ZodString;
+        bindingRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>>;
+    }, z.core.$strict>], "kind">;
+    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"PUBLIC">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"BOUND">;
+        bindingRef: z.ZodString;
+        revision: z.ZodString;
+    }, z.core.$strict>], "type">;
+    executionBinding: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        bindingRef: z.ZodString;
+        revision: z.ZodString;
+    }, z.core.$strict>>>;
+    access: z.ZodEnum<{
+        PUBLIC: "PUBLIC";
+        PUBLIC_METADATA: "PUBLIC_METADATA";
+        TENANT: "TENANT";
+        INTERNAL: "INTERNAL";
+        FDE_INTERNAL: "FDE_INTERNAL";
+        ACCESS_CONTROLLED: "ACCESS_CONTROLLED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    sourcePolicy: z.ZodObject<{
+        ref: z.ZodString;
+        revision: z.ZodString;
+        acquisition: z.ZodEnum<{
+            ALLOW: "ALLOW";
+            DENY: "DENY";
+        }>;
+        propagation: z.ZodEnum<{
+            TENANT_ONLY: "TENANT_ONLY";
+            SHARE_ALLOWED: "SHARE_ALLOWED";
+            PUBLIC_ALLOWED: "PUBLIC_ALLOWED";
+        }>;
+    }, z.core.$strict>;
+    region: z.ZodNullable<z.ZodString>;
+    representation: z.ZodObject<{
+        format: z.ZodEnum<{
+            RICH_DOCUMENT_V1: "RICH_DOCUMENT_V1";
+            RAW: "RAW";
+        }>;
+        extractor: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const tenantSourceBasisSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    sourceId: z.ZodString;
+    title: z.ZodString;
+    semantics: z.ZodObject<{
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"URL">;
+            locator: z.ZodURL;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"FILE">;
+            rootBinding: z.ZodString;
+            relativePath: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"EXECUTOR">;
+            executorId: z.ZodString;
+            bindingRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>>;
+        }, z.core.$strict>], "kind">;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"PUBLIC">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"BOUND">;
+            bindingRef: z.ZodString;
+            revision: z.ZodString;
+        }, z.core.$strict>], "type">;
+        executionBinding: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+            bindingRef: z.ZodString;
+            revision: z.ZodString;
+        }, z.core.$strict>>>;
+        access: z.ZodEnum<{
+            PUBLIC: "PUBLIC";
+            PUBLIC_METADATA: "PUBLIC_METADATA";
+            TENANT: "TENANT";
+            INTERNAL: "INTERNAL";
+            FDE_INTERNAL: "FDE_INTERNAL";
+            ACCESS_CONTROLLED: "ACCESS_CONTROLLED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        sourcePolicy: z.ZodObject<{
+            ref: z.ZodString;
+            revision: z.ZodString;
+            acquisition: z.ZodEnum<{
+                ALLOW: "ALLOW";
+                DENY: "DENY";
+            }>;
+            propagation: z.ZodEnum<{
+                TENANT_ONLY: "TENANT_ONLY";
+                SHARE_ALLOWED: "SHARE_ALLOWED";
+                PUBLIC_ALLOWED: "PUBLIC_ALLOWED";
+            }>;
+        }, z.core.$strict>;
+        region: z.ZodNullable<z.ZodString>;
+        representation: z.ZodObject<{
+            format: z.ZodEnum<{
+                RICH_DOCUMENT_V1: "RICH_DOCUMENT_V1";
+                RAW: "RAW";
+            }>;
+            extractor: z.ZodNullable<z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare function tenantSourceRef(tenantId: string, sourceId: string): string;
+export declare function parseTenantSourceRevisionRef(ref: string): {
+    storageKey: string;
+    sourceId: string;
+    revision: string;
+} | null;
+/** 已正规化 basis 的唯一指纹算法，canonical reader 与 Identity 关系校验共用。 */
+export declare function tenantSourceFingerprints(basis: TenantSourceBasis): {
+    sourceRef: string;
+    revision: string;
+    revisionRef: string;
+    semanticKey: string;
+    targetId: string;
+};
+export declare const tenantSourceSnapshotSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    sourceId: z.ZodString;
