@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/compliance/documents/governed-documents.shared.schemas.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import "@wildo-ai/zod-decorators";
 /**
  * What a GOVERNED DOCUMENT is: its classes, audiences, review and publication vocabulary, its
  * identities, its governance scope, its public content, and the release and publication events that
@@ -27,10 +28,12 @@ import { z } from "zod";
  *
  * ## What replaces it
  *
- * Nothing yet, deliberately. A governed document is a FILE in the application's specifications
- * package; publishing one is a decision recorded by a commit. When an application actually has a
- * document to serve, the serving is rebuilt from those files — a read, not a custody protocol. The
- * vocabulary below is what survives, and it is the half every other layer actually consumes.
+ * A read over committed files, not a custody protocol. A governed document is a FILE in the
+ * application's specifications package, and a release is a record the application commits — since
+ * 2026-09-12 carrying the text it publishes (`GovernedDocumentReleaseSchema.content`, #968), so the
+ * commit that introduced the record is what binds a release to its words. What a public page serves
+ * is `GovernedDocumentPublicDocument`: a release with its text, or the latest draft of a document
+ * never released, chosen by `resolveInForcePublicDocument`. No digest, no bundle, no receipt.
  */
 /** Exact media type of the canonical browser-safe governed-document JSON bytes. */
 export declare const GOVERNED_DOCUMENT_PUBLIC_CONTENT_MEDIA_TYPE = "application/vnd.wildo.governed-document.public+json;version=1";
@@ -120,6 +123,108 @@ export declare enum GovernedDocumentInteractionKind {
     CONSENT_GIVEN = "CONSENT_GIVEN",
     CONSENT_WITHDRAWN = "CONSENT_WITHDRAWN"
 }
+/** @wildo_source:part:start saas.models.governed-document-acceptance-mode facet:layer:shared facet:audience:app-developer */
+/**
+ * HOW an application asks a registrant to accept the documents it requires accepting — the three
+ * shapes courts actually distinguish, declared once per application (#1258).
+ *
+ * Declared on `compliance.governedDocumentAcceptanceMode` in the application's own
+ * `backend-api/src/saas-config.backend.ts`, beside `governedDocumentReleases` and `publicDocuments`.
+ *
+ * It is a RENDERING posture, not a server-side gate. The backend records whichever accepted release
+ * ids a registration carries and does not know which mode produced them, so a client that does not
+ * use the form is bound by none of the three. That is the honest scope: what the mode decides is how
+ * strong a notice a person is given and what the form withholds until they act — the things a
+ * registration screen can actually control.
+ *
+ * ## Why this is a declared CHOICE rather than one shipped behaviour
+ *
+ * Registration shipped with exactly one shape — an unticked box gating the submit button — and no
+ * way to ask for another. That is the strongest of the three and it is the right DEFAULT, but it is
+ * not the right answer for every application: a product whose terms are a one-paragraph acceptable-use
+ * statement and a product whose terms carry an arbitration clause are not asking the same thing of the
+ * same person, and the framework should let each say which it is asking.
+ *
+ * ## The enforceability ladder, which is what the members are ordered by
+ *
+ * Enforceability turns on whether the person had REASONABLE NOTICE of the terms and took an action
+ * MANIFESTING ASSENT to them. Clickwrap — an affirmative act aimed at the terms themselves — is the
+ * shape courts uphold most consistently; sign-in-wrap, where the act is the registration and the
+ * notice sits beside it, is upheld when the notice is conspicuous and fails when it is buried;
+ * browsewrap, where nothing but a footer link exists, is the shape that routinely fails. This
+ * vocabulary offers the first two and does NOT offer the third, because an application that asks for
+ * nothing is already representable by declaring no release that permits `CONTRACT_ACCEPTED`.
+ *
+ * (Drawn from the settled shape of US and EU practice on online contract formation, not from a single
+ * cited authority. Not legal advice — an operator's counsel decides which their terms warrant.)
+ *
+ * ## Every member DOES something, deliberately
+ *
+ * Each one changes what the registration form renders and what it refuses. A member that only named a
+ * posture without changing behaviour is the defect removed from this lane one commit earlier, when a
+ * stored privacy-level field was deleted for meaning nothing at any call site.
