@pactosigna/schemas 0.1.5 → 0.1.7

package/dist/index.js

@@ -6,10 +6,10 @@ import {
   inferDocumentType
 } from "./chunk-XP2LBTDS.js";
 
-// ../shared/dist/schemas/index.js
-import { z as z24 } from "zod";
+// ../contracts/dist/commonSchemas.js
+import { z as z2 } from "zod";
 
-// ../shared/dist/schemas/common-enums.js
+// ../contracts/dist/domain-schemas/common-enums.js
 import { z } from "zod";
 var RegulatoryFrameworkSchema = z.enum([
   "ISO_13485",
@@ -105,9 +105,224 @@ var LinkTypeSchema = z.enum([
 var AcceptabilityStatusSchema = z.enum(["acceptable", "review_required", "unacceptable"]);
 var DepartmentRoleSchema = z.enum(["manager", "member"]);
 
-// ../shared/dist/schemas/risk.js
-import { z as z2 } from "zod";
-var RiskDocumentStatusSchema = z2.enum([
+// ../contracts/dist/commonSchemas.js
+var ErrorResponseSchema = z2.object({
+  error: z2.string(),
+  code: z2.string().optional(),
+  details: z2.record(z2.unknown()).optional()
+});
+var PaginationParamsSchema = z2.object({
+  limit: z2.coerce.number().min(1).max(100).optional().default(50),
+  offset: z2.coerce.number().min(0).optional().default(0)
+});
+
+// ../contracts/dist/identity/requests.js
+import { z as z3 } from "zod";
+var RegulatoryFrameworkSchema2 = z3.enum([
+  "ISO_13485",
+  "IEC_62304",
+  "FDA_21_CFR_820",
+  "QMSR",
+  "EU_MDR",
+  "ISO_14971",
+  "AI_ACT"
+]);
+var RoleSchema = z3.enum(["admin", "member", "auditor"]);
+var DepartmentRoleSchema2 = z3.enum(["manager", "member"]);
+var AuditorTypeSchema = z3.enum(["internal", "external"]);
+var ReviewerRuleSchema = z3.object({
+  documentType: z3.string(),
+  requiredDepartments: z3.array(z3.string()),
+  finalApproverDepartment: z3.string()
+});
+var CreateOrganizationRequestSchema = z3.object({
+  name: z3.string().min(3).max(100),
+  frameworks: z3.array(RegulatoryFrameworkSchema2).min(1),
+  department: z3.string().min(1)
+});
+var ChecklistTemplateItemSchema = z3.object({
+  id: z3.string().min(1),
+  label: z3.string().min(1).max(500),
+  sortOrder: z3.number().int().nonnegative()
+});
+var UpdateOrganizationSettingsRequestSchema = z3.object({
+  name: z3.string().min(1).optional(),
+  frameworks: z3.array(RegulatoryFrameworkSchema2).optional(),
+  departments: z3.array(z3.string()).optional(),
+  reviewerRules: z3.array(ReviewerRuleSchema).optional(),
+  releaseChecklistTemplate: z3.array(ChecklistTemplateItemSchema).max(30).optional()
+});
+var UpdateMemberRequestSchema = z3.object({
+  department: z3.string().optional(),
+  role: RoleSchema.optional(),
+  departmentRole: DepartmentRoleSchema2.optional()
+});
+var InviteUserRequestSchema = z3.object({
+  email: z3.string().email(),
+  department: z3.string().min(1),
+  role: RoleSchema,
+  departmentRole: DepartmentRoleSchema2.optional(),
+  auditorType: AuditorTypeSchema.optional(),
+  accessExpiresAt: z3.string().datetime().optional()
+}).superRefine((data, ctx) => {
+  if (data.role === "auditor" && !data.auditorType) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "auditorType is required when role is auditor",
+      path: ["auditorType"]
+    });
+  }
+  if (data.role !== "auditor" && data.auditorType) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "auditorType is only valid for auditor role",
+      path: ["auditorType"]
+    });
+  }
+  if (data.role !== "auditor" && data.accessExpiresAt) {
+    ctx.addIssue({
+      code: z3.ZodIssueCode.custom,
+      message: "accessExpiresAt is only valid for auditor role",
+      path: ["accessExpiresAt"]
+    });
+  }
+});
+var AcceptInviteRequestSchema = z3.object({
+  token: z3.string().min(1)
+});
+var UpdateProfileRequestSchema = z3.object({
+  displayName: z3.string().min(1).max(100).optional()
+});
+var OrgIdParamSchema = z3.object({
+  orgId: z3.string().min(1)
+});
+var MemberIdParamSchema = z3.object({
+  orgId: z3.string().min(1),
+  memberId: z3.string().min(1)
+});
+var InviteIdParamSchema = z3.object({
+  orgId: z3.string().min(1),
+  inviteId: z3.string().min(1)
+});
+
+// ../contracts/dist/identity/responses.js
+import { z as z5 } from "zod";
+
+// ../contracts/dist/billing/responses.js
+import { z as z4 } from "zod";
+var SubscriptionStatusSchema = z4.enum([
+  "active",
+  "trialing",
+  "past_due",
+  "canceled",
+  "incomplete"
+]);
+var SubscriptionResponseSchema = z4.object({
+  status: SubscriptionStatusSchema,
+  currentPeriodEnd: z4.string(),
+  cancelAtPeriodEnd: z4.boolean()
+});
+var CreateCheckoutSessionResponseSchema = z4.object({
+  checkoutUrl: z4.string().url()
+});
+var CreatePortalSessionResponseSchema = z4.object({
+  portalUrl: z4.string().url()
+});
+
+// ../contracts/dist/identity/responses.js
+var MemberStatusSchema = z5.enum(["active", "suspended", "removed"]);
+var InviteStatusSchema = z5.enum(["pending", "accepted", "expired", "revoked"]);
+var MemberResponseSchema = z5.object({
+  id: z5.string(),
+  email: z5.string().email(),
+  emailVerified: z5.boolean(),
+  displayName: z5.string(),
+  department: z5.string(),
+  departmentRole: DepartmentRoleSchema2.optional(),
+  role: RoleSchema,
+  auditorType: AuditorTypeSchema.optional(),
+  accessExpiresAt: z5.string().optional(),
+  // ISO date (for external auditors)
+  status: MemberStatusSchema,
+  joinedAt: z5.string()
+  // ISO date
+});
+var InviteResponseSchema = z5.object({
+  id: z5.string(),
+  email: z5.string().email(),
+  department: z5.string(),
+  role: RoleSchema,
+  status: InviteStatusSchema,
+  expiresAt: z5.string(),
+  // ISO date
+  createdAt: z5.string()
+  // ISO date
+});
+var OrganizationResponseSchema = z5.object({
+  id: z5.string(),
+  name: z5.string(),
+  role: RoleSchema,
+  department: z5.string(),
+  gitHubAppInstallationId: z5.number().optional(),
+  gitHubOrgName: z5.string().optional(),
+  subscription: SubscriptionResponseSchema.optional()
+});
+var OrganizationSettingsResponseSchema = z5.object({
+  frameworks: z5.array(z5.string()),
+  departments: z5.array(z5.string()),
+  defaultSafetyClass: SafetyClassSchema,
+  reviewerRules: z5.array(ReviewerRuleSchema),
+  releaseChecklistTemplate: z5.array(ChecklistTemplateItemSchema).optional()
+});
+var CreateOrganizationResponseSchema = z5.object({
+  organizationId: z5.string()
+});
+var GetOrganizationsResponseSchema = z5.object({
+  organizations: z5.array(OrganizationResponseSchema)
+});
+var GetMembersResponseSchema = z5.object({
+  members: z5.array(MemberResponseSchema)
+});
+var GetInvitesResponseSchema = z5.object({
+  invites: z5.array(InviteResponseSchema)
+});
+var AcceptInviteResponseSchema = z5.object({
+  organizationId: z5.string(),
+  organizationName: z5.string()
+});
+var PendingInviteResponseSchema = z5.object({
+  id: z5.string(),
+  organizationId: z5.string(),
+  organizationName: z5.string(),
+  invitedByName: z5.string(),
+  role: RoleSchema,
+  department: z5.string(),
+  createdAt: z5.string(),
+  expiresAt: z5.string()
+});
+var GetPendingInvitesResponseSchema = z5.object({
+  invites: z5.array(PendingInviteResponseSchema)
+});
+var SuccessResponseSchema = z5.object({
+  success: z5.boolean()
+});
+var ValidateInviteResponseSchema = z5.object({
+  organizationName: z5.string(),
+  status: InviteStatusSchema
+});
+var CreateInviteResponseSchema = z5.object({
+  inviteId: z5.string()
+});
+
+// ../contracts/dist/identity/legal-requests.js
+import { z as z29 } from "zod";
+
+// ../contracts/dist/domain-schemas/index.js
+import { z as z28 } from "zod";
+
+// ../contracts/dist/domain-schemas/risk.js
+import { z as z6 } from "zod";
+var RiskDocumentStatusSchema = z6.enum([
   "draft",
   "in_review",
   "approved",
@@ -115,12 +330,12 @@ var RiskDocumentStatusSchema = z2.enum([
   "archived",
   "example"
 ]);
-var MitigationTargetSchema = z2.enum([
+var MitigationTargetSchema = z6.enum([
   "sequence_probability",
   "harm_probability",
   "severity"
 ]);
-var RiskGapCodeSchema = z2.enum([
+var RiskGapCodeSchema = z6.enum([
   "hazard_no_situation",
   "situation_no_harm",
   "hazard_not_analyzed",
@@ -139,31 +354,31 @@ var RiskGapCodeSchema = z2.enum([
   "haz_invalid_category",
   "category_not_approved"
 ]);
-var RiskGapSeveritySchema = z2.enum(["error", "warning"]);
-var MitigationSchema = z2.object({
-  control: z2.string().min(1),
+var RiskGapSeveritySchema = z6.enum(["error", "warning"]);
+var MitigationSchema = z6.object({
+  control: z6.string().min(1),
   reduces: MitigationTargetSchema,
-  for_harm: z2.string().optional()
-});
-var HarmAssessmentSchema = z2.object({
-  harm: z2.string().min(1),
-  inherent_probability: z2.number().int().min(1).max(5).optional(),
-  inherent_exploitability: z2.number().int().min(1).max(5).optional(),
-  residual_probability: z2.number().int().min(1).max(5).optional(),
-  residual_exploitability: z2.number().int().min(1).max(5).optional(),
-  residual_severity_override: z2.number().int().min(1).max(5).optional()
-});
-var RiskEntryFrontmatterSchema = z2.object({
-  type: z2.enum(["software_risk", "usability_risk", "security_risk"]),
-  id: z2.string().min(1),
-  title: z2.string().min(1),
+  for_harm: z6.string().optional()
+});
+var HarmAssessmentSchema = z6.object({
+  harm: z6.string().min(1),
+  inherent_probability: z6.number().int().min(1).max(5).optional(),
+  inherent_exploitability: z6.number().int().min(1).max(5).optional(),
+  residual_probability: z6.number().int().min(1).max(5).optional(),
+  residual_exploitability: z6.number().int().min(1).max(5).optional(),
+  residual_severity_override: z6.number().int().min(1).max(5).optional()
+});
+var RiskEntryFrontmatterSchema = z6.object({
+  type: z6.enum(["software_risk", "usability_risk", "security_risk"]),
+  id: z6.string().min(1),
+  title: z6.string().min(1),
   status: RiskDocumentStatusSchema,
-  analyzes: z2.string().min(1),
-  hazardous_situation: z2.string().min(1),
-  harm_assessments: z2.array(HarmAssessmentSchema).min(1),
-  mitigations: z2.array(MitigationSchema).optional(),
-  cvss_score: z2.number().min(0).max(10).optional(),
-  cvss_vector: z2.string().regex(/^CVSS:3\.[01]\/AV:[NALP]\/AC:[LH]\/PR:[NLH]\/UI:[NR]\/S:[UC]\/C:[NLH]\/I:[NLH]\/A:[NLH]$/).optional()
+  analyzes: z6.string().min(1),
+  hazardous_situation: z6.string().min(1),
+  harm_assessments: z6.array(HarmAssessmentSchema).min(1),
+  mitigations: z6.array(MitigationSchema).optional(),
+  cvss_score: z6.number().min(0).max(10).optional(),
+  cvss_vector: z6.string().regex(/^CVSS:3\.[01]\/AV:[NALP]\/AC:[LH]\/PR:[NLH]\/UI:[NR]\/S:[UC]\/C:[NLH]\/I:[NLH]\/A:[NLH]$/).optional()
 }).refine((data) => {
   if (data.type === "security_risk") {
     return data.harm_assessments.every((ha) => ha.inherent_exploitability != null);
@@ -172,242 +387,118 @@ var RiskEntryFrontmatterSchema = z2.object({
 }, {
   message: "Security risks must use inherent_exploitability; software/usability risks must use inherent_probability"
 });
-var HazardFrontmatterSchema = z2.object({
-  type: z2.enum(["haz_soe_software", "haz_soe_security"]),
-  id: z2.string().min(1),
-  title: z2.string().min(1),
+var HazardFrontmatterSchema = z6.object({
+  type: z6.enum(["haz_soe_software", "haz_soe_security"]),
+  id: z6.string().min(1),
+  title: z6.string().min(1),
   status: RiskDocumentStatusSchema,
-  leads_to: z2.array(z2.string()).optional(),
+  leads_to: z6.array(z6.string()).optional(),
   // sFMEA fields
-  failure_mode: z2.string().optional(),
-  cause: z2.string().optional(),
-  detection_method: z2.string().optional(),
+  failure_mode: z6.string().optional(),
+  cause: z6.string().optional(),
+  detection_method: z6.string().optional(),
   // STRIDE fields
-  threat_category: z2.string().optional(),
-  attack_vector: z2.string().optional(),
+  threat_category: z6.string().optional(),
+  attack_vector: z6.string().optional(),
   // Hazard category reference (HC-xxx)
-  hazard_category: z2.string().optional()
+  hazard_category: z6.string().optional()
 });
-var HazardCategoryFrontmatterSchema = z2.object({
-  type: z2.literal("hazard_category"),
-  id: z2.string().min(1),
-  title: z2.string().min(1),
+var HazardCategoryFrontmatterSchema = z6.object({
+  type: z6.literal("hazard_category"),
+  id: z6.string().min(1),
+  title: z6.string().min(1),
   status: RiskDocumentStatusSchema,
-  source: z2.string().optional()
+  source: z6.string().optional()
 });
-var HazardousSituationFrontmatterSchema = z2.object({
-  type: z2.literal("hazardous_situation"),
-  id: z2.string().min(1),
-  title: z2.string().min(1),
+var HazardousSituationFrontmatterSchema = z6.object({
+  type: z6.literal("hazardous_situation"),
+  id: z6.string().min(1),
+  title: z6.string().min(1),
   status: RiskDocumentStatusSchema,
-  results_in: z2.array(z2.string()).optional()
+  results_in: z6.array(z6.string()).optional()
 });
-var HarmFrontmatterSchema = z2.object({
-  type: z2.literal("harm"),
-  id: z2.string().min(1),
-  title: z2.string().min(1),
+var HarmFrontmatterSchema = z6.object({
+  type: z6.literal("harm"),
+  id: z6.string().min(1),
+  title: z6.string().min(1),
   status: RiskDocumentStatusSchema,
-  severity: z2.number().int().min(1).max(5),
-  category: z2.string().optional()
-});
-var RiskMatrixConfigSchema = z2.object({
-  version: z2.number(),
-  labels: z2.object({
-    severity: z2.array(z2.string()).length(5),
-    probability: z2.array(z2.string()).length(5),
-    exploitability: z2.array(z2.string()).length(5).optional()
+  severity: z6.number().int().min(1).max(5),
+  category: z6.string().optional()
+});
+var RiskMatrixConfigSchema = z6.object({
+  version: z6.number(),
+  labels: z6.object({
+    severity: z6.array(z6.string()).length(5),
+    probability: z6.array(z6.string()).length(5),
+    exploitability: z6.array(z6.string()).length(5).optional()
   }),
-  acceptability: z2.object({
-    unacceptable: z2.array(z2.tuple([z2.number(), z2.number()])),
-    review_required: z2.array(z2.tuple([z2.number(), z2.number()])).optional()
+  acceptability: z6.object({
+    unacceptable: z6.array(z6.tuple([z6.number(), z6.number()])),
+    review_required: z6.array(z6.tuple([z6.number(), z6.number()])).optional()
   }),
-  overrides: z2.record(z2.object({
-    unacceptable: z2.array(z2.tuple([z2.number(), z2.number()])),
-    review_required: z2.array(z2.tuple([z2.number(), z2.number()])).optional()
+  overrides: z6.record(z6.object({
+    unacceptable: z6.array(z6.tuple([z6.number(), z6.number()])),
+    review_required: z6.array(z6.tuple([z6.number(), z6.number()])).optional()
   })).optional()
 });
 
-// ../shared/dist/schemas/usability.js
-import { z as z3 } from "zod";
-var UsabilityPlanFrontmatterSchema = z3.object({
-  type: z3.literal("usability_plan"),
-  id: z3.string().min(1),
-  title: z3.string().min(1),
-  status: RiskDocumentStatusSchema,
-  author: z3.string().optional(),
-  reviewers: z3.array(z3.string()).optional(),
-  approvers: z3.array(z3.string()).optional()
-});
-var UseSpecificationFrontmatterSchema = z3.object({
-  type: z3.literal("use_specification"),
-  id: z3.string().min(1),
-  title: z3.string().min(1),
-  status: RiskDocumentStatusSchema,
-  user_group: z3.string().min(1),
-  author: z3.string().optional(),
-  reviewers: z3.array(z3.string()).optional(),
-  approvers: z3.array(z3.string()).optional()
-});
-var TaskAnalysisFrontmatterSchema = z3.object({
-  type: z3.literal("task_analysis"),
-  id: z3.string().min(1),
-  title: z3.string().min(1),
-  status: RiskDocumentStatusSchema,
-  user_group: z3.string().min(1),
-  critical_task: z3.boolean(),
-  author: z3.string().optional(),
-  reviewers: z3.array(z3.string()).optional(),
-  approvers: z3.array(z3.string()).optional()
-});
-var UsabilityEvaluationFrontmatterSchema = z3.object({
-  type: z3.literal("usability_evaluation"),
-  id: z3.string().min(1),
-  title: z3.string().min(1),
-  status: RiskDocumentStatusSchema,
-  result: z3.enum(["pass", "fail", "pass_with_findings"]).optional(),
-  author: z3.string().optional(),
-  reviewers: z3.array(z3.string()).optional(),
-  approvers: z3.array(z3.string()).optional()
-});
-var SummativeEvaluationFrontmatterSchema = z3.object({
-  type: z3.literal("summative_evaluation"),
-  id: z3.string().min(1),
-  title: z3.string().min(1),
-  status: RiskDocumentStatusSchema,
-  result: z3.enum(["pass", "fail", "pass_with_findings"]).optional(),
-  author: z3.string().optional(),
-  reviewers: z3.array(z3.string()).optional(),
-  approvers: z3.array(z3.string()).optional()
-});
-
-// ../shared/dist/schemas/risk-management-plan.js
-import { z as z4 } from "zod";
-var RiskManagementPlanFrontmatterSchema = z4.object({
-  type: z4.literal("risk_management_plan"),
-  id: z4.string().min(1),
-  title: z4.string().min(1),
+// ../contracts/dist/domain-schemas/usability.js
+import { z as z7 } from "zod";
+var UsabilityPlanFrontmatterSchema = z7.object({
+  type: z7.literal("usability_plan"),
+  id: z7.string().min(1),
+  title: z7.string().min(1),
   status: RiskDocumentStatusSchema,
-  author: z4.string().optional(),
-  reviewers: z4.array(z4.string()).optional(),
-  approvers: z4.array(z4.string()).optional()
+  author: z7.string().optional(),
+  reviewers: z7.array(z7.string()).optional(),
+  approvers: z7.array(z7.string()).optional()
 });
-
-// ../shared/dist/schemas/software-lifecycle.js
-import { z as z5 } from "zod";
-var SoftwareDevelopmentPlanFrontmatterSchema = z5.object({
-  type: z5.literal("software_development_plan"),
-  id: z5.string().min(1),
-  title: z5.string().min(1),
-  status: RiskDocumentStatusSchema,
-  author: z5.string().optional(),
-  reviewers: z5.array(z5.string()).optional(),
-  approvers: z5.array(z5.string()).optional()
-});
-var SoftwareMaintenancePlanFrontmatterSchema = z5.object({
-  type: z5.literal("software_maintenance_plan"),
-  id: z5.string().min(1),
-  title: z5.string().min(1),
-  status: RiskDocumentStatusSchema,
-  author: z5.string().optional(),
-  reviewers: z5.array(z5.string()).optional(),
-  approvers: z5.array(z5.string()).optional()
-});
-var SoupRegisterFrontmatterSchema = z5.object({
-  type: z5.literal("soup_register"),
-  id: z5.string().min(1),
-  title: z5.string().min(1),
-  status: RiskDocumentStatusSchema,
-  author: z5.string().optional(),
-  reviewers: z5.array(z5.string()).optional(),
-  approvers: z5.array(z5.string()).optional()
-});
-var SoftwareTestPlanFrontmatterSchema = z5.object({
-  type: z5.literal("software_test_plan"),
-  id: z5.string().min(1),
-  title: z5.string().min(1),
+var UseSpecificationFrontmatterSchema = z7.object({
+  type: z7.literal("use_specification"),
+  id: z7.string().min(1),
+  title: z7.string().min(1),
   status: RiskDocumentStatusSchema,
-  author: z5.string().optional(),
-  reviewers: z5.array(z5.string()).optional(),
-  approvers: z5.array(z5.string()).optional()
-});
-
-// ../shared/dist/schemas/architecture.js
-import { z as z6 } from "zod";
-var SoftwareItemTypeSchema = z6.enum(["system", "subsystem", "component", "unit"]);
-var SegregationSchema = z6.object({
-  mechanism: z6.string().min(1),
-  rationale: z6.string().min(1)
+  user_group: z7.string().min(1),
+  author: z7.string().optional(),
+  reviewers: z7.array(z7.string()).optional(),
+  approvers: z7.array(z7.string()).optional()
 });
-var ArchitectureFrontmatterSchema = z6.object({
-  id: z6.string().min(1),
-  title: z6.string().min(1),
-  type: z6.literal("architecture"),
+var TaskAnalysisFrontmatterSchema = z7.object({
+  type: z7.literal("task_analysis"),
+  id: z7.string().min(1),
+  title: z7.string().min(1),
   status: RiskDocumentStatusSchema,
-  software_item_type: SoftwareItemTypeSchema.optional(),
-  parent_item: z6.string().optional(),
-  safety_class: z6.enum(["A", "B", "C"]).optional(),
-  segregation: SegregationSchema.optional(),
-  author: z6.string().optional(),
-  reviewers: z6.array(z6.string()).optional(),
-  approvers: z6.array(z6.string()).optional()
+  user_group: z7.string().min(1),
+  critical_task: z7.boolean(),
+  author: z7.string().optional(),
+  reviewers: z7.array(z7.string()).optional(),
+  approvers: z7.array(z7.string()).optional()
 });
-var DetailedDesignFrontmatterSchema = z6.object({
-  id: z6.string().min(1),
-  title: z6.string().min(1),
-  type: z6.literal("detailed_design"),
+var UsabilityEvaluationFrontmatterSchema = z7.object({
+  type: z7.literal("usability_evaluation"),
+  id: z7.string().min(1),
+  title: z7.string().min(1),
   status: RiskDocumentStatusSchema,
-  software_item_type: SoftwareItemTypeSchema.optional(),
-  parent_item: z6.string().optional(),
-  safety_class: z6.enum(["A", "B", "C"]).optional(),
-  segregation: SegregationSchema.optional(),
-  author: z6.string().optional(),
-  reviewers: z6.array(z6.string()).optional(),
-  approvers: z6.array(z6.string()).optional()
+  result: z7.enum(["pass", "fail", "pass_with_findings"]).optional(),
+  author: z7.string().optional(),
+  reviewers: z7.array(z7.string()).optional(),
+  approvers: z7.array(z7.string()).optional()
 });
-
-// ../shared/dist/schemas/anomaly.js
-import { z as z7 } from "zod";
-var AnomalyCategorySchema = z7.enum([
-  "bug",
-  "security_vulnerability",
-  "regression",
-  "performance"
-]);
-var AnomalySeveritySchema = z7.enum(["critical", "major", "minor"]);
-var AnomalyDispositionSchema = z7.enum([
-  "open",
-  "investigating",
-  "resolved",
-  "deferred",
-  "will_not_fix"
-]);
-var AnomalyFrontmatterSchema = z7.object({
-  type: z7.literal("anomaly"),
+var SummativeEvaluationFrontmatterSchema = z7.object({
+  type: z7.literal("summative_evaluation"),
   id: z7.string().min(1),
   title: z7.string().min(1),
   status: RiskDocumentStatusSchema,
-  category: AnomalyCategorySchema,
-  severity: AnomalySeveritySchema,
-  disposition: AnomalyDispositionSchema,
-  affected_version: z7.string().optional(),
+  result: z7.enum(["pass", "fail", "pass_with_findings"]).optional(),
   author: z7.string().optional(),
   reviewers: z7.array(z7.string()).optional(),
   approvers: z7.array(z7.string()).optional()
 });
 
