@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/compliance/documents/governed-documents.shared.schemas.js

@@ -0,0 +1,482 @@
+import { z } from "zod";
+/**
+ * What a GOVERNED DOCUMENT is: its classes, audiences, review and publication vocabulary, its
+ * identities, its governance scope, its public content, and the release and publication events that
+ * record it being issued and withdrawn.
+ *
+ * ## What this file used to also be, and why that half is gone (2026-08-28)
+ *
+ * Until this revision the same file carried a complete SEALED DELIVERY MACHINE beside the
+ * vocabulary: public-release and deployment BUNDLES with self-referential digests, deployment
+ * OBSERVATIONS carrying canonical bytes plus a detached backend signature and a rotated-key
+ * `notAfter` window, publication PROOF digests, interaction RECEIPTS, byte-exact retrieval queries,
+ * and a dozen `canonicalize*DigestBasis` functions feeding them. Around it sat a backend registry
+ * that revalidated every digest at boot, two controllers, a CLI artifact-sync writing immutable
+ * receipts, and a generated module the application loaded at startup.
+ *
+ * All of it is removed under `.claude/rules/one-source-of-truth.md` Rule 0 — *nothing that is not
+ * branchable on git*. A digest chain cannot merge: two branches that publish different content
+ * produce a merged tree whose digests belong to neither. What the machine protected — that a
+ * published document is exactly the bytes somebody approved — is what git and the forge already
+ * provide, per commit, mergeably, to a reviewer reading a diff.
+ *
+ * Two facts made the removal cheap rather than risky, and both were measured rather than assumed:
+ * **no application had ever produced a bundle** (`.wildo-saas/generated/compliance/` was empty in
+ * both example applications), and every read path was built on the seal, so there was no
+ * non-sealed serving to preserve.
+ *
+ * ## What replaces it
+ *
+ * Nothing yet, deliberately. A governed document is a FILE in the application's specifications
+ * package; publishing one is a decision recorded by a commit. When an application actually has a
+ * document to serve, the serving is rebuilt from those files — a read, not a custody protocol. The
+ * vocabulary below is what survives, and it is the half every other layer actually consumes.
+ */
+/** Exact media type of the canonical browser-safe governed-document JSON bytes. */
+export const GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE = "application/vnd.wildo.governed-document.public+json;version=1";
+const governedDocumentRefPattern = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*(?::[A-Za-z0-9][A-Za-z0-9._-]*)+$/;
+const compareCanonicalText = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
+const valuesAreUnique = (values) => new Set(values).size === values.length;
+const valuesAreLexicallySorted = (values) => values.every((value, index) => index === 0 || compareCanonicalText(values[index - 1], value) <= 0);
+const addUniqueSortedIssue = (values, context, path, label) => {
+    if (!valuesAreUnique(values) || !valuesAreLexicallySorted(values)) {
+        context.addIssue({ code: "custom", message: `${label} must be unique and lexically sorted`, path });
+    }
+};
+export const GovernedDocumentRefSchema = z.string().trim().regex(governedDocumentRefPattern).brand();
+export const GovernedDocumentIsoDateTimeSchema = z.iso.datetime({ offset: true });
+export const GovernedDocumentIsoDateSchema = z.iso.date();
+/** One runtime source for every governed-document version/order identity. */
+export const GovernedDocumentPositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+/** Semantic class of governed content. The class controls review, release and interaction rules; a public label never changes it. */
+export var GovernedDocumentClass;
+(function (GovernedDocumentClass) {
+    GovernedDocumentClass["PUBLIC_NOTICE"] = "PUBLIC_NOTICE";
+    GovernedDocumentClass["CONTRACTUAL_TERMS"] = "CONTRACTUAL_TERMS";
+    GovernedDocumentClass["GOVERNANCE_POLICY"] = "GOVERNANCE_POLICY";
+    GovernedDocumentClass["PROCEDURE_OR_RUNBOOK"] = "PROCEDURE_OR_RUNBOOK";
+    GovernedDocumentClass["PLAN"] = "PLAN";
+    GovernedDocumentClass["REGISTER"] = "REGISTER";
+    GovernedDocumentClass["REVIEW_OR_DECISION_RECORD"] = "REVIEW_OR_DECISION_RECORD";
+    GovernedDocumentClass["ASSESSMENT_OR_REPORT"] = "ASSESSMENT_OR_REPORT";
+    GovernedDocumentClass["EVIDENCE_ARTIFACT"] = "EVIDENCE_ARTIFACT";
+})(GovernedDocumentClass || (GovernedDocumentClass = {}));
+/** Whose facts and authority a document may speak for. Shared responsibility is explicit rather than a flattened synthetic owner. */
+export var GovernedDocumentGovernanceSubjectKind;
+(function (GovernedDocumentGovernanceSubjectKind) {
+    GovernedDocumentGovernanceSubjectKind["WILDO_PROVIDER"] = "WILDO_PROVIDER";
+    GovernedDocumentGovernanceSubjectKind["APPLICATION_OPERATOR"] = "APPLICATION_OPERATOR";
+    GovernedDocumentGovernanceSubjectKind["TENANT_ORGANIZATION"] = "TENANT_ORGANIZATION";
+    GovernedDocumentGovernanceSubjectKind["SHARED_RESPONSIBILITY"] = "SHARED_RESPONSIBILITY";
+})(GovernedDocumentGovernanceSubjectKind || (GovernedDocumentGovernanceSubjectKind = {}));
+export var GovernedDocumentAudienceKind;
+(function (GovernedDocumentAudienceKind) {
+    GovernedDocumentAudienceKind["PUBLIC_GENERAL"] = "PUBLIC_GENERAL";
+    GovernedDocumentAudienceKind["BUSINESS_CUSTOMER"] = "BUSINESS_CUSTOMER";
+    GovernedDocumentAudienceKind["CONSUMER"] = "CONSUMER";
+    GovernedDocumentAudienceKind["APPLICATION_USER"] = "APPLICATION_USER";
+    GovernedDocumentAudienceKind["WORKFORCE"] = "WORKFORCE";
+    GovernedDocumentAudienceKind["TENANT_ADMINISTRATOR"] = "TENANT_ADMINISTRATOR";
+    GovernedDocumentAudienceKind["QUALIFIED_REVIEWER"] = "QUALIFIED_REVIEWER";
+})(GovernedDocumentAudienceKind || (GovernedDocumentAudienceKind = {}));
+export var GovernedDocumentApplicabilityStatus;
+(function (GovernedDocumentApplicabilityStatus) {
+    GovernedDocumentApplicabilityStatus["APPLICABLE"] = "APPLICABLE";
+    GovernedDocumentApplicabilityStatus["NOT_APPLICABLE"] = "NOT_APPLICABLE";
+    GovernedDocumentApplicabilityStatus["DEFERRED"] = "DEFERRED";
+})(GovernedDocumentApplicabilityStatus || (GovernedDocumentApplicabilityStatus = {}));
+export var GovernedDocumentFactResolutionStatus;
+(function (GovernedDocumentFactResolutionStatus) {
+    GovernedDocumentFactResolutionStatus["KNOWN"] = "KNOWN";
+    GovernedDocumentFactResolutionStatus["MISSING"] = "MISSING";
+    GovernedDocumentFactResolutionStatus["CONFLICTING"] = "CONFLICTING";
+    GovernedDocumentFactResolutionStatus["STALE"] = "STALE";
+    GovernedDocumentFactResolutionStatus["NOT_APPLICABLE"] = "NOT_APPLICABLE";
+})(GovernedDocumentFactResolutionStatus || (GovernedDocumentFactResolutionStatus = {}));
+export var GovernedDocumentCandidateStatus;
+(function (GovernedDocumentCandidateStatus) {
+    GovernedDocumentCandidateStatus["DRAFT"] = "DRAFT";
+    GovernedDocumentCandidateStatus["BLOCKED"] = "BLOCKED";
+    GovernedDocumentCandidateStatus["READY_FOR_REVIEW"] = "READY_FOR_REVIEW";
+    GovernedDocumentCandidateStatus["SUPERSEDED"] = "SUPERSEDED";
+})(GovernedDocumentCandidateStatus || (GovernedDocumentCandidateStatus = {}));
+export var GovernedDocumentReviewKind;
+(function (GovernedDocumentReviewKind) {
+    GovernedDocumentReviewKind["CONTENT"] = "CONTENT";
+    GovernedDocumentReviewKind["TECHNICAL"] = "TECHNICAL";
+    GovernedDocumentReviewKind["PRIVACY"] = "PRIVACY";
+    GovernedDocumentReviewKind["SECURITY"] = "SECURITY";
+    GovernedDocumentReviewKind["LEGAL"] = "LEGAL";
+    GovernedDocumentReviewKind["BUSINESS"] = "BUSINESS";