+ */
+export declare enum GovernedDocumentAcceptanceMode {
+    /**
+     * SIGN-IN-WRAP — "by registering you agree to our terms and privacy policy", beside the button.
+     *
+     * No checkbox and no separate act: submitting the registration IS the act of assent, so the
+     * accepted release ids still travel with it and the interaction is still recorded. What changes is
+     * that nothing is withheld — the button is available from the first keystroke.
+     *
+     * The notice is rendered immediately above the submit control rather than in a footer, because
+     * conspicuousness is the whole of what distinguishes this from the browsewrap shape that fails.
+     */
+    IMPLIED_BY_REGISTERING = "IMPLIED_BY_REGISTERING",
+    /**
+     * CLICKWRAP — an unticked box the person ticks, with the submit control unavailable until they do.
+     *
+     * The DEFAULT, and the framework default may not silently weaken: an application that declared
+     * nothing shipped this behaviour before the vocabulary existed, and must keep shipping it.
+     *
+     * The box is never pre-ticked. A pre-ticked box is not an affirmative act, so it undermines the one
+     * property this mode exists to provide — the same reason the consent gate's own optional purposes
+     * start unticked.
+     */
+    EXPLICIT_CHECKBOX = "EXPLICIT_CHECKBOX",
+    /**
+     * CLICKWRAP WITH A READING GATE — the document is shown, and the box cannot be ticked until the
+     * reader has scrolled to the end of it.
+     *
+     * The strongest available notice: the terms are not merely linked, they are placed in front of the
+     * person and the affirmative act is unavailable until they have passed over all of them.
+     *
+     * Two things it deliberately does NOT claim. It does not claim the person READ the document — no
+     * mechanism can — only that the text was presented in full and the act came after. And it does not
+     * replace the public document page: the pane shows the same content that page serves, and links to
+     * it, because the page is where the document is rendered with its own typography.
+     */
+    EXPLICIT_AFTER_READING = "EXPLICIT_AFTER_READING"
+}
+/**
+ * Does this mode require a SEPARATE affirmative act before the registration may be submitted?
+ *
+ * Two readers, one answer: the form disables its submit control on it, and the same form decides on
+ * it whether the accepted release ids travel with the request. Those had to agree — a submit the
+ * person could press without the ids being sent records nothing while reporting success — so the
+ * predicate is named once here rather than spelled twice at the two call sites.
+ *
+ * Written as "anything but implied" deliberately: a fourth mode added tomorrow is treated as needing
+ * the act until somebody says otherwise, which is the direction that fails safe. The inverse spelling
+ * ({@link GovernedDocumentAcceptanceMode.EXPLICIT_CHECKBOX} or `EXPLICIT_AFTER_READING`) would let a
+ * new member fall through to "registering is enough" silently.
+ */
+export declare const governedDocumentAcceptanceRequiresExplicitAct: (mode: GovernedDocumentAcceptanceMode) => boolean;
+/**
+ * Must the document be placed in front of the reader, and the affirmative act withheld until they
+ * have passed over all of it?
+ *
+ * Named rather than compared inline for the same reason as its sibling, and spelled the other way
+ * round for the same fail-safe reason read in the other direction: a new mode does NOT acquire a
+ * reading gate nobody asked for.
+ */
+export declare const governedDocumentAcceptanceRequiresReading: (mode: GovernedDocumentAcceptanceMode) => boolean;
+/** @wildo_source:part:end saas.models.governed-document-acceptance-mode */
 export declare enum GovernedDocumentChangeAction {
     NO_PUBLIC_ACTION = "NO_PUBLIC_ACTION",
     REVISE_CANDIDATE = "REVISE_CANDIDATE",
@@ -156,6 +261,33 @@ export declare const GovernedDocumentApprovalDecisionIdentitySchema: z.ZodObject
     decisionVersion: z.ZodNumber;
 }, z.core.$strict>;
 export type GovernedDocumentApprovalDecisionIdentity = z.infer<typeof GovernedDocumentApprovalDecisionIdentitySchema>;
+/**
+ * Whether a release has been APPROVED yet — and it is a MARK, never a gate on producing one.