-// ../shared/dist/schemas/cybersecurity.js
+// ../contracts/dist/domain-schemas/risk-management-plan.js
 import { z as z8 } from "zod";
-var CybersecurityPlanFrontmatterSchema = z8.object({
-  type: z8.literal("cybersecurity_plan"),
-  id: z8.string().min(1),
-  title: z8.string().min(1),
-  status: RiskDocumentStatusSchema,
-  author: z8.string().optional(),
-  reviewers: z8.array(z8.string()).optional(),
-  approvers: z8.array(z8.string()).optional()
-});
-var SbomFrontmatterSchema = z8.object({
-  type: z8.literal("sbom"),
+var RiskManagementPlanFrontmatterSchema = z8.object({
+  type: z8.literal("risk_management_plan"),
   id: z8.string().min(1),
   title: z8.string().min(1),
   status: RiskDocumentStatusSchema,
@@ -416,10 +507,28 @@ var SbomFrontmatterSchema = z8.object({
   approvers: z8.array(z8.string()).optional()
 });
 
-// ../shared/dist/schemas/clinical.js
+// ../contracts/dist/domain-schemas/software-lifecycle.js
 import { z as z9 } from "zod";
-var ClinicalEvaluationPlanFrontmatterSchema = z9.object({
-  type: z9.literal("clinical_evaluation_plan"),
+var SoftwareDevelopmentPlanFrontmatterSchema = z9.object({
+  type: z9.literal("software_development_plan"),
+  id: z9.string().min(1),
+  title: z9.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z9.string().optional(),
+  reviewers: z9.array(z9.string()).optional(),
+  approvers: z9.array(z9.string()).optional()
+});
+var SoftwareMaintenancePlanFrontmatterSchema = z9.object({
+  type: z9.literal("software_maintenance_plan"),
+  id: z9.string().min(1),
+  title: z9.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z9.string().optional(),
+  reviewers: z9.array(z9.string()).optional(),
+  approvers: z9.array(z9.string()).optional()
+});
+var SoupRegisterFrontmatterSchema = z9.object({
+  type: z9.literal("soup_register"),
   id: z9.string().min(1),
   title: z9.string().min(1),
   status: RiskDocumentStatusSchema,
@@ -427,8 +536,8 @@ var ClinicalEvaluationPlanFrontmatterSchema = z9.object({
   reviewers: z9.array(z9.string()).optional(),
   approvers: z9.array(z9.string()).optional()
 });
-var ClinicalEvaluationReportFrontmatterSchema = z9.object({
-  type: z9.literal("clinical_evaluation_report"),
+var SoftwareTestPlanFrontmatterSchema = z9.object({
+  type: z9.literal("software_test_plan"),
   id: z9.string().min(1),
   title: z9.string().min(1),
   status: RiskDocumentStatusSchema,
@@ -437,55 +546,74 @@ var ClinicalEvaluationReportFrontmatterSchema = z9.object({
   approvers: z9.array(z9.string()).optional()
 });
 
-// ../shared/dist/schemas/post-market.js
+// ../contracts/dist/domain-schemas/architecture.js
 import { z as z10 } from "zod";
-var PostMarketSurveillancePlanFrontmatterSchema = z10.object({
-  type: z10.literal("post_market_surveillance_plan"),
+var SoftwareItemTypeSchema = z10.enum(["system", "subsystem", "component", "unit"]);
+var SegregationSchema = z10.object({
+  mechanism: z10.string().min(1),
+  rationale: z10.string().min(1)
+});
+var ArchitectureFrontmatterSchema = z10.object({
   id: z10.string().min(1),
   title: z10.string().min(1),
+  type: z10.literal("architecture"),
   status: RiskDocumentStatusSchema,
+  software_item_type: SoftwareItemTypeSchema.optional(),
+  parent_item: z10.string().optional(),
+  safety_class: z10.enum(["A", "B", "C"]).optional(),
+  segregation: SegregationSchema.optional(),
   author: z10.string().optional(),
   reviewers: z10.array(z10.string()).optional(),
   approvers: z10.array(z10.string()).optional()
 });
-var PostMarketFeedbackCategorySchema = z10.enum([
-  "complaint",
-  "field_observation",
-  "clinical_followup",
-  "trend_report"
-]);
-var PostMarketFeedbackSeveritySchema = z10.enum(["low", "medium", "high", "critical"]);
-var PostMarketFeedbackFrontmatterSchema = z10.object({
-  type: z10.literal("post_market_feedback"),
+var DetailedDesignFrontmatterSchema = z10.object({
   id: z10.string().min(1),
   title: z10.string().min(1),
+  type: z10.literal("detailed_design"),
   status: RiskDocumentStatusSchema,
-  category: PostMarketFeedbackCategorySchema,
-  severity: PostMarketFeedbackSeveritySchema,
-  device: z10.string().optional(),
-  reporting_period: z10.string().optional(),
+  software_item_type: SoftwareItemTypeSchema.optional(),
+  parent_item: z10.string().optional(),
+  safety_class: z10.enum(["A", "B", "C"]).optional(),
+  segregation: SegregationSchema.optional(),
   author: z10.string().optional(),
   reviewers: z10.array(z10.string()).optional(),
   approvers: z10.array(z10.string()).optional()
 });
 
-// ../shared/dist/schemas/labeling.js
+// ../contracts/dist/domain-schemas/anomaly.js
 import { z as z11 } from "zod";
-var LabelingFrontmatterSchema = z11.object({
-  type: z11.literal("labeling"),
+var AnomalyCategorySchema = z11.enum([
+  "bug",
+  "security_vulnerability",
+  "regression",
+  "performance"
+]);
+var AnomalySeveritySchema = z11.enum(["critical", "major", "minor"]);
+var AnomalyDispositionSchema = z11.enum([
+  "open",
+  "investigating",
+  "resolved",
+  "deferred",
+  "will_not_fix"
+]);
+var AnomalyFrontmatterSchema = z11.object({
+  type: z11.literal("anomaly"),
   id: z11.string().min(1),
   title: z11.string().min(1),
   status: RiskDocumentStatusSchema,
-  label_type: z11.enum(["ifu", "product_label", "packaging_label"]).optional(),
+  category: AnomalyCategorySchema,
+  severity: AnomalySeveritySchema,
+  disposition: AnomalyDispositionSchema,
+  affected_version: z11.string().optional(),
   author: z11.string().optional(),
   reviewers: z11.array(z11.string()).optional(),
   approvers: z11.array(z11.string()).optional()
 });
 
-// ../shared/dist/schemas/product.js
+// ../contracts/dist/domain-schemas/cybersecurity.js
 import { z as z12 } from "zod";
-var ProductDevelopmentPlanFrontmatterSchema = z12.object({
-  type: z12.literal("product_development_plan"),
+var CybersecurityPlanFrontmatterSchema = z12.object({
+  type: z12.literal("cybersecurity_plan"),
   id: z12.string().min(1),
   title: z12.string().min(1),
   status: RiskDocumentStatusSchema,
@@ -493,8 +621,8 @@ var ProductDevelopmentPlanFrontmatterSchema = z12.object({
   reviewers: z12.array(z12.string()).optional(),
   approvers: z12.array(z12.string()).optional()
 });
-var IntendedUseFrontmatterSchema = z12.object({
-  type: z12.literal("intended_use"),
+var SbomFrontmatterSchema = z12.object({
+  type: z12.literal("sbom"),
   id: z12.string().min(1),
   title: z12.string().min(1),
   status: RiskDocumentStatusSchema,
@@ -503,31 +631,118 @@ var IntendedUseFrontmatterSchema = z12.object({
   approvers: z12.array(z12.string()).optional()
 });
 
-// ../shared/dist/schemas/user-need.js
+// ../contracts/dist/domain-schemas/clinical.js
 import { z as z13 } from "zod";
-var UserNeedPrioritySchema = z13.enum(["must_have", "should_have", "nice_to_have"]);
-var UserNeedFrontmatterSchema = z13.object({
+var ClinicalEvaluationPlanFrontmatterSchema = z13.object({
+  type: z13.literal("clinical_evaluation_plan"),
+  id: z13.string().min(1),
+  title: z13.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z13.string().optional(),
+  reviewers: z13.array(z13.string()).optional(),
+  approvers: z13.array(z13.string()).optional()
+});
+var ClinicalEvaluationReportFrontmatterSchema = z13.object({
+  type: z13.literal("clinical_evaluation_report"),
   id: z13.string().min(1),
   title: z13.string().min(1),
   status: RiskDocumentStatusSchema,
+  author: z13.string().optional(),
+  reviewers: z13.array(z13.string()).optional(),
+  approvers: z13.array(z13.string()).optional()
+});
+
+// ../contracts/dist/domain-schemas/post-market.js
+import { z as z14 } from "zod";
+var PostMarketSurveillancePlanFrontmatterSchema = z14.object({
+  type: z14.literal("post_market_surveillance_plan"),
+  id: z14.string().min(1),
+  title: z14.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z14.string().optional(),
+  reviewers: z14.array(z14.string()).optional(),
+  approvers: z14.array(z14.string()).optional()
+});
+var PostMarketFeedbackCategorySchema = z14.enum([
+  "complaint",
+  "field_observation",
+  "clinical_followup",
+  "trend_report"
+]);
+var PostMarketFeedbackSeveritySchema = z14.enum(["low", "medium", "high", "critical"]);
+var PostMarketFeedbackFrontmatterSchema = z14.object({
+  type: z14.literal("post_market_feedback"),
+  id: z14.string().min(1),
+  title: z14.string().min(1),
+  status: RiskDocumentStatusSchema,
+  category: PostMarketFeedbackCategorySchema,
+  severity: PostMarketFeedbackSeveritySchema,
+  device: z14.string().optional(),
+  reporting_period: z14.string().optional(),
+  author: z14.string().optional(),
+  reviewers: z14.array(z14.string()).optional(),
+  approvers: z14.array(z14.string()).optional()
+});
+
+// ../contracts/dist/domain-schemas/labeling.js
+import { z as z15 } from "zod";
+var LabelingFrontmatterSchema = z15.object({
+  type: z15.literal("labeling"),
+  id: z15.string().min(1),
+  title: z15.string().min(1),
+  status: RiskDocumentStatusSchema,
+  label_type: z15.enum(["ifu", "product_label", "packaging_label"]).optional(),
+  author: z15.string().optional(),
+  reviewers: z15.array(z15.string()).optional(),
+  approvers: z15.array(z15.string()).optional()
+});
+
+// ../contracts/dist/domain-schemas/product.js
+import { z as z16 } from "zod";
+var ProductDevelopmentPlanFrontmatterSchema = z16.object({
+  type: z16.literal("product_development_plan"),
+  id: z16.string().min(1),
+  title: z16.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z16.string().optional(),
+  reviewers: z16.array(z16.string()).optional(),
+  approvers: z16.array(z16.string()).optional()
+});
+var IntendedUseFrontmatterSchema = z16.object({
+  type: z16.literal("intended_use"),
+  id: z16.string().min(1),
+  title: z16.string().min(1),
+  status: RiskDocumentStatusSchema,
+  author: z16.string().optional(),
+  reviewers: z16.array(z16.string()).optional(),
+  approvers: z16.array(z16.string()).optional()
+});
+
+// ../contracts/dist/domain-schemas/user-need.js
+import { z as z17 } from "zod";
+var UserNeedPrioritySchema = z17.enum(["must_have", "should_have", "nice_to_have"]);
+var UserNeedFrontmatterSchema = z17.object({
+  id: z17.string().min(1),
+  title: z17.string().min(1),
+  status: RiskDocumentStatusSchema,
   /** Validated if present — ensures frontmatter doesn't misidentify the document type */
-  type: z13.literal("user_need").optional(),
+  type: z17.literal("user_need").optional(),
   /** The user role or stakeholder (e.g., "Quality Manager", "Developer") */
-  stakeholder: z13.string().optional(),
+  stakeholder: z17.string().optional(),
   /** MoSCoW priority classification */
   priority: UserNeedPrioritySchema.optional(),
   /** Where this need originated (e.g., "ISO 13485 §7.3", "user interview") */
-  source: z13.string().optional(),
+  source: z17.string().optional(),
   /** IDs of product requirements derived from this need */
-  derives: z13.array(z13.string()).optional(),
-  author: z13.string().optional(),
-  reviewers: z13.array(z13.string()).optional(),
-  approvers: z13.array(z13.string()).optional()
+  derives: z17.array(z17.string()).optional(),
+  author: z17.string().optional(),
+  reviewers: z17.array(z17.string()).optional(),
+  approvers: z17.array(z17.string()).optional()
 });
 
-// ../shared/dist/schemas/requirement.js
-import { z as z14 } from "zod";
-var RequirementTypeSchema = z14.enum([
+// ../contracts/dist/domain-schemas/requirement.js
+import { z as z18 } from "zod";
+var RequirementTypeSchema = z18.enum([
   "functional",
   "interface",
   "performance",
@@ -536,8 +751,8 @@ var RequirementTypeSchema = z14.enum([
   "safety",
   "regulatory"
 ]);
-var RequirementFormatSchema = z14.enum(["standard", "user_story"]);
-var RequirementFulfillmentTypeSchema = z14.enum([
+var RequirementFormatSchema = z18.enum(["standard", "user_story"]);
+var RequirementFulfillmentTypeSchema = z18.enum([
   "software",
   "labeling",
   "clinical",
@@ -545,9 +760,9 @@ var RequirementFulfillmentTypeSchema = z14.enum([
   "regulatory_doc",
   "process"
 ]);
-var RequirementFrontmatterSchema = z14.object({
-  id: z14.string().min(1),
-  title: z14.string().min(1),
+var RequirementFrontmatterSchema = z18.object({
+  id: z18.string().min(1),
+  title: z18.string().min(1),
   status: RiskDocumentStatusSchema,
   /** IEC 62304 §5.2.2 — requirement classification (required for SRS, optional for PRS) */
   req_type: RequirementTypeSchema.optional(),
@@ -555,72 +770,72 @@ var RequirementFrontmatterSchema = z14.object({
   format: RequirementFormatSchema.optional(),
   /** ISO 13485 §7.3.3 — how this PRS design input is fulfilled (PRS only, defaults to 'software') */
   fulfillment_type: RequirementFulfillmentTypeSchema.optional(),
-  author: z14.string().optional(),
-  reviewers: z14.array(z14.string()).optional(),
-  approvers: z14.array(z14.string()).optional(),
+  author: z18.string().optional(),
+  reviewers: z18.array(z18.string()).optional(),
+  approvers: z18.array(z18.string()).optional(),
   /** Upstream traceability — IDs of documents this requirement traces from (e.g., UN for PRS, PRS for SRS) */
-  traces_from: z14.array(z14.string()).optional(),
+  traces_from: z18.array(z18.string()).optional(),
   /** Downstream traceability — IDs of documents this requirement traces to (e.g., SRS for PRS) */
-  traces_to: z14.array(z14.string()).optional()
+  traces_to: z18.array(z18.string()).optional()
 });
 
-// ../shared/dist/schemas/test-documents.js
-import { z as z15 } from "zod";
-var TestProtocolFrontmatterSchema = z15.object({
-  type: z15.literal("test_protocol"),
-  id: z15.string().min(1),
-  title: z15.string().min(1),
+// ../contracts/dist/domain-schemas/test-documents.js
+import { z as z19 } from "zod";
+var TestProtocolFrontmatterSchema = z19.object({
+  type: z19.literal("test_protocol"),
+  id: z19.string().min(1),
+  title: z19.string().min(1),
   status: RiskDocumentStatusSchema,
-  author: z15.string().optional(),
-  reviewers: z15.array(z15.string()).optional(),
-  approvers: z15.array(z15.string()).optional()
+  author: z19.string().optional(),
+  reviewers: z19.array(z19.string()).optional(),
+  approvers: z19.array(z19.string()).optional()
 });
-var TestPhaseSchema = z15.enum(["verification", "production"]);
-var TestReportFrontmatterSchema = z15.object({
-  type: z15.literal("test_report"),
-  id: z15.string().min(1),
-  title: z15.string().min(1),
+var TestPhaseSchema = z19.enum(["verification", "production"]);
+var TestReportFrontmatterSchema = z19.object({
+  type: z19.literal("test_report"),
+  id: z19.string().min(1),
+  title: z19.string().min(1),
   status: RiskDocumentStatusSchema,
-  author: z15.string().optional(),
-  reviewers: z15.array(z15.string()).optional(),
-  approvers: z15.array(z15.string()).optional(),
-  release_version: z15.string().optional(),
+  author: z19.string().optional(),
+  reviewers: z19.array(z19.string()).optional(),
+  approvers: z19.array(z19.string()).optional(),
+  release_version: z19.string().optional(),
   test_phase: TestPhaseSchema.optional()
 });
 
-// ../shared/dist/schemas/repo-config.js
-import { z as z16 } from "zod";
-var ReleaseReviewConfigSchema = z16.object({
-  required_departments: z16.array(z16.string().min(1)).min(1),
-  final_approver: z16.string().min(1)
-});
-var RepoConfigSchema = z16.object({
-  device: z16.object({
-    name: z16.string().min(1),
-    safety_class: z16.enum(["A", "B", "C"]),
-    classification: z16.object({
-      eu: z16.string().optional(),
-      us: z16.string().optional()
+// ../contracts/dist/domain-schemas/repo-config.js
+import { z as z20 } from "zod";
+var ReleaseReviewConfigSchema = z20.object({
+  required_departments: z20.array(z20.string().min(1)).min(1),
+  final_approver: z20.string().min(1)
+});
+var RepoConfigSchema = z20.object({
+  device: z20.object({
+    name: z20.string().min(1),
+    safety_class: z20.enum(["A", "B", "C"]),
+    classification: z20.object({
+      eu: z20.string().optional(),
+      us: z20.string().optional()
     }).optional(),
-    udi_device_identifier: z16.string().optional()
+    udi_device_identifier: z20.string().optional()
   }),
   release_review: ReleaseReviewConfigSchema.optional()
 });
 
-// ../shared/dist/schemas/qms-device.js
-import { z as z17 } from "zod";
-var OwnerTypeSchema = z17.enum(["qms", "device"]);
-var DocumentSnapshotSchema = z17.object({
-  documentId: z17.string(),
-  commitSha: z17.string(),
-  documentPath: z17.string(),
-  documentTitle: z17.string(),
-  documentType: z17.string(),
-  previousReleasedCommitSha: z17.string().optional(),
-  changeType: z17.enum(["added", "modified", "unchanged"]),
-  changeDescription: z17.string().optional()
-});
-var QmsDocumentTypeSchema = z17.enum([
+// ../contracts/dist/domain-schemas/qms-device.js
+import { z as z21 } from "zod";
+var OwnerTypeSchema = z21.enum(["qms", "device"]);
+var DocumentSnapshotSchema = z21.object({
+  documentId: z21.string(),
+  commitSha: z21.string(),
+  documentPath: z21.string(),
+  documentTitle: z21.string(),
+  documentType: z21.string(),
+  previousReleasedCommitSha: z21.string().optional(),
+  changeType: z21.enum(["added", "modified", "unchanged"]),
+  changeDescription: z21.string().optional()
+});
+var QmsDocumentTypeSchema = z21.enum([
   "sop",
   "policy",
   "work_instruction",
@@ -629,7 +844,7 @@ var QmsDocumentTypeSchema = z17.enum([
   "audit_report",
   "management_review"
 ]);
-var DeviceDocumentTypeSchema = z17.enum([
+var DeviceDocumentTypeSchema = z21.enum([
   "user_need",
   "requirement",
   "architecture",
@@ -681,67 +896,68 @@ var DeviceDocumentTypeSchema = z17.enum([
   "software_test_plan"
 ]);
 
-// ../shared/dist/schemas/change-management.js
-import { z as z18 } from "zod";
-var ReleasePlanFrontmatterSchema = z18.object({
-  id: z18.string().min(1),
-  title: z18.string().min(1),
-  type: z18.literal("release_plan").optional(),
-  status: z18.string().optional(),
-  author: z18.string().optional(),
-  reviewers: z18.array(z18.string()).optional(),
-  approvers: z18.array(z18.string()).optional(),
-  version: z18.string().optional(),
-  target_date: z18.string().optional()
+// ../contracts/dist/domain-schemas/change-management.js
+import { z as z22 } from "zod";
+var ReleasePlanFrontmatterSchema = z22.object({
+  id: z22.string().min(1),
+  title: z22.string().min(1),
+  type: z22.literal("release_plan").optional(),
+  status: z22.string().optional(),
+  author: z22.string().optional(),
+  reviewers: z22.array(z22.string()).optional(),
+  approvers: z22.array(z22.string()).optional(),
+  version: z22.string().optional(),
+  target_date: z22.string().optional(),
+  applicable_plans: z22.array(z22.string()).optional()
 });
-var SuspectedLinkDispositionSchema = z18.enum(["included_in_release", "not_impacted"]);
-var SuspectedLinkNeighborSchema = z18.object({
-  document: z18.string().min(1),
-  direction: z18.enum(["upstream", "downstream"]),
+var SuspectedLinkDispositionSchema = z22.enum(["included_in_release", "not_impacted"]);
+var SuspectedLinkNeighborSchema = z22.object({
+  document: z22.string().min(1),
+  direction: z22.enum(["upstream", "downstream"]),
   disposition: SuspectedLinkDispositionSchema,
   /** Required when disposition is 'not_impacted' */
-  rationale: z18.string().min(1).optional()
+  rationale: z22.string().min(1).optional()
 });
-var SuspectedLinkGroupSchema = z18.object({
-  triggered_by: z18.string().min(1),
-  neighbors: z18.array(SuspectedLinkNeighborSchema).min(1)
+var SuspectedLinkGroupSchema = z22.object({
+  triggered_by: z22.string().min(1),
+  neighbors: z22.array(SuspectedLinkNeighborSchema).min(1)
 });
-var DesignReviewFrontmatterSchema = z18.object({
-  id: z18.string().min(1),
-  title: z18.string().min(1),
-  type: z18.literal("design_review").optional(),
-  status: z18.string().optional(),
-  author: z18.string().optional(),
-  reviewers: z18.array(z18.string()).optional(),
-  approvers: z18.array(z18.string()).optional(),
+var DesignReviewFrontmatterSchema = z22.object({
+  id: z22.string().min(1),
+  title: z22.string().min(1),
+  type: z22.literal("design_review").optional(),
+  status: z22.string().optional(),
+  author: z22.string().optional(),
+  reviewers: z22.array(z22.string()).optional(),
+  approvers: z22.array(z22.string()).optional(),
   /** Optional link to a Release Plan document (e.g. "RP-001") */
-  release_plan: z18.string().optional(),
+  release_plan: z22.string().optional(),
   /** Acknowledged suspected links — one-up/one-down neighbor analysis */
-  suspected_links: z18.array(SuspectedLinkGroupSchema).optional()
+  suspected_links: z22.array(SuspectedLinkGroupSchema).optional()
 });
-var ReleaseNotesAudienceSchema = z18.enum(["customer", "technical"]);
-var ReleaseNotesFrontmatterSchema = z18.object({
-  id: z18.string().min(1),
-  title: z18.string().min(1),
-  type: z18.literal("release_notes").optional(),
+var ReleaseNotesAudienceSchema = z22.enum(["customer", "technical"]);
+var ReleaseNotesFrontmatterSchema = z22.object({
+  id: z22.string().min(1),
+  title: z22.string().min(1),
+  type: z22.literal("release_notes").optional(),
   status: RiskDocumentStatusSchema,
-  author: z18.string().optional(),
-  reviewers: z18.array(z18.string()).optional(),
-  approvers: z18.array(z18.string()).optional(),
+  author: z22.string().optional(),
+  reviewers: z22.array(z22.string()).optional(),
+  approvers: z22.array(z22.string()).optional(),
   audience: ReleaseNotesAudienceSchema,
-  release_version: z18.string().min(1)
+  release_version: z22.string().min(1)
 });
 