+    GovernedDocumentReviewKind["INDEPENDENT_ASSESSMENT"] = "INDEPENDENT_ASSESSMENT";
+})(GovernedDocumentReviewKind || (GovernedDocumentReviewKind = {}));
+export var GovernedDocumentReviewDecisionKind;
+(function (GovernedDocumentReviewDecisionKind) {
+    GovernedDocumentReviewDecisionKind["APPROVED"] = "APPROVED";
+    GovernedDocumentReviewDecisionKind["CHANGES_REQUIRED"] = "CHANGES_REQUIRED";
+    GovernedDocumentReviewDecisionKind["REJECTED"] = "REJECTED";
+    GovernedDocumentReviewDecisionKind["CONFLICT"] = "CONFLICT";
+})(GovernedDocumentReviewDecisionKind || (GovernedDocumentReviewDecisionKind = {}));
+export var GovernedDocumentPublicationChannelKind;
+(function (GovernedDocumentPublicationChannelKind) {
+    GovernedDocumentPublicationChannelKind["PUBLIC_WEB"] = "PUBLIC_WEB";
+    GovernedDocumentPublicationChannelKind["AUTHENTICATED_WEB"] = "AUTHENTICATED_WEB";
+    GovernedDocumentPublicationChannelKind["DURABLE_DOWNLOAD"] = "DURABLE_DOWNLOAD";
+    GovernedDocumentPublicationChannelKind["DIRECT_DELIVERY"] = "DIRECT_DELIVERY";
+    GovernedDocumentPublicationChannelKind["GOVERNANCE_REPOSITORY"] = "GOVERNANCE_REPOSITORY";
+})(GovernedDocumentPublicationChannelKind || (GovernedDocumentPublicationChannelKind = {}));
+export var GovernedDocumentPublicationEventKind;
+(function (GovernedDocumentPublicationEventKind) {
+    GovernedDocumentPublicationEventKind["PUBLISHED"] = "PUBLISHED";
+    GovernedDocumentPublicationEventKind["WITHDRAWN"] = "WITHDRAWN";
+})(GovernedDocumentPublicationEventKind || (GovernedDocumentPublicationEventKind = {}));
+/** Distinct legal/user interactions. A notice interaction, contract acceptance and consent decision are never aliases. */
+export var GovernedDocumentInteractionKind;
+(function (GovernedDocumentInteractionKind) {
+    GovernedDocumentInteractionKind["NOTICE_DELIVERED"] = "NOTICE_DELIVERED";
+    GovernedDocumentInteractionKind["NOTICE_ACKNOWLEDGED"] = "NOTICE_ACKNOWLEDGED";
+    GovernedDocumentInteractionKind["CONTRACT_ACCEPTED"] = "CONTRACT_ACCEPTED";
+    GovernedDocumentInteractionKind["CONSENT_GIVEN"] = "CONSENT_GIVEN";
+    GovernedDocumentInteractionKind["CONSENT_WITHDRAWN"] = "CONSENT_WITHDRAWN";
+})(GovernedDocumentInteractionKind || (GovernedDocumentInteractionKind = {}));
+export var GovernedDocumentChangeAction;
+(function (GovernedDocumentChangeAction) {
+    GovernedDocumentChangeAction["NO_PUBLIC_ACTION"] = "NO_PUBLIC_ACTION";
+    GovernedDocumentChangeAction["REVISE_CANDIDATE"] = "REVISE_CANDIDATE";
+    GovernedDocumentChangeAction["REPUBLISH"] = "REPUBLISH";
+    GovernedDocumentChangeAction["NOTIFY"] = "NOTIFY";
+    GovernedDocumentChangeAction["REQUEST_REACKNOWLEDGEMENT"] = "REQUEST_REACKNOWLEDGEMENT";
+    GovernedDocumentChangeAction["REQUEST_REACCEPTANCE"] = "REQUEST_REACCEPTANCE";
+    GovernedDocumentChangeAction["WITHDRAW"] = "WITHDRAW";
+    GovernedDocumentChangeAction["ESCALATE_FOR_QUALIFIED_REVIEW"] = "ESCALATE_FOR_QUALIFIED_REVIEW";
+})(GovernedDocumentChangeAction || (GovernedDocumentChangeAction = {}));
+export const GovernedDocumentDefinitionIdentitySchema = z.strictObject({
+    definitionRef: GovernedDocumentRefSchema,
+    definitionVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+export const GovernedDocumentIdentitySchema = z.strictObject({
+    documentRef: GovernedDocumentRefSchema,
+    documentVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+export const GovernedDocumentReleaseIdentitySchema = z.strictObject({
+    document: GovernedDocumentIdentitySchema,
+    releaseId: GovernedDocumentRefSchema,
+    releaseVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+export const governedDocumentReleaseIdentityKey = (identity) => `${identity.document.documentRef}@${identity.document.documentVersion}:${identity.releaseId}@${identity.releaseVersion}`;
+/** Exact immutable approval-decision identity retained by an issued release without exposing private review content publicly. */
+export const GovernedDocumentApprovalDecisionIdentitySchema = z.strictObject({
+    decisionRef: GovernedDocumentRefSchema,
+    decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+/**
+ * Exact private materiality-decision identity retained when one release
+ * replaces another. The full decision and authority evidence remain in
+ * application-creation custody; this identity makes the replacement and any
+ * required renewed interaction causally auditable without exposing the
+ * decision publicly.
+ */
+export const GovernedDocumentMaterialityDecisionIdentitySchema = z
+    .strictObject({
+    decisionRef: GovernedDocumentRefSchema,
+    decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,
+    previousRelease: GovernedDocumentReleaseIdentitySchema,
+    requiredInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),
+})
+    .superRefine((decision, context) => {
+    addUniqueSortedIssue(decision.requiredInteractionKinds, context, ["requiredInteractionKinds"], "requiredInteractionKinds");
+});
+/** Exact immutable reviewer-authority grant selected by a review decision. */
+export const GovernedDocumentReviewerAuthorityIdentitySchema = z.strictObject({
+    authorityRef: GovernedDocumentRefSchema,
+    authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+/** Exact immutable authority identity selected for a document materiality decision; never interchangeable with candidate-review authority. */
+export const GovernedDocumentMaterialityAuthorityIdentitySchema = z.strictObject({
+    authorityRef: GovernedDocumentRefSchema,
+    authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,
+});
+/**
+ * Exact ownership boundary for one governed document.
+ *
+ * Shared-responsibility output must retain at least two attributed parties and an explicit precedence rule. A single-subject output must not carry those shared-only
+ * fields, preventing provider, operator and tenant statements from being silently flattened into one voice.
+ */
+export const GovernedDocumentGovernanceScopeSchema = z
+    .strictObject({
+    subjectKind: z.enum(GovernedDocumentGovernanceSubjectKind),
+    subjectRef: GovernedDocumentRefSchema,
+    scopeRef: GovernedDocumentRefSchema,
+    scopeVersion: GovernedDocumentPositiveSafeIntegerSchema,
+    participantRefs: z.array(GovernedDocumentRefSchema),
+    precedenceRuleRefs: z.array(GovernedDocumentRefSchema),
+})
+    .superRefine((scope, context) => {
+    addUniqueSortedIssue(scope.participantRefs, context, ["participantRefs"], "participantRefs");
+    addUniqueSortedIssue(scope.precedenceRuleRefs, context, ["precedenceRuleRefs"], "precedenceRuleRefs");
+    if (scope.subjectKind === GovernedDocumentGovernanceSubjectKind.SHARED_RESPONSIBILITY) {
+        if (scope.participantRefs.length < 2) {
+            context.addIssue({ code: "custom", message: "shared responsibility requires at least two attributed participants", path: ["participantRefs"] });
+        }
+        if (scope.precedenceRuleRefs.length === 0) {
+            context.addIssue({ code: "custom", message: "shared responsibility requires an explicit precedence rule", path: ["precedenceRuleRefs"] });
+        }
+    }
+    else if (scope.participantRefs.length > 0 || scope.precedenceRuleRefs.length > 0) {
+        context.addIssue({
+            code: "custom",
+            message: "single-subject governance cannot carry shared-responsibility participants or precedence rules",
+            path: ["participantRefs"],
+        });
+    }
+});
+/**
+ * Browser-safe public projection of approved semantic document content.
+ *
+ * Internal fact, authority, source-policy and review evidence stays in the
+ * candidate/release records. Public routes render this exact projection as
+ * text; `bodyMarkdown` is never trusted as raw HTML.