+ *
+ * Wildo is agent-first: the mechanism composes the artifact and says what is true about it. Approval
+ * is a workflow act that happens at the END, so requiring it in order to compose a release would put
+ * a compliance workflow in front of the application-creation mechanism — which is the one thing that
+ * must never block. `approvalDecisions` was `.min(1)` until 2026-09-11, and that single constraint
+ * meant an unapproved release could not be REPRESENTED at all: an application either forged an
+ * approval identity or had no release, and the honest third answer did not exist.
+ *
+ * What replaces the refusal is this field. A release always exists and always states its own
+ * standing, so nothing downstream has to infer it and nothing can mistake a draft for a published
+ * document. Arming the gate that actually withholds an UNAPPROVED release from a real reader belongs
+ * to Gate 3 ("an application may face a real user"), per `one-source-of-truth.md` D5: critical gate
+ * points stay MARKED in every mechanism so they can be switched on when the posture changes.
+ */
+export declare enum GovernedDocumentReleaseApprovalState {
+    /** At least one approval decision is retained. The release may be served as a published document. */
+    APPROVED = "APPROVED",
+    /**
+     * Composed, coherent, and NOT approved.
+     *
+     * A true record of a real draft — not a defect and not a placeholder. It is what an application
+     * holds between drafting and approval, which for most of its life is where it is.
+     */
+    UNAPPROVED = "UNAPPROVED"
+}
 /**
  * Exact private materiality-decision identity retained when one release
  * replaces another. The full decision and authority evidence remain in
@@ -196,7 +328,7 @@ export type GovernedDocumentMaterialityAuthorityIdentity = z.infer<typeof Govern
  * fields, preventing provider, operator and tenant statements from being silently flattened into one voice.
  */
 export declare const GovernedDocumentGovernanceScopeSchema: z.ZodObject<{
-    subjectKind: z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>;
+    subjectKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>>;
     subjectRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
     scopeRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
     scopeVersion: z.ZodNumber;
@@ -205,29 +337,65 @@ export declare const GovernedDocumentGovernanceScopeSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type GovernedDocumentGovernanceScope = z.infer<typeof GovernedDocumentGovernanceScopeSchema>;
 /**
- * Browser-safe public projection of approved semantic document content.
+ * Whether a published clause states something the application has ESTABLISHED — the one fact about a
+ * draft's completeness a READER is owed.
+ *
+ * It is the public projection of the candidate's `ComplianceStatementCompleteness`
+ * (`@wildo-ai/saas-specifications`): `DERIVED` becomes `ESTABLISHED`, and each of the three `NEEDS_*`
+ * members becomes `NOT_YET_ESTABLISHED`. Coarser ON PURPOSE, the way the public release projection
+ * withholds `governanceScope`: which party closes a gap (a framework change, an operator decision, an
+ * application configuration) and how (`closedBy` — issue refs, owners) is the publisher's custody.
+ * What a person reading the document is owed is that this statement is not yet established, and what
+ * is missing.
+ *
+ * Decided 2026-09-12 (wildo-ai/wildo-ai#968): an unestablished clause is MARKED on the page. Omitting it
+ * would narrow the document (#454 rejects that), and refusing the whole document would put a workflow
+ * fact in front of the page. Projecting it as plain text would state as settled what the drafter wrote
+ * down as unsettled.
+ */
+export declare enum GovernedDocumentPublicClauseStanding {
+    ESTABLISHED = "ESTABLISHED",
+    NOT_YET_ESTABLISHED = "NOT_YET_ESTABLISHED"
+}
+/**
+ * Browser-safe public projection of governed document content.
  *
  * Internal fact, authority, source-policy and review evidence stays in the
  * candidate/release records. Public routes render this exact projection as
  * text; `bodyMarkdown` is never trusted as raw HTML.
+ *
+ * Carried `clauseVersion` (and its section `sectionVersion`) until 2026-09-12 (#968). Nothing read
+ * either, no draft carries one, and a clause's revision history is the commits that changed it — so a
+ * required integer here could only be stamped, which would assert a history nothing tracks.