+    title: z.ZodString;
+    semantics: z.ZodObject<{
+        target: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"URL">;
+            locator: z.ZodURL;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"FILE">;
+            rootBinding: z.ZodString;
+            relativePath: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"EXECUTOR">;
+            executorId: z.ZodString;
+            bindingRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            parameters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>, z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>]>>>;
+        }, z.core.$strict>], "kind">;
+        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"PUBLIC">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"BOUND">;
+            bindingRef: z.ZodString;
+            revision: z.ZodString;
+        }, z.core.$strict>], "type">;
+        executionBinding: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+            bindingRef: z.ZodString;
+            revision: z.ZodString;
+        }, z.core.$strict>>>;
+        access: z.ZodEnum<{
+            PUBLIC: "PUBLIC";
+            PUBLIC_METADATA: "PUBLIC_METADATA";
+            TENANT: "TENANT";
+            INTERNAL: "INTERNAL";
+            FDE_INTERNAL: "FDE_INTERNAL";
+            ACCESS_CONTROLLED: "ACCESS_CONTROLLED";
+            UNKNOWN: "UNKNOWN";
+        }>;
+        sourcePolicy: z.ZodObject<{
+            ref: z.ZodString;
+            revision: z.ZodString;
+            acquisition: z.ZodEnum<{
+                ALLOW: "ALLOW";
+                DENY: "DENY";
+            }>;
+            propagation: z.ZodEnum<{
+                TENANT_ONLY: "TENANT_ONLY";
+                SHARE_ALLOWED: "SHARE_ALLOWED";
+                PUBLIC_ALLOWED: "PUBLIC_ALLOWED";
+            }>;
+        }, z.core.$strict>;
+        region: z.ZodNullable<z.ZodString>;
+        representation: z.ZodObject<{
+            format: z.ZodEnum<{
+                RICH_DOCUMENT_V1: "RICH_DOCUMENT_V1";
+                RAW: "RAW";
+            }>;
+            extractor: z.ZodNullable<z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    sourceRef: z.ZodString;
+    revision: z.ZodString;
+    revisionRef: z.ZodString;
+    semanticKey: z.ZodString;
+    targetId: z.ZodString;
+}, z.core.$strict>;
+export type TenantSourceBasis = z.infer<typeof tenantSourceBasisSchema>;
+export type TenantSourceSemantics = z.infer<typeof tenantSourceSemanticsSchema>;
+export type TenantSourceSnapshot = z.infer<typeof tenantSourceSnapshotSchema>;

package/dist/internal/contracts/tenant-source.js

@@ -0,0 +1,83 @@
+/** 来源获取语义不包含用途、Project、调度启用或秘密；同 URL 不代表同一次获取权限。 */
+import { z } from 'zod';
+import { createHash } from 'node:crypto';
+import { acquisitionTargetSchema } from './project-intent.js';
+import { accessClassificationSchema, sha256Schema, stableUriSchema } from './common.js';
+import { materialTenantIdSchema } from './material-context.js';
+import { tenantStorageKey } from './resource-scope.js';
+export const tenantSourceIdSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/);
+export const tenantSourceCredentialSchema = z.discriminatedUnion('type', [
+    z.object({ type: z.literal('PUBLIC') }).strict(),
+    z.object({ type: z.literal('BOUND'), bindingRef: stableUriSchema, revision: sha256Schema }).strict(),
+]);
+/** Shared Source/configuration rule: secrets never become acquisition locator parameters. */
+export const isTenantSourceCredentialParameter = (key) => /^(?:password|passwd|secret|cookie|authorization|auth|token|access[_-]?token|refresh[_-]?token|api[_-]?key|signature|x-amz-signature|x-goog-signature)$/i.test(key);
+export const tenantSourceSemanticsSchema = z.object({
+    target: acquisitionTargetSchema,
+    credential: tenantSourceCredentialSchema,
+    executionBinding: z.object({ bindingRef: stableUriSchema, revision: sha256Schema }).strict().nullable().default(null),
+    access: accessClassificationSchema,
+    sourcePolicy: z.object({ ref: stableUriSchema, revision: sha256Schema, acquisition: z.enum(['ALLOW', 'DENY']), propagation: z.enum(['TENANT_ONLY', 'SHARE_ALLOWED', 'PUBLIC_ALLOWED']) }).strict(),