-// ../shared/dist/schemas/retention-policy.js
-import { z as z19 } from "zod";
-var RetentionPolicySchema = z19.object({
+// ../contracts/dist/domain-schemas/retention-policy.js
+import { z as z23 } from "zod";
+var RetentionPolicySchema = z23.object({
   /** Default retention period in years for all record types */
-  defaultPeriodYears: z19.number().int().min(1).max(30).default(10),
+  defaultPeriodYears: z23.number().int().min(1).max(30).default(10),
   /**
    * Optional per-record-type overrides (e.g., { "release": 15, "signature": 20 }).
    * Keys are record type identifiers; values are retention periods in years.
    */
-  byRecordType: z19.record(z19.string(), z19.number().int().min(1).max(30)).optional()
+  byRecordType: z23.record(z23.string(), z23.number().int().min(1).max(30)).optional()
 });
 function isWithinRetentionPeriod(createdAt, retentionYears, now = /* @__PURE__ */ new Date()) {
   const retentionEnd = new Date(createdAt);
@@ -756,143 +972,143 @@ function getEffectiveRetentionYears(policy, recordType) {
   return policy.byRecordType?.[recordType] ?? policy.defaultPeriodYears;
 }
 
-// ../shared/dist/schemas/audit.js
-import { z as z20 } from "zod";
-var AuditFindingClassificationSchema = z20.enum(["observation", "minor_nc", "major_nc"]);
-var AuditStatusSchema = z20.enum(["planned", "in_progress", "completed", "cancelled"]);
-var PlannedAuditEntrySchema = z20.object({
-  audit_id: z20.string().min(1),
-  process_area: z20.string().min(1),
-  clause: z20.string().optional(),
-  planned_date: z20.string().min(1),
-  auditor: z20.string().min(1),
+// ../contracts/dist/domain-schemas/audit.js
+import { z as z24 } from "zod";
+var AuditFindingClassificationSchema = z24.enum(["observation", "minor_nc", "major_nc"]);
+var AuditStatusSchema = z24.enum(["planned", "in_progress", "completed", "cancelled"]);
+var PlannedAuditEntrySchema = z24.object({
+  audit_id: z24.string().min(1),
+  process_area: z24.string().min(1),
+  clause: z24.string().optional(),
+  planned_date: z24.string().min(1),
+  auditor: z24.string().min(1),
   status: AuditStatusSchema
 });
-var AuditScheduleFrontmatterSchema = z20.object({
-  id: z20.string().min(1),
-  title: z20.string().min(1),
-  type: z20.literal("audit_schedule").optional(),
-  status: z20.string().optional(),
-  author: z20.string().optional(),
-  reviewers: z20.array(z20.string()).optional(),
-  approvers: z20.array(z20.string()).optional(),
-  cycle_year: z20.number().int().min(2e3).max(2100),
-  audits: z20.array(PlannedAuditEntrySchema).min(1)
-});
-var AuditFindingSchema = z20.object({
-  finding_id: z20.string().min(1),
+var AuditScheduleFrontmatterSchema = z24.object({
+  id: z24.string().min(1),
+  title: z24.string().min(1),
+  type: z24.literal("audit_schedule").optional(),
+  status: z24.string().optional(),
+  author: z24.string().optional(),
+  reviewers: z24.array(z24.string()).optional(),
+  approvers: z24.array(z24.string()).optional(),
+  cycle_year: z24.number().int().min(2e3).max(2100),
+  audits: z24.array(PlannedAuditEntrySchema).min(1)
+});
+var AuditFindingSchema = z24.object({
+  finding_id: z24.string().min(1),
   classification: AuditFindingClassificationSchema,
-  description: z20.string().min(1),
-  capa_id: z20.string().optional()
-});
-var AuditReportFrontmatterSchema = z20.object({
-  id: z20.string().min(1),
-  title: z20.string().min(1),
-  type: z20.literal("audit_report").optional(),
-  status: z20.string().optional(),
-  author: z20.string().optional(),
-  reviewers: z20.array(z20.string()).optional(),
-  approvers: z20.array(z20.string()).optional(),
-  audit_date: z20.string().min(1),
-  audit_id: z20.string().optional(),
-  process_area: z20.string().min(1),
-  clause: z20.string().optional(),
-  auditor: z20.string().min(1),
-  findings: z20.array(AuditFindingSchema),
-  findings_major: z20.number().int().min(0).optional(),
-  findings_minor: z20.number().int().min(0).optional(),
-  findings_observations: z20.number().int().min(0).optional()
-});
-
-// ../shared/dist/schemas/management-review.js
-import { z as z21 } from "zod";
-var ManagementReviewAttendeeSchema = z21.object({
-  name: z21.string().min(1),
-  role: z21.string().min(1)
-});
-var ManagementReviewFrontmatterSchema = z21.object({
-  id: z21.string().min(1),
-  title: z21.string().min(1),
-  type: z21.literal("management_review").optional(),
-  version: z21.string().optional(),
-  status: z21.enum(["draft", "scheduled", "completed"]).optional(),
-  review_date: z21.string().min(1),
-  review_period: z21.object({
-    from: z21.string().min(1),
-    to: z21.string().min(1)
+  description: z24.string().min(1),
+  capa_id: z24.string().optional()
+});
+var AuditReportFrontmatterSchema = z24.object({
+  id: z24.string().min(1),
+  title: z24.string().min(1),
+  type: z24.literal("audit_report").optional(),
+  status: z24.string().optional(),
+  author: z24.string().optional(),
+  reviewers: z24.array(z24.string()).optional(),
+  approvers: z24.array(z24.string()).optional(),
+  audit_date: z24.string().min(1),
+  audit_id: z24.string().optional(),
+  process_area: z24.string().min(1),
+  clause: z24.string().optional(),
+  auditor: z24.string().min(1),
+  findings: z24.array(AuditFindingSchema),
+  findings_major: z24.number().int().min(0).optional(),
+  findings_minor: z24.number().int().min(0).optional(),
+  findings_observations: z24.number().int().min(0).optional()
+});
+
+// ../contracts/dist/domain-schemas/management-review.js
+import { z as z25 } from "zod";
+var ManagementReviewAttendeeSchema = z25.object({
+  name: z25.string().min(1),
+  role: z25.string().min(1)
+});
+var ManagementReviewFrontmatterSchema = z25.object({
+  id: z25.string().min(1),
+  title: z25.string().min(1),
+  type: z25.literal("management_review").optional(),
+  version: z25.string().optional(),
+  status: z25.enum(["draft", "scheduled", "completed"]).optional(),
+  review_date: z25.string().min(1),
+  review_period: z25.object({
+    from: z25.string().min(1),
+    to: z25.string().min(1)
   }),
-  attendees: z21.array(ManagementReviewAttendeeSchema).min(1),
-  data_snapshot_date: z21.string().optional(),
-  next_review_date: z21.string().optional()
+  attendees: z25.array(ManagementReviewAttendeeSchema).min(1),
+  data_snapshot_date: z25.string().optional(),
+  next_review_date: z25.string().optional()
 });
 
-// ../shared/dist/schemas/frameworks.js
-import { z as z22 } from "zod";
-var FrameworkScopeSchema = z22.enum(["qms", "device", "both"]);
-var MappingRelationshipSchema = z22.enum(["equivalent", "partial", "related", "supersedes"]);
-var FrameworkDefinitionSeedSchema = z22.object({
+// ../contracts/dist/domain-schemas/frameworks.js
+import { z as z26 } from "zod";
+var FrameworkScopeSchema = z26.enum(["qms", "device", "both"]);
+var MappingRelationshipSchema = z26.enum(["equivalent", "partial", "related", "supersedes"]);
+var FrameworkDefinitionSeedSchema = z26.object({
   id: RegulatoryFrameworkSchema,
-  name: z22.string().min(1),
-  version: z22.string().min(1),
+  name: z26.string().min(1),
+  version: z26.string().min(1),
   scope: FrameworkScopeSchema,
-  url: z22.string().url().nullable(),
-  active: z22.boolean().default(true)
+  url: z26.string().url().nullable(),
+  active: z26.boolean().default(true)
 });
-var ClauseBase = z22.object({
-  clauseNumber: z22.string().min(1),
-  title: z22.string().min(1)
+var ClauseBase = z26.object({
+  clauseNumber: z26.string().min(1),
+  title: z26.string().min(1)
 });
 function buildClauseSchema(remainingDepth) {
   if (remainingDepth <= 0) {
     return ClauseBase.strict();
   }
   return ClauseBase.extend({
-    children: z22.array(z22.lazy(() => buildClauseSchema(remainingDepth - 1))).optional()
+    children: z26.array(z26.lazy(() => buildClauseSchema(remainingDepth - 1))).optional()
   });
 }
 var FrameworkClauseSeedSchema = buildClauseSchema(5);
-var FrameworkMappingSeedSchema = z22.object({
-  sourceClause: z22.string().min(1),
+var FrameworkMappingSeedSchema = z26.object({
+  sourceClause: z26.string().min(1),
   targetFramework: RegulatoryFrameworkSchema,
-  targetClause: z22.string().min(1),
+  targetClause: z26.string().min(1),
   relationship: MappingRelationshipSchema,
-  notes: z22.string().nullable().default(null)
+  notes: z26.string().nullable().default(null)
 });
-var MappingFileSeedSchema = z22.object({
+var MappingFileSeedSchema = z26.object({
   sourceFramework: RegulatoryFrameworkSchema,
-  mappings: z22.array(FrameworkMappingSeedSchema)
+  mappings: z26.array(FrameworkMappingSeedSchema)
 });
-var EvidenceSourceSchema = z22.enum(["documents", "training_records"]);
-var EvidenceRuleConditionsSeedSchema = z22.object({
+var EvidenceSourceSchema = z26.enum(["documents", "training_records"]);
+var EvidenceRuleConditionsSeedSchema = z26.object({
   evidenceSource: EvidenceSourceSchema.optional(),
   documentType: DocumentTypeSchema.optional(),
   linkType: LinkTypeSchema.optional(),
-  status: z22.string().optional(),
-  minCount: z22.number().int().positive().optional()
+  status: z26.string().optional(),
+  minCount: z26.number().int().positive().optional()
 });
-var EvidenceRuleSeedSchema = z22.object({
-  clauseId: z22.string().min(1),
-  description: z22.string().min(1),
+var EvidenceRuleSeedSchema = z26.object({
+  clauseId: z26.string().min(1),
+  description: z26.string().min(1),
   conditions: EvidenceRuleConditionsSeedSchema,
-  weight: z22.number().min(0).max(1)
+  weight: z26.number().min(0).max(1)
 });
-var EvidenceRulesFileSeedSchema = z22.object({
+var EvidenceRulesFileSeedSchema = z26.object({
   frameworkId: RegulatoryFrameworkSchema,
-  rules: z22.array(EvidenceRuleSeedSchema)
+  rules: z26.array(EvidenceRuleSeedSchema)
 });
 var FrameworkFileSeedSchema = FrameworkDefinitionSeedSchema.extend({
-  clauses: z22.array(FrameworkClauseSeedSchema)
+  clauses: z26.array(FrameworkClauseSeedSchema)
 });
 
-// ../shared/dist/schemas/legal.js
-import { z as z23 } from "zod";
-var LegalDocumentTypeSchema = z23.enum(["tos", "privacy-policy", "billing-terms"]);
-var LegalDocumentVersionSchema = z23.string().regex(/^\d{4}-\d{2}-\d{2}$/, {
+// ../contracts/dist/domain-schemas/legal.js
+import { z as z27 } from "zod";
+var LegalDocumentTypeSchema = z27.enum(["tos", "privacy-policy", "billing-terms"]);
+var LegalDocumentVersionSchema = z27.string().regex(/^\d{4}-\d{2}-\d{2}$/, {
   message: "Version must be in YYYY-MM-DD format"
 });
 
-// ../shared/dist/schemas/index.js
-var GateOverrideCategorySchema = z24.enum([
+// ../contracts/dist/domain-schemas/index.js
+var GateOverrideCategorySchema = z28.enum([
   "unverified_requirements",
   "unanalyzed_requirements",
   "error_risk_gaps",
@@ -909,19 +1125,19 @@ var GateOverrideCategorySchema = z24.enum([
   "missing_deployment_references",
   "missing_smoke_test_evidence"
 ]);
-var MemberRoleSchema = z24.enum(["admin", "member"]);
-var MemberStatusSchema = z24.enum(["active", "suspended", "removed"]);
-var EmailAddressSchema = z24.object({
-  value: z24.string().email(),
-  verified: z24.boolean()
+var MemberRoleSchema = z28.enum(["admin", "member"]);
+var MemberStatusSchema2 = z28.enum(["active", "suspended", "removed"]);
+var EmailAddressSchema = z28.object({
+  value: z28.string().email(),
+  verified: z28.boolean()
 });
-var ReviewerRuleSchema = z24.object({
+var ReviewerRuleSchema2 = z28.object({
   documentType: DocumentTypeSchema,
-  requiredDepartments: z24.array(z24.string()),
-  finalApproverDepartment: z24.string()
+  requiredDepartments: z28.array(z28.string()),
+  finalApproverDepartment: z28.string()
 });
-var SyncStatusSchema = z24.enum(["active", "paused", "error"]);
-var AuditActionSchema = z24.enum([
+var SyncStatusSchema = z28.enum(["active", "paused", "error"]);
+var AuditActionSchema = z28.enum([
   // Organization
   "organization.created",
   "organization.settings_updated",
@@ -1086,7 +1302,7 @@ var AuditActionSchema = z24.enum([
   // Audit
   "audit_log.exported"
 ]);
-var ResourceTypeSchema = z24.enum([
+var ResourceTypeSchema = z28.enum([
   "organization",
   "member",
   "invite",
@@ -1118,186 +1334,3037 @@ var ResourceTypeSchema = z24.enum([
   "audit_log",
   "risk_matrix"
 ]);
-var ReleaseTypeSchema = z24.enum(["qms", "device", "combined"]);
-var ReleaseStatusSchema = z24.enum(["draft", "in_review", "approved", "published"]);
-var SignatureTypeSchema = z24.enum(["author", "dept_reviewer", "final_approver", "trainee"]);
-var ChangeTypeSchema = z24.enum(["added", "modified", "deleted"]);
-var SigningRequestStatusSchema = z24.enum([
+var ReleaseTypeSchema = z28.enum(["qms", "device", "combined"]);
+var ReleaseStatusSchema = z28.enum(["draft", "in_review", "approved", "published"]);
+var SignatureTypeSchema = z28.enum(["author", "dept_reviewer", "final_approver", "trainee"]);
+var ChangeTypeSchema = z28.enum(["added", "modified", "deleted"]);
+var SigningRequestStatusSchema = z28.enum([
   "sent",
   "partially_signed",
   "completed",
   "expired",
   "cancelled"
 ]);
-var SignerStatusSchema = z24.enum(["pending", "viewed", "signed", "declined"]);
-var FieldTypeSchema = z24.enum(["signature", "initials", "date"]);
+var SignerStatusSchema = z28.enum(["pending", "viewed", "signed", "declined"]);
+var FieldTypeSchema = z28.enum(["signature", "initials", "date"]);
 
-// ../shared/dist/constants/risk-matrix.js
-var RISK_DOCUMENT_TYPES = [
-  "software_risk",
-  "usability_risk",
-  "security_risk"
-];
-var HAZARD_DOCUMENT_TYPES = ["haz_soe_software", "haz_soe_security"];
-var ALL_RISK_RELATED_DOCUMENT_TYPES = [
-  ...RISK_DOCUMENT_TYPES,
-  ...HAZARD_DOCUMENT_TYPES,
-  "hazardous_situation",
-  "harm"
-];
+// ../contracts/dist/identity/legal-requests.js
+var LegalAcceptRequestSchema = z29.object({
+  documentType: LegalDocumentTypeSchema,
+  documentVersion: LegalDocumentVersionSchema,
+  organizationId: z29.string().optional()
+}).superRefine((data, ctx) => {
+  if (data.documentType === "billing-terms" && !data.organizationId) {
+    ctx.addIssue({
+      code: z29.ZodIssueCode.custom,
+      message: "organizationId is required for billing-terms",
+      path: ["organizationId"]
+    });
+  }
+});
+var LegalHistoryQuerySchema = z29.object({
+  pageToken: z29.string().optional(),
+  limit: z29.coerce.number().min(1).max(100).default(20)
+});
 