  */
 export declare const GovernedDocumentPublicClauseSchema: z.ZodObject<{
     clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
-    clauseVersion: z.ZodNumber;
     order: z.ZodNumber;
     bodyMarkdown: z.ZodString;
+    standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+    /**
+     * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+     * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+     * nothing they can use, and an established clause carrying one would contradict itself.
+     */
+    missingInformation: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type GovernedDocumentPublicClause = z.infer<typeof GovernedDocumentPublicClauseSchema>;
 export declare const GovernedDocumentPublicSectionSchema: z.ZodObject<{
     sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
-    sectionVersion: z.ZodNumber;
     order: z.ZodNumber;
     title: z.ZodString;
     clauses: z.ZodArray<z.ZodObject<{
         clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
-        clauseVersion: z.ZodNumber;
         order: z.ZodNumber;
         bodyMarkdown: z.ZodString;
+        standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+        /**
+         * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+         * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+         * nothing they can use, and an established clause carrying one would contradict itself.
+         */
+        missingInformation: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type GovernedDocumentPublicSection = z.infer<typeof GovernedDocumentPublicSectionSchema>;
@@ -238,14 +406,19 @@ export declare const GovernedDocumentPublicContentSchema: z.ZodObject<{
     jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
     sections: z.ZodArray<z.ZodObject<{
         sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
-        sectionVersion: z.ZodNumber;
         order: z.ZodNumber;
         title: z.ZodString;
         clauses: z.ZodArray<z.ZodObject<{
             clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
-            clauseVersion: z.ZodNumber;
             order: z.ZodNumber;
             bodyMarkdown: z.ZodString;
+            standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+            /**
+             * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+             * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+             * nothing they can use, and an established clause carrying one would contradict itself.
+             */
+            missingInformation: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
@@ -272,7 +445,7 @@ export declare const GovernedDocumentReleaseCommonSchema: z.ZodObject<{
         definitionVersion: z.ZodNumber;
     }, z.core.$strict>;
     governanceScope: z.ZodObject<{
-        subjectKind: z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>;
+        subjectKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>>;
         subjectRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         scopeRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         scopeVersion: z.ZodNumber;
@@ -289,10 +462,15 @@ export declare const GovernedDocumentReleaseCommonSchema: z.ZodObject<{
     issuedAt: z.ZodISODateTime;
     effectiveAt: z.ZodISODateTime;
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
+    /**
+     * NOT `.min(1)`: see {@link GovernedDocumentReleaseApprovalState}. An unapproved release carries
+     * none, and says so in `approvalState` rather than being unrepresentable.
+     */
     approvalDecisions: z.ZodArray<z.ZodObject<{
         decisionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         decisionVersion: z.ZodNumber;
     }, z.core.$strict>>;
+    approvalState: z.ZodEnum<typeof GovernedDocumentReleaseApprovalState>;
     replacesRelease: z.ZodOptional<z.ZodObject<{
         document: z.ZodObject<{
             documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
@@ -315,7 +493,35 @@ export declare const GovernedDocumentReleaseCommonSchema: z.ZodObject<{
         requiredInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
-/** Immutable historical/public issued release. Its content branch remains byte-exact v1. */
+/**
+ * An issued release — and, since 2026-09-12, the TEXT it publishes (wildo-ai/wildo-ai#968).
+ *
+ * ## Why the release carries its content
+ *
+ * A release says which drafted content takes effect, and until #968 it could not say WHICH text: the
+ * sealed content binding went with the digest machinery on 2026-08-28, leaving only "the commit that
+ * introduced both the release and its content file". But a draft keeps changing after it is released,
+ * so pairing a release with "the draft of the same document" at read time shows every release — the
+ * one in force, the one it superseded, the one scheduled next — the SAME, current text. Two releases
+ * of one document could not differ at all.