+ */
+export const GovernedDocumentPublicClauseSchema = z.strictObject({
+    clauseRef: GovernedDocumentRefSchema,
+    clauseVersion: GovernedDocumentPositiveSafeIntegerSchema,
+    order: GovernedDocumentPositiveSafeIntegerSchema,
+    bodyMarkdown: z.string().trim().min(1),
+});
+export const GovernedDocumentPublicSectionSchema = z
+    .strictObject({
+    sectionRef: GovernedDocumentRefSchema,
+    sectionVersion: GovernedDocumentPositiveSafeIntegerSchema,
+    order: GovernedDocumentPositiveSafeIntegerSchema,
+    title: z.string().trim().min(1),
+    clauses: z.array(GovernedDocumentPublicClauseSchema).min(1),
+})
+    .superRefine((section, context) => {
+    if (!valuesAreUnique(section.clauses.map((clause) => clause.clauseRef))) {
+        context.addIssue({ code: "custom", message: "public document clause references must be unique", path: ["clauses"] });
+    }
+    section.clauses.forEach((clause, index) => {
+        if (clause.order !== index + 1) {
+            context.addIssue({
+                code: "custom",
+                message: "public document clause order must be contiguous and match array order",
+                path: ["clauses", index, "order"],
+            });
+        }
+    });
+});
+export const GovernedDocumentPublicContentSchema = z
+    .strictObject({
+    schemaVersion: z.literal(1),
+    title: z.string().trim().min(1),
+    locale: z.string().trim().min(2),
+    jurisdictionRefs: z.array(GovernedDocumentRefSchema),
+    sections: z.array(GovernedDocumentPublicSectionSchema).min(1),
+})
+    .superRefine((content, context) => {
+    addUniqueSortedIssue(content.jurisdictionRefs, context, ["jurisdictionRefs"], "jurisdictionRefs");
+    if (!valuesAreUnique(content.sections.map((section) => section.sectionRef))) {
+        context.addIssue({ code: "custom", message: "public document section references must be unique", path: ["sections"] });
+    }
+    content.sections.forEach((section, index) => {
+        if (section.order !== index + 1) {
+            context.addIssue({
+                code: "custom",
+                message: "public document section order must be contiguous and match array order",
+                path: ["sections", index, "order"],
+            });
+        }
+    });
+});
+/**
+ * Content-branch-neutral immutable release metadata.
+ *
+ * Historical public releases and current internal structured releases add
+ * their own explicit schema/content discriminators to this shared invariant
+ * basis. Consumers must select one complete branch rather than accepting this
+ * common shape directly.
+ */
+export const GovernedDocumentReleaseCommonSchema = z
+    .strictObject({
+    identity: GovernedDocumentReleaseIdentitySchema,
+    definition: GovernedDocumentDefinitionIdentitySchema,
+    governanceScope: GovernedDocumentGovernanceScopeSchema,
+    documentClass: z.enum(GovernedDocumentClass),
+    audienceKinds: z.array(z.enum(GovernedDocumentAudienceKind)).min(1),
+    publicationChannelKinds: z.array(z.enum(GovernedDocumentPublicationChannelKind)).min(1),
+    allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),
+    locale: z.string().trim().min(2),
+    jurisdictionRefs: z.array(GovernedDocumentRefSchema),
+    /*
+     * The release names its content's MEDIA TYPE and nothing more.
+     *
+     * It carried `candidateDigest`, `contentDigest` and `contentArtifactRef` until 2026-08-28 — a
+     * seal binding the release to exact bytes in a content-addressed store. The store and the
+     * verifier are gone with the rest of the digest machinery; the binding a reader needs is the
+     * commit that introduced both the release and its content file.
+     */
+    contentMediaType: z.string().trim().min(1),
+    issuedAt: GovernedDocumentIsoDateTimeSchema,
+    effectiveAt: GovernedDocumentIsoDateTimeSchema,
+    expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),
+    approvalDecisions: z.array(GovernedDocumentApprovalDecisionIdentitySchema).min(1),
+    replacesRelease: GovernedDocumentReleaseIdentitySchema.optional(),
+    materialityDecision: GovernedDocumentMaterialityDecisionIdentitySchema.optional(),
+})
+    .superRefine((release, context) => {
+    addUniqueSortedIssue(release.audienceKinds, context, ["audienceKinds"], "audienceKinds");
+    addUniqueSortedIssue(release.publicationChannelKinds, context, ["publicationChannelKinds"], "publicationChannelKinds");
+    addUniqueSortedIssue(release.allowedInteractionKinds, context, ["allowedInteractionKinds"], "allowedInteractionKinds");
+    addUniqueSortedIssue(release.jurisdictionRefs, context, ["jurisdictionRefs"], "jurisdictionRefs");
+    addUniqueSortedIssue(release.approvalDecisions.map((decision) => `${decision.decisionRef}@${decision.decisionVersion}`), context, ["approvalDecisions"], "approvalDecisions");
+    if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {
+        context.addIssue({ code: "custom", message: "effectiveAt cannot precede issuedAt", path: ["effectiveAt"] });
+    }
+    if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {
+        context.addIssue({ code: "custom", message: "expiresAt must follow effectiveAt", path: ["expiresAt"] });
+    }
+    if (release.replacesRelease &&
+        release.replacesRelease.document.documentRef === release.identity.document.documentRef &&
+        release.replacesRelease.releaseId === release.identity.releaseId &&
+        release.replacesRelease.releaseVersion === release.identity.releaseVersion) {
+        context.addIssue({ code: "custom", message: "a release cannot replace itself", path: ["replacesRelease"] });
+    }
+    if (release.replacesRelease && release.replacesRelease.document.documentRef !== release.identity.document.documentRef) {
+        context.addIssue({ code: "custom", message: "a release can replace only a prior release of the same governed document", path: ["replacesRelease"] });
+    }
+    if ((release.replacesRelease === undefined) !== (release.materialityDecision === undefined)) {
+        context.addIssue({
+            code: "custom",
+            message: "replacement release identity and exact materiality decision must be present together",
+            path: ["materialityDecision"],
+        });
+    }
+    if (release.replacesRelease &&
+        release.materialityDecision &&
+        governedDocumentReleaseIdentityKey(release.replacesRelease) !== governedDocumentReleaseIdentityKey(release.materialityDecision.previousRelease)) {
+        context.addIssue({
+            code: "custom",
+            message: "materiality decision must bind the exact release being replaced",
+            path: ["materialityDecision", "previousRelease"],
+        });
+    }
+    if (release.materialityDecision?.requiredInteractionKinds.some((interactionKind) => !release.allowedInteractionKinds.includes(interactionKind))) {
+        context.addIssue({
+            code: "custom",
+            message: "required renewed interactions must be authorized by the replacement release",
+            path: ["materialityDecision", "requiredInteractionKinds"],
+        });
+    }
+});
+/** Immutable historical/public issued release. Its content branch remains byte-exact v1. */
+export const GovernedDocumentReleaseSchema = GovernedDocumentReleaseCommonSchema.safeExtend({
+    schemaVersion: z.literal(1),
+});
+/** Locator kind is explicit so a channel cannot reinterpret an arbitrary string. */
+export var GovernedDocumentPublicationLocatorKind;
+(function (GovernedDocumentPublicationLocatorKind) {
+    GovernedDocumentPublicationLocatorKind["WEB_URL"] = "WEB_URL";
+    GovernedDocumentPublicationLocatorKind["RECORD_REF"] = "RECORD_REF";
+})(GovernedDocumentPublicationLocatorKind || (GovernedDocumentPublicationLocatorKind = {}));
+export const GovernedDocumentPublicationWebLocatorSchema = z.strictObject({
+    kind: z.literal(GovernedDocumentPublicationLocatorKind.WEB_URL),
+    url: z.url().refine((value) => new URL(value).protocol === "https:", "published web locations require HTTPS"),
+});
+export const GovernedDocumentPublicationRecordLocatorSchema = z.strictObject({
+    kind: z.literal(GovernedDocumentPublicationLocatorKind.RECORD_REF),
+    recordRef: GovernedDocumentRefSchema,
+});
+export const GovernedDocumentPublicationLocatorSchema = z.discriminatedUnion("kind", [
+    GovernedDocumentPublicationWebLocatorSchema,
+    GovernedDocumentPublicationRecordLocatorSchema,
+]);
+const GovernedDocumentPublicationEventCommonSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    eventRef: GovernedDocumentRefSchema,
+    release: GovernedDocumentReleaseIdentitySchema,
+    channel: z.enum(GovernedDocumentPublicationChannelKind),
+    occurredAt: GovernedDocumentIsoDateTimeSchema,
+    publicationLocator: GovernedDocumentPublicationLocatorSchema,
+});
+const addGovernedDocumentPublicationLocatorIssue = (event, context) => {
+    // Zod invokes refinements over its input shape, where a required nested
+    // object may still be absent before the base object reports that issue.
+    // Leave requiredness to the property schema and validate channel semantics
+    // only once a locator has successfully parsed.