-// ../shared/dist/constants/document-types.js
-var QMS_DOCUMENT_TYPES = [
-  "sop",
-  "policy",
-  "work_instruction",
-  "supplier",
-  // Internal audit management (ISO 13485 §8.2.2)
-  "audit_schedule",
-  "audit_report",
-  // Management review (ISO 13485 §5.6)
-  "management_review"
-];
-var DEVICE_DOCUMENT_TYPES = [
-  "user_need",
-  "requirement",
-  "architecture",
-  "detailed_design",
-  "test_protocol",
-  "test_report",
-  "usability_risk",
+// ../contracts/dist/identity/legal-responses.js
+import { z as z30 } from "zod";
+var LegalAcceptResponseSchema = z30.object({
+  acceptanceId: z30.string(),
+  acceptedAt: z30.string()
+});
+var DocumentStatusSchema2 = z30.object({
+  accepted: z30.boolean(),
+  acceptedVersion: z30.string().optional(),
+  currentVersion: z30.string()
+});
+var LegalStatusResponseSchema = z30.object({
+  tos: DocumentStatusSchema2,
+  privacyPolicy: DocumentStatusSchema2,
+  billingTerms: z30.record(z30.string(), DocumentStatusSchema2)
+});
+var LegalHistoryResponseSchema = z30.object({
+  acceptances: z30.array(z30.object({
+    id: z30.string(),
+    documentType: LegalDocumentTypeSchema,
+    documentVersion: z30.string(),
+    organizationId: z30.string().optional(),
+    acceptedAt: z30.string()
+  })),
+  nextPageToken: z30.string().optional()
+});
+
+// ../contracts/dist/repositories/requests.js
+import { z as z31 } from "zod";
+var RepositoryTypeSchema = z31.enum(["qms", "device"]);
+var SyncStatusSchema2 = z31.enum(["active", "paused", "error"]);
+var ConnectRepositoryRequestSchema = z31.object({
+  organizationId: z31.string().min(1),
+  gitHubRepoFullName: z31.string().min(1),
+  gitHubRepoId: z31.number().int().positive()
+});
+var RepositoryIdParamSchema = z31.object({
+  repositoryId: z31.string().min(1)
+});
+var OrgRepositoryParamSchema = z31.object({
+  orgId: z31.string().min(1),
+  repositoryId: z31.string().min(1)
+});
+var OrgIdQuerySchema = z31.object({
+  organizationId: z31.string().min(1)
+});
+var OwnerTypeSchema2 = z31.enum(["qms", "device"]);
+var AssignRepositoryRequestSchema = z31.object({
+  ownerType: OwnerTypeSchema2,
+  ownerId: z31.string().min(1)
+});
+var TriggerSyncRequestSchema = z31.object({
+  organizationId: z31.string().min(1)
+});
+var SyncEventParamSchema = z31.object({
+  repositoryId: z31.string().min(1),
+  syncEventId: z31.string().min(1)
+});
+
+// ../contracts/dist/repositories/responses.js
+import { z as z32 } from "zod";
+var DocumentCountsSchema = z32.record(z32.string(), z32.number());
+var LinkCountsSchema = z32.record(z32.string(), z32.number());
+var RepositorySnapshotSchema = z32.object({
+  documentCounts: DocumentCountsSchema,
+  linkCounts: LinkCountsSchema,
+  totalDocuments: z32.number(),
+  totalLinks: z32.number()
+});
+var BaseFieldsSchema = z32.object({
+  id: z32.string(),
+  organizationId: z32.string(),
+  ownerType: z32.enum(["qms", "device"]).nullable(),
+  ownerId: z32.string().nullable(),
+  gitHubRepoFullName: z32.string(),
+  gitHubRepoId: z32.number(),
+  syncStatus: SyncStatusSchema2,
+  lastSyncedAt: z32.string().optional(),
+  // ISO date
+  lastSyncCommitSha: z32.string().optional(),
+  connectedAt: z32.string(),
+  // ISO date
+  connectedBy: z32.string(),
+  snapshot: RepositorySnapshotSchema.optional()
+});
+var UnassignedRepositoryResponseSchema = BaseFieldsSchema.extend({
+  type: z32.literal("unassigned")
+});
+var QmsRepositoryResponseSchema = BaseFieldsSchema.extend({
+  type: z32.literal("qms")
+});
+var DeviceRepositoryResponseSchema = BaseFieldsSchema.extend({
+  type: z32.literal("device"),
+  deviceName: z32.string(),
+  safetyClass: SafetyClassSchema,
+  configManaged: z32.boolean().optional()
+});
+var RepositoryResponseSchema = z32.discriminatedUnion("type", [
+  UnassignedRepositoryResponseSchema,
+  QmsRepositoryResponseSchema,
+  DeviceRepositoryResponseSchema
+]);
+var BaseRepositoryResponseSchema = BaseFieldsSchema.extend({
+  type: z32.enum(["unassigned", "qms", "device"])
+});
+var GitHubRepositoryResponseSchema = z32.object({
+  id: z32.number(),
+  fullName: z32.string(),
+  name: z32.string(),
+  private: z32.boolean(),
+  defaultBranch: z32.string()
+});
+var ConnectRepositoryResponseSchema = z32.object({
+  repositoryId: z32.string()
+});
+var GetRepositoriesResponseSchema = z32.object({
+  repositories: z32.array(RepositoryResponseSchema)
+});
+var ListGitHubReposResponseSchema = z32.object({
+  repositories: z32.array(GitHubRepositoryResponseSchema)
+});
+var TriggerSyncResponseSchema = z32.object({
+  syncEventId: z32.string()
+});
+var SyncEventStatusSchema = z32.enum([
+  "pending",
+  "in_progress",
+  "completed",
+  "completed_with_errors",
+  "failed"
+]);
+var SyncTriggerSchema = z32.enum(["manual", "webhook", "scheduled"]);
+var SyncEventResultSchema = z32.object({
+  documentsCreated: z32.number(),
+  documentsUpdated: z32.number(),
+  documentsRemoved: z32.number(),
+  linksCreated: z32.number(),
+  linksRemoved: z32.number(),
+  errors: z32.array(z32.string()),
+  commitSha: z32.string(),
+  repoConfig: z32.object({
+    device: z32.object({
+      name: z32.string(),
+      safety_class: z32.enum(["A", "B", "C"]),
+      classification: z32.object({
+        eu: z32.string().optional(),
+        us: z32.string().optional()
+      }).optional()
+    })
+  }).optional()
+});
+var SyncEventResponseSchema = z32.object({
+  id: z32.string(),
+  status: SyncEventStatusSchema,
+  trigger: SyncTriggerSchema,
+  createdAt: z32.string(),
+  // ISO date
+  createdBy: z32.string(),
+  startedAt: z32.string().optional(),
+  completedAt: z32.string().optional(),
+  error: z32.string().optional(),
+  result: SyncEventResultSchema.optional()
+});
+var GetSyncEventResponseSchema = z32.object({
+  syncEvent: SyncEventResponseSchema
+});
+
+// ../contracts/dist/risks/requests.js
+import { z as z33 } from "zod";
+var RiskTypeSchema = z33.enum(["software_risk", "usability_risk", "security_risk"]);
+var GetRiskMatrixQuerySchema = z33.object({
+  organizationId: z33.string().min(1),
+  repositoryId: z33.string().optional(),
+  type: RiskTypeSchema.optional()
+});
+var GetRiskGapsQuerySchema = z33.object({
+  organizationId: z33.string().min(1),
+  repositoryId: z33.string().optional(),
+  type: RiskTypeSchema.optional()
+});
+var GetRiskListQuerySchema = z33.object({
+  organizationId: z33.string().min(1),
+  repositoryId: z33.string().optional(),
+  type: RiskTypeSchema.optional(),
+  limit: z33.coerce.number().min(1).max(100).optional().default(50)
+});
+
+// ../contracts/dist/risks/responses.js
+import { z as z34 } from "zod";
+var RiskValueSchema = z34.number().int().min(1).max(5);
+var RiskDocumentTypeSchema = z34.enum([
   "software_risk",
+  "usability_risk",
   "security_risk",
-  "hazardous_situation",
-  "harm",
   "haz_soe_software",
   "haz_soe_security",
-  "hazard_category",
-  // Usability engineering (IEC 62366)
-  "usability_plan",
-  "use_specification",
-  "task_analysis",
-  "usability_evaluation",
-  "summative_evaluation",
-  // Risk management (ISO 14971)
-  "risk_management_plan",
-  // Software lifecycle (IEC 62304)
-  "software_development_plan",
-  "software_maintenance_plan",
-  "soup_register",
-  // Problem resolution (IEC 62304 §9)
-  "anomaly",
-  // Cybersecurity (IEC 81001-5-1)
-  "cybersecurity_plan",
-  "sbom",
-  // Clinical (MDR / FDA)
-  "clinical_evaluation_plan",
-  "clinical_evaluation_report",
-  // Post-market surveillance (MDR Art. 83)
-  "post_market_surveillance_plan",
-  "post_market_feedback",
-  // Labeling (MDR Annex I)
-  "labeling",
-  // Product (ISO 13485 §7.3)
-  "product_development_plan",
-  "intended_use",
-  // Release management (IEC 62304 §5.7)
-  "release_plan",
-  // Change management (ISO 13485 §7.3.5)
-  "design_review",
-  "release_notes",
-  // Software test plan (IEC 62304 §5.7)
-  "software_test_plan"
-];
-var CHANGE_DOCUMENT_TYPES = ["design_review", "release_plan"];
-function isChangeDocumentType(type) {
-  return CHANGE_DOCUMENT_TYPES.includes(type);
-}
-function isQmsDocumentType(type) {
-  return QMS_DOCUMENT_TYPES.includes(type);
-}
-function isDeviceDocumentType(type) {
-  return DEVICE_DOCUMENT_TYPES.includes(type);
-}
+  "hazardous_situation",
+  "harm",
+  "hazard_category"
+]);
+var HarmAssessmentEntrySchema = z34.object({
+  harm: z34.string(),
+  harmTitle: z34.string().optional(),
+  harmSeverity: RiskValueSchema,
+  inherentProbability: RiskValueSchema,
+  residualProbability: RiskValueSchema,
+  residualSeverityOverride: RiskValueSchema.optional(),
+  residualSeverity: RiskValueSchema,
+  inherentAcceptability: AcceptabilityStatusSchema,
+  residualAcceptability: AcceptabilityStatusSchema
+});
+var RiskEntrySchema = z34.object({
+  id: z34.string(),
+  type: RiskDocumentTypeSchema,
+  harmAssessments: z34.array(HarmAssessmentEntrySchema),
+  worstInherentSeverity: RiskValueSchema.optional(),
+  worstInherentProbability: RiskValueSchema.optional(),
+  worstResidualSeverity: RiskValueSchema.optional(),
+  worstResidualProbability: RiskValueSchema.optional(),
+  worstAcceptability: AcceptabilityStatusSchema.optional(),
+  cvssScore: z34.number().min(0).max(10).optional(),
+  cvssVector: z34.string().optional()
+});
+var RiskMatrixResponseSchema = z34.object({
+  inherent: z34.array(z34.array(z34.number())),
+  residual: z34.array(z34.array(z34.number())),
+  acceptability: z34.array(z34.array(AcceptabilityStatusSchema)),
+  summary: z34.object({
+    total: z34.number(),
+    acceptable: z34.number(),
+    reviewRequired: z34.number(),
+    unacceptable: z34.number()
+  }),
+  labels: z34.object({
+    severity: z34.array(z34.string()),
+    probability: z34.array(z34.string())
+  })
+});
+var RiskGapSchema = z34.object({
+  code: z34.string(),
+  severity: z34.enum(["error", "warning"]),
+  documentId: z34.string(),
+  documentTitle: z34.string(),
+  message: z34.string(),
+  repositoryId: z34.string().optional(),
+  repositoryName: z34.string().optional()
+});
+var RiskGapsResponseSchema = z34.object({
+  gaps: z34.array(RiskGapSchema),
+  byType: z34.record(z34.array(RiskGapSchema))
+});
+var RiskListItemSchema = z34.object({
+  id: z34.string(),
+  documentId: z34.string(),
+  title: z34.string(),
+  type: RiskDocumentTypeSchema,
+  harmAssessmentCount: z34.number().int().min(0),
+  worstInherentSeverity: RiskValueSchema.optional(),
+  worstInherentProbability: RiskValueSchema.optional(),
+  worstResidualSeverity: RiskValueSchema.optional(),
+  worstResidualProbability: RiskValueSchema.optional(),
+  worstAcceptability: AcceptabilityStatusSchema.optional(),
+  mitigationsCount: z34.number().int().min(0),
+  hasRiskBenefit: z34.boolean(),
+  cvssScore: z34.number().min(0).max(10).optional(),
+  cvssVector: z34.string().optional()
+});
+var RiskListResponseSchema = z34.object({
+  risks: z34.array(RiskListItemSchema),
+  total: z34.number()
+});
 