+ *
+ * So the release holds its own published text, captured when it is composed. Retrieving "release N of
+ * a document" is one read. Intermediate drafts are NOT kept here — their history is the commits that
+ * changed the draft — and neither is anything the public projection withholds: `content` is already
+ * the browser-safe shape (no fact refs, no source policies, no `closedBy`).
+ *
+ * ## The text is only frozen if the RECORD is
+ *
+ * This field makes the binding representable; committing the record as data is what keeps it. An
+ * application that recomposes its releases from the live draft on every import would carry today's
+ * draft in every release, which is the defect above one layer later.
+ *
+ * ## What it refuses
+ *
+ * Content in a language or for jurisdictions the release does not name: publishing `fr-FR` text under
+ * an `en-GB` release is a false legal statement, the same lie `GovernedDocumentPublicDocumentSchema`
+ * refuses.
+ */
 export declare const GovernedDocumentReleaseSchema: z.ZodObject<{
     identity: z.ZodObject<{
         document: z.ZodObject<{
@@ -330,7 +536,7 @@ export declare const GovernedDocumentReleaseSchema: z.ZodObject<{
         definitionVersion: z.ZodNumber;
     }, z.core.$strict>;
     governanceScope: z.ZodObject<{
-        subjectKind: z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>;
+        subjectKind: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof GovernedDocumentGovernanceSubjectKind>>;
         subjectRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         scopeRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         scopeVersion: z.ZodNumber;
@@ -343,7 +549,6 @@ export declare const GovernedDocumentReleaseSchema: z.ZodObject<{
     allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
     locale: z.ZodString;
     jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
-    contentMediaType: z.ZodString;
     issuedAt: z.ZodISODateTime;
     effectiveAt: z.ZodISODateTime;
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
@@ -351,6 +556,7 @@ export declare const GovernedDocumentReleaseSchema: z.ZodObject<{
         decisionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
         decisionVersion: z.ZodNumber;
     }, z.core.$strict>>;
+    approvalState: z.ZodEnum<typeof GovernedDocumentReleaseApprovalState>;
     replacesRelease: z.ZodOptional<z.ZodObject<{
         document: z.ZodObject<{
             documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
@@ -373,8 +579,82 @@ export declare const GovernedDocumentReleaseSchema: z.ZodObject<{
         requiredInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
     }, z.core.$strict>>;
     schemaVersion: z.ZodLiteral<1>;
+    content: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        title: z.ZodString;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        sections: z.ZodArray<z.ZodObject<{
+            sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            order: z.ZodNumber;
+            title: z.ZodString;
+            clauses: z.ZodArray<z.ZodObject<{
+                clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                bodyMarkdown: z.ZodString;
+                standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+                /**
+                 * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+                 * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+                 * nothing they can use, and an established clause carrying one would contradict itself.
+                 */
+                missingInformation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
 }, z.core.$strict>;
 export type GovernedDocumentRelease = z.infer<typeof GovernedDocumentReleaseSchema>;
+/**
+ * The governed documents an application SERVES as public pages, named once for every layer.
+ *
+ * These two live HERE, in the shared wire layer, and not with their four governance siblings in
+ * `saas-specifications/_core/compliance-documents` — because these are the only two a BROWSER has
+ * to name. `AppRouter` mounts `/privacy` and `/terms` and must say which document each serves, and
+ * `saas-frontend-lib` neither depends on `saas-specifications` nor should: that is the design-time
+ * layer. The alternative was a second copy of two strings in the router, which is exactly the
+ * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses.
+ *
+ * `required-document-set.schemas.ts` imports them rather than re-declaring them, so the composer
+ * and the page agree about which document they are talking about by construction.
+ */
+export declare const PUBLIC_GOVERNED_DOCUMENT_REFS: Readonly<{
+    readonly PRIVACY_NOTICE: "document:public.privacy-notice";
+    readonly SERVICE_TERMS: "document:public.service-terms";
+}>;
+export type PublicGovernedDocumentRefName = keyof typeof PUBLIC_GOVERNED_DOCUMENT_REFS;
+/**
+ * Which public page serves which governed document — the pairing every surface that links to one needs.