+    region: z.string().trim().min(1).max(128).nullable(),
+    representation: z.object({ format: z.enum(['RAW', 'RICH_DOCUMENT_V1']), extractor: z.object({ id: z.string().trim().min(1).max(128), version: z.string().trim().min(1).max(128) }).strict().nullable() }).strict(),
+}).strict().superRefine((value, ctx) => {
+    if ((value.representation.format === 'RAW') !== (value.representation.extractor === null))
+        ctx.addIssue({ code: 'custom', path: ['representation'], message: 'Derived representation requires its exact registered extractor' });
+    if ((value.target.kind !== 'URL' || value.credential.type === 'BOUND') && value.executionBinding === null)
+        ctx.addIssue({ code: 'custom', path: ['executionBinding'], message: 'FILE, EXECUTOR and authenticated acquisition require an exact runtime binding revision' });
+    if (value.target.kind === 'URL') {
+        const url = new URL(value.target.locator);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || value.target.locator.length > 2048)
+            ctx.addIssue({ code: 'custom', path: ['target'], message: 'URL target must use bounded HTTP without embedded credentials' });
+        if ([...url.searchParams.keys()].some(isTenantSourceCredentialParameter))
+            ctx.addIssue({ code: 'custom', path: ['target'], message: 'Credential query parameters belong in a runtime binding' });
+    }
+    if (value.target.kind === 'EXECUTOR' && Object.keys(value.target.parameters).some(key => /(?:password|secret|cookie|authorization|access[_-]?token|refresh[_-]?token)/i.test(key)))
+        ctx.addIssue({ code: 'custom', path: ['target', 'parameters'], message: 'Secrets belong in a runtime credential binding' });
+});
+export const tenantSourceBasisSchema = z.object({
+    schemaVersion: z.literal(1), tenantId: materialTenantIdSchema, sourceId: tenantSourceIdSchema,
+    title: z.string().trim().min(1).max(512), semantics: tenantSourceSemanticsSchema,
+}).strict().superRefine((value, ctx) => {
+    if (value.semantics.credential.type === 'BOUND') {
+        const prefix = `tenant-credential://${tenantStorageKey(value.tenantId)}/`, ref = value.semantics.credential.bindingRef;
+        if (!ref.startsWith(prefix) || !tenantSourceIdSchema.safeParse(ref.slice(prefix.length)).success)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'credential', 'bindingRef'], message: 'Credential reference must belong to the exact Tenant' });
+    }
+    if (value.semantics.executionBinding !== null) {
+        const prefix = `tenant-execution://${tenantStorageKey(value.tenantId)}/`, ref = value.semantics.executionBinding.bindingRef;
+        if (!ref.startsWith(prefix) || !tenantSourceIdSchema.safeParse(ref.slice(prefix.length)).success)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'executionBinding', 'bindingRef'], message: 'Execution binding must belong to the exact Tenant' });
+    }
+});
+export function tenantSourceRef(tenantId, sourceId) { return `tenant-source://${tenantStorageKey(tenantId)}/${tenantSourceIdSchema.parse(sourceId)}`; }
+export function parseTenantSourceRevisionRef(ref) {
+    const match = /^tenant-source:\/\/([a-f0-9]{64})\/([A-Za-z0-9][A-Za-z0-9._-]{0,127})\/v\/([a-f0-9]{64})$/.exec(ref);
+    return match ? { storageKey: match[1], sourceId: match[2], revision: `sha256:${match[3]}` } : null;
+}
+const canonical = (value) => { if (value === null || typeof value !== 'object')
+    return JSON.stringify(value); if (Array.isArray(value))
+    return '[' + value.map(canonical).join(',') + ']'; const row = value; return '{' + Object.keys(row).sort().map(key => JSON.stringify(key) + ':' + canonical(row[key])).join(',') + '}'; };
+const hash = (value) => 'sha256:' + createHash('sha256').update(canonical(value)).digest('hex');
+/** 已正规化 basis 的唯一指纹算法，canonical reader 与 Identity 关系校验共用。 */
+export function tenantSourceFingerprints(basis) {
+    const sourceRef = tenantSourceRef(basis.tenantId, basis.sourceId), revision = hash(basis);
+    return { sourceRef, revision, revisionRef: `${sourceRef}/v/${revision.slice(7)}`, semanticKey: hash({ tenantId: basis.tenantId, semantics: basis.semantics }), targetId: hash(basis.semantics.target) };