-// ../shared/dist/constants/index.js
-var DOCUMENT_TYPES = {
-  user_need: "User Need",
-  requirement: "Requirement",
-  architecture: "Architecture",
-  detailed_design: "Detailed Design",
-  test_protocol: "Test Protocol",
-  test_report: "Test Report",
-  sop: "SOP",
-  work_instruction: "Work Instruction",
-  policy: "Policy",
-  usability_risk: "Usability Risk",
-  software_risk: "Software Risk",
-  security_risk: "Security Risk",
-  // Risk document types
-  haz_soe_software: "Hazard (Software)",
-  haz_soe_security: "Hazard (Security)",
-  hazardous_situation: "Hazardous Situation",
-  harm: "Harm",
-  hazard_category: "Hazard Category",
-  // Usability engineering (IEC 62366)
-  usability_plan: "Usability Plan",
-  use_specification: "Use Specification",
-  task_analysis: "Task Analysis",
-  usability_evaluation: "Usability Evaluation",
-  summative_evaluation: "Summative Evaluation",
-  // Risk management (ISO 14971)
-  risk_management_plan: "Risk Management Plan",
-  // Software lifecycle (IEC 62304)
-  software_development_plan: "Software Development Plan",
-  software_maintenance_plan: "Software Maintenance Plan",
-  soup_register: "SOUP Register",
-  // Problem resolution (IEC 62304 §9)
-  anomaly: "Anomaly",
-  // Cybersecurity (IEC 81001-5-1)
-  cybersecurity_plan: "Cybersecurity Plan",
-  sbom: "SBOM",
-  // Clinical (MDR / FDA)
-  clinical_evaluation_plan: "Clinical Evaluation Plan",
-  clinical_evaluation_report: "Clinical Evaluation Report",
-  // Post-market surveillance (MDR Art. 83)
-  post_market_surveillance_plan: "Post-Market Surveillance Plan",
-  post_market_feedback: "Post-Market Feedback",
-  // Labeling (MDR Annex I)
-  labeling: "Labeling",
-  // Product (ISO 13485 §7.3)
-  product_development_plan: "Product Development Plan",
-  intended_use: "Intended Use",
-  // Release management (IEC 62304 §5.7)
-  release_plan: "Release Plan",
-  // Change management (ISO 13485 §7.3.5)
-  design_review: "Design Review",
-  release_notes: "Release Notes",
-  // Supplier management (ISO 13485 §7.4)
-  supplier: "Supplier",
-  // Internal audit management (ISO 13485 §8.2.2)
-  audit_schedule: "Audit Schedule",
-  audit_report: "Audit Report",
-  // Management review (ISO 13485 §5.6)
-  management_review: "Management Review",
-  // Software test plan (IEC 62304 §5.7)
-  software_test_plan: "Software Test Plan"
-};
-var LINK_TYPES = {
-  derives_from: "Derives From",
-  implements: "Implements",
-  verified_by: "Verified By",
-  mitigates: "Mitigates",
-  parent_of: "Parent Of",
-  related_to: "Related To",
-  // New risk link types
-  leads_to: "Leads To",
-  results_in: "Results In",
-  analyzes: "Analyzes"
-};
-var REQUIRED_SECTIONS = {
-  user_need: ["Purpose", "Stakeholder", "User Needs"],
-  architecture: ["Purpose"],
+// ../contracts/dist/documents/requests.js
+import { z as z35 } from "zod";
+var DocumentSourceTypeSchema = z35.enum([
+  "markdown",
+  "pdf"
+]);
+var ChangeTypeSchema2 = z35.enum(["added", "modified", "removed"]);
+var GetDocumentsQuerySchema = z35.object({
+  organizationId: z35.string().min(1),
+  repositoryId: z35.string().min(1).optional(),
+  docType: DocumentTypeSchema.optional(),
+  status: DocumentStatusSchema.optional(),
+  searchQuery: z35.string().optional(),
+  limit: z35.coerce.number().int().positive().max(200).default(50),
+  offset: z35.coerce.number().int().nonnegative().default(0)
+});
+var GetDocumentQuerySchema = z35.object({
+  organizationId: z35.string().min(1),
+  includeChangelog: z35.string().transform((v) => v === "true").pipe(z35.boolean()).default("false")
+});
+var GetDocumentContentQuerySchema = z35.object({
+  organizationId: z35.string().min(1),
+  commitSha: z35.string().min(1).optional()
+});
+var GetTraceabilityMatrixQuerySchema = z35.object({
+  organizationId: z35.string().min(1),
+  repositoryId: z35.string().min(1).optional(),
+  sourceType: DocumentTypeSchema,
+  targetType: DocumentTypeSchema,
+  linkType: LinkTypeSchema,
+  statusFilter: z35.string().transform((v) => v.split(",").filter(Boolean)).pipe(z35.array(DocumentStatusSchema)).optional()
+});
+var GetGapsQuerySchema = z35.object({
+  organizationId: z35.string().min(1),
+  repositoryId: z35.string().min(1).optional(),
+  docTypes: z35.string().transform((v) => v.split(",").filter(Boolean)).pipe(z35.array(DocumentTypeSchema)).optional()
+});
+var GetDeviceTraceabilityMatrixQuerySchema = z35.object({
+  sourceType: DocumentTypeSchema,
+  targetType: DocumentTypeSchema,
+  linkType: LinkTypeSchema,
+  statusFilter: z35.string().transform((v) => v.split(",").filter(Boolean)).pipe(z35.array(DocumentStatusSchema)).optional()
+});
+var GetDeviceGapsQuerySchema = z35.object({
+  docTypes: z35.string().transform((v) => v.split(",").filter(Boolean)).pipe(z35.array(DocumentTypeSchema)).optional()
+});
+var DocumentIdParamSchema = z35.object({
+  documentId: z35.string().min(1)
+});
+
+// ../contracts/dist/documents/responses.js
+import { z as z36 } from "zod";
+var ChangelogEntryResponseSchema = z36.object({
+  id: z36.string(),
+  changeType: ChangeTypeSchema2,
+  commitSha: z36.string(),
+  previousCommitSha: z36.string().optional(),
+  changedBy: z36.string().optional(),
+  changedByEmail: z36.string().optional(),
+  changedAt: z36.string(),
+  // ISO datetime
+  pullRequestNumber: z36.number().optional(),
+  pullRequestTitle: z36.string().optional(),
+  releaseId: z36.string().optional(),
+  releaseName: z36.string().optional(),
+  changeSummary: z36.string().optional()
+});
+var LinkResponseSchema = z36.object({
+  id: z36.string(),
+  sourceDocumentId: z36.string(),
+  targetDocumentId: z36.string(),
+  linkType: LinkTypeSchema,
+  sourceDocPath: z36.string(),
+  targetDocPath: z36.string(),
+  sourceRepositoryId: z36.string(),
+  targetRepositoryId: z36.string().optional(),
+  rationale: z36.string().optional()
+});
+var DocumentSummaryResponseSchema = z36.object({
+  id: z36.string(),
+  documentId: z36.string(),
+  title: z36.string(),
+  docType: DocumentTypeSchema,
+  status: DocumentStatusSchema,
+  sourceType: DocumentSourceTypeSchema,
+  path: z36.string(),
+  repositoryId: z36.string(),
+  repositoryName: z36.string(),
+  repositoryType: z36.enum(["qms", "device"]),
+  lastSyncedAt: z36.string(),
+  // ISO datetime
+  metadata: z36.record(z36.string(), z36.unknown()).optional()
+});
+var DocumentDetailResponseSchema = DocumentSummaryResponseSchema.extend({
+  metadata: z36.record(z36.string(), z36.unknown()),
+  currentCommitSha: z36.string(),
+  sourcePath: z36.string().nullable(),
+  changelog: z36.array(ChangelogEntryResponseSchema).optional(),
+  incomingLinks: z36.array(LinkResponseSchema).optional(),
+  outgoingLinks: z36.array(LinkResponseSchema).optional()
+});
+var DocumentContentResponseSchema = z36.object({
+  content: z36.string(),
+  commitSha: z36.string(),
+  path: z36.string(),
+  githubUrl: z36.string()
+});
+var GetDocumentsResponseSchema = z36.object({
+  documents: z36.array(DocumentSummaryResponseSchema),
+  total: z36.number(),
+  limit: z36.number(),
+  offset: z36.number()
+});
+var TraceabilityRowSchema = z36.object({
+  sourceId: z36.string(),
+  sourceDocumentId: z36.string(),
+  sourceTitle: z36.string(),
+  sourcePath: z36.string(),
+  linked: z36.boolean(),
+  targetIds: z36.array(z36.string()),
+  targetDocumentIds: z36.array(z36.string()),
+  targetTitles: z36.array(z36.string())
+});
+var TraceabilityMatrixResponseSchema = z36.object({
+  sourceType: DocumentTypeSchema,
+  targetType: DocumentTypeSchema,
+  linkType: LinkTypeSchema,
+  coveragePercent: z36.number(),
+  totalSources: z36.number(),
+  coveredSources: z36.number(),
+  rows: z36.array(TraceabilityRowSchema)
+});
+var GapItemSchema = z36.object({
+  documentId: z36.string(),
+  documentTitle: z36.string(),
+  documentPath: z36.string(),
+  docType: DocumentTypeSchema,
+  missingLinkType: LinkTypeSchema,
+  expectedTargetType: DocumentTypeSchema
+});
+var GapsResponseSchema = z36.object({
+  totalGaps: z36.number(),
+  gaps: z36.array(GapItemSchema)
+});
+var ComponentResponseSchema = z36.object({
+  id: z36.string(),
+  componentName: z36.string(),
+  version: z36.string(),
+  license: z36.string().optional(),
+  safetyRiskClass: z36.string().optional(),
+  purpose: z36.string().optional(),
+  verification: z36.string().optional(),
+  cveStatus: z36.string().optional(),
+  category: z36.string().optional(),
+  supplierId: z36.string().optional(),
+  sourceFormat: z36.enum(["markdown_table", "cyclonedx", "spdx"]),
+  purl: z36.string().optional()
+});
+var GetComponentsResponseSchema = z36.array(ComponentResponseSchema);
+
+// ../contracts/dist/documents/signoff.js
+import { z as z37 } from "zod";
+var DocumentSignoffObligationSchema = z37.object({
+  obligationId: z37.string(),
+  role: z37.enum(["author", "reviewer", "approver"]),
+  department: z37.string(),
+  status: z37.enum(["pending", "fulfilled"]),
+  fulfilledByUserId: z37.string().optional(),
+  fulfilledByUserEmail: z37.string().optional(),
+  fulfilledByUserDisplayName: z37.string().optional(),
+  fulfilledAt: z37.string().optional(),
+  signatureId: z37.string().optional()
+});
+var DocumentSignoffStatusResponseSchema = z37.object({
+  documentId: z37.string(),
+  commitSha: z37.string(),
+  obligations: z37.array(DocumentSignoffObligationSchema),
+  progress: z37.object({
+    total: z37.number(),
+    fulfilled: z37.number(),
+    isComplete: z37.boolean()
+  })
+});
+var DocumentExportResponseSchema = z37.object({
+  message: z37.string()
+});
+
+// ../contracts/dist/documents/compiled.js
+import { z as z38 } from "zod";
+var CompiledDocumentPresetSchema = z38.enum(["srs", "prs", "dmr", "risk"]);
+var CompiledDocumentQuerySchema = z38.object({
+  organizationId: z38.string().min(1),
+  repositoryId: z38.string().min(1).optional(),
+  docType: DocumentTypeSchema.optional(),
+  category: z38.string().optional(),
+  status: DocumentStatusSchema.optional(),
+  preset: CompiledDocumentPresetSchema.optional()
+}).refine((data) => data.preset || data.docType, {
+  message: "Either preset or docType must be provided"
+});
+var CompiledTableOfContentsEntrySchema = z38.object({
+  documentId: z38.string(),
+  title: z38.string(),
+  anchor: z38.string()
+});
+var CompiledDocumentItemSchema = z38.object({
+  documentId: z38.string(),
+  title: z38.string(),
+  docType: DocumentTypeSchema,
+  status: DocumentStatusSchema,
+  path: z38.string(),
+  content: z38.string(),
+  anchor: z38.string()
+});
+var CompiledDocumentResponseSchema = z38.object({
+  title: z38.string(),
+  generatedAt: z38.string(),
+  documentCount: z38.number(),
+  tableOfContents: z38.array(CompiledTableOfContentsEntrySchema),
+  documents: z38.array(CompiledDocumentItemSchema)
+});
+
+// ../contracts/dist/releases/requests.js
+import { z as z39 } from "zod";
+var ReleaseTypeSchema2 = z39.enum(["qms", "device"]);
+var ReleaseStatusSchema2 = z39.enum(["draft", "in_review", "approved", "published"]);
+var SignatureTypeSchema2 = z39.enum([
+  "author",
+  "reviewer",
+  "approver",
+  "dept_reviewer",
+  "final_approver",
+  "trainee",
+  "trainer"
+]);
+var ReleaseChangeTypeSchema = z39.enum(["added", "modified", "removed"]);
+var ListReleasesQuerySchema = z39.object({
+  organizationId: z39.string().min(1),
+  status: ReleaseStatusSchema2.optional(),
+  type: ReleaseTypeSchema2.optional(),
+  deviceId: z39.string().optional(),
+  limit: z39.coerce.number().int().positive().max(100).default(50),
+  offset: z39.coerce.number().int().nonnegative().default(0)
+});
+var GetReleaseQuerySchema = z39.object({
+  organizationId: z39.string().min(1),
+  includeSignatures: z39.string().transform((v) => v === "true").pipe(z39.boolean()).default("false"),
+  includeSnapshot: z39.string().transform((v) => v === "true").pipe(z39.boolean()).default("false")
+});
+var GetSignaturesQuerySchema = z39.object({
+  organizationId: z39.string().min(1)
+});
+var GetChangedDocumentsQuerySchema = z39.object({
+  organizationId: z39.string().min(1),
+  type: ReleaseTypeSchema2,
+  deviceId: z39.string().optional()
+});
+var ReleaseIdParamSchema = z39.object({
+  releaseId: z39.string().min(1)
+});
+var DHRMarketEntrySchema = z39.object({
+  country: z39.string().min(1),
+  clinicalEvaluation: z39.boolean()
+});
+var DHRTestEvidenceEntrySchema = z39.object({
+  label: z39.string().min(1),
+  url: z39.string().url()
+});
+var DHRMetadataSchema = z39.object({
+  markets: z39.array(DHRMarketEntrySchema).default([]),
+  udi: z39.string().nullable().default(null),
+  automatedTestEvidence: z39.array(DHRTestEvidenceEntrySchema).default([])
+});
+var DeploymentReferenceTypeSchema = z39.enum([
+  "artifact",
+  "pipeline",
+  "deployment",
+  "other"
+]);
+var DeploymentReferenceSchema = z39.object({
+  label: z39.string().min(1).max(200),
+  url: z39.string().url(),
+  type: DeploymentReferenceTypeSchema
+});
+var CreateReleaseRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  name: z39.string().min(1).max(200),
+  description: z39.string().max(2e3).optional(),
+  type: ReleaseTypeSchema2,
+  deviceId: z39.string().optional(),
+  releasePlanDocumentId: z39.string().min(1).optional(),
+  designReviewId: z39.string().min(1).optional(),
+  releaseNotesDocumentId: z39.string().min(1).optional(),
+  deviationNotes: z39.string().max(5e3).optional(),
+  dhr: DHRMetadataSchema.optional(),
+  reason: z39.string().max(500).optional()
+}).strict();
+var UpdateReleaseRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  name: z39.string().min(1).max(200).optional(),
+  description: z39.string().max(2e3).optional(),
+  releasePlanDocumentId: z39.string().min(1).nullable().optional(),
+  designReviewId: z39.string().min(1).nullable().optional(),
+  releaseNotesDocumentId: z39.string().min(1).nullable().optional(),
+  deviationNotes: z39.string().max(5e3).optional(),
+  dhr: DHRMetadataSchema.nullable().optional(),
+  deploymentReferences: z39.array(DeploymentReferenceSchema).optional(),
+  smokeTestEvidence: z39.array(DHRTestEvidenceEntrySchema).optional(),
+  reason: z39.string().max(500).optional()
+}).strict();
+var AddSignatureRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  obligationId: z39.string().min(1),
+  meaning: z39.string().min(1).max(500),
+  /** Fresh Firebase ID token for per-signature re-authentication (Part 11 §11.200) */
+  idToken: z39.string().min(1).optional(),
+  /** Part 11: ID of the ERSD version the signer accepted */
+  ersdDisclosureId: z39.string().min(1),
+  /** Part 11: ISO date string when the signer accepted the ERSD */
+  ersdAcceptedAt: z39.string().datetime()
+}).strict();
+var SubmitReleaseRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  reason: z39.string().max(500).optional()
+});
+var WithdrawReleaseRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  reason: z39.string().max(500).optional()
+});
+var PublishReleaseRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  reason: z39.string().max(500).optional()
+});
+var DeleteReleaseQuerySchema = z39.object({
+  organizationId: z39.string().min(1)
+});
+var UpdateChecklistItemParamSchema = z39.object({
+  releaseId: z39.string().min(1),
+  templateItemId: z39.string().min(1)
+});
+var UpdateChecklistItemRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  checked: z39.boolean(),
+  evidence: z39.string().max(2e3).optional()
+}).strict();
+var GateOverrideCategoryParamSchema = z39.object({
+  releaseId: z39.string().min(1),
+  category: GateOverrideCategorySchema
+});
+var AddGateOverrideRequestSchema = z39.object({
+  organizationId: z39.string().min(1),
+  category: GateOverrideCategorySchema,
+  justification: z39.string().min(20).max(2e3)
+}).strict();
+var RemoveGateOverrideQuerySchema = z39.object({
+  organizationId: z39.string().min(1)
+});
+
+// ../contracts/dist/releases/responses.js
+import { z as z40 } from "zod";
+var ReleaseChangeResponseSchema = z40.object({
+  repositoryId: z40.string(),
+  documentId: z40.string(),
+  documentPath: z40.string(),
+  documentTitle: z40.string(),
+  documentType: z40.string(),
+  commitSha: z40.string(),
+  changeType: ReleaseChangeTypeSchema
+});
+var SignatureResponseSchema = z40.object({
+  id: z40.string(),
+  releaseId: z40.string(),
+  obligationId: z40.string(),
+  userId: z40.string(),
+  userEmail: z40.string(),
+  userDisplayName: z40.string(),
+  userDepartment: z40.string(),
+  signatureType: SignatureTypeSchema2,
+  meaning: z40.string(),
+  timestamp: z40.string(),
+  // ISO datetime
+  signedCommitShas: z40.array(z40.string())
+});
+var SigningObligationRoleSchema = z40.enum(["author", "reviewer", "approver"]);
+var SigningObligationStatusSchema = z40.enum(["pending", "fulfilled"]);
+var SigningObligationResponseSchema = z40.object({
+  obligationId: z40.string(),
+  role: SigningObligationRoleSchema,
+  department: z40.string(),
+  documentIds: z40.array(z40.string()),
+  status: SigningObligationStatusSchema,
+  fulfilledBySignatureId: z40.string().optional(),
+  fulfilledAt: z40.string().optional()
+});
+var SigningObligationsSummarySchema = z40.object({
+  total: z40.number(),
+  fulfilled: z40.number(),
+  pending: z40.number()
+});
+var SnapshotLinkSchema = z40.object({
+  sourceDocumentId: z40.string(),
+  targetDocumentId: z40.string(),
+  linkType: z40.string()
+});
+var RiskMatrixCellSchema = z40.object({
+  count: z40.number(),
+  acceptability: z40.enum(["acceptable", "review_required", "unacceptable"])
+});
+var SnapshotGapSchema = z40.object({
+  code: z40.string(),
+  severity: z40.enum(["error", "warning"]),
+  documentId: z40.string(),
+  documentTitle: z40.string(),
+  message: z40.string()
+});
+var SnapshotTraceabilityChainEntrySchema = z40.object({
+  hazardId: z40.string(),
+  hazardTitle: z40.string(),
+  situationId: z40.string(),
+  situationTitle: z40.string(),
+  harmId: z40.string(),
+  harmTitle: z40.string(),
+  riskId: z40.string(),
+  riskTitle: z40.string(),
+  riskType: z40.string(),
+  inherentSeverity: z40.number(),
+  inherentProbability: z40.number(),
+  residualSeverity: z40.number(),
+  residualProbability: z40.number(),
+  acceptability: z40.string(),
+  controls: z40.array(z40.string()),
+  cvssScore: z40.number().optional(),
+  cvssVector: z40.string().optional()
+});
+var SnapshotPlanReferenceSchema = z40.object({
+  documentId: z40.string(),
+  title: z40.string(),
+  commitSha: z40.string(),
+  safetyClass: z40.string(),
+  postProductionReference: z40.string().optional()
+});
+var ComponentSnapshotEntryResponseSchema = z40.object({
+  componentName: z40.string(),
+  version: z40.string(),
+  license: z40.string().optional(),
+  safetyRiskClass: z40.string().optional(),
+  sourceFormat: z40.enum(["markdown_table", "cyclonedx", "spdx"])
+});
+var ReleaseSnapshotResponseSchema = z40.object({
+  traceabilityLinks: z40.array(SnapshotLinkSchema),
+  traceabilityCoverage: z40.number(),
+  riskMatrix: z40.object({
+    inherent: z40.array(z40.array(z40.number())),
+    residual: z40.array(z40.array(z40.number())),
+    acceptability: z40.array(z40.array(z40.enum(["acceptable", "review_required", "unacceptable"]))),
+    summary: z40.object({
+      total: z40.number(),
+      acceptable: z40.number(),
+      reviewRequired: z40.number(),
+      unacceptable: z40.number()
+    })
+  }),
+  gaps: z40.array(SnapshotGapSchema),
+  gapsSummary: z40.object({
+    errorCount: z40.number(),
+    warningCount: z40.number()
+  }),
+  riskTraceabilityChain: z40.array(SnapshotTraceabilityChainEntrySchema).optional(),
+  riskManagementPlan: SnapshotPlanReferenceSchema.optional(),
+  componentSnapshots: z40.record(z40.array(ComponentSnapshotEntryResponseSchema)).optional()
+});
+var DHRMarketEntryResponseSchema = z40.object({
+  country: z40.string(),
+  clinicalEvaluation: z40.boolean()
+});
+var DHRTestEvidenceEntryResponseSchema = z40.object({
+  label: z40.string(),
+  url: z40.string()
+});
+var DHRMetadataResponseSchema = z40.object({
+  markets: z40.array(DHRMarketEntryResponseSchema),
+  udi: z40.string().nullable(),
+  automatedTestEvidence: z40.array(DHRTestEvidenceEntryResponseSchema)
+});
+var DeploymentReferenceResponseSchema = z40.object({
+  label: z40.string(),
+  url: z40.string(),
+  type: z40.string()
+});
+var GateOverrideResponseSchema = z40.object({
+  category: z40.string(),
+  justification: z40.string(),
+  gapDocumentIds: z40.array(z40.string()),
+  gapCount: z40.number(),
+  createdBy: z40.string(),
+  createdByEmail: z40.string(),
+  createdByDepartment: z40.string(),
+  createdAt: z40.string()
+});
+var ReleaseChecklistItemResponseSchema = z40.object({
+  templateItemId: z40.string(),
+  label: z40.string(),
+  checked: z40.boolean(),
+  evidence: z40.string().optional(),
+  updatedBy: z40.string().optional(),
+  updatedAt: z40.string().optional()
+});
+var ReleaseDocumentManifestEntrySchema = z40.object({
+  documentId: z40.string(),
+  title: z40.string(),
+  type: z40.string(),
+  path: z40.string(),
+  commitSha: z40.string()
+});
+var ReleaseSummaryResponseSchema = z40.object({
+  id: z40.string(),
+  name: z40.string(),
+  description: z40.string().optional(),
+  type: ReleaseTypeSchema2,
+  deviceId: z40.string().optional(),
+  status: ReleaseStatusSchema2,
+  changesCount: z40.number(),
+  signaturesCount: z40.number(),
+  obligationsSummary: SigningObligationsSummarySchema,
+  createdBy: z40.string(),
+  createdAt: z40.string(),
+  // ISO datetime
+  submittedForReviewAt: z40.string().optional(),
+  approvedAt: z40.string().optional(),
+  publishedAt: z40.string().optional(),
+  obligationsDerivedAt: z40.string().optional(),
+  obligationsDerivationVersion: z40.number().optional(),
+  obligationsInputHash: z40.string().optional(),
+  releasePlanDocumentId: z40.string().optional(),
+  designReviewId: z40.string().optional(),
+  releaseNotesDocumentId: z40.string().optional(),
+  deviationNotes: z40.string().optional(),
+  dhr: DHRMetadataResponseSchema.optional(),
+  version: z40.string().optional()
+});
+var ReleaseDetailResponseSchema = ReleaseSummaryResponseSchema.extend({
+  changes: z40.array(ReleaseChangeResponseSchema),
+  signingObligations: z40.array(SigningObligationResponseSchema),
+  signatures: z40.array(SignatureResponseSchema).optional(),
+  snapshot: ReleaseSnapshotResponseSchema.optional(),
+  checklist: z40.array(ReleaseChecklistItemResponseSchema).optional(),
+  releaseCommitSha: z40.string().optional(),
+  previousReleaseId: z40.string().optional(),
+  previousReleaseCommitSha: z40.string().optional(),
+  deploymentReferences: z40.array(DeploymentReferenceResponseSchema).optional(),
+  smokeTestEvidence: z40.array(z40.object({ label: z40.string(), url: z40.string() })).optional(),
+  gateOverrides: z40.array(GateOverrideResponseSchema).default([]),
+  documentManifest: z40.array(ReleaseDocumentManifestEntrySchema).optional()
+});
+var ListReleasesResponseSchema = z40.object({
+  releases: z40.array(ReleaseSummaryResponseSchema),
+  total: z40.number(),
+  limit: z40.number(),
+  offset: z40.number()
+});
+var GetSignaturesResponseSchema = z40.object({
+  signatures: z40.array(SignatureResponseSchema)
+});
+var ChangedDocumentResponseSchema = z40.object({
+  documentId: z40.string(),
+  repositoryId: z40.string(),
+  documentPath: z40.string(),
+  documentTitle: z40.string(),
+  documentType: z40.string(),
+  currentCommitSha: z40.string(),
+  previousCommitSha: z40.string().optional(),
+  changeType: ReleaseChangeTypeSchema
+});
+var GetChangedDocumentsResponseSchema = z40.object({
+  changes: z40.array(ChangedDocumentResponseSchema),
+  previousReleaseId: z40.string().optional(),
+  previousReleaseName: z40.string().optional()
+});
+var CreateReleaseResponseSchema = z40.object({
+  id: z40.string(),
+  release: ReleaseDetailResponseSchema
+});
+var ReleaseStatusChangeResponseSchema = z40.object({
+  success: z40.boolean(),
+  release: ReleaseDetailResponseSchema
+});
+var AddSignatureResponseSchema = z40.object({
+  signature: SignatureResponseSchema,
+  releaseStatus: ReleaseStatusSchema2,
+  isAutoApproved: z40.boolean()
+});
+
+// ../contracts/dist/releases/comparison.js
+import { z as z41 } from "zod";
+var ComparisonChangeTypeSchema = z41.enum(["added", "modified", "removed", "unchanged"]);
+var GetReleaseComparisonQuerySchema = z41.object({
+  organizationId: z41.string().min(1),
+  baseReleaseId: z41.string().min(1).optional()
+});
+var ComparisonReleaseInfoSchema = z41.object({
+  id: z41.string(),
+  name: z41.string(),
+  publishedAt: z41.string().nullable()
+});
+var ComparisonCommitRefSchema = z41.object({
+  commitSha: z41.string()
+});
+var ReleaseComparisonChangeSchema = z41.object({
+  documentId: z41.string(),
+  documentTitle: z41.string(),
+  documentType: z41.string(),
+  documentPath: z41.string(),
+  changeType: ComparisonChangeTypeSchema,
+  target: ComparisonCommitRefSchema.nullable(),
+  base: ComparisonCommitRefSchema.nullable()
+});
+var ComparisonSummarySchema = z41.object({
+  added: z41.number(),
+  modified: z41.number(),
+  removed: z41.number(),
+  unchanged: z41.number()
+});
+var BaselineOptionSchema = z41.object({
+  id: z41.string(),
+  name: z41.string(),
+  publishedAt: z41.string()
+});
+var ReleaseComparisonResponseSchema = z41.object({
+  targetRelease: ComparisonReleaseInfoSchema,
+  baseRelease: ComparisonReleaseInfoSchema.nullable(),
+  changes: z41.array(ReleaseComparisonChangeSchema),
+  summary: ComparisonSummarySchema,
+  fallback: z41.boolean(),
+  baselineOptions: z41.array(BaselineOptionSchema)
+});
+
+// ../contracts/dist/qms/requests.js
+import { z as z42 } from "zod";
+var CreateQmsRequestSchema = z42.object({
+  organizationId: z42.string().min(1),
+  repositoryId: z42.string().min(1),
+  name: z42.string().min(1).max(100)
+});
+var UpdateQmsRequestSchema = z42.object({
+  name: z42.string().min(1).max(100).optional()
+});
+var QmsIdParamSchema = z42.object({
+  orgId: z42.string().min(1),
+  qmsId: z42.string().min(1)
+});
+
+// ../contracts/dist/qms/responses.js
+import { z as z43 } from "zod";
+var QmsResponseSchema = z43.object({
+  id: z43.string(),
+  organizationId: z43.string(),
+  repositoryId: z43.string(),
+  name: z43.string(),
+  createdAt: z43.string(),
+  createdBy: z43.string()
+});
+
+// ../contracts/dist/devices/requests.js
+import { z as z44 } from "zod";
+var CreateDeviceRequestSchema = z44.object({
+  organizationId: z44.string().min(1),
+  repositoryId: z44.string().min(1),
+  name: z44.string().min(1).max(100),
+  safetyClass: SafetyClassSchema
+});
+var UpdateDeviceRequestSchema = z44.object({
+  name: z44.string().min(1).max(100).optional(),
+  safetyClass: SafetyClassSchema.optional()
+});
+var DeviceIdParamSchema = z44.object({
+  orgId: z44.string().min(1),
+  deviceId: z44.string().min(1)
+});
+var DeviceListQuerySchema = z44.object({
+  organizationId: z44.string().min(1)
+});
+
+// ../contracts/dist/devices/responses.js
+import { z as z45 } from "zod";
+var DeviceResponseSchema = z45.object({
+  id: z45.string(),
+  organizationId: z45.string(),
+  repositoryId: z45.string(),
+  name: z45.string(),
+  safetyClass: SafetyClassSchema,
+  createdAt: z45.string(),
+  createdBy: z45.string()
+});
+
+// ../contracts/dist/dco/requests.js
+import { z as z46 } from "zod";
+var DCODocumentChangeTypeSchema = z46.enum(["new", "revision", "obsolete"]);
+var DCOStatusSchema = z46.enum(["draft", "pending_signatures", "approved", "effective"]);
+var DCOScopeSchema = z46.enum(["release", "documents", "maintenance"]);
+var DCODocumentEntrySchema = z46.object({
+  documentId: z46.string().min(1),
+  repositoryId: z46.string().min(1),
+  commitSha: z46.string().min(1),
+  changeType: DCODocumentChangeTypeSchema,
+  changeDescription: z46.string().min(1).max(2e3)
+});
+var CreateDCORequestSchema = z46.object({
+  title: z46.string().min(1).max(200),
+  description: z46.string().min(1).max(5e3),
+  scope: DCOScopeSchema,
+  effectiveDate: z46.string().datetime(),
+  documents: z46.array(DCODocumentEntrySchema).min(1),
+  /** Required when scope='release' */
+  releaseId: z46.string().min(1).optional()
+}).superRefine((data, ctx) => {
+  if (data.scope === "release" && !data.releaseId) {
+    ctx.addIssue({
+      code: z46.ZodIssueCode.custom,
+      message: 'releaseId is required when scope is "release"',
+      path: ["releaseId"]
+    });
+  }
+});
+var UpdateDCORequestSchema = z46.object({
+  title: z46.string().min(1).max(200).optional(),
+  description: z46.string().min(1).max(5e3).optional(),
+  effectiveDate: z46.string().datetime().optional(),
+  documents: z46.array(DCODocumentEntrySchema).min(1).optional()
+});
+var SubmitDCORequestSchema = z46.object({
+  departments: z46.array(z46.string().min(1)).min(1, "At least one department must be specified")
+});
+var FulfillDCOObligationRequestSchema = z46.object({
+  obligationId: z46.string().min(1),
+  meaning: z46.string().min(1).max(500),
+  /** Fresh ID token from re-authentication (Part 11 §11.200 compliance) */
+  idToken: z46.string().min(1),
+  /** Part 11: ID of the ERSD version the signer accepted */
+  ersdDisclosureId: z46.string().min(1),
+  /** Part 11: ISO date string when the signer accepted the ERSD */
+  ersdAcceptedAt: z46.string().datetime()
+});
+var DCOIdParamSchema = z46.object({
+  orgId: z46.string().min(1),
+  qmsId: z46.string().min(1),
+  dcoId: z46.string().min(1)
+});
+var QmsDCOParamSchema = z46.object({
+  orgId: z46.string().min(1),
+  qmsId: z46.string().min(1)
+});
+var DCOListQuerySchema = PaginationParamsSchema.extend({
+  status: DCOStatusSchema.optional(),
+  scope: DCOScopeSchema.optional()
+});
+
+// ../contracts/dist/dco/responses.js
+import { z as z47 } from "zod";
+var RevisionAssignmentSchema = z47.object({
+  documentId: z47.string(),
+  revisionNumber: z47.number()
+});
+var DCOSigningObligationSchema = z47.object({
+  obligationId: z47.string(),
+  department: z47.string(),
+  status: z47.enum(["pending", "fulfilled"]),
+  meaning: z47.string().optional(),
+  fulfilledBySignatureId: z47.string().optional(),
+  fulfilledAt: z47.string().optional()
+});
+var DCOResponseSchema = z47.object({
+  id: z47.string(),
+  organizationId: z47.string(),
+  qmsId: z47.string(),
+  dcoNumber: z47.string(),
+  title: z47.string(),
+  description: z47.string(),
+  scope: DCOScopeSchema,
+  releaseId: z47.string().optional(),
+  documents: z47.array(DCODocumentEntrySchema),
+  status: DCOStatusSchema,
+  effectiveDate: z47.string(),
+  createdAt: z47.string(),
+  createdBy: z47.string(),
+  approvedAt: z47.string().optional(),
+  effectiveAt: z47.string().optional(),
+  revisionAssignments: z47.array(RevisionAssignmentSchema),
+  signingObligations: z47.array(DCOSigningObligationSchema)
+});
+var DCOListResponseSchema = z47.object({
+  items: z47.array(DCOResponseSchema),
+  total: z47.number(),
+  limit: z47.number(),
+  offset: z47.number()
+});
+var DocumentRevisionResponseSchema = z47.object({
+  id: z47.string(),
+  revisionNumber: z47.number(),
+  dcoId: z47.string(),
+  dcoNumber: z47.string(),
+  releaseId: z47.string().optional(),
+  releaseName: z47.string().optional(),
+  commitSha: z47.string(),
+  changeType: DCODocumentChangeTypeSchema,
+  changeDescription: z47.string(),
+  effectiveAt: z47.string(),
+  effectiveBy: z47.string()
+});
+var RequestDCOExportResponseSchema = z47.object({
+  message: z47.string(),
+  estimatedMinutes: z47.number()
+});
+
+// ../contracts/dist/capas/requests.js
+import { z as z48 } from "zod";
+
+// ../contracts/dist/domain-types/capa.js
+var CAPA_STATUSES = [
+  "open",
+  "investigation",
+  "implementation",
+  "verification",
+  "closed",
+  "cancelled"
+];
+var CAPA_CLASSIFICATIONS = ["corrective", "preventive"];
+var CAPA_PRIORITIES = ["low", "medium", "high", "critical"];
+var CAPA_SOURCE_TYPES = [
+  "nonconformance",
+  "complaint",