+    if (!event.publicationLocator)
+        return;
+    const requiresWebUrl = event.channel === GovernedDocumentPublicationChannelKind.PUBLIC_WEB || event.channel === GovernedDocumentPublicationChannelKind.AUTHENTICATED_WEB;
+    if (requiresWebUrl !== (event.publicationLocator.kind === GovernedDocumentPublicationLocatorKind.WEB_URL)) {
+        context.addIssue({
+            code: "custom",
+            message: requiresWebUrl ? "web publication channels require an HTTPS locator" : "non-web publication channels require a durable record reference",
+            path: ["publicationLocator"],
+        });
+    }
+};
+export const GovernedDocumentPublishedEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({
+    eventKind: z.literal(GovernedDocumentPublicationEventKind.PUBLISHED),
+    /*
+     * It carried `servedContentDigest`, `exactByteProofDigest` and an optional `deploymentObservation`
+     * — the latter a signed record of bytes read back from a deployed bundle — until 2026-08-28. The
+     * event's own JSDoc called the observation the difference between "evidence of deployed bytes" and
+     * "a self-assertion over custody", which was a fair description of a machine that had never once
+     * run. A publication is now what it says it is: this release, on this channel, at this locator, at
+     * this time — recorded in a file, in a commit, which a reviewer can read.
+     */
+}).superRefine(addGovernedDocumentPublicationLocatorIssue);
+export const GovernedDocumentWithdrawnEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({
+    eventKind: z.literal(GovernedDocumentPublicationEventKind.WITHDRAWN),
+    withdrawalReason: z.string().trim().min(1),
+}).superRefine(addGovernedDocumentPublicationLocatorIssue);
+export const GovernedDocumentPublicationEventSchema = z.discriminatedUnion("eventKind", [
+    GovernedDocumentPublishedEventSchema,
+    GovernedDocumentWithdrawnEventSchema,
+]);
+/**
+ * Browser-safe immutable release projection.
+ *
+ * Governance scope, candidate digest, approval-decision identities and the
+ * internal content-artifact ref remain in the retained release/bundle custody
+ * boundary. Public consumers receive only the fields needed to route, display
+ * and independently verify the published bytes and effective interval.
+ */
+export const GovernedDocumentPublicReleaseProjectionSchema = z
+    .strictObject({
+    schemaVersion: z.literal(1),
+    identity: GovernedDocumentReleaseIdentitySchema,
+    definition: GovernedDocumentDefinitionIdentitySchema,
+    documentClass: z.enum(GovernedDocumentClass),
+    locale: z.string().trim().min(2),
+    jurisdictionRefs: z.array(GovernedDocumentRefSchema),
+    contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),
+    issuedAt: GovernedDocumentIsoDateTimeSchema,
+    effectiveAt: GovernedDocumentIsoDateTimeSchema,
+    expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),
+})
+    .superRefine((release, context) => {
+    addUniqueSortedIssue(release.jurisdictionRefs, context, ["jurisdictionRefs"], "jurisdictionRefs");
+    if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {
+        context.addIssue({ code: "custom", message: "effectiveAt cannot precede issuance", path: ["effectiveAt"] });
+    }
+    if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {
+        context.addIssue({ code: "custom", message: "expiresAt must follow effectiveAt", path: ["expiresAt"] });
+    }
+});
+/** Explicit allow-list projection from retained internal release to public release metadata. */
+export const projectGovernedDocumentPublicRelease = (releaseInput) => {
+    const release = GovernedDocumentReleaseSchema.parse(releaseInput);
+    return GovernedDocumentPublicReleaseProjectionSchema.parse({
+        schemaVersion: 1,
+        identity: release.identity,
+        definition: release.definition,
+        documentClass: release.documentClass,
+        locale: release.locale,
+        jurisdictionRefs: release.jurisdictionRefs,
+        contentMediaType: release.contentMediaType,
+        issuedAt: release.issuedAt,
+        effectiveAt: release.effectiveAt,
+        ...(release.expiresAt ? { expiresAt: release.expiresAt } : {}),
+    });
+};
+//# sourceMappingURL=governed-documents.shared.schemas.js.map

package/dist/esm/compliance/documents/governed-documents.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governed-documents.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/compliance/documents/governed-documents.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,2CAA2C,GAAG,+DAA+D,CAAC;AAE3H,MAAM,0BAA0B,GAAG,oEAAoE,CAAC;AACxG,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjH,MAAM,eAAe,GAAG,CAAC,MAAyB,EAAW,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC;AACvG,MAAM,wBAAwB,GAAG,CAAC,MAAyB,EAAW,EAAE,CACtE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtG,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAE,OAAwB,EAAE,IAAmB,EAAE,KAAa,EAAQ,EAAE;IAC7H,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAyB,CAAC;AAG5H,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1D,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAElH,qIAAqI;AACrI,MAAM,CAAN,IAAY,qBAUX;AAVD,WAAY,qBAAqB;IAC/B,wDAA+B,CAAA;IAC/B,gEAAuC,CAAA;IACvC,gEAAuC,CAAA;IACvC,sEAA6C,CAAA;IAC7C,sCAAa,CAAA;IACb,8CAAqB,CAAA;IACrB,gFAAuD,CAAA;IACvD,sEAA6C,CAAA;IAC7C,gEAAuC,CAAA;AACzC,CAAC,EAVW,qBAAqB,KAArB,qBAAqB,QAUhC;AAED,qIAAqI;AACrI,MAAM,CAAN,IAAY,qCAKX;AALD,WAAY,qCAAqC;IAC/C,0EAAiC,CAAA;IACjC,sFAA6C,CAAA;IAC7C,oFAA2C,CAAA;IAC3C,wFAA+C,CAAA;AACjD,CAAC,EALW,qCAAqC,KAArC,qCAAqC,QAKhD;AAED,MAAM,CAAN,IAAY,4BAQX;AARD,WAAY,4BAA4B;IACtC,iEAAiC,CAAA;IACjC,uEAAuC,CAAA;IACvC,qDAAqB,CAAA;IACrB,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,6EAA6C,CAAA;IAC7C,yEAAyC,CAAA;AAC3C,CAAC,EARW,4BAA4B,KAA5B,4BAA4B,QAQvC;AAED,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,gEAAyB,CAAA;IACzB,wEAAiC,CAAA;IACjC,4DAAqB,CAAA;AACvB,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,MAAM,CAAN,IAAY,oCAMX;AAND,WAAY,oCAAoC;IAC9C,uDAAe,CAAA;IACf,2DAAmB,CAAA;IACnB,mEAA2B,CAAA;IAC3B,uDAAe,CAAA;IACf,yEAAiC,CAAA;AACnC,CAAC,EANW,oCAAoC,KAApC,oCAAoC,QAM/C;AAED,MAAM,CAAN,IAAY,+BAKX;AALD,WAAY,+BAA+B;IACzC,kDAAe,CAAA;IACf,sDAAmB,CAAA;IACnB,wEAAqC,CAAA;IACrC,4DAAyB,CAAA;AAC3B,CAAC,EALW,+BAA+B,KAA/B,+BAA+B,QAK1C;AAED,MAAM,CAAN,IAAY,0BAQX;AARD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;IACnB,qDAAuB,CAAA;IACvB,iDAAmB,CAAA;IACnB,mDAAqB,CAAA;IACrB,6CAAe,CAAA;IACf,mDAAqB,CAAA;IACrB,+EAAiD,CAAA;AACnD,CAAC,EARW,0BAA0B,KAA1B,0BAA0B,QAQrC;AAED,MAAM,CAAN,IAAY,kCAKX;AALD,WAAY,kCAAkC;IAC5C,2DAAqB,CAAA;IACrB,2EAAqC,CAAA;IACrC,2DAAqB,CAAA;IACrB,2DAAqB,CAAA;AACvB,CAAC,EALW,kCAAkC,KAAlC,kCAAkC,QAK7C;AAED,MAAM,CAAN,IAAY,sCAMX;AAND,WAAY,sCAAsC;IAChD,mEAAyB,CAAA;IACzB,iFAAuC,CAAA;IACvC,+EAAqC,CAAA;IACrC,6EAAmC,CAAA;IACnC,yFAA+C,CAAA;AACjD,CAAC,EANW,sCAAsC,KAAtC,sCAAsC,QAMjD;AAED,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,+DAAuB,CAAA;IACvB,+DAAuB,CAAA;AACzB,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED,0HAA0H;AAC1H,MAAM,CAAN,IAAY,+BAMX;AAND,WAAY,+BAA+B;IACzC,wEAAqC,CAAA;IACrC,8EAA2C,CAAA;IAC3C,0EAAuC,CAAA;IACvC,kEAA+B,CAAA;IAC/B,0EAAuC,CAAA;AACzC,CAAC,EANW,+BAA+B,KAA/B,+BAA+B,QAM1C;AAED,MAAM,CAAN,IAAY,4BASX;AATD,WAAY,4BAA4B;IACtC,qEAAqC,CAAA;IACrC,qEAAqC,CAAA;IACrC,uDAAuB,CAAA;IACvB,iDAAiB,CAAA;IACjB,uFAAuD,CAAA;IACvD,6EAA6C,CAAA;IAC7C,qDAAqB,CAAA;IACrB,+FAA+D,CAAA;AACjE,CAAC,EATW,4BAA4B,KAA5B,4BAA4B,QASvC;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,YAAY,CAAC;IACrE,aAAa,EAAE,yBAAyB;IACxC,iBAAiB,EAAE,yCAAyC;CAC7D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3D,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,QAAQ,EAAE,8BAA8B;IACxC,SAAS,EAAE,yBAAyB;IACpC,cAAc,EAAE,yCAAyC;CAC1D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,QAAyC,EAAU,EAAE,CACtG,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;AAE3H,iIAAiI;AACjI,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;CAC3D,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAAC;KAC/D,YAAY,CAAC;IACZ,WAAW,EAAE,yBAAyB;IACtC,eAAe,EAAE,yCAAyC;IAC1D,eAAe,EAAE,qCAAqC;IACtD,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;CAC3E,CAAC;KACD,WAAW,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