+}
+export const tenantSourceSnapshotSchema = tenantSourceBasisSchema.safeExtend({
+    sourceRef: stableUriSchema, revision: sha256Schema, revisionRef: stableUriSchema, semanticKey: sha256Schema, targetId: sha256Schema,
+}).strict().superRefine((value, ctx) => {
+    const ref = tenantSourceRef(value.tenantId, value.sourceId);
+    if (value.sourceRef !== ref || value.revisionRef !== `${ref}/v/${value.revision.slice(7)}`)
+        ctx.addIssue({ code: 'custom', path: ['revisionRef'], message: 'Source revision must retain exact Tenant and Source identity' });
+    if (value.semantics.target.kind === 'URL') {
+        const url = new URL(value.semantics.target.locator);
+        url.hash = '';
+        if (url.toString() !== value.semantics.target.locator)
+            ctx.addIssue({ code: 'custom', path: ['semantics', 'target'], message: 'Snapshot URL must be canonical' });
+    }
+    const { sourceRef, revision, revisionRef, semanticKey, targetId, ...basis } = value, expected = tenantSourceFingerprints(basis);
+    for (const key of ['sourceRef', 'revision', 'revisionRef', 'semanticKey', 'targetId'])
+        if (value[key] !== expected[key])
+            ctx.addIssue({ code: 'custom', path: [key], message: 'Source fingerprint mismatch' });
+});

package/dist/internal/contracts/tenant-web-collection.d.ts

@@ -0,0 +1,287 @@
+import { z } from 'zod';
+export declare const TENANT_WEB_SPEC_CAPABILITY = "TENANT_WEB_COLLECTION_SPEC_V1";
+export declare const tenantWebUrlSchema: z.ZodString;
+export declare const tenantWebScopeSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        FEED: "FEED";
+        SINGLE_PAGE: "SINGLE_PAGE";
+        URL_LIST: "URL_LIST";
+        SITE_SECTION: "SITE_SECTION";
+        SITEMAP: "SITEMAP";
+    }>;
+    allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    includePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    excludePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    urls: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    followPagination: z.ZodDefault<z.ZodBoolean>;
+    followDetailLinks: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const tenantWebRequirementsSchema: z.ZodObject<{
+    instruction: z.ZodString;
+    fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodEnum<{
+            string: "string";
+            number: "number";
+            boolean: "boolean";
+            object: "object";
+            array: "array";
+        }>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>>;
+    outputs: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        RAW: "RAW";
+        DOCUMENT: "DOCUMENT";
+        RECORDS: "RECORDS";
+    }>>>;
+    attachments: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+        PDF: "PDF";
+        IMAGE: "IMAGE";
+        AUDIO: "AUDIO";
+        VIDEO: "VIDEO";
+        OTHER: "OTHER";
+    }>>>;
+}, z.core.$strict>;
+export declare const tenantWebDefaultLimits: {
+    maxPages: number;
+    maxDepth: number;
+    maxResourceBytes: number;
+    maxTotalBytes: number;
+    maxRuntimeMs: number;
+    maxInteractions: number;
+    maxFiles: number;
+};
+export declare const tenantWebLimitsSchema: z.ZodObject<{
+    maxPages: z.ZodDefault<z.ZodNumber>;
+    maxDepth: z.ZodDefault<z.ZodNumber>;
+    maxResourceBytes: z.ZodDefault<z.ZodNumber>;
+    maxTotalBytes: z.ZodDefault<z.ZodNumber>;
+    maxRuntimeMs: z.ZodDefault<z.ZodNumber>;
+    maxInteractions: z.ZodDefault<z.ZodNumber>;
+    maxFiles: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const tenantWebSpecSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    url: z.ZodString;
+    scope: z.ZodObject<{
+        mode: z.ZodEnum<{
+            FEED: "FEED";
+            SINGLE_PAGE: "SINGLE_PAGE";
+            URL_LIST: "URL_LIST";
+            SITE_SECTION: "SITE_SECTION";
+            SITEMAP: "SITEMAP";
+        }>;
+        allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        includePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        excludePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        urls: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        followPagination: z.ZodDefault<z.ZodBoolean>;