+  "audit_finding",
+  "observation",
+  "other"
+];
+var CAPA_ACTION_STATUSES = ["pending", "in_progress", "completed"];
+
+// ../contracts/dist/capas/requests.js
+var CapaStatusSchema = z48.enum(CAPA_STATUSES);
+var CapaClassificationSchema = z48.enum(CAPA_CLASSIFICATIONS);
+var CapaPrioritySchema = z48.enum(CAPA_PRIORITIES);
+var CapaSourceTypeSchema = z48.enum(CAPA_SOURCE_TYPES);
+var CapaActionStatusSchema = z48.enum(CAPA_ACTION_STATUSES);
+var QmsCapaParamSchema = z48.object({
+  orgId: z48.string().min(1),
+  qmsId: z48.string().min(1)
+});
+var CapaIdParamSchema = z48.object({
+  orgId: z48.string().min(1),
+  qmsId: z48.string().min(1),
+  capaId: z48.string().min(1)
+});
+var CapaActionIdParamSchema = z48.object({
+  orgId: z48.string().min(1),
+  qmsId: z48.string().min(1),
+  capaId: z48.string().min(1),
+  actionId: z48.string().min(1)
+});
+var CreateCapaRequestSchema = z48.object({
+  classification: CapaClassificationSchema,
+  priority: CapaPrioritySchema,
+  title: z48.string().min(1).max(200),
+  description: z48.string().min(1).max(5e3),
+  sourceType: CapaSourceTypeSchema,
+  sourceDescription: z48.string().min(1).max(2e3),
+  sourceId: z48.string().max(200).optional(),
+  dueDate: z48.string().datetime().optional(),
+  affectedDocumentIds: z48.array(z48.string().min(1)).default([]),
+  affectedDeviceIds: z48.array(z48.string().min(1)).default([])
+});
+var UpdateCapaRequestSchema = z48.object({
+  title: z48.string().min(1).max(200).optional(),
+  description: z48.string().min(1).max(5e3).optional(),
+  priority: CapaPrioritySchema.optional(),
+  rootCauseDescription: z48.string().max(5e3).optional(),
+  verificationDescription: z48.string().max(5e3).optional(),
+  affectedDocumentIds: z48.array(z48.string().min(1)).optional(),
+  affectedDeviceIds: z48.array(z48.string().min(1)).optional(),
+  dueDate: z48.string().datetime().nullable().optional()
+});
+var CloseCapaRequestSchema = z48.object({
+  signatureId: z48.string().min(1)
+});
+var AddCapaActionRequestSchema = z48.object({
+  description: z48.string().min(1).max(2e3),
+  assigneeId: z48.string().min(1),
+  dueDate: z48.string().datetime(),
+  notes: z48.string().max(2e3).optional()
+});
+var UpdateCapaActionRequestSchema = z48.object({
+  description: z48.string().min(1).max(2e3).optional(),
+  assigneeId: z48.string().min(1).optional(),
+  dueDate: z48.string().datetime().optional(),
+  status: CapaActionStatusSchema.optional(),
+  notes: z48.string().max(2e3).optional()
+});
+var CapaListQuerySchema = PaginationParamsSchema.extend({
+  status: CapaStatusSchema.optional(),
+  classification: CapaClassificationSchema.optional(),
+  priority: CapaPrioritySchema.optional()
+});
+
+// ../contracts/dist/capas/responses.js
+import { z as z49 } from "zod";
+var CapaActionResponseSchema = z49.object({
+  id: z49.string(),
+  description: z49.string(),
+  assigneeId: z49.string(),
+  assigneeEmail: z49.string(),
+  dueDate: z49.string(),
+  status: CapaActionStatusSchema,
+  completedAt: z49.string().optional(),
+  notes: z49.string().optional()
+});
+var CapaResponseSchema = z49.object({
+  id: z49.string(),
+  qmsId: z49.string(),
+  organizationId: z49.string(),
+  capaNumber: z49.string(),
+  classification: CapaClassificationSchema,
+  priority: CapaPrioritySchema,
+  title: z49.string(),
+  description: z49.string(),
+  sourceType: CapaSourceTypeSchema,
+  sourceId: z49.string().optional(),
+  sourceDescription: z49.string(),
+  rootCauseDescription: z49.string().optional(),
+  verificationDescription: z49.string().optional(),
+  affectedDocumentIds: z49.array(z49.string()),
+  affectedDeviceIds: z49.array(z49.string()),
+  actions: z49.array(CapaActionResponseSchema),
+  status: CapaStatusSchema,
+  createdAt: z49.string(),
+  createdBy: z49.string(),
+  investigationStartedAt: z49.string().optional(),
+  implementationStartedAt: z49.string().optional(),
+  verificationStartedAt: z49.string().optional(),
+  closedAt: z49.string().optional(),
+  closedBy: z49.string().optional(),
+  cancelledAt: z49.string().optional(),
+  cancelledBy: z49.string().optional(),
+  dueDate: z49.string().optional()
+});
+var CapaListResponseSchema = z49.object({
+  items: z49.array(CapaResponseSchema),
+  total: z49.number(),
+  limit: z49.number(),
+  offset: z49.number()
+});
+
+// ../contracts/dist/complaints/requests.js
+import { z as z50 } from "zod";
+
+// ../contracts/dist/domain-types/complaint.js
+var COMPLAINT_STATUSES = [
+  "open",
+  "investigating",
+  "resolved",
+  "closed",
+  "cancelled"
+];
+var COMPLAINT_SEVERITIES = ["low", "medium", "high", "critical"];
+var COMPLAINT_CATEGORIES = [
+  "quality",
+  "safety",
+  "performance",
+  "usability",
+  "other"
+];
+var COMPLAINT_SOURCES = ["customer", "internal", "regulatory", "distributor"];
+
+// ../contracts/dist/complaints/requests.js
+var ComplaintStatusSchema = z50.enum(COMPLAINT_STATUSES);
+var ComplaintSeveritySchema = z50.enum(COMPLAINT_SEVERITIES);
+var ComplaintCategorySchema = z50.enum(COMPLAINT_CATEGORIES);
+var ComplaintSourceSchema = z50.enum(COMPLAINT_SOURCES);
+var QmsComplaintParamSchema = z50.object({
+  orgId: z50.string().min(1),
+  qmsId: z50.string().min(1)
+});
+var ComplaintIdParamSchema = z50.object({
+  orgId: z50.string().min(1),
+  qmsId: z50.string().min(1),
+  complaintId: z50.string().min(1)
+});
+var ComplainantSchema = z50.object({
+  name: z50.string().min(1).max(200),
+  email: z50.string().email().optional(),
+  phone: z50.string().max(50).optional(),
+  organization: z50.string().max(200).optional()
+});
+var CreateComplaintRequestSchema = z50.object({
+  title: z50.string().min(1).max(200),
+  description: z50.string().min(1).max(5e3),
+  severity: ComplaintSeveritySchema,
+  category: ComplaintCategorySchema,
+  source: ComplaintSourceSchema,
+  receivedDate: z50.string().datetime(),
+  complainant: ComplainantSchema,
+  reportable: z50.boolean(),
+  reportabilityJustification: z50.string().max(5e3).optional(),
+  affectedDeviceIds: z50.array(z50.string().min(1)).default([]),
+  affectedDocumentIds: z50.array(z50.string().min(1)).default([]),
+  assigneeId: z50.string().min(1).optional(),
+  dueDate: z50.string().datetime().optional()
+});
+var UpdateComplaintRequestSchema = z50.object({
+  title: z50.string().min(1).max(200).optional(),
+  description: z50.string().min(1).max(5e3).optional(),
+  severity: ComplaintSeveritySchema.optional(),
+  category: ComplaintCategorySchema.optional(),
+  source: ComplaintSourceSchema.optional(),
+  reportable: z50.boolean().optional(),
+  reportabilityJustification: z50.string().max(5e3).optional(),
+  investigationSummary: z50.string().max(5e3).optional(),
+  rootCauseDescription: z50.string().max(5e3).optional(),
+  resolutionDescription: z50.string().max(5e3).optional(),
+  affectedDeviceIds: z50.array(z50.string().min(1)).optional(),
+  affectedDocumentIds: z50.array(z50.string().min(1)).optional(),
+  assigneeId: z50.string().min(1).nullable().optional(),
+  dueDate: z50.string().datetime().nullable().optional()
+});
+var ResolveComplaintRequestSchema = z50.object({
+  resolutionDescription: z50.string().min(1).max(5e3)
+});
+var CloseComplaintRequestSchema = z50.object({
+  signatureId: z50.string().min(1)
+});
+var CancelComplaintRequestSchema = z50.object({
+  reason: z50.string().min(1).max(5e3)
+});
+var ComplaintListQuerySchema = PaginationParamsSchema.extend({
+  status: ComplaintStatusSchema.optional(),
+  severity: ComplaintSeveritySchema.optional(),
+  category: ComplaintCategorySchema.optional(),
+  source: ComplaintSourceSchema.optional()
+});
+
+// ../contracts/dist/complaints/responses.js
+import { z as z51 } from "zod";
+var ComplaintResponseSchema = z51.object({
+  id: z51.string(),
+  qmsId: z51.string(),
+  organizationId: z51.string(),
+  complaintNumber: z51.string(),
+  title: z51.string(),
+  description: z51.string(),
+  status: ComplaintStatusSchema,
+  severity: ComplaintSeveritySchema,
+  category: ComplaintCategorySchema,
+  source: ComplaintSourceSchema,
+  receivedDate: z51.string(),
+  complainant: ComplainantSchema,
+  reportable: z51.boolean(),
+  reportabilityJustification: z51.string().optional(),
+  investigationSummary: z51.string().optional(),
+  rootCauseDescription: z51.string().optional(),
+  resolutionDescription: z51.string().optional(),
+  affectedDeviceIds: z51.array(z51.string()),
+  affectedDocumentIds: z51.array(z51.string()),
+  linkedCapaId: z51.string().optional(),
+  assigneeId: z51.string().optional(),
+  assigneeEmail: z51.string().optional(),
+  dueDate: z51.string().optional(),
+  createdAt: z51.string(),
+  createdBy: z51.string(),
+  investigationStartedAt: z51.string().optional(),
+  resolvedAt: z51.string().optional(),
+  resolvedBy: z51.string().optional(),
+  closedAt: z51.string().optional(),
+  closedBy: z51.string().optional(),
+  cancellationReason: z51.string().optional(),
+  cancelledAt: z51.string().optional(),
+  cancelledBy: z51.string().optional()
+});
+var ComplaintListResponseSchema = z51.object({
+  items: z51.array(ComplaintResponseSchema),
+  total: z51.number(),
+  limit: z51.number(),
+  offset: z51.number()
+});
+var EscalateToCapaResponseSchema = z51.object({
+  capaId: z51.string()
+});
+
+// ../contracts/dist/nonconformances/requests.js
+import { z as z52 } from "zod";
+
+// ../contracts/dist/domain-types/nonconformance.js
+var NC_STATUSES = [
+  "reported",
+  "investigation",
+  "disposition",
+  "closed",
+  "cancelled"
+];
+var NC_SEVERITIES = ["minor", "major", "critical"];
+var NC_DISPOSITIONS = [
+  "use_as_is",
+  "rework",
+  "scrap",
+  "return_to_supplier",
+  "concession"
+];
+var NC_SOURCE_TYPES = [
+  "product",
+  "process",
+  "supplier",
+  "audit_finding",
+  "complaint",
+  "other"
+];
+
+// ../contracts/dist/nonconformances/requests.js
+var NcStatusSchema = z52.enum(NC_STATUSES);
+var NcSeveritySchema = z52.enum(NC_SEVERITIES);
+var NcDispositionSchema = z52.enum(NC_DISPOSITIONS);
+var NcSourceTypeSchema = z52.enum(NC_SOURCE_TYPES);
+var QmsNcParamSchema = z52.object({
+  orgId: z52.string().min(1),
+  qmsId: z52.string().min(1)
+});
+var NcIdParamSchema = z52.object({
+  orgId: z52.string().min(1),
+  qmsId: z52.string().min(1),
+  ncId: z52.string().min(1)
+});
+var CreateNcRequestSchema = z52.object({
+  severity: NcSeveritySchema,
+  sourceType: NcSourceTypeSchema,
+  title: z52.string().min(1).max(200),
+  description: z52.string().min(1).max(5e3),
+  dueDate: z52.string().datetime().optional(),
+  affectedDocumentIds: z52.array(z52.string().min(1)).default([]),
+  affectedDeviceIds: z52.array(z52.string().min(1)).default([])
+});
+var UpdateNcRequestSchema = z52.object({
+  title: z52.string().min(1).max(200).optional(),
+  description: z52.string().min(1).max(5e3).optional(),
+  severity: NcSeveritySchema.optional(),
+  investigationDescription: z52.string().max(5e3).optional(),
+  affectedDocumentIds: z52.array(z52.string().min(1)).optional(),
+  affectedDeviceIds: z52.array(z52.string().min(1)).optional(),
+  dueDate: z52.string().datetime().nullable().optional()
+});
+var SetDispositionRequestSchema = z52.object({
+  disposition: NcDispositionSchema,
+  justification: z52.string().min(1).max(5e3)
+});
+var ApproveConcessionRequestSchema = z52.object({
+  signatureId: z52.string().min(1)
+});
+var NcListQuerySchema = PaginationParamsSchema.extend({
+  status: NcStatusSchema.optional(),
+  severity: NcSeveritySchema.optional(),
+  sourceType: NcSourceTypeSchema.optional()
+});
+
+// ../contracts/dist/nonconformances/responses.js
+import { z as z53 } from "zod";
+var NcResponseSchema = z53.object({
+  id: z53.string(),
+  qmsId: z53.string(),
+  organizationId: z53.string(),
+  ncNumber: z53.string(),
+  severity: NcSeveritySchema,
+  sourceType: NcSourceTypeSchema,
+  title: z53.string(),
+  description: z53.string(),
+  investigationDescription: z53.string().optional(),
+  disposition: NcDispositionSchema.optional(),
+  dispositionJustification: z53.string().optional(),
+  concessionSignatureId: z53.string().optional(),
+  affectedDocumentIds: z53.array(z53.string()),
+  affectedDeviceIds: z53.array(z53.string()),
+  linkedCapaId: z53.string().optional(),
+  status: NcStatusSchema,
+  createdAt: z53.string(),
+  createdBy: z53.string(),
+  investigationStartedAt: z53.string().optional(),
+  investigationStartedBy: z53.string().optional(),
+  dispositionSetAt: z53.string().optional(),
+  dispositionSetBy: z53.string().optional(),
+  closedAt: z53.string().optional(),
+  closedBy: z53.string().optional(),
+  cancelledAt: z53.string().optional(),
+  cancelledBy: z53.string().optional(),
+  dueDate: z53.string().optional()
+});
+var NcListResponseSchema = z53.object({
+  items: z53.array(NcResponseSchema),
+  total: z53.number(),
+  limit: z53.number(),
+  offset: z53.number()
+});
+
+// ../contracts/dist/signatures/requests.js
+import { z as z54 } from "zod";
+var DocumentSignatureTypeSchema = z54.enum([
+  "author",
+  "reviewer",
+  "approver",
+  "dept_reviewer",
+  "final_approver",
+  "trainee",
+  "trainer"
+]);
+var SignatureCaptureContextSchema = z54.discriminatedUnion("type", [
+  z54.object({
+    type: z54.literal("release"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("design_review"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("dco"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("document_signoff"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("nonconformance"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("complaint"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("training_completion"),
+    id: z54.string().min(1)
+  }),
+  z54.object({
+    type: z54.literal("training_signoff"),
+    id: z54.string().min(1)
+  })
+]);
+var CreateDocumentSignatureRequestSchema = z54.object({
+  signatureType: DocumentSignatureTypeSchema,
+  meaning: z54.string().min(1).max(500),
+  capturedDuring: SignatureCaptureContextSchema,
+  reason: z54.string().max(500).optional(),
+  /** Fresh Firebase ID token for per-signature re-authentication (Part 11 §11.200) */
+  idToken: z54.string().min(1).optional(),
+  /** Part 11: ID of the ERSD version the signer accepted */
+  ersdDisclosureId: z54.string().min(1),
+  /** Part 11: ISO date string when the signer accepted the ERSD */
+  ersdAcceptedAt: z54.string().datetime()
+});
+var SignatureDocumentCommitParamSchema = z54.object({
+  orgId: z54.string().min(1),
+  docId: z54.string().min(1),
+  commitSha: z54.string().min(1)
+});
+var SignatureDocumentIdParamSchema = z54.object({
+  orgId: z54.string().min(1),
+  docId: z54.string().min(1)
+});
+
+// ../contracts/dist/signatures/responses.js
+import { z as z55 } from "zod";
+var DocumentSignatureResponseSchema = z55.object({
+  id: z55.string(),
+  organizationId: z55.string(),
+  documentId: z55.string(),
+  commitSha: z55.string(),
+  userId: z55.string(),
+  userEmail: z55.string(),
+  userDisplayName: z55.string(),
+  userDepartment: z55.string(),
+  signatureType: DocumentSignatureTypeSchema,
+  meaning: z55.string(),
+  contentHash: z55.string().optional(),
+  timestamp: z55.string(),
+  capturedDuring: SignatureCaptureContextSchema
+});
+var DocumentSignaturesListResponseSchema = z55.object({
+  signatures: z55.array(DocumentSignatureResponseSchema)
+});
+var DocumentSignatureHistoryItemSchema = z55.object({
+  commitSha: z55.string(),
+  signatures: z55.array(DocumentSignatureResponseSchema)
+});
+var DocumentSignatureHistoryResponseSchema = z55.object({
+  documentId: z55.string(),
+  history: z55.array(DocumentSignatureHistoryItemSchema)
+});
+var CreateDocumentSignatureResponseSchema = z55.object({
+  signatureId: z55.string()
+});
+
+// ../contracts/dist/github/webhooks.js
+import { z as z56 } from "zod";
+var GitHubCommitAuthorSchema = z56.object({
+  email: z56.string(),
+  name: z56.string()
+});
+var GitHubPushCommitSchema = z56.object({
+  id: z56.string(),
+  message: z56.string(),
+  author: GitHubCommitAuthorSchema,
+  added: z56.array(z56.string()),
+  modified: z56.array(z56.string()),
+  removed: z56.array(z56.string())
+});
+var GitHubWebhookRepositorySchema = z56.object({
+  id: z56.number(),
+  full_name: z56.string()
+});
+var GitHubInstallationSchema = z56.object({
+  id: z56.number()
+});
+var GitHubAccountSchema = z56.object({
+  login: z56.string(),
+  type: z56.string()
+});
+var GitHubPushEventSchema = z56.object({
+  ref: z56.string(),
+  before: z56.string(),
+  after: z56.string(),
+  repository: GitHubWebhookRepositorySchema,
+  installation: GitHubInstallationSchema.optional(),
+  commits: z56.array(GitHubPushCommitSchema)
+});
+var GitHubInstallationEventSchema = z56.object({
+  action: z56.enum(["created", "deleted", "suspend", "unsuspend"]),
+  installation: z56.object({
+    id: z56.number(),
+    account: GitHubAccountSchema
+  }),
+  repositories: z56.array(z56.object({
+    id: z56.number(),
+    full_name: z56.string()
+  })).optional()
+});
+var GitHubInstallationRepositoriesEventSchema = z56.object({
+  action: z56.enum(["added", "removed"]),
+  installation: z56.object({
+    id: z56.number(),
+    account: GitHubAccountSchema
+  }),
+  repositories_added: z56.array(z56.object({
+    id: z56.number(),
+    full_name: z56.string()
+  })),
+  repositories_removed: z56.array(z56.object({
+    id: z56.number(),
+    full_name: z56.string()
+  }))
+});
+var GitHubWebhookHeadersSchema = z56.object({
+  "x-github-event": z56.string(),
+  "x-github-delivery": z56.string(),
+  "x-hub-signature-256": z56.string().optional()
+});
+
+// ../contracts/dist/github/requests.js
+import { z as z57 } from "zod";
+var CompleteGitHubInstallationRequestSchema = z57.object({
+  organizationId: z57.string().min(1),
+  installationId: z57.number().int().positive()
+});
+var ListGitHubRepositoriesRequestSchema = z57.object({
+  organizationId: z57.string().min(1)
+});
+
+// ../contracts/dist/github/responses.js
+import { z as z58 } from "zod";
+var GitHubInstallationRepoSchema = z58.object({
+  id: z58.number(),
+  full_name: z58.string(),
+  name: z58.string(),
+  owner: z58.string(),
+  default_branch: z58.string()
+});
+var ListGitHubRepositoriesResponseSchema = z58.object({
+  repositories: z58.array(GitHubInstallationRepoSchema),
+  installed: z58.boolean(),
+  gitHubOrgName: z58.string().optional()
+});
+var CompleteGitHubInstallationResponseSchema = z58.object({
+  success: z58.boolean()
+});
+
+// ../contracts/dist/training/requests.js
+import { z as z59 } from "zod";
+var TrainingTypeSchema = z59.enum(["quiz", "acknowledge", "instructor_led"]);
+var TrainingStatusSchema = z59.enum(["pending", "in_progress", "completed", "overdue"]);
+var TrainingOrgParamSchema = z59.object({
+  orgId: z59.string().min(1)
+});
+var TrainingTaskParamSchema = z59.object({
+  orgId: z59.string().min(1),
+  taskId: z59.string().min(1)
+});
+var MyTrainingQuerySchema = z59.object({
+  status: TrainingStatusSchema.optional(),
+  documentId: z59.string().optional()
+});
+var TrainingDashboardQuerySchema = z59.object({
+  status: TrainingStatusSchema.optional(),
+  memberId: z59.string().optional(),
+  documentId: z59.string().optional()
+});
+var StartTrainingRequestSchema = z59.object({});
+var SubmitQuizRequestSchema = z59.object({
+  sessionId: z59.string().min(1),
+  answers: z59.record(z59.string(), z59.union([z59.number(), z59.array(z59.number()), z59.boolean()]))
+});
+var AcknowledgeTrainingRequestSchema = z59.object({
+  meaning: z59.string().min(1).max(500)
+});
+var BatchSignoffRequestSchema = z59.object({
+  taskIds: z59.array(z59.string().min(1)).min(1),
+  evidenceUrl: z59.string().url(),
+  evidenceHash: z59.string().min(1),
+  meaning: z59.string().min(1).max(500)
+});
+var QuizOptionSchema = z59.object({
+  text: z59.string().min(1),
+  correct: z59.boolean().optional(),
+  explanation: z59.string().optional()
+});
+var QuizQuestionSchema = z59.object({
+  type: z59.enum(["single-choice", "multi-choice", "true-false"]),
+  text: z59.string().min(1),
+  options: z59.array(QuizOptionSchema).optional(),
+  correct: z59.boolean().optional(),
+  explanation: z59.string().optional()
+});
+var QuizDefinitionSchema = z59.object({
+  passingScore: z59.number().min(0).max(100).optional(),
+  questions: z59.array(QuizQuestionSchema).min(1)
+});
+var CreateTrainingTaskRequestSchema = z59.object({
+  memberId: z59.string().min(1),
+  documentId: z59.string().min(1),
+  documentVersion: z59.string().min(1),
+  trainingType: TrainingTypeSchema,
+  dueDays: z59.number().int().positive().optional(),
+  /** Required for quiz-type training. Stored server-side for scoring. */
+  quizDefinition: QuizDefinitionSchema.optional()
+});
+var UpdateTrainingSettingsRequestSchema = z59.object({
+  defaultDueDays: z59.number().int().positive().optional(),
+  passingScorePercent: z59.number().int().min(0).max(100).optional()
+});
+var BulkAssignTrainingRequestSchema = z59.object({
+  department: z59.string().min(1),
+  documentId: z59.string().min(1),
+  documentVersion: z59.string().min(1),
+  trainingType: TrainingTypeSchema,
+  dueDays: z59.number().int().positive().optional()
+});
+
+// ../contracts/dist/training/responses.js
+import { z as z60 } from "zod";
+var TrainingTaskResponseSchema = z60.object({
+  id: z60.string(),
+  organizationId: z60.string(),
+  memberId: z60.string(),
+  memberName: z60.string(),
+  memberEmail: z60.string(),
+  documentId: z60.string(),
+  documentTitle: z60.string(),
+  documentVersion: z60.string(),
+  trainingType: TrainingTypeSchema,
+  status: TrainingStatusSchema,
+  dueDate: z60.string(),
+  createdAt: z60.string(),
+  startedAt: z60.string().optional(),
+  completedAt: z60.string().optional(),
+  quizScore: z60.number().optional(),
+  signatureId: z60.string().optional(),
+  evidenceUrl: z60.string().optional()
+});
+var QuizOptionResponseSchema = z60.object({
+  text: z60.string()
+});
+var QuizQuestionTypeSchema = z60.enum(["single_choice", "multiple_choice", "true_false"]);
+var QuizQuestionResponseSchema = z60.object({
+  type: QuizQuestionTypeSchema,
+  text: z60.string(),
+  options: z60.array(QuizOptionResponseSchema).optional()
+});
+var QuizSessionResponseSchema = z60.object({
+  sessionId: z60.string(),
+  questions: z60.array(QuizQuestionResponseSchema),
+  questionCount: z60.number(),
+  passingScore: z60.number(),
+  savedAnswers: z60.record(z60.string(), z60.union([z60.number(), z60.array(z60.number()), z60.boolean()])).optional()
+});
+var QuizResultResponseSchema = z60.object({
+  passed: z60.boolean(),
+  score: z60.number(),
+  passingScore: z60.number(),
+  correctCount: z60.number(),
+  totalCount: z60.number(),
+  explanations: z60.record(z60.string(), z60.string()),
+  signatureRequired: z60.boolean()
+});
+var TrainingStatsResponseSchema = z60.object({
+  pending: z60.number(),
+  inProgress: z60.number(),
+  completed: z60.number(),
+  overdue: z60.number(),
+  completionRate: z60.number()
+});
+var TrainingDashboardResponseSchema = z60.object({
+  stats: TrainingStatsResponseSchema,
+  tasks: z60.array(TrainingTaskResponseSchema)
+});
+var TrainingSettingsResponseSchema = z60.object({
+  defaultDueDays: z60.number(),
+  passingScorePercent: z60.number()
+});
+var BulkAssignTrainingResponseSchema = z60.object({
+  createdCount: z60.number(),
+  skippedCount: z60.number(),
+  memberNames: z60.array(z60.string())
+});
+var SigningEligibilityResponseSchema = z60.object({
+  eligible: z60.boolean(),
+  hasIncompleteTraining: z60.boolean()
+});
+
+// ../contracts/dist/signing-requests/requests.js
+import { z as z61 } from "zod";
+var SigningFieldSchema = z61.object({
+  id: z61.string().min(1),
+  type: FieldTypeSchema,
+  assignedSignerEmail: z61.string().email(),
+  /** 1-based page index within the PDF document. */
+  page: z61.number().int().positive(),
+  /** Field left edge as a percentage of the page width (0–100). */
+  x: z61.number().min(0).max(100),
+  /** Field top edge as a percentage of the page height (0–100). */
+  y: z61.number().min(0).max(100),
+  /** Field width as a percentage of the page width (0–100). */
+  width: z61.number().min(0).max(100),
+  /** Field height as a percentage of the page height (0–100). */
+  height: z61.number().min(0).max(100)
+});
+var SigningDocumentInputSchema = z61.object({
+  fileName: z61.string().min(1),
+  storagePath: z61.string().startsWith("signing-uploads/"),
+  fileHash: z61.string().min(1),
+  pageCount: z61.number().int().positive(),
+  fields: z61.array(SigningFieldSchema).min(1)
+});
+var SignerInputSchema = z61.object({
+  name: z61.string().min(1).max(200),
+  email: z61.string().email(),
+  meaning: z61.string().min(1).max(500)
+});
+var SigningRequestIdParamSchema = z61.object({
+  signingRequestId: z61.string().min(1)
+});
+var ListSigningRequestsQuerySchema = z61.object({
+  organizationId: z61.string().min(1),
+  status: SigningRequestStatusSchema.optional(),
+  limit: z61.coerce.number().int().positive().max(100).default(50),
+  offset: z61.coerce.number().int().nonnegative().default(0)
+});
+var GetSigningRequestQuerySchema = z61.object({
+  organizationId: z61.string().min(1)
+});
+var CreateSigningRequestSchema = z61.object({
+  organizationId: z61.string().min(1),
+  title: z61.string().min(1).max(200),
+  description: z61.string().max(2e3).optional(),
+  meaning: z61.string().min(1).max(500),
+  expiresAt: z61.string().datetime(),
+  signingDocuments: z61.array(SigningDocumentInputSchema).min(1),
+  signers: z61.array(SignerInputSchema).min(1)
+});
+var CancelSigningRequestSchema = z61.object({
+  organizationId: z61.string().min(1)
+});
+var RemindSignersSchema = z61.object({
+  organizationId: z61.string().min(1)
+});
+var GetSigningCeremonyParamSchema = z61.object({
+  token: z61.string().min(1)
+});
+var RequestVerificationCodeSchema = z61.object({
+  token: z61.string().min(1)
+});
+var CompleteSigningCeremonySchema = z61.object({
+  token: z61.string().min(1),
+  verificationCode: z61.string().length(6),
+  signatureImagePath: z61.string().startsWith("data:"),
+  initialsImagePath: z61.string().startsWith("data:").optional(),
+  fieldValues: z61.array(z61.object({
+    fieldId: z61.string().min(1),
+    type: FieldTypeSchema,
+    value: z61.string().min(1).refine((v) => v.startsWith("data:") || /^\d{4}-\d{2}-\d{2}/.test(v), {
+      message: "Value must be a data URL or a date string"
+    })
+  })).min(1),
+  /** Part 11: ID of the ERSD version the signer accepted — required, 400 if missing */
+  ersdDisclosureId: z61.string().min(1),
+  /** Part 11: ISO timestamp when the signer accepted the ERSD — required, 400 if missing */
+  ersdAcceptedAt: z61.string().datetime()
+});
+
+// ../contracts/dist/signing-requests/responses.js
+import { z as z62 } from "zod";
+var SigningFieldResponseSchema = z62.object({
+  id: z62.string(),
+  type: FieldTypeSchema,
+  assignedSignerEmail: z62.string(),
+  page: z62.number(),
+  x: z62.number(),
+  y: z62.number(),
+  width: z62.number(),
+  height: z62.number()
+});
+var SigningDocumentResponseSchema = z62.object({
+  fileName: z62.string(),
+  storagePath: z62.string(),
+  fileHash: z62.string(),
+  pageCount: z62.number(),
+  uploadedAt: z62.string(),
+  fields: z62.array(SigningFieldResponseSchema)
+});
+var SignerResponseSchema = z62.object({
+  name: z62.string(),
+  email: z62.string(),
+  meaning: z62.string(),
+  status: SignerStatusSchema,
+  signedAt: z62.string().optional()
+});
+var SigningAuditEntryResponseSchema = z62.object({
+  id: z62.string(),
+  eventType: z62.string(),
+  actor: z62.string(),
+  timestamp: z62.string(),
+  details: z62.record(z62.unknown()).optional()
+});
+var SigningRequestSummaryResponseSchema = z62.object({
+  id: z62.string(),
+  title: z62.string(),
+  status: SigningRequestStatusSchema,
+  meaning: z62.string(),
+  signerCount: z62.number(),
+  signedCount: z62.number(),
+  createdAt: z62.string(),
+  expiresAt: z62.string()
+});
+var SigningRequestDetailResponseSchema = SigningRequestSummaryResponseSchema.extend({
+  description: z62.string().optional(),
+  createdBy: z62.string(),
+  createdByEmail: z62.string(),
+  signingDocuments: z62.array(SigningDocumentResponseSchema),
+  signers: z62.array(SignerResponseSchema),
+  auditTrail: z62.array(SigningAuditEntryResponseSchema)
+});
+var ListSigningRequestsResponseSchema = z62.object({
+  signingRequests: z62.array(SigningRequestSummaryResponseSchema),
+  total: z62.number()
+});
+var CeremonyDocumentResponseSchema = SigningDocumentResponseSchema.omit({
+  storagePath: true
+});
+var CeremonyERSDResponseSchema = z62.object({
+  id: z62.string(),
+  content: z62.string(),
+  version: z62.string()
+});
+var SigningCeremonyResponseSchema = z62.object({
+  organizationName: z62.string(),
+  title: z62.string(),
+  description: z62.string().optional(),
+  meaning: z62.string(),
+  signerName: z62.string(),
+  signerEmail: z62.string(),
+  status: z62.enum(["ready", "already_signed", "expired", "cancelled"]),
+  signingDocuments: z62.array(CeremonyDocumentResponseSchema),
+  /** Only fields assigned to this signer */
+  fields: z62.array(SigningFieldResponseSchema),
+  /** Part 11: Electronic Record and Signature Disclosure — must be accepted before signing */
+  ersd: CeremonyERSDResponseSchema
+});
+var DownloadSignedPdfResponseSchema = z62.object({
+  downloadUrl: z62.string().url()
+});
+
+// ../contracts/dist/notifications/requests.js
+import { z as z63 } from "zod";
+var NotificationTypeSchema = z63.enum([
+  "training_assigned",
+  "training_overdue",
+  "release_submitted_for_review",
+  "release_published",
+  "signature_requested",
+  "capa_overdue",
+  "nc_overdue",
+  "complaint_overdue",
+  "action_overdue",
+  "objective_threshold_breach",
+  "review_due_soon",
+  "review_auto_drafted",
+  "review_overdue"
+]);
+var NotificationOrgParamSchema = z63.object({
+  orgId: z63.string().min(1)
+});
+var NotificationIdParamSchema = z63.object({
+  orgId: z63.string().min(1),
+  notificationId: z63.string().min(1)
+});
+var NotificationQuerySchema = z63.object({
+  unreadOnly: z63.enum(["true", "false"]).optional(),
+  type: NotificationTypeSchema.optional(),
+  limit: z63.coerce.number().int().positive().max(100).optional()
+});
+
+// ../contracts/dist/notifications/responses.js
+import { z as z64 } from "zod";
+var NotificationResponseSchema = z64.object({
+  id: z64.string(),
+  type: NotificationTypeSchema,
+  title: z64.string(),
+  body: z64.string(),
+  resourceType: z64.string(),
+  resourceId: z64.string(),
+  deepLink: z64.string(),
+  read: z64.boolean(),
+  createdAt: z64.string()
+});
+var NotificationListResponseSchema = z64.object({
+  notifications: z64.array(NotificationResponseSchema),
+  unreadCount: z64.number()
+});
+
+// ../contracts/dist/billing/requests.js
+import { z as z65 } from "zod";
+var CreateCheckoutSessionRequestSchema = z65.object({
+  organizationId: z65.string().min(1)
+});
+var CreatePortalSessionRequestSchema = z65.object({
+  organizationId: z65.string().min(1)
+});
+
+// ../contracts/dist/quality-metrics/responses.js
+import { z as z66 } from "zod";
+var MonthlyCountSchema = z66.object({
+  month: z66.string(),
+  // 'YYYY-MM'
+  opened: z66.number(),
+  closed: z66.number()
+});
+var CapaMetricsSchema = z66.object({
+  total: z66.number(),
+  byStatus: z66.record(z66.string(), z66.number()),
+  overdue: z66.number(),
+  avgCycleTimeDays: z66.number().nullable(),
+  trend: z66.array(MonthlyCountSchema)
+});
+var NcMetricsSchema = z66.object({
+  total: z66.number(),
+  byStatus: z66.record(z66.string(), z66.number()),
+  bySeverity: z66.record(z66.string(), z66.number()),
+  overdue: z66.number(),
+  avgCycleTimeDays: z66.number().nullable(),
+  trend: z66.array(MonthlyCountSchema)
+});
+var ComplaintMetricsSchema = z66.object({
+  total: z66.number(),