;IACjC,oBAAoB,CAAC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,EAAE,CAAC,0BAA0B,CAAC,EAAE,0BAA0B,CAAC,CAAC;AAC7H,CAAC,CAAC,CAAC;AAGL,8EAA8E;AAC9E,MAAM,CAAC,MAAM,+CAA+C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH,8IAA8I;AAC9I,MAAM,CAAC,MAAM,kDAAkD,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/E,YAAY,EAAE,yBAAyB;IACvC,gBAAgB,EAAE,yCAAyC;CAC5D,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,YAAY,CAAC;IACZ,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC;IAC1D,UAAU,EAAE,yBAAyB;IACrC,QAAQ,EAAE,yBAAyB;IACnC,YAAY,EAAE,yCAAyC;IACvD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACnD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;CACvD,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,oBAAoB,CAAC,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC7F,oBAAoB,CAAC,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACtG,IAAI,KAAK,CAAC,WAAW,KAAK,qCAAqC,CAAC,qBAAqB,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClJ,CAAC;QACD,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,4DAA4D,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+FAA+F;YACxG,IAAI,EAAE,CAAC,iBAAiB,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,SAAS,EAAE,yBAAyB;IACpC,aAAa,EAAE,yCAAyC;IACxD,KAAK,EAAE,yCAAyC;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,UAAU,EAAE,yBAAyB;IACrC,cAAc,EAAE,yCAAyC;IACzD,KAAK,EAAE,yCAAyC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACxC,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,uEAAuE;gBAChF,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9D,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mDAAmD,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wEAAwE;gBACjF,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,YAAY,CAAC;IACZ,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,eAAe,EAAE,qCAAqC;IACtD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD;;;;;;;OAOG;IACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACvD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,eAAe,EAAE,qCAAqC,CAAC,QAAQ,EAAE;IACjE,mBAAmB,EAAE,iDAAiD,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;IACzF,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,uBAAuB,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACvH,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,oBAAoB,CAClB,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC,EAClG,OAAO,EACP,CAAC,mBAAmB,CAAC,EACrB,mBAAmB,CACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW;QACtF,OAAO,CAAC,eAAe,CAAC,SAAS,KAAK,OAAO,CAAC,QAAQ,CAAC,SAAS;QAChE,OAAO,CAAC,eAAe,CAAC,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC1E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0EAA0E,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACvJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,CAAC,EAAE,CAAC;QAC5F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sFAAsF;YAC/F,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IACE,OAAO,CAAC,eAAe;QACvB,OAAO,CAAC,mBAAmB;QAC3B,kCAAkC,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,kCAAkC,CAAC,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAC/I,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,iEAAiE;YAC1E,IAAI,EAAE,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAChJ,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6EAA6E;YACtF,IAAI,EAAE,CAAC,qBAAqB,EAAE,0BAA0B,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,4FAA4F;AAC5F,MAAM,CAAC,MAAM,6BAA6B,GAAG,mCAAmC,CAAC,UAAU,CAAC;IAC1F,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,CAAN,IAAY,sCAGX;AAHD,WAAY,sCAAsC;IAChD,6DAAmB,CAAA;IACnB,mEAAyB,CAAA;AAC3B,CAAC,EAHW,sCAAsC,KAAtC,sCAAsC,QAGjD;AAED,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,OAAO,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,uCAAuC,CAAC;CAC9G,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,YAAY,CAAC;IAC3E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,UAAU,CAAC;IAClE,SAAS,EAAE,yBAAyB;CACrC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACnF,2CAA2C;IAC3C,8CAA8C;CAC/C,CAAC,CAAC;AAGH,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,yBAAyB;IACnC,OAAO,EAAE,qCAAqC;IAC9C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sCAAsC,CAAC;IACvD,UAAU,EAAE,iCAAiC;IAC7C,kBAAkB,EAAE,wCAAwC;CAC7D,CAAC,CAAC;AAEH,MAAM,0CAA0C,GAAG,CACjD,KAAqI,EACrI,OAAwB,EAClB,EAAE;IACR,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI,CAAC,KAAK,CAAC,kBAAkB;QAAE,OAAO;IACtC,MAAM,cAAc,GAClB,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC,CAAC,iBAAiB,CAAC;IACpJ,IAAI,cAAc,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,KAAK,sCAAsC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1G,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,iEAAiE;YACjJ,IAAI,EAAE,CAAC,oBAAoB,CAAC;SAC7B,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE;;;;;;;OAOG;CACJ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,oCAAoC,GAAG,4CAA4C,CAAC,MAAM,CAAC;IACtG,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,SAAS,CAAC;IACpE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3C,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,kBAAkB,CAAC,WAAW,EAAE;IACtF,oCAAoC;IACpC,oCAAoC;CACrC,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC;KAC3D,YAAY,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,QAAQ,EAAE,qCAAqC;IAC/C,UAAU,EAAE,wCAAwC;IACpD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACpD,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC;IACxE,QAAQ,EAAE,iCAAiC;IAC3C,WAAW,EAAE,iCAAiC;IAC9C,SAAS,EAAE,iCAAiC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,WAAW,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;IAChC,oBAAoB,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC,CAAC,CAAC;AAGL,gGAAgG;AAChG,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,YAAqC,EAA2C,EAAE;IACrI,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAClE,OAAO,6CAA6C,CAAC,KAAK,CAAC;QACzD,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * What a GOVERNED DOCUMENT is: its classes, audiences, review and publication vocabulary, its\n * identities, its governance scope, its public content, and the release and publication events that\n * record it being issued and withdrawn.\n *\n * ## What this file used to also be, and why that half is gone (2026-08-28)\n *\n * Until this revision the same file carried a complete SEALED DELIVERY MACHINE beside the\n * vocabulary: public-release and deployment BUNDLES with self-referential digests, deployment\n * OBSERVATIONS carrying canonical bytes plus a detached backend signature and a rotated-key\n * `notAfter` window, publication PROOF digests, interaction RECEIPTS, byte-exact retrieval queries,\n * and a dozen `canonicalize*DigestBasis` functions feeding them. Around it sat a backend registry\n * that revalidated every digest at boot, two controllers, a CLI artifact-sync writing immutable\n * receipts, and a generated module the application loaded at startup.\n *\n * All of it is removed under `.claude/rules/one-source-of-truth.md` Rule 0 — *nothing that is not\n * branchable on git*. A digest chain cannot merge: two branches that publish different content\n * produce a merged tree whose digests belong to neither. What the machine protected — that a\n * published document is exactly the bytes somebody approved — is what git and the forge already\n * provide, per commit, mergeably, to a reviewer reading a diff.\n *\n * Two facts made the removal cheap rather than risky, and both were measured rather than assumed:\n * **no application had ever produced a bundle** (`.wildo-saas/generated/compliance/` was empty in\n * both example applications), and every read path was built on the seal, so there was no\n * non-sealed serving to preserve.\n *\n * ## What replaces it\n *\n * Nothing yet, deliberately. A governed document is a FILE in the application's specifications\n * package; publishing one is a decision recorded by a commit. When an application actually has a\n * document to serve, the serving is rebuilt from those files — a read, not a custody protocol. The\n * vocabulary below is what survives, and it is the half every other layer actually consumes.