+ *
+ * TOTAL over {@link PUBLIC_GOVERNED_DOCUMENT_REFS} by its type, so a third public document added to
+ * that vocabulary is a compile error here rather than a document with no page. A hand-kept list of
+ * pairings is the thing that rots; a total over the vocabulary is the thing that cannot.
+ *
+ * ## Why the PATH lives here and not with the frontend's other routes
+ *
+ * The same reason the refs beside it do, and it took a SECOND reader to make it obvious. `AppRouter`
+ * MOUNTS these paths; the consent panel LINKS to the privacy notice from `presets-components`, and
+ * the registration form links to each required document from `saas-frontend-lib`. Only the router can
+ * reach that package's internal route module, so the panel would have hard-coded a copy — the
+ * closed-vocabulary-with-no-named-source shape `CLAUDE.md` refuses, and a copy nothing renders is the
+ * one that drifts. `CommonRoutePaths.privacy` / `.terms` are derived from this, so the router still
+ * spells its routes in one place and that place agrees with the links.
+ *
+ * A MARKETING WEBSITE is deliberately NOT one of the readers, although an earlier version of this
+ * note claimed it was. `saas-website` may import only `@wildo-ai/saas-models/public-runtime` under
+ * bundle discipline, and this is not exported there — so the claim named a reader that could not
+ * reach it. If a website ever needs these paths, carve them into `public-runtime` through the K-2
+ * protocol rather than restoring the sentence.
+ */
+export declare const PUBLIC_GOVERNED_DOCUMENT_ROUTE_PATHS: Readonly<Record<(typeof PUBLIC_GOVERNED_DOCUMENT_REFS)[PublicGovernedDocumentRefName], string>>;
+/**
+ * The page serving this document, or `undefined` when it has none.
+ *
+ * A governed document an application requires acceptance of need NOT be one of the two public pages
+ * — an application may require a data-processing agreement served elsewhere entirely — so a caller
+ * gets `undefined` and omits the link rather than being handed a route that leads nowhere.
+ */
+export declare const resolvePublicGovernedDocumentRoutePath: (documentRef: string) => string | undefined;
 /** Locator kind is explicit so a channel cannot reinterpret an arbitrary string. */
 export declare enum GovernedDocumentPublicationLocatorKind {
     WEB_URL = "WEB_URL",
@@ -517,8 +797,252 @@ export declare const GovernedDocumentPublicReleaseProjectionSchema: z.ZodObject<
     issuedAt: z.ZodISODateTime;
     effectiveAt: z.ZodISODateTime;
     expiresAt: z.ZodOptional<z.ZodISODateTime>;
+    /**
+     * What a person may DO with this release — carried onto the public projection so the serving
+     * surface can tell whether recording a `NOTICE_DELIVERED` (#1258 Step 5) is something the
+     * release actually permits, without a second, wider read of the release's own custody record.
+     * Not new authority: `composeGovernedDocumentInteraction` already refuses an interaction kind a
+     * release does not permit, so a reader without this field could only guess.
+     */
+    allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
 }, z.core.$strict>;
 export type GovernedDocumentPublicReleaseProjection = z.infer<typeof GovernedDocumentPublicReleaseProjectionSchema>;
 /** Explicit allow-list projection from retained internal release to public release metadata. */
 export declare const projectGovernedDocumentPublicRelease: (releaseInput: GovernedDocumentRelease) => GovernedDocumentPublicReleaseProjection;
+/**
+ * A governed document AS A PUBLIC PAGE CAN HOLD IT — the release metadata a reader is entitled to,
+ * paired with the exact content bytes it names. Issue #168.
+ *
+ * ## Why this pair, and why it is one record
+ *
+ * The two halves already existed and had never been joined. `GovernedDocumentPublicReleaseProjection`
+ * answers *which release is this, in what language, for which jurisdictions, in force when* —
+ * deliberately narrower than the internal release, withholding `governanceScope` and
+ * `approvalDecisions` as custody detail. `GovernedDocumentPublicContent` answers *what does it say*.
+ * A page needs both and must not be able to show one release's date above another release's prose,
+ * so they travel together and their agreement is checked here rather than at each reader.