+  byStatus: z66.record(z66.string(), z66.number()),
+  bySeverity: z66.record(z66.string(), z66.number()),
+  overdue: z66.number(),
+  reportableCount: z66.number(),
+  avgCycleTimeDays: z66.number().nullable(),
+  trend: z66.array(MonthlyCountSchema)
+});
+var TrainingMetricsSchema = z66.object({
+  totalTasks: z66.number(),
+  complianceRate: z66.number(),
+  // 0-100
+  byStatus: z66.record(z66.string(), z66.number()),
+  overdue: z66.number()
+});
+var ReleaseMetricsSchema = z66.object({
+  total: z66.number(),
+  byStatus: z66.record(z66.string(), z66.number()),
+  avgCycleTimeDays: z66.number().nullable()
+});
+var AuditMetricsSchema = z66.object({
+  totalSchedules: z66.number(),
+  totalReports: z66.number(),
+  findingsMajor: z66.number(),
+  findingsMinor: z66.number(),
+  findingsObservations: z66.number()
+});
+var QualityMetricsResponseSchema = z66.object({
+  generatedAt: z66.string(),
+  period: z66.object({
+    from: z66.string(),
+    to: z66.string()
+  }),
+  capas: CapaMetricsSchema,
+  nonconformances: NcMetricsSchema,
+  complaints: ComplaintMetricsSchema,
+  training: TrainingMetricsSchema,
+  releases: ReleaseMetricsSchema,
+  audits: AuditMetricsSchema
+});
+var QualityMetricsQuerySchema = z66.object({
+  period: z66.enum(["30d", "90d", "365d"]).optional().default("90d")
+});
+
+// ../contracts/dist/api-keys/requests.js
+import { z as z67 } from "zod";
+var ApiKeyOrgParamSchema = z67.object({
+  orgId: z67.string().min(1)
+});
+var ApiKeyIdParamSchema = z67.object({
+  orgId: z67.string().min(1),
+  apiKeyId: z67.string().min(1)
+});
+var CreateApiKeyRequestSchema = z67.object({
+  name: z67.string().min(1).max(100)
+});
+
+// ../contracts/dist/api-keys/responses.js
+import { z as z68 } from "zod";
+var ApiKeyResponseSchema = z68.object({
+  id: z68.string(),
+  name: z68.string(),
+  prefix: z68.string(),
+  createdAt: z68.string(),
+  lastUsedAt: z68.string().nullable(),
+  createdBy: z68.string(),
+  createdByEmail: z68.string()
+});
+var CreateApiKeyResponseSchema = z68.object({
+  id: z68.string(),
+  name: z68.string(),
+  key: z68.string(),
+  prefix: z68.string(),
+  createdAt: z68.string()
+});
+var ApiKeyListResponseSchema = z68.object({
+  keys: z68.array(ApiKeyResponseSchema)
+});
+
+// ../contracts/dist/compliance/requests.js
+import { z as z69 } from "zod";
+var CompliancePackageStatusEnum = z69.enum([
+  "pending",
+  "in_progress",
+  "completed",
+  "failed"
+]);
+var CompliancePackageSectionEnum = z69.enum([
+  "system_description",
+  "electronic_signatures",
+  "audit_trails",
+  "access_controls",
+  "change_control",
+  "dhr_attestation",
+  "compiled_documents"
+]);
+var ComplianceOrgParamSchema = z69.object({
+  orgId: z69.string().min(1)
+});
+var CompliancePackageParamSchema = z69.object({
+  orgId: z69.string().min(1),
+  packageId: z69.string().min(1)
+});
+var GenerateCompliancePackageRequestSchema = z69.object({
+  /** Safety class determines which sections and depth of evidence to include */
+  safetyClass: SafetyClassSchema,
+  /** Sections to include; defaults to all if omitted */
+  sections: z69.array(CompliancePackageSectionEnum).min(1).optional(),
+  /** Optional date range filter for audit trail entries */
+  auditTrailFrom: z69.string().datetime().optional(),
+  auditTrailTo: z69.string().datetime().optional(),
+  /** Optional release ID to scope signatures and change control to a specific release */
+  releaseId: z69.string().optional()
+});
+
+// ../contracts/dist/compliance/responses.js
+import { z as z70 } from "zod";
+var CompliancePackageResponseSchema = z70.object({
+  id: z70.string(),
+  organizationId: z70.string(),
+  status: CompliancePackageStatusEnum,
+  safetyClass: SafetyClassSchema,
+  sections: z70.array(CompliancePackageSectionEnum),
+  /** Requesting member info */
+  requestedById: z70.string(),
+  requestedByName: z70.string(),
+  requestedAt: z70.string(),
+  /** Completion timestamps */
+  completedAt: z70.string().optional(),
+  /** Expiry for the download URL */
+  downloadExpiresAt: z70.string().optional(),
+  /** Error message — only present when status is 'failed' */
+  errorMessage: z70.string().optional(),
+  /** Optional scoping filters used during generation */
+  releaseId: z70.string().optional(),
+  auditTrailFrom: z70.string().optional(),
+  auditTrailTo: z70.string().optional()
+});
+var CompliancePackageListResponseSchema = z70.object({
+  packages: z70.array(CompliancePackageResponseSchema)
+});
+var ValidationPackageResponseSchema = z70.object({
+  downloadUrl: z70.string().url(),
+  version: z70.string(),
+  lastUpdated: z70.string()
+});
+
+// ../contracts/dist/compliance/readiness.js
+import { z as z71 } from "zod";
+var ReadinessSeveritySchema = z71.enum(["error", "warning", "info"]);
+var ReadinessItemSchema = z71.object({
+  severity: ReadinessSeveritySchema,
+  message: z71.string(),
+  documentId: z71.string().optional(),
+  releaseId: z71.string().optional(),
+  action: z71.string()
+});
+var ReadinessDimensionSchema = z71.object({
+  name: z71.string(),
+  score: z71.number().min(0).max(100),
+  weight: z71.number().min(0).max(1),
+  details: z71.string(),
+  items: z71.array(ReadinessItemSchema)
+});
+var ComplianceReadinessResponseSchema = z71.object({
+  overallScore: z71.number().min(0).max(100),
+  calculatedAt: z71.string(),
+  dimensions: z71.array(ReadinessDimensionSchema)
+});
+
+// ../contracts/dist/actions/requests.js
+import { z as z72 } from "zod";
+
+// ../contracts/dist/domain-types/action.js
+var ACTION_STATUSES = ["open", "in_progress", "completed", "cancelled"];
+var ACTION_PRIORITIES = ["low", "medium", "high", "critical"];
+var ACTION_SOURCE_TYPES = [
+  "capa",
+  "nonconformance",
+  "complaint",
+  "management_review",
+  "custom_review",
+  "audit_finding",
+  "quality_objective"
+];
+
+// ../contracts/dist/actions/requests.js
+var ActionSourceSchema = z72.object({
+  type: z72.enum(ACTION_SOURCE_TYPES),
+  id: z72.string().min(1),
+  displayNumber: z72.string().optional()
+});
+var CreateActionRequestSchema = z72.object({
+  title: z72.string().min(1).max(200),
+  description: z72.string().min(1).max(5e3),
+  source: ActionSourceSchema,
+  assigneeDepartment: z72.string().min(1),
+  assigneeDepartmentRole: z72.enum(["manager", "member"]),
+  assigneeId: z72.string().optional(),
+  priority: z72.enum(ACTION_PRIORITIES),
+  dueDate: z72.string().datetime()
+});
+var UpdateActionRequestSchema = z72.object({
+  title: z72.string().min(1).max(200).optional(),
+  description: z72.string().min(1).max(5e3).optional(),
+  assigneeDepartment: z72.string().min(1).optional(),
+  assigneeDepartmentRole: z72.enum(["manager", "member"]).optional(),
+  assigneeId: z72.string().nullable().optional(),
+  priority: z72.enum(ACTION_PRIORITIES).optional(),
+  dueDate: z72.string().datetime().optional(),
+  notes: z72.string().max(5e3).optional()
+});
+var ListActionsQuerySchema = z72.object({
+  sourceType: z72.enum(ACTION_SOURCE_TYPES).optional(),
+  sourceId: z72.string().optional(),
+  status: z72.enum(ACTION_STATUSES).optional(),
+  assigneeDepartment: z72.string().optional(),
+  priority: z72.enum(ACTION_PRIORITIES).optional(),
+  page: z72.coerce.number().int().positive().default(1),
+  limit: z72.coerce.number().int().positive().max(100).default(20)
+});
+var CompleteActionRequestSchema = z72.object({
+  notes: z72.string().max(5e3).optional()
+});
+var QmsActionParamSchema = z72.object({
+  orgId: z72.string().min(1),
+  qmsId: z72.string().min(1)
+});
+var ActionIdParamSchema = z72.object({
+  orgId: z72.string().min(1),
+  qmsId: z72.string().min(1),
+  actionId: z72.string().min(1)
+});
+
+// ../contracts/dist/actions/responses.js
+import { z as z73 } from "zod";
+var ActionResponseSchema = z73.object({
+  id: z73.string(),
+  actionNumber: z73.string(),
+  title: z73.string(),
+  description: z73.string(),
+  source: z73.object({
+    type: z73.enum(ACTION_SOURCE_TYPES),
+    id: z73.string(),
+    displayNumber: z73.string().optional()
+  }),
+  assigneeDepartment: z73.string(),
+  assigneeDepartmentRole: z73.enum(["manager", "member"]),
+  assigneeId: z73.string().nullable(),
+  priority: z73.enum(ACTION_PRIORITIES),
+  dueDate: z73.string(),
+  status: z73.enum(ACTION_STATUSES),
+  isOverdue: z73.boolean(),
+  completedAt: z73.string().nullable(),
+  completedBy: z73.string().nullable(),
+  notes: z73.string().nullable(),
+  createdAt: z73.string(),
+  createdBy: z73.string(),
+  updatedAt: z73.string()
+});
+var ListActionsResponseSchema = z73.object({
+  items: z73.array(ActionResponseSchema),
+  total: z73.number(),
+  page: z73.number(),
+  limit: z73.number(),
+  hasMore: z73.boolean()
+});
+
+// ../contracts/dist/quality-objectives/requests.js
+import { z as z74 } from "zod";
+
+// ../contracts/dist/domain-types/quality-objective.js
+var OBJECTIVE_TYPES = ["auto", "manual"];
+var OBJECTIVE_STATUSES = ["on_track", "at_risk", "off_target", "not_started"];
+var OBJECTIVE_DIRECTIONS = ["above", "below"];
+var OBJECTIVE_CADENCES = ["monthly", "quarterly", "annual"];
+var AUTO_METRIC_SOURCES = [
+  "capa.avgCycleTimeDays",
+  "capa.overdueCount",
+  "capa.openCount",
+  "nonconformance.avgCycleTimeDays",
+  "nonconformance.overdueCount",
+  "nonconformance.openCount",
+  "complaint.avgCycleTimeDays",
+  "complaint.overdueCount",
+  "complaint.reportableCount",
+  "training.complianceRate",
+  "training.overdueCount",
+  "release.avgCycleTimeDays",
+  "audit.findingsMajor",
+  "audit.findingsMinor"
+];
+
+// ../contracts/dist/quality-objectives/requests.js
+var AlertRecipientSchema = z74.object({
+  department: z74.string().min(1),
+  departmentRole: z74.enum(["manager", "member"])
+});
+var CreateQualityObjectiveRequestSchema = z74.object({
+  title: z74.string().min(1).max(200),
+  description: z74.string().min(1).max(5e3),
+  type: z74.enum(OBJECTIVE_TYPES),
+  metricSource: z74.enum(AUTO_METRIC_SOURCES).optional(),
+  unit: z74.string().min(1).max(50),
+  target: z74.number(),
+  direction: z74.enum(OBJECTIVE_DIRECTIONS),
+  warningThreshold: z74.number(),
+  ownerDepartment: z74.string().min(1),
+  ownerDepartmentRole: z74.enum(["manager", "member"]),
+  alertRecipients: z74.array(AlertRecipientSchema).default([]),
+  reviewCadence: z74.enum(OBJECTIVE_CADENCES),
+  effectiveDate: z74.string().datetime(),
+  targetDate: z74.string().datetime().optional()
+});
+var UpdateQualityObjectiveRequestSchema = z74.object({
+  title: z74.string().min(1).max(200).optional(),
+  description: z74.string().min(1).max(5e3).optional(),
+  unit: z74.string().min(1).max(50).optional(),
+  target: z74.number().optional(),
+  direction: z74.enum(OBJECTIVE_DIRECTIONS).optional(),
+  warningThreshold: z74.number().optional(),
+  ownerDepartment: z74.string().min(1).optional(),
+  ownerDepartmentRole: z74.enum(["manager", "member"]).optional(),
+  alertRecipients: z74.array(AlertRecipientSchema).optional(),
+  reviewCadence: z74.enum(OBJECTIVE_CADENCES).optional(),
+  targetDate: z74.string().datetime().nullable().optional()
+});
+var RecordObjectiveValueRequestSchema = z74.object({
+  value: z74.number(),
+  note: z74.string().max(1e3).optional()
+});
+var ListQualityObjectivesQuerySchema = z74.object({
+  type: z74.enum(OBJECTIVE_TYPES).optional(),
+  status: z74.enum(OBJECTIVE_STATUSES).optional(),
+  isActive: z74.enum(["true", "false"]).transform((v) => v === "true").optional(),
+  page: z74.coerce.number().int().positive().default(1),
+  limit: z74.coerce.number().int().positive().max(100).default(20)
+});
+var QmsObjectiveParamSchema = z74.object({
+  orgId: z74.string().min(1),
+  qmsId: z74.string().min(1)
+});
+var ObjectiveIdParamSchema = z74.object({
+  orgId: z74.string().min(1),
+  qmsId: z74.string().min(1),
+  objectiveId: z74.string().min(1)
+});
+
+// ../contracts/dist/quality-objectives/responses.js
+import { z as z75 } from "zod";
+var QualityObjectiveSnapshotResponseSchema = z75.object({
+  id: z75.string(),
+  value: z75.number(),
+  status: z75.enum(OBJECTIVE_STATUSES),
+  source: z75.enum(["auto", "manual", "review"]),
+  reviewId: z75.string().nullable(),
+  capturedAt: z75.string(),
+  capturedBy: z75.string().nullable()
+});
+var QualityObjectiveResponseSchema = z75.object({
+  id: z75.string(),
+  objectiveNumber: z75.string(),
+  title: z75.string(),
+  description: z75.string(),
+  type: z75.enum(OBJECTIVE_TYPES),
+  metricSource: z75.enum(AUTO_METRIC_SOURCES).nullable(),
+  unit: z75.string(),
+  target: z75.number(),
+  direction: z75.enum(OBJECTIVE_DIRECTIONS),
+  warningThreshold: z75.number(),
+  currentValue: z75.number().nullable(),
+  currentValueUpdatedAt: z75.string().nullable(),
+  status: z75.enum(OBJECTIVE_STATUSES),
+  ownerDepartment: z75.string(),
+  ownerDepartmentRole: z75.enum(["manager", "member"]),
+  alertRecipients: z75.array(z75.object({
+    department: z75.string(),
+    departmentRole: z75.enum(["manager", "member"])
+  })),
+  reviewCadence: z75.enum(OBJECTIVE_CADENCES),
+  effectiveDate: z75.string(),
+  targetDate: z75.string().nullable(),
+  isActive: z75.boolean(),
+  createdAt: z75.string(),
+  createdBy: z75.string(),
+  updatedAt: z75.string(),
+  // Optional: included when fetching detail with snapshots
+  recentSnapshots: z75.array(QualityObjectiveSnapshotResponseSchema).optional()
+});
+var ListQualityObjectivesResponseSchema = z75.object({
+  items: z75.array(QualityObjectiveResponseSchema),
+  total: z75.number(),
+  page: z75.number(),
+  limit: z75.number(),
+  hasMore: z75.boolean()
+});
+
+// ../contracts/dist/review-types/requests.js
+import { z as z76 } from "zod";
+
+// ../contracts/dist/domain-types/quality-review.js
+var REVIEW_STATUSES = [
+  "scheduled",
+  "draft",
+  "in_progress",
+  "completed",
+  "cancelled"
+];
+var REVIEW_CADENCES = ["monthly", "quarterly", "semi_annual", "annual"];
+var REVIEW_DATA_SOURCES = [
+  "capas",
+  "nonconformances",
+  "complaints",
+  "training",
+  "releases",
+  "audits"
+];
+
+// ../contracts/dist/review-types/requests.js
+var CreateReviewTypeRequestSchema = z76.object({
+  name: z76.string().min(1).max(200),
+  dataSources: z76.array(z76.enum(REVIEW_DATA_SOURCES)).min(1),
+  requiredSections: z76.array(z76.string().min(1)).default([]),
+  ownerDepartment: z76.string().min(1),
+  ownerDepartmentRole: z76.enum(["manager", "member"]),
+  cadence: z76.enum(REVIEW_CADENCES),
+  advanceNotificationDays: z76.number().int().min(1).max(30).default(7),
+  includeObjectives: z76.boolean().default(false)
+});
+var UpdateReviewTypeRequestSchema = z76.object({
+  name: z76.string().min(1).max(200).optional(),
+  dataSources: z76.array(z76.enum(REVIEW_DATA_SOURCES)).min(1).optional(),
+  requiredSections: z76.array(z76.string().min(1)).optional(),
+  ownerDepartment: z76.string().min(1).optional(),
+  ownerDepartmentRole: z76.enum(["manager", "member"]).optional(),
+  cadence: z76.enum(REVIEW_CADENCES).optional(),
+  advanceNotificationDays: z76.number().int().min(1).max(30).optional(),
+  includeObjectives: z76.boolean().optional()
+});
+var QmsReviewTypeParamSchema = z76.object({
+  orgId: z76.string().min(1),
+  qmsId: z76.string().min(1)
+});
+var ReviewTypeIdParamSchema = z76.object({
+  orgId: z76.string().min(1),
+  qmsId: z76.string().min(1),
+  reviewTypeId: z76.string().min(1)
+});
+
+// ../contracts/dist/review-types/responses.js
+import { z as z77 } from "zod";
+var ReviewTypeResponseSchema = z77.object({
+  id: z77.string(),
+  name: z77.string(),
+  isBuiltIn: z77.boolean(),
+  dataSources: z77.array(z77.enum(REVIEW_DATA_SOURCES)),
+  requiredSections: z77.array(z77.string()),
+  ownerDepartment: z77.string(),
+  ownerDepartmentRole: z77.enum(["manager", "member"]),
+  cadence: z77.enum(REVIEW_CADENCES),
+  advanceNotificationDays: z77.number(),
+  includeObjectives: z77.boolean(),
+  isActive: z77.boolean(),
+  createdAt: z77.string(),
+  updatedAt: z77.string()
+});
+var ListReviewTypesResponseSchema = z77.object({
+  items: z77.array(ReviewTypeResponseSchema)
+});
+
+// ../contracts/dist/quality-reviews/requests.js
+import { z as z78 } from "zod";
+var CreateQualityReviewRequestSchema = z78.object({
+  reviewTypeId: z78.string().min(1),
+  title: z78.string().min(1).max(200),
+  scheduledDate: z78.string().datetime(),
+  reviewPeriod: z78.object({
+    from: z78.string().datetime(),
+    to: z78.string().datetime()
+  })
+});
+var AddDecisionRequestSchema = z78.object({
+  description: z78.string().min(1).max(2e3),
+  decidedBy: z78.string().min(1)
+});
+var AddAttendeeRequestSchema = z78.object({
+  memberId: z78.string().min(1),
+  name: z78.string().min(1),
+  department: z78.string().min(1),
+  role: z78.string().min(1)
+});
+var UpdateReviewNotesRequestSchema = z78.object({
+  notes: z78.string().max(1e4)
+});
+var ListQualityReviewsQuerySchema = z78.object({
+  reviewTypeId: z78.string().optional(),
+  status: z78.enum(REVIEW_STATUSES).optional(),
+  page: z78.coerce.number().int().positive().default(1),
+  limit: z78.coerce.number().int().positive().max(100).default(20)
+});
+var QmsReviewParamSchema = z78.object({
+  orgId: z78.string().min(1),
+  qmsId: z78.string().min(1)
+});
+var ReviewIdParamSchema = z78.object({
+  orgId: z78.string().min(1),
+  qmsId: z78.string().min(1),
+  reviewId: z78.string().min(1)
+});
+
+// ../contracts/dist/quality-reviews/responses.js
+import { z as z79 } from "zod";
+var MonthlyTrendSchema = z79.object({
+  month: z79.string(),
+  opened: z79.number(),
+  closed: z79.number()
+});
+var ReviewDataSnapshotSchema = z79.object({
+  capas: z79.object({
+    total: z79.number(),
+    open: z79.number(),
+    overdue: z79.number(),
+    avgCycleTimeDays: z79.number().nullable(),
+    trend: z79.array(MonthlyTrendSchema)
+  }).optional(),
+  nonconformances: z79.object({
+    total: z79.number(),
+    open: z79.number(),
+    overdue: z79.number(),
+    avgCycleTimeDays: z79.number().nullable(),
+    bySeverity: z79.record(z79.string(), z79.number()),
+    trend: z79.array(MonthlyTrendSchema)
+  }).optional(),
+  complaints: z79.object({
+    total: z79.number(),
+    open: z79.number(),
+    overdue: z79.number(),
+    reportableCount: z79.number(),
+    trend: z79.array(MonthlyTrendSchema)
+  }).optional(),
+  training: z79.object({
+    totalTasks: z79.number(),
+    complianceRate: z79.number(),
+    overdue: z79.number()
+  }).optional(),
+  releases: z79.object({
+    total: z79.number(),
+    avgCycleTimeDays: z79.number().nullable()
+  }).optional(),
+  audits: z79.object({
+    totalFindings: z79.number(),
+    major: z79.number(),
+    minor: z79.number(),
+    observations: z79.number()
+  }).optional()
+});
+var ReviewObjectiveSnapshotSchema = z79.object({
+  objectiveId: z79.string(),
+  title: z79.string(),
+  target: z79.number(),
+  value: z79.number().nullable(),
+  status: z79.string(),
+  direction: z79.string(),
+  unit: z79.string()
+});
+var ReviewDecisionSchema = z79.object({
+  description: z79.string(),
+  decidedBy: z79.string()
+});
+var ReviewAttendeeSchema = z79.object({
+  memberId: z79.string(),
+  name: z79.string(),
+  department: z79.string(),
+  role: z79.string()
+});
+var QualityReviewResponseSchema = z79.object({
+  id: z79.string(),
+  reviewNumber: z79.string(),
+  title: z79.string(),
+  reviewTypeId: z79.string(),
+  reviewTypeName: z79.string(),
+  status: z79.enum(REVIEW_STATUSES),
+  scheduledDate: z79.string(),
+  conductedDate: z79.string().nullable(),
+  reviewPeriod: z79.object({
+    from: z79.string(),
+    to: z79.string()
+  }),
+  ownerDepartment: z79.string(),
+  ownerDepartmentRole: z79.enum(["manager", "member"]),
+  dataSources: z79.array(z79.enum(REVIEW_DATA_SOURCES)),
+  attendees: z79.array(ReviewAttendeeSchema),
+  dataSnapshot: ReviewDataSnapshotSchema,
+  objectiveSnapshots: z79.array(ReviewObjectiveSnapshotSchema),
+  decisions: z79.array(ReviewDecisionSchema),
+  notes: z79.string().nullable(),
+  completedAt: z79.string().nullable(),
+  completedBy: z79.string().nullable(),
+  createdAt: z79.string(),
+  createdBy: z79.string(),
+  updatedAt: z79.string()
+});
+var ListQualityReviewsResponseSchema = z79.object({
+  items: z79.array(QualityReviewResponseSchema),
+  total: z79.number(),
+  page: z79.number(),
+  limit: z79.number(),
+  hasMore: z79.boolean()
+});
+
+// ../contracts/dist/quality-findings/responses.js
+import { z as z80 } from "zod";
+var QUALITY_FINDING_CODES = [
+  "review_overdue",
+  "action_overdue",
+  "objective_off_target",
+  "review_actions_incomplete"
+];
+var QUALITY_FINDING_SEVERITIES = ["error", "warning"];
+var QualityFindingSchema = z80.object({
+  code: z80.enum(QUALITY_FINDING_CODES),
+  severity: z80.enum(QUALITY_FINDING_SEVERITIES),
+  entityId: z80.string(),
+  entityTitle: z80.string(),
+  message: z80.string(),
+  metadata: z80.record(z80.unknown()).optional()
+});
+var QualityFindingsResponseSchema = z80.object({
+  findings: z80.array(QualityFindingSchema),
+  summary: z80.object({
+    errorCount: z80.number(),
+    warningCount: z80.number(),
+    overdueActions: z80.number(),
+    overdueReviews: z80.number(),
+    offTargetObjectives: z80.number(),
+    incompleteReviewActions: z80.number()
+  })
+});
+
+// ../contracts/dist/frameworks/requests.js
+import { z as z81 } from "zod";
+var GetFrameworksQuerySchema = z81.object({
+  scope: FrameworkScopeSchema.optional()
+});
+var GetFrameworkParamsSchema = z81.object({
+  frameworkId: RegulatoryFrameworkSchema
+});
+var GetClauseMappingsParamsSchema = z81.object({
+  frameworkId: RegulatoryFrameworkSchema,
+  clauseId: z81.string().min(1)
+});
+var GetCrosswalkQuerySchema = z81.object({
+  targetFrameworkId: RegulatoryFrameworkSchema
+});
+var GetQmsComplianceParamsSchema = z81.object({
+  orgId: z81.string().min(1)
+});
+var GetQmsComplianceQuerySchema = z81.object({
+  repositoryId: z81.string().min(1)
+});
+var GetDeviceComplianceParamsSchema = z81.object({
+  orgId: z81.string().min(1),
+  deviceId: z81.string().min(1)
+});
+var GetDeviceFrameworkComplianceParamsSchema = z81.object({
+  orgId: z81.string().min(1),
+  deviceId: z81.string().min(1),
+  frameworkId: RegulatoryFrameworkSchema
+});
+
+// ../contracts/dist/frameworks/responses.js
+import { z as z82 } from "zod";
+var FrameworkSummarySchema = z82.object({
+  id: RegulatoryFrameworkSchema,
+  name: z82.string(),
+  version: z82.string(),
+  scope: FrameworkScopeSchema,
+  url: z82.string().nullable(),
+  active: z82.boolean(),
+  clauseCount: z82.number().int().nonnegative()
+});
+var FrameworksListResponseSchema = z82.object({
+  frameworks: z82.array(FrameworkSummarySchema)
+});
+var ClauseNodeSchema = z82.lazy(() => z82.object({
+  id: z82.string(),
+  frameworkId: RegulatoryFrameworkSchema,
+  clauseNumber: z82.string(),
+  title: z82.string(),
+  parentClauseId: z82.string().nullable(),
+  depth: z82.number().int().nonnegative(),
+  sortOrder: z82.number().int().nonnegative(),
+  children: z82.array(ClauseNodeSchema)
+}));
+var FrameworkDetailResponseSchema = z82.object({
+  id: RegulatoryFrameworkSchema,
+  name: z82.string(),
+  version: z82.string(),
+  scope: FrameworkScopeSchema,
+  url: z82.string().nullable(),
+  active: z82.boolean(),
+  clauses: z82.array(ClauseNodeSchema)
+});
+var ClauseMappingSchema = z82.object({
+  clauseId: z82.string(),
+  mappedFrameworkId: RegulatoryFrameworkSchema,
+  mappedFrameworkName: z82.string(),
+  mappedClauseId: z82.string(),
+  mappedClauseTitle: z82.string(),
+  relationship: MappingRelationshipSchema,
+  notes: z82.string().nullable()
+});
+var ClauseMappingsResponseSchema = z82.object({
+  clauseId: z82.string(),
+  frameworkId: RegulatoryFrameworkSchema,
+  mappings: z82.array(ClauseMappingSchema)
+});
+var CrosswalkResponseSchema = z82.object({
+  sourceFrameworkId: RegulatoryFrameworkSchema,
+  targetFrameworkId: RegulatoryFrameworkSchema,
+  mappings: z82.array(ClauseMappingSchema)
+});
+var FrameworkCoverageSchema = z82.object({
+  frameworkId: RegulatoryFrameworkSchema,
+  frameworkName: z82.string(),
+  totalClauses: z82.number().int().nonnegative(),
+  coveredClauses: z82.number().int().nonnegative(),
+  coveragePercent: z82.number().min(0).max(100),
+  scope: FrameworkScopeSchema
+});
+var ComplianceSummaryResponseSchema = z82.object({
+  organizationId: z82.string(),
+  frameworks: z82.array(FrameworkCoverageSchema),
+  overallCoveragePercent: z82.number().min(0).max(100)
+});
+var EvidenceItemSchema = z82.object({
+  documentId: z82.string(),
+  documentTitle: z82.string(),
+  /** Document type. Optional — omitted for non-document evidence (e.g. training records). */
+  docType: DocumentTypeSchema.optional(),
+  linkType: LinkTypeSchema.optional(),
+  status: z82.string()
+});
+var ClauseComplianceSchema = z82.object({
+  clauseId: z82.string(),
+  clauseNumber: z82.string(),
+  clauseTitle: z82.string(),
+  covered: z82.boolean(),
+  /** Compliance score 0..1 based on weighted evidence rules */
+  score: z82.number().min(0).max(1),
+  evidence: z82.array(EvidenceItemSchema)
+});
+var FrameworkComplianceResponseSchema = z82.object({
+  frameworkId: RegulatoryFrameworkSchema,
+  frameworkName: z82.string(),
+  totalClauses: z82.number().int().nonnegative(),
+  coveredClauses: z82.number().int().nonnegative(),
+  coveragePercent: z82.number().min(0).max(100),
+  clauses: z82.array(ClauseComplianceSchema)
+});
+
+// ../contracts/dist/frameworks/evidence.js
+import { z as z83 } from "zod";
+var ClauseEvidenceStatusSchema = z83.enum(["covered", "partial", "missing"]);
+var ClauseEvidenceItemSchema = z83.object({
+  type: z83.string(),
+  label: z83.string(),
+  count: z83.number().int().nonnegative(),
+  status: ClauseEvidenceStatusSchema
+});
+var ClauseEvidenceNodeSchema = z83.object({
+  clauseId: z83.string(),
+  clauseNumber: z83.string(),
+  clauseTitle: z83.string(),
+  status: ClauseEvidenceStatusSchema,
+  evidenceCount: z83.number().int().nonnegative(),
+  evidence: z83.array(ClauseEvidenceItemSchema)
+});
+var FrameworkEvidenceResponseSchema = z83.object({
+  frameworkId: RegulatoryFrameworkSchema,
+  frameworkName: z83.string(),
+  totalClauses: z83.number().int().nonnegative(),
+  coveredClauses: z83.number().int().nonnegative(),
+  partialClauses: z83.number().int().nonnegative(),
+  missingClauses: z83.number().int().nonnegative(),
+  clauses: z83.array(ClauseEvidenceNodeSchema)
+});
+
+// ../contracts/dist/domain-constants/risk-matrix.js
+var RISK_DOCUMENT_TYPES = [
+  "software_risk",
+  "usability_risk",
+  "security_risk"
+];
+var HAZARD_DOCUMENT_TYPES = ["haz_soe_software", "haz_soe_security"];
+var ALL_RISK_RELATED_DOCUMENT_TYPES = [
+  ...RISK_DOCUMENT_TYPES,
+  ...HAZARD_DOCUMENT_TYPES,
+  "hazardous_situation",
+  "harm"
+];
+
+// ../contracts/dist/domain-constants/document-types.js
+var QMS_DOCUMENT_TYPES = [
+  "sop",
+  "policy",
+  "work_instruction",
+  "supplier",
+  // Internal audit management (ISO 13485 §8.2.2)
+  "audit_schedule",
+  "audit_report",
+  // Management review (ISO 13485 §5.6)
+  "management_review"
+];
+var DEVICE_DOCUMENT_TYPES = [
+  "user_need",
+  "requirement",
+  "architecture",
+  "detailed_design",
+  "test_protocol",
+  "test_report",
+  "usability_risk",
+  "software_risk",
+  "security_risk",
+  "hazardous_situation",
+  "harm",
+  "haz_soe_software",
+  "haz_soe_security",
+  "hazard_category",
+  // Usability engineering (IEC 62366)
+  "usability_plan",
+  "use_specification",
+  "task_analysis",
+  "usability_evaluation",
+  "summative_evaluation",
+  // Risk management (ISO 14971)
+  "risk_management_plan",
+  // Software lifecycle (IEC 62304)
+  "software_development_plan",
+  "software_maintenance_plan",
+  "soup_register",
+  // Problem resolution (IEC 62304 §9)
+  "anomaly",
+  // Cybersecurity (IEC 81001-5-1)
+  "cybersecurity_plan",
+  "sbom",
+  // Clinical (MDR / FDA)
+  "clinical_evaluation_plan",
+  "clinical_evaluation_report",
+  // Post-market surveillance (MDR Art. 83)
+  "post_market_surveillance_plan",
+  "post_market_feedback",
+  // Labeling (MDR Annex I)
+  "labeling",
+  // Product (ISO 13485 §7.3)
+  "product_development_plan",
+  "intended_use",
+  // Release management (IEC 62304 §5.7)
+  "release_plan",
+  // Change management (ISO 13485 §7.3.5)
+  "design_review",
+  "release_notes",
+  // Software test plan (IEC 62304 §5.7)
+  "software_test_plan"
+];
+var CHANGE_DOCUMENT_TYPES = ["design_review", "release_plan"];
+function isChangeDocumentType(type) {
+  return CHANGE_DOCUMENT_TYPES.includes(type);
+}
+function isQmsDocumentType(type) {
+  return QMS_DOCUMENT_TYPES.includes(type);
+}
+function isDeviceDocumentType(type) {
+  return DEVICE_DOCUMENT_TYPES.includes(type);
+}
+
+// ../contracts/dist/domain-constants/index.js
+var DOCUMENT_TYPES = {
+  user_need: "User Need",
+  requirement: "Requirement",
+  architecture: "Architecture",
+  detailed_design: "Detailed Design",
+  test_protocol: "Test Protocol",
+  test_report: "Test Report",
+  sop: "SOP",
+  work_instruction: "Work Instruction",
+  policy: "Policy",
+  usability_risk: "Usability Risk",
+  software_risk: "Software Risk",
+  security_risk: "Security Risk",
+  // Risk document types
+  haz_soe_software: "Hazard (Software)",
+  haz_soe_security: "Hazard (Security)",
+  hazardous_situation: "Hazardous Situation",
+  harm: "Harm",
+  hazard_category: "Hazard Category",
+  // Usability engineering (IEC 62366)
+  usability_plan: "Usability Plan",
+  use_specification: "Use Specification",
+  task_analysis: "Task Analysis",
+  usability_evaluation: "Usability Evaluation",
+  summative_evaluation: "Summative Evaluation",
+  // Risk management (ISO 14971)
+  risk_management_plan: "Risk Management Plan",
+  // Software lifecycle (IEC 62304)
+  software_development_plan: "Software Development Plan",
+  software_maintenance_plan: "Software Maintenance Plan",
+  soup_register: "SOUP Register",
+  // Problem resolution (IEC 62304 §9)
+  anomaly: "Anomaly",
+  // Cybersecurity (IEC 81001-5-1)
+  cybersecurity_plan: "Cybersecurity Plan",
+  sbom: "SBOM",
+  // Clinical (MDR / FDA)
+  clinical_evaluation_plan: "Clinical Evaluation Plan",
+  clinical_evaluation_report: "Clinical Evaluation Report",
+  // Post-market surveillance (MDR Art. 83)
+  post_market_surveillance_plan: "Post-Market Surveillance Plan",
+  post_market_feedback: "Post-Market Feedback",
+  // Labeling (MDR Annex I)
+  labeling: "Labeling",
+  // Product (ISO 13485 §7.3)
+  product_development_plan: "Product Development Plan",
+  intended_use: "Intended Use",
+  // Release management (IEC 62304 §5.7)
+  release_plan: "Release Plan",
+  // Change management (ISO 13485 §7.3.5)
+  design_review: "Design Review",
+  release_notes: "Release Notes",
+  // Supplier management (ISO 13485 §7.4)
+  supplier: "Supplier",
+  // Internal audit management (ISO 13485 §8.2.2)
+  audit_schedule: "Audit Schedule",
+  audit_report: "Audit Report",
+  // Management review (ISO 13485 §5.6)
+  management_review: "Management Review",
+  // Software test plan (IEC 62304 §5.7)
+  software_test_plan: "Software Test Plan"
+};
+var LINK_TYPES = {
+  derives_from: "Derives From",
+  implements: "Implements",
+  verified_by: "Verified By",
+  mitigates: "Mitigates",
+  parent_of: "Parent Of",
+  related_to: "Related To",
+  // New risk link types
+  leads_to: "Leads To",
+  results_in: "Results In",
+  analyzes: "Analyzes"
+};
+var REQUIRED_SECTIONS = {
+  user_need: ["Purpose", "Stakeholder", "User Needs"],
+  architecture: ["Purpose"],
   release_plan: ["Scope", "Applicable Plans", "Release-Specific Criteria", "Known Anomalies"],
   design_review: ["Review Scope", "Attendees", "Findings", "Actions", "Conclusion"],
   release_notes: ["Changes", "Known Issues"],
@@ -1307,16 +4374,16 @@ var REQUIRED_SECTIONS = {
   hazard_category: ["Description", "Examples", "Applicable Standards"]
 };
 