\n */\n\n/** Exact media type of the canonical browser-safe governed-document JSON bytes. */\nexport const GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE = \"application/vnd.wildo.governed-document.public+json;version=1\";\n\nconst governedDocumentRefPattern = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)*(?::[A-Za-z0-9][A-Za-z0-9._-]*)+$/;\nconst compareCanonicalText = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\nconst valuesAreUnique = (values: readonly string[]): boolean => new Set(values).size === values.length;\nconst valuesAreLexicallySorted = (values: readonly string[]): boolean =>\n  values.every((value, index) => index === 0 || compareCanonicalText(values[index - 1]!, value) <= 0);\n\nconst addUniqueSortedIssue = (values: readonly string[], context: z.RefinementCtx, path: PropertyKey[], label: string): void => {\n  if (!valuesAreUnique(values) || !valuesAreLexicallySorted(values)) {\n    context.addIssue({ code: \"custom\", message: `${label} must be unique and lexically sorted`, path });\n  }\n};\n\nexport const GovernedDocumentRefSchema = z.string().trim().regex(governedDocumentRefPattern).brand<\"GovernedDocumentRef\">();\nexport type GovernedDocumentRef = z.infer<typeof GovernedDocumentRefSchema>;\n\nexport const GovernedDocumentIsoDateTimeSchema = z.iso.datetime({ offset: true });\nexport const GovernedDocumentIsoDateSchema = z.iso.date();\n/** One runtime source for every governed-document version/order identity. */\nexport const GovernedDocumentPositiveSafeIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/** Semantic class of governed content. The class controls review, release and interaction rules; a public label never changes it. */\nexport enum GovernedDocumentClass {\n  PUBLIC_NOTICE = \"PUBLIC_NOTICE\",\n  CONTRACTUAL_TERMS = \"CONTRACTUAL_TERMS\",\n  GOVERNANCE_POLICY = \"GOVERNANCE_POLICY\",\n  PROCEDURE_OR_RUNBOOK = \"PROCEDURE_OR_RUNBOOK\",\n  PLAN = \"PLAN\",\n  REGISTER = \"REGISTER\",\n  REVIEW_OR_DECISION_RECORD = \"REVIEW_OR_DECISION_RECORD\",\n  ASSESSMENT_OR_REPORT = \"ASSESSMENT_OR_REPORT\",\n  EVIDENCE_ARTIFACT = \"EVIDENCE_ARTIFACT\",\n}\n\n/** Whose facts and authority a document may speak for. Shared responsibility is explicit rather than a flattened synthetic owner. */\nexport enum GovernedDocumentGovernanceSubjectKind {\n  WILDO_PROVIDER = \"WILDO_PROVIDER\",\n  APPLICATION_OPERATOR = \"APPLICATION_OPERATOR\",\n  TENANT_ORGANIZATION = \"TENANT_ORGANIZATION\",\n  SHARED_RESPONSIBILITY = \"SHARED_RESPONSIBILITY\",\n}\n\nexport enum GovernedDocumentAudienceKind {\n  PUBLIC_GENERAL = \"PUBLIC_GENERAL\",\n  BUSINESS_CUSTOMER = \"BUSINESS_CUSTOMER\",\n  CONSUMER = \"CONSUMER\",\n  APPLICATION_USER = \"APPLICATION_USER\",\n  WORKFORCE = \"WORKFORCE\",\n  TENANT_ADMINISTRATOR = \"TENANT_ADMINISTRATOR\",\n  QUALIFIED_REVIEWER = \"QUALIFIED_REVIEWER\",\n}\n\nexport enum GovernedDocumentApplicabilityStatus {\n  APPLICABLE = \"APPLICABLE\",\n  NOT_APPLICABLE = \"NOT_APPLICABLE\",\n  DEFERRED = \"DEFERRED\",\n}\n\nexport enum GovernedDocumentFactResolutionStatus {\n  KNOWN = \"KNOWN\",\n  MISSING = \"MISSING\",\n  CONFLICTING = \"CONFLICTING\",\n  STALE = \"STALE\",\n  NOT_APPLICABLE = \"NOT_APPLICABLE\",\n}\n\nexport enum GovernedDocumentCandidateStatus {\n  DRAFT = \"DRAFT\",\n  BLOCKED = \"BLOCKED\",\n  READY_FOR_REVIEW = \"READY_FOR_REVIEW\",\n  SUPERSEDED = \"SUPERSEDED\",\n}\n\nexport enum GovernedDocumentReviewKind {\n  CONTENT = \"CONTENT\",\n  TECHNICAL = \"TECHNICAL\",\n  PRIVACY = \"PRIVACY\",\n  SECURITY = \"SECURITY\",\n  LEGAL = \"LEGAL\",\n  BUSINESS = \"BUSINESS\",\n  INDEPENDENT_ASSESSMENT = \"INDEPENDENT_ASSESSMENT\",\n}\n\nexport enum GovernedDocumentReviewDecisionKind {\n  APPROVED = \"APPROVED\",\n  CHANGES_REQUIRED = \"CHANGES_REQUIRED\",\n  REJECTED = \"REJECTED\",\n  CONFLICT = \"CONFLICT\",\n}\n\nexport enum GovernedDocumentPublicationChannelKind {\n  PUBLIC_WEB = \"PUBLIC_WEB\",\n  AUTHENTICATED_WEB = \"AUTHENTICATED_WEB\",\n  DURABLE_DOWNLOAD = \"DURABLE_DOWNLOAD\",\n  DIRECT_DELIVERY = \"DIRECT_DELIVERY\",\n  GOVERNANCE_REPOSITORY = \"GOVERNANCE_REPOSITORY\",\n}\n\nexport enum GovernedDocumentPublicationEventKind {\n  PUBLISHED = \"PUBLISHED\",\n  WITHDRAWN = \"WITHDRAWN\",\n}\n\n/** Distinct legal/user interactions. A notice interaction, contract acceptance and consent decision are never aliases. */\nexport enum GovernedDocumentInteractionKind {\n  NOTICE_DELIVERED = \"NOTICE_DELIVERED\",\n  NOTICE_ACKNOWLEDGED = \"NOTICE_ACKNOWLEDGED\",\n  CONTRACT_ACCEPTED = \"CONTRACT_ACCEPTED\",\n  CONSENT_GIVEN = \"CONSENT_GIVEN\",\n  CONSENT_WITHDRAWN = \"CONSENT_WITHDRAWN\",\n}\n\nexport enum GovernedDocumentChangeAction {\n  NO_PUBLIC_ACTION = \"NO_PUBLIC_ACTION\",\n  REVISE_CANDIDATE = \"REVISE_CANDIDATE\",\n  REPUBLISH = \"REPUBLISH\",\n  NOTIFY = \"NOTIFY\",\n  REQUEST_REACKNOWLEDGEMENT = \"REQUEST_REACKNOWLEDGEMENT\",\n  REQUEST_REACCEPTANCE = \"REQUEST_REACCEPTANCE\",\n  WITHDRAW = \"WITHDRAW\",\n  ESCALATE_FOR_QUALIFIED_REVIEW = \"ESCALATE_FOR_QUALIFIED_REVIEW\",\n}\n\nexport const GovernedDocumentDefinitionIdentitySchema = z.strictObject({\n  definitionRef: GovernedDocumentRefSchema,\n  definitionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentDefinitionIdentity = z.infer<typeof GovernedDocumentDefinitionIdentitySchema>;\n\nexport const GovernedDocumentIdentitySchema = z.strictObject({\n  documentRef: GovernedDocumentRefSchema,\n  documentVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentIdentity = z.infer<typeof GovernedDocumentIdentitySchema>;\n\nexport const GovernedDocumentReleaseIdentitySchema = z.strictObject({\n  document: GovernedDocumentIdentitySchema,\n  releaseId: GovernedDocumentRefSchema,\n  releaseVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReleaseIdentity = z.infer<typeof GovernedDocumentReleaseIdentitySchema>;\n\nexport const governedDocumentReleaseIdentityKey = (identity: GovernedDocumentReleaseIdentity): string =>\n  `${identity.document.documentRef}@${identity.document.documentVersion}:${identity.releaseId}@${identity.releaseVersion}`;\n\n/** Exact immutable approval-decision identity retained by an issued release without exposing private review content publicly. */\nexport const GovernedDocumentApprovalDecisionIdentitySchema = z.strictObject({\n  decisionRef: GovernedDocumentRefSchema,\n  decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentApprovalDecisionIdentity = z.infer<typeof GovernedDocumentApprovalDecisionIdentitySchema>;\n\n/**\n * Exact private materiality-decision identity retained when one release\n * replaces another. The full decision and authority evidence remain in\n * application-creation custody; this identity makes the replacement and any\n * required renewed interaction causally auditable without exposing the\n * decision publicly.\n */\nexport const GovernedDocumentMaterialityDecisionIdentitySchema = z\n  .strictObject({\n    decisionRef: GovernedDocumentRefSchema,\n    decisionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n    previousRelease: GovernedDocumentReleaseIdentitySchema,\n    requiredInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n  })\n  .superRefine((decision, context) => {\n    addUniqueSortedIssue(decision.requiredInteractionKinds, context, [\"requiredInteractionKinds\"], \"requiredInteractionKinds\");\n  });\nexport type GovernedDocumentMaterialityDecisionIdentity = z.infer<typeof GovernedDocumentMaterialityDecisionIdentitySchema>;\n\n/** Exact immutable reviewer-authority grant selected by a review decision. */\nexport const GovernedDocumentReviewerAuthorityIdentitySchema = z.strictObject({\n  authorityRef: GovernedDocumentRefSchema,\n  authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentReviewerAuthorityIdentity = z.infer<typeof GovernedDocumentReviewerAuthorityIdentitySchema>;\n\n/** Exact immutable authority identity selected for a document materiality decision; never interchangeable with candidate-review authority. */\nexport const GovernedDocumentMaterialityAuthorityIdentitySchema = z.strictObject({\n  authorityRef: GovernedDocumentRefSchema,\n  authorityVersion: GovernedDocumentPositiveSafeIntegerSchema,\n});\nexport type GovernedDocumentMaterialityAuthorityIdentity = z.infer<typeof GovernedDocumentMaterialityAuthorityIdentitySchema>;\n\n/**\n * Exact ownership boundary for one governed document.