+ *
+ * ## What the guard refuses, and what it deliberately does not
+ *
+ * It refuses a record that would be a LIE: content whose `locale` or `jurisdictionRefs` disagree
+ * with the release naming it, and a media type the release does not declare. Serving an `en-GB`
+ * notice under a release that says `fr-FR` is a false legal statement, and that is the one thing a
+ * public document may never be.
+ *
+ * It does NOT refuse an UNAPPROVED release, and that is the directive'''s own instruction rather than
+ * an oversight: *"Composing a release harms nobody; serving an unapproved one to a real reader is a
+ * legally-binding statement leaving the system. So the filter lives on the READ, defaults to off,
+ * and says at its own site that it is the gate point."* The approval gate is
+ * {@link resolveInForcePublicDocument}'''s `requireApproved`, MARKED there and armed at Gate 3.
+ * Refusing here would make an application unable to REPRESENT a draft notice at all, which is the
+ * shape `.claude/rules/application-creation-directive.md` records as the reference defect.
+ *
+ * The release'''s own `approvalState` is not carried, because this projection deliberately withholds
+ * it (a reader is not told about internal custody). The approval decision is made where the document
+ * is SELECTED, from the authored release, before it reaches a browser.
+ */
+export declare enum GovernedDocumentPublicDocumentKind {
+    /** A composed release and the text that release carries. */
+    RELEASED = "RELEASED",
+    /**
+     * The latest draft of a document the application has NEVER released (wildo-ai/wildo-ai#968 decision 5).
+     *
+     * It exists so that neither a missing approval nor a missing release leaves a page with nothing. It
+     * carries no release projection and no approval state because neither exists — inventing either
+     * would claim a release nobody composed — and a page showing one must SAY it is a draft.
+     */
+    UNRELEASED_DRAFT = "UNRELEASED_DRAFT"
+}
+export declare const GovernedDocumentReleasedPublicDocumentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<GovernedDocumentPublicDocumentKind.RELEASED>;
+    release: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        identity: z.ZodObject<{
+            document: z.ZodObject<{
+                documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                documentVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            releaseVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        definition: z.ZodObject<{
+            definitionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            definitionVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        documentClass: z.ZodEnum<typeof GovernedDocumentClass>;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
+        issuedAt: z.ZodISODateTime;
+        effectiveAt: z.ZodISODateTime;
+        expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        /**
+         * What a person may DO with this release — carried onto the public projection so the serving
+         * surface can tell whether recording a `NOTICE_DELIVERED` (#1258 Step 5) is something the
+         * release actually permits, without a second, wider read of the release's own custody record.
+         * Not new authority: `composeGovernedDocumentInteraction` already refuses an interaction kind a
+         * release does not permit, so a reader without this field could only guess.
+         */
+        allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
+    }, z.core.$strict>;
+    content: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        title: z.ZodString;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        sections: z.ZodArray<z.ZodObject<{
+            sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            order: z.ZodNumber;
+            title: z.ZodString;
+            clauses: z.ZodArray<z.ZodObject<{
+                clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                bodyMarkdown: z.ZodString;
+                standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+                /**
+                 * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+                 * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+                 * nothing they can use, and an established clause carrying one would contradict itself.
+                 */
+                missingInformation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    /**
+     * Whether the release this content belongs to has been approved.
+     *
+     * Carried HERE rather than on the release projection because it is a fact about the PUBLISHER'''s
+     * process, not about the document, and the projection is the shape a reader receives. A serving
+     * surface needs it to decide whether it may render at all; it is never displayed.
+     */
+    approvalState: z.ZodEnum<typeof GovernedDocumentReleaseApprovalState>;
+}, z.core.$strict>;
+export type GovernedDocumentReleasedPublicDocument = z.infer<typeof GovernedDocumentReleasedPublicDocumentSchema>;
+/** See {@link GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT}. */
+export declare const GovernedDocumentUnreleasedDraftPublicDocumentSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT>;
+    /** The governed document this is the latest draft of. */
+    documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+    content: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        title: z.ZodString;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        sections: z.ZodArray<z.ZodObject<{
+            sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            order: z.ZodNumber;
+            title: z.ZodString;
+            clauses: z.ZodArray<z.ZodObject<{
+                clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                bodyMarkdown: z.ZodString;
+                standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+                /**
+                 * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+                 * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+                 * nothing they can use, and an established clause carrying one would contradict itself.