-// ../shared/dist/validators/permissions.js
-import { z as z25 } from "zod";
-var MemberPermissionsSchema = z25.object({
-  canSign: z25.boolean(),
-  canApprove: z25.boolean(),
-  canCreateRelease: z25.boolean(),
-  canPublishRelease: z25.boolean(),
-  canManageMembers: z25.boolean(),
-  canViewAuditLog: z25.boolean(),
-  canExport: z25.boolean()
+// ../contracts/dist/domain-validators/permissions.js
+import { z as z84 } from "zod";
+var MemberPermissionsSchema = z84.object({
+  canSign: z84.boolean(),
+  canApprove: z84.boolean(),
+  canCreateRelease: z84.boolean(),
+  canPublishRelease: z84.boolean(),
+  canManageMembers: z84.boolean(),
+  canViewAuditLog: z84.boolean(),
+  canExport: z84.boolean()
 });
 
 // src/schema-map.ts
@@ -1609,7 +4676,7 @@ export {
   ProductDevelopmentPlanFrontmatterSchema,
   QMS_DOCUMENT_TYPES,
   REQUIRED_SECTIONS,
-  RegulatoryFrameworkSchema,
+  RegulatoryFrameworkSchema2 as RegulatoryFrameworkSchema,
   ReleaseNotesAudienceSchema,
   ReleaseNotesFrontmatterSchema,
   ReleasePlanFrontmatterSchema,