\n *\n * Shared-responsibility output must retain at least two attributed parties and an explicit precedence rule. A single-subject output must not carry those shared-only\n * fields, preventing provider, operator and tenant statements from being silently flattened into one voice.\n */\nexport const GovernedDocumentGovernanceScopeSchema = z\n  .strictObject({\n    subjectKind: z.enum(GovernedDocumentGovernanceSubjectKind),\n    subjectRef: GovernedDocumentRefSchema,\n    scopeRef: GovernedDocumentRefSchema,\n    scopeVersion: GovernedDocumentPositiveSafeIntegerSchema,\n    participantRefs: z.array(GovernedDocumentRefSchema),\n    precedenceRuleRefs: z.array(GovernedDocumentRefSchema),\n  })\n  .superRefine((scope, context) => {\n    addUniqueSortedIssue(scope.participantRefs, context, [\"participantRefs\"], \"participantRefs\");\n    addUniqueSortedIssue(scope.precedenceRuleRefs, context, [\"precedenceRuleRefs\"], \"precedenceRuleRefs\");\n    if (scope.subjectKind === GovernedDocumentGovernanceSubjectKind.SHARED_RESPONSIBILITY) {\n      if (scope.participantRefs.length < 2) {\n        context.addIssue({ code: \"custom\", message: \"shared responsibility requires at least two attributed participants\", path: [\"participantRefs\"] });\n      }\n      if (scope.precedenceRuleRefs.length === 0) {\n        context.addIssue({ code: \"custom\", message: \"shared responsibility requires an explicit precedence rule\", path: [\"precedenceRuleRefs\"] });\n      }\n    } else if (scope.participantRefs.length > 0 || scope.precedenceRuleRefs.length > 0) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"single-subject governance cannot carry shared-responsibility participants or precedence rules\",\n        path: [\"participantRefs\"],\n      });\n    }\n  });\nexport type GovernedDocumentGovernanceScope = z.infer<typeof GovernedDocumentGovernanceScopeSchema>;\n\n/**\n * Browser-safe public projection of approved semantic document content.\n *\n * Internal fact, authority, source-policy and review evidence stays in the\n * candidate/release records. Public routes render this exact projection as\n * text; `bodyMarkdown` is never trusted as raw HTML.\n */\nexport const GovernedDocumentPublicClauseSchema = z.strictObject({\n  clauseRef: GovernedDocumentRefSchema,\n  clauseVersion: GovernedDocumentPositiveSafeIntegerSchema,\n  order: GovernedDocumentPositiveSafeIntegerSchema,\n  bodyMarkdown: z.string().trim().min(1),\n});\nexport type GovernedDocumentPublicClause = z.infer<typeof GovernedDocumentPublicClauseSchema>;\n\nexport const GovernedDocumentPublicSectionSchema = z\n  .strictObject({\n    sectionRef: GovernedDocumentRefSchema,\n    sectionVersion: GovernedDocumentPositiveSafeIntegerSchema,\n    order: GovernedDocumentPositiveSafeIntegerSchema,\n    title: z.string().trim().min(1),\n    clauses: z.array(GovernedDocumentPublicClauseSchema).min(1),\n  })\n  .superRefine((section, context) => {\n    if (!valuesAreUnique(section.clauses.map((clause) => clause.clauseRef))) {\n      context.addIssue({ code: \"custom\", message: \"public document clause references must be unique\", path: [\"clauses\"] });\n    }\n    section.clauses.forEach((clause, index) => {\n      if (clause.order !== index + 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"public document clause order must be contiguous and match array order\",\n          path: [\"clauses\", index, \"order\"],\n        });\n      }\n    });\n  });\nexport type GovernedDocumentPublicSection = z.infer<typeof GovernedDocumentPublicSectionSchema>;\n\nexport const GovernedDocumentPublicContentSchema = z\n  .strictObject({\n    schemaVersion: z.literal(1),\n    title: z.string().trim().min(1),\n    locale: z.string().trim().min(2),\n    jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n    sections: z.array(GovernedDocumentPublicSectionSchema).min(1),\n  })\n  .superRefine((content, context) => {\n    addUniqueSortedIssue(content.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n    if (!valuesAreUnique(content.sections.map((section) => section.sectionRef))) {\n      context.addIssue({ code: \"custom\", message: \"public document section references must be unique\", path: [\"sections\"] });\n    }\n    content.sections.forEach((section, index) => {\n      if (section.order !== index + 1) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"public document section order must be contiguous and match array order\",\n          path: [\"sections\", index, \"order\"],\n        });\n      }\n    });\n  });\nexport type GovernedDocumentPublicContent = z.infer<typeof GovernedDocumentPublicContentSchema>;\n\n/**\n * Content-branch-neutral immutable release metadata.\n *\n * Historical public releases and current internal structured releases add\n * their own explicit schema/content discriminators to this shared invariant\n * basis. Consumers must select one complete branch rather than accepting this\n * common shape directly.\n */\nexport const GovernedDocumentReleaseCommonSchema = z\n  .strictObject({\n    identity: GovernedDocumentReleaseIdentitySchema,\n    definition: GovernedDocumentDefinitionIdentitySchema,\n    governanceScope: GovernedDocumentGovernanceScopeSchema,\n    documentClass: z.enum(GovernedDocumentClass),\n    audienceKinds: z.array(z.enum(GovernedDocumentAudienceKind)).min(1),\n    publicationChannelKinds: z.array(z.enum(GovernedDocumentPublicationChannelKind)).min(1),\n    allowedInteractionKinds: z.array(z.enum(GovernedDocumentInteractionKind)),\n    locale: z.string().trim().min(2),\n    jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n    /*\n     * The release names its content's MEDIA TYPE and nothing more.\n     *\n     * It carried `candidateDigest`, `contentDigest` and `contentArtifactRef` until 2026-08-28 — a\n     * seal binding the release to exact bytes in a content-addressed store. The store and the\n     * verifier are gone with the rest of the digest machinery; the binding a reader needs is the\n     * commit that introduced both the release and its content file.\n     */\n    contentMediaType: z.string().trim().min(1),\n    issuedAt: GovernedDocumentIsoDateTimeSchema,\n    effectiveAt: GovernedDocumentIsoDateTimeSchema,\n    expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n    approvalDecisions: z.array(GovernedDocumentApprovalDecisionIdentitySchema).min(1),\n    replacesRelease: GovernedDocumentReleaseIdentitySchema.optional(),\n    materialityDecision: GovernedDocumentMaterialityDecisionIdentitySchema.optional(),\n  })\n  .superRefine((release, context) => {\n    addUniqueSortedIssue(release.audienceKinds, context, [\"audienceKinds\"], \"audienceKinds\");\n    addUniqueSortedIssue(release.publicationChannelKinds, context, [\"publicationChannelKinds\"], \"publicationChannelKinds\");\n    addUniqueSortedIssue(release.allowedInteractionKinds, context, [\"allowedInteractionKinds\"], \"allowedInteractionKinds\");\n    addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n    addUniqueSortedIssue(\n      release.approvalDecisions.map((decision) => `${decision.decisionRef}@${decision.decisionVersion}`),\n      context,\n      [\"approvalDecisions\"],\n      \"approvalDecisions\",\n    );\n    if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n      context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuedAt\", path: [\"effectiveAt\"] });\n    }\n    if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n      context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n    }\n    if (\n      release.replacesRelease &&\n      release.replacesRelease.document.documentRef === release.identity.document.documentRef &&\n      release.replacesRelease.releaseId === release.identity.releaseId &&\n      release.replacesRelease.releaseVersion === release.identity.releaseVersion\n    ) {\n      context.addIssue({ code: \"custom\", message: \"a release cannot replace itself\", path: [\"replacesRelease\"] });\n    }\n    if (release.replacesRelease && release.replacesRelease.document.documentRef !