+                 */
+                missingInformation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type GovernedDocumentUnreleasedDraftPublicDocument = z.infer<typeof GovernedDocumentUnreleasedDraftPublicDocumentSchema>;
+/** A document a public page may render: a composed release, or the latest draft of a never-released document. */
+export declare const GovernedDocumentPublicDocumentSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<GovernedDocumentPublicDocumentKind.RELEASED>;
+    release: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        identity: z.ZodObject<{
+            document: z.ZodObject<{
+                documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                documentVersion: z.ZodNumber;
+            }, z.core.$strict>;
+            releaseId: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            releaseVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        definition: z.ZodObject<{
+            definitionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            definitionVersion: z.ZodNumber;
+        }, z.core.$strict>;
+        documentClass: z.ZodEnum<typeof GovernedDocumentClass>;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        contentMediaType: z.ZodLiteral<"application/vnd.wildo.governed-document.public+json;version=1">;
+        issuedAt: z.ZodISODateTime;
+        effectiveAt: z.ZodISODateTime;
+        expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        /**
+         * What a person may DO with this release — carried onto the public projection so the serving
+         * surface can tell whether recording a `NOTICE_DELIVERED` (#1258 Step 5) is something the
+         * release actually permits, without a second, wider read of the release's own custody record.
+         * Not new authority: `composeGovernedDocumentInteraction` already refuses an interaction kind a
+         * release does not permit, so a reader without this field could only guess.
+         */
+        allowedInteractionKinds: z.ZodArray<z.ZodEnum<typeof GovernedDocumentInteractionKind>>;
+    }, z.core.$strict>;
+    content: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        title: z.ZodString;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        sections: z.ZodArray<z.ZodObject<{
+            sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            order: z.ZodNumber;
+            title: z.ZodString;
+            clauses: z.ZodArray<z.ZodObject<{
+                clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                bodyMarkdown: z.ZodString;
+                standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+                /**
+                 * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+                 * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+                 * nothing they can use, and an established clause carrying one would contradict itself.
+                 */
+                missingInformation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    /**
+     * Whether the release this content belongs to has been approved.
+     *
+     * Carried HERE rather than on the release projection because it is a fact about the PUBLISHER'''s
+     * process, not about the document, and the projection is the shape a reader receives. A serving
+     * surface needs it to decide whether it may render at all; it is never displayed.
+     */
+    approvalState: z.ZodEnum<typeof GovernedDocumentReleaseApprovalState>;
+}, z.core.$strict>, z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    kind: z.ZodLiteral<GovernedDocumentPublicDocumentKind.UNRELEASED_DRAFT>;
+    /** The governed document this is the latest draft of. */
+    documentRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+    content: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        title: z.ZodString;
+        locale: z.ZodString;
+        jurisdictionRefs: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">>;
+        sections: z.ZodArray<z.ZodObject<{
+            sectionRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+            order: z.ZodNumber;
+            title: z.ZodString;
+            clauses: z.ZodArray<z.ZodObject<{
+                clauseRef: z.core.$ZodBranded<z.ZodString, "GovernedDocumentRef", "out">;
+                order: z.ZodNumber;
+                bodyMarkdown: z.ZodString;
+                standing: z.ZodEnum<typeof GovernedDocumentPublicClauseStanding>;
+                /**
+                 * What is missing, in the reader's terms — the drafter's own `needs` text. Present exactly when the
+                 * clause is `NOT_YET_ESTABLISHED`: a marked clause that does not say what it lacks tells a reader
+                 * nothing they can use, and an established clause carrying one would contradict itself.
+                 */
+                missingInformation: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
+export type GovernedDocumentPublicDocument = z.infer<typeof GovernedDocumentPublicDocumentSchema>;
 //# sourceMappingURL=governed-documents.shared.schemas.d.ts.map