+        followDetailLinks: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>;
+    requirements: z.ZodObject<{
+        instruction: z.ZodString;
+        fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodEnum<{
+                string: "string";
+                number: "number";
+                boolean: "boolean";
+                object: "object";
+                array: "array";
+            }>;
+            required: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>>>;
+        outputs: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            RAW: "RAW";
+            DOCUMENT: "DOCUMENT";
+            RECORDS: "RECORDS";
+        }>>>;
+        attachments: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+            PDF: "PDF";
+            IMAGE: "IMAGE";
+            AUDIO: "AUDIO";
+            VIDEO: "VIDEO";
+            OTHER: "OTHER";
+        }>>>;
+    }, z.core.$strict>;
+    limits: z.ZodDefault<z.ZodObject<{
+        maxPages: z.ZodDefault<z.ZodNumber>;
+        maxDepth: z.ZodDefault<z.ZodNumber>;
+        maxResourceBytes: z.ZodDefault<z.ZodNumber>;
+        maxTotalBytes: z.ZodDefault<z.ZodNumber>;
+        maxRuntimeMs: z.ZodDefault<z.ZodNumber>;
+        maxInteractions: z.ZodDefault<z.ZodNumber>;
+        maxFiles: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+    refresh: z.ZodDefault<z.ZodObject<{
+        mode: z.ZodLiteral<"ONCE">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type TenantWebSpec = z.infer<typeof tenantWebSpecSchema>;
+export type TenantWebSpecInput = z.input<typeof tenantWebSpecSchema>;
+export declare function tenantWebCanonical(value: unknown): string;
+export declare function tenantWebSpecRevision(spec: TenantWebSpec): string;
+export declare function tenantWebRequestKey(requestId: string): string;
+export declare function tenantWebJobRef(tenantId: string, requestId: string): string;
+export declare const tenantWebJobRefSchema: z.ZodString;
+export declare const tenantWebIntentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    requestId: z.ZodString;
+    jobRef: z.ZodString;
+    inputRevision: z.ZodString;
+    specRevision: z.ZodString;
+    requestedSpec: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        url: z.ZodString;
+        scope: z.ZodObject<{
+            mode: z.ZodEnum<{
+                FEED: "FEED";
+                SINGLE_PAGE: "SINGLE_PAGE";
+                URL_LIST: "URL_LIST";
+                SITE_SECTION: "SITE_SECTION";
+                SITEMAP: "SITEMAP";
+            }>;
+            allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            includePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            excludePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            urls: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            followPagination: z.ZodDefault<z.ZodBoolean>;
+            followDetailLinks: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>;
+        requirements: z.ZodObject<{
+            instruction: z.ZodString;
+            fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                type: z.ZodEnum<{
+                    string: "string";
+                    number: "number";
+                    boolean: "boolean";
+                    object: "object";
+                    array: "array";
+                }>;
+                required: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            outputs: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                RAW: "RAW";
+                DOCUMENT: "DOCUMENT";
+                RECORDS: "RECORDS";
+            }>>>;
+            attachments: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                PDF: "PDF";
+                IMAGE: "IMAGE";
+                AUDIO: "AUDIO";
+                VIDEO: "VIDEO";
+                OTHER: "OTHER";
+            }>>>;
+        }, z.core.$strict>;
+        limits: z.ZodDefault<z.ZodObject<{
+            maxPages: z.ZodDefault<z.ZodNumber>;
+            maxDepth: z.ZodDefault<z.ZodNumber>;
+            maxResourceBytes: z.ZodDefault<z.ZodNumber>;