== release.identity.document.documentRef) {\n      context.addIssue({ code: \"custom\", message: \"a release can replace only a prior release of the same governed document\", path: [\"replacesRelease\"] });\n    }\n    if ((release.replacesRelease === undefined) !== (release.materialityDecision === undefined)) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"replacement release identity and exact materiality decision must be present together\",\n        path: [\"materialityDecision\"],\n      });\n    }\n    if (\n      release.replacesRelease &&\n      release.materialityDecision &&\n      governedDocumentReleaseIdentityKey(release.replacesRelease) !== governedDocumentReleaseIdentityKey(release.materialityDecision.previousRelease)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"materiality decision must bind the exact release being replaced\",\n        path: [\"materialityDecision\", \"previousRelease\"],\n      });\n    }\n    if (release.materialityDecision?.requiredInteractionKinds.some((interactionKind) => !release.allowedInteractionKinds.includes(interactionKind))) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"required renewed interactions must be authorized by the replacement release\",\n        path: [\"materialityDecision\", \"requiredInteractionKinds\"],\n      });\n    }\n  });\n\n/** Immutable historical/public issued release. Its content branch remains byte-exact v1. */\nexport const GovernedDocumentReleaseSchema = GovernedDocumentReleaseCommonSchema.safeExtend({\n  schemaVersion: z.literal(1),\n});\nexport type GovernedDocumentRelease = z.infer<typeof GovernedDocumentReleaseSchema>;\n\n/** Locator kind is explicit so a channel cannot reinterpret an arbitrary string. */\nexport enum GovernedDocumentPublicationLocatorKind {\n  WEB_URL = \"WEB_URL\",\n  RECORD_REF = \"RECORD_REF\",\n}\n\nexport const GovernedDocumentPublicationWebLocatorSchema = z.strictObject({\n  kind: z.literal(GovernedDocumentPublicationLocatorKind.WEB_URL),\n  url: z.url().refine((value) => new URL(value).protocol === \"https:\", \"published web locations require HTTPS\"),\n});\nexport const GovernedDocumentPublicationRecordLocatorSchema = z.strictObject({\n  kind: z.literal(GovernedDocumentPublicationLocatorKind.RECORD_REF),\n  recordRef: GovernedDocumentRefSchema,\n});\nexport const GovernedDocumentPublicationLocatorSchema = z.discriminatedUnion(\"kind\", [\n  GovernedDocumentPublicationWebLocatorSchema,\n  GovernedDocumentPublicationRecordLocatorSchema,\n]);\nexport type GovernedDocumentPublicationLocator = z.infer<typeof GovernedDocumentPublicationLocatorSchema>;\n\nconst GovernedDocumentPublicationEventCommonSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  eventRef: GovernedDocumentRefSchema,\n  release: GovernedDocumentReleaseIdentitySchema,\n  channel: z.enum(GovernedDocumentPublicationChannelKind),\n  occurredAt: GovernedDocumentIsoDateTimeSchema,\n  publicationLocator: GovernedDocumentPublicationLocatorSchema,\n});\n\nconst addGovernedDocumentPublicationLocatorIssue = (\n  event: { readonly channel: GovernedDocumentPublicationChannelKind; readonly publicationLocator?: GovernedDocumentPublicationLocator },\n  context: z.RefinementCtx,\n): void => {\n  // Zod invokes refinements over its input shape, where a required nested\n  // object may still be absent before the base object reports that issue.\n  // Leave requiredness to the property schema and validate channel semantics\n  // only once a locator has successfully parsed.\n  if (!event.publicationLocator) return;\n  const requiresWebUrl =\n    event.channel === GovernedDocumentPublicationChannelKind.PUBLIC_WEB || event.channel === GovernedDocumentPublicationChannelKind.AUTHENTICATED_WEB;\n  if (requiresWebUrl !== (event.publicationLocator.kind === GovernedDocumentPublicationLocatorKind.WEB_URL)) {\n    context.addIssue({\n      code: \"custom\",\n      message: requiresWebUrl ? \"web publication channels require an HTTPS locator\" : \"non-web publication channels require a durable record reference\",\n      path: [\"publicationLocator\"],\n    });\n  }\n};\n\nexport const GovernedDocumentPublishedEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n  eventKind: z.literal(GovernedDocumentPublicationEventKind.PUBLISHED),\n  /*\n   * It carried `servedContentDigest`, `exactByteProofDigest` and an optional `deploymentObservation`\n   * — the latter a signed record of bytes read back from a deployed bundle — until 2026-08-28. The\n   * event's own JSDoc called the observation the difference between \"evidence of deployed bytes\" and\n   * \"a self-assertion over custody\", which was a fair description of a machine that had never once\n   * run. A publication is now what it says it is: this release, on this channel, at this locator, at\n   * this time — recorded in a file, in a commit, which a reviewer can read.\n   */\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentPublishedEvent = z.infer<typeof GovernedDocumentPublishedEventSchema>;\n\nexport const GovernedDocumentWithdrawnEventSchema = GovernedDocumentPublicationEventCommonSchema.extend({\n  eventKind: z.literal(GovernedDocumentPublicationEventKind.WITHDRAWN),\n  withdrawalReason: z.string().trim().min(1),\n}).superRefine(addGovernedDocumentPublicationLocatorIssue);\nexport type GovernedDocumentWithdrawnEvent = z.infer<typeof GovernedDocumentWithdrawnEventSchema>;\n\nexport const GovernedDocumentPublicationEventSchema = z.discriminatedUnion(\"eventKind\", [\n  GovernedDocumentPublishedEventSchema,\n  GovernedDocumentWithdrawnEventSchema,\n]);\nexport type GovernedDocumentPublicationEvent = z.infer<typeof GovernedDocumentPublicationEventSchema>;\n\n/**\n * Browser-safe immutable release projection.\n *\n * Governance scope, candidate digest, approval-decision identities and the\n * internal content-artifact ref remain in the retained release/bundle custody\n * boundary. Public consumers receive only the fields needed to route, display\n * and independently verify the published bytes and effective interval.\n */\nexport const GovernedDocumentPublicReleaseProjectionSchema = z\n  .strictObject({\n    schemaVersion: z.literal(1),\n    identity: GovernedDocumentReleaseIdentitySchema,\n    definition: GovernedDocumentDefinitionIdentitySchema,\n    documentClass: z.enum(GovernedDocumentClass),\n    locale: z.string().trim().min(2),\n    jurisdictionRefs: z.array(GovernedDocumentRefSchema),\n    contentMediaType: z.literal(GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE),\n    issuedAt: GovernedDocumentIsoDateTimeSchema,\n    effectiveAt: GovernedDocumentIsoDateTimeSchema,\n    expiresAt: GovernedDocumentIsoDateTimeSchema.optional(),\n  })\n  .superRefine((release, context) => {\n    addUniqueSortedIssue(release.jurisdictionRefs, context, [\"jurisdictionRefs\"], \"jurisdictionRefs\");\n    if (Date.parse(release.effectiveAt) < Date.parse(release.issuedAt)) {\n      context.addIssue({ code: \"custom\", message: \"effectiveAt cannot precede issuance\", path: [\"effectiveAt\"] });\n    }\n    if (release.expiresAt && Date.parse(release.expiresAt) <= Date.parse(release.effectiveAt)) {\n      context.addIssue({ code: \"custom\", message: \"expiresAt must follow effectiveAt\", path: [\"expiresAt\"] });\n    }\n  });\nexport type GovernedDocumentPublicReleaseProjection = z.infer<typeof GovernedDocumentPublicReleaseProjectionSchema>;\n\n/** Explicit allow-list projection from retained internal release to public release metadata. */\nexport const projectGovernedDocumentPublicRelease = (releaseInput: GovernedDocumentRelease): GovernedDocumentPublicReleaseProjection => {\n  const release = GovernedDocumentReleaseSchema.parse(releaseInput);\n  return GovernedDocumentPublicReleaseProjectionSchema.parse({\n    schemaVersion: 1,\n    identity: release.identity,\n    definition: release.definition,\n    documentClass: release.documentClass,\n    locale: release.locale,\n    jurisdictionRefs: release.jurisdictionRefs,\n    contentMediaType: release.contentMediaType,\n    issuedAt: release.issuedAt,\n    effectiveAt: release.effectiveAt,\n    ...(release.expiresAt ? { expiresAt: release.expiresAt } : {}),\n  });\n};\n\n"]}