+            maxTotalBytes: z.ZodDefault<z.ZodNumber>;
+            maxRuntimeMs: z.ZodDefault<z.ZodNumber>;
+            maxInteractions: z.ZodDefault<z.ZodNumber>;
+            maxFiles: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
+        refresh: z.ZodDefault<z.ZodObject<{
+            mode: z.ZodLiteral<"ONCE">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    spec: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        url: z.ZodString;
+        scope: z.ZodObject<{
+            mode: z.ZodEnum<{
+                FEED: "FEED";
+                SINGLE_PAGE: "SINGLE_PAGE";
+                URL_LIST: "URL_LIST";
+                SITE_SECTION: "SITE_SECTION";
+                SITEMAP: "SITEMAP";
+            }>;
+            allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            includePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            excludePaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            urls: z.ZodDefault<z.ZodArray<z.ZodString>>;
+            followPagination: z.ZodDefault<z.ZodBoolean>;
+            followDetailLinks: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strict>;
+        requirements: z.ZodObject<{
+            instruction: z.ZodString;
+            fields: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                type: z.ZodEnum<{
+                    string: "string";
+                    number: "number";
+                    boolean: "boolean";
+                    object: "object";
+                    array: "array";
+                }>;
+                required: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            outputs: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                RAW: "RAW";
+                DOCUMENT: "DOCUMENT";
+                RECORDS: "RECORDS";
+            }>>>;
+            attachments: z.ZodDefault<z.ZodArray<z.ZodEnum<{
+                PDF: "PDF";
+                IMAGE: "IMAGE";
+                AUDIO: "AUDIO";
+                VIDEO: "VIDEO";
+                OTHER: "OTHER";
+            }>>>;
+        }, z.core.$strict>;
+        limits: z.ZodDefault<z.ZodObject<{
+            maxPages: z.ZodDefault<z.ZodNumber>;
+            maxDepth: z.ZodDefault<z.ZodNumber>;
+            maxResourceBytes: z.ZodDefault<z.ZodNumber>;
+            maxTotalBytes: z.ZodDefault<z.ZodNumber>;
+            maxRuntimeMs: z.ZodDefault<z.ZodNumber>;
+            maxInteractions: z.ZodDefault<z.ZodNumber>;
+            maxFiles: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
+        refresh: z.ZodDefault<z.ZodObject<{
+            mode: z.ZodLiteral<"ONCE">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    actor: z.ZodObject<{
+        tenantId: z.ZodString;
+        userId: z.ZodString;
+        agentId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>;
+    authority: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"HOST">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"OAUTH">;
+        authorityVersion: z.ZodLiteral<2>;
+        clientId: z.ZodString;
+        grantId: z.ZodString;
+        resource: z.ZodString;
+    }, z.core.$strict>], "type">;
+    submittedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type TenantWebIntent = z.infer<typeof tenantWebIntentSchema>;
+/** S1 仅证明意图持久化；不制造待采列表、原件、时效或准入成功。 */
+export declare const tenantWebSummarySchema: z.ZodObject<{
+    requestId: z.ZodString;
+    jobRef: z.ZodString;
+    specRevision: z.ZodString;
+    submittedAt: z.ZodISODateTime;
+    phase: z.ZodLiteral<"WEB_INTENT_PERSISTED">;
+    state: z.ZodLiteral<"ACCEPTED">;
+    execution: z.ZodLiteral<"UNAVAILABLE">;
+    reason: z.ZodLiteral<"S2_NOT_IMPLEMENTED">;
+    completion: z.ZodNull;
+    networkValidated: z.ZodLiteral<false>;
+    budgetReserved: z.ZodLiteral<false>;
+    requirementsState: z.ZodLiteral<"DECLARED_NOT_EVALUATED">;
+    coverage: z.ZodObject<{
+        state: z.ZodLiteral<"NOT_STARTED">;
+        total: z.ZodNull;
+        discovered: z.ZodLiteral<0>;
+        acquired: z.ZodLiteral<0>;
+        extracted: z.ZodLiteral<0>;
+        registered: z.ZodLiteral<0>;
+    }, z.core.$strict>;
+}, z.core.$strict>;