@aaes-ai/govern-sdk 0.1.3 → 0.2.0

package/CHANGELOG.md

@@ -1,8 +1,25 @@
 # Changelog
 
-## 0.1.3 candidate
+## 0.2.0 (2026-10-22, prepared and tagged, not published)
 
-- The package name is `@aaes-ai/govern-sdk`. npm still lists `@aaes-ai/sdk` through 0.1.2 until the rename release.
+Breaking changes (hence 0.2.0 under the SDK release policy):
+
+- An omitted daemon spend cap now reads as `spendCapMinor: null` with `spendCapMinorPresent: false` on grants, presented grants and federated grants and scopes. 0.1.3 reported an omitted cap as `0`, which could not be told apart from an explicit zero cap. An explicit zero stays `0` with `spendCapMinorPresent: true`. The declarations now type the field as `number | null`.
+- `action()` refuses before sending when the capability has no published risk tier for the caller, and asks the caller to refresh capabilities or request access. 0.1.3 sent such a request without a tier.
+- Read filters accept `limit: 0`, which means the daemon default, as omitting `limit` does.
+
+Fixes:
+
+- Brokered and resumed brokered calls check the connector outcome. An allowed decision whose outcome is missing or malformed raises `AaesError` saying the effect may have run, instead of returning an empty outcome.
+- A federated grant must name the requested intent, a marker receipt hash, and the requested capability (optionally pinned as `capability@version`) and task. The sealed record's intent id is no longer filled in from the request.
+- The bearer token must be a string of printable ASCII characters. Payload numbers must be finite. Capability and catalogue entries must be JSON objects.
+- Response bodies are released after a redirect refusal or a failed read.
+- Wire types: receipts may have class `deferred`; model usage may carry `estimated: true`; execution steps accept `share` and `transfer`; the model list response types are added; license and usage summaries may carry `null` objects.
+
+## 0.1.3 (2026-10-18)
+
+- Published on npm as `@aaes-ai/govern-sdk`. Earlier releases through 0.1.2 remain under `@aaes-ai/sdk`.
+- This version was published by hand from a maintainer login at 15:34 UTC, as the package's required first publish, not by `sdk-publish.yml`. No `sdk/typescript/v0.1.3` tag or gated run exists for it, and it has no provenance. Its registry integrity (`sha512-iBcfEA4lYKhYJ47dx+ZtmGDJjqNp7oPAnPULzsoarP2mmU8tOmwKowifwV3VahlMFCx9aWpPgmNNv3uqoQcOaw==`) equals `npm pack` of commit `0193b9374`, the commit tagged `sdk/python/v0.1.2`.
 - Minor-unit amounts above `Number.MAX_SAFE_INTEGER` are refused before sending, since the caller's exact amount may already be lost as a double.
 - A daemon-published spend cap (`spend_cap_minor`, federated `spend_cap.minor`) must be a nonnegative safe integer and `latency_added_ms` a finite nonnegative number; malformed values raise `AaesError` instead of being coerced, matching the Python and Go clients. An omitted cap still reads as `0`.
 
@@ -12,7 +29,7 @@
 
 ## 0.1.1
 
-- Packaging-only patch, published through the sdk-publish.yml npm trusted publisher with provenance. No functional changes; the shipped files are unchanged apart from the version field.
+- Packaging-only patch, published through the sdk-publish.yml npm trusted publisher without provenance (npm provenance requires a public source repository). No functional changes; the shipped files are unchanged apart from the version field.
 - Verified the 0.1.0 tarball already ships `README.md` (extracted by the registry), so no packaging change was required for npm's README rendering.
 
 ## 0.1.0 — candidate

package/README.md

@@ -5,7 +5,8 @@ AAES (Autonomous Agentic Enterprise Systems) is an AI governance platform for th
 ES module package `@aaes-ai/govern-sdk`, dependency-free runtime, with complete public TypeScript declarations and wire response types. Node 18+.
 
 ```bash
-npm install ./sdk/typescript      # install local candidate
+npm install @aaes-ai/govern-sdk
+# For local development: npm install ./sdk/typescript
 node sdk/typescript/aaes.test.mjs   # node:test, nothing to install
 ```
 
@@ -46,9 +47,9 @@ Full guide: [docs/guides/INTEGRATION.md](../../docs/guides/INTEGRATION.md).
 
 A 503 response does not prove that the provider performed no action. Repeat only the identical request with its original effect key; never change the key to force a retry. The daemon retains the reservation and dispatch claim for uncertain outcomes and may answer the repeat with 409. It permits another dispatch only after proving that the previous attempt was never dispatched.
 
-## Candidate package and expanded contract
+## Published package and expanded contract
 
-See [SDK release policy](../RELEASE.md) and [complete operation/scope table](../CONTRACT.md). npm lists `@aaes-ai/sdk` through 0.1.2. This tree's package name is `@aaes-ai/govern-sdk`.
+See [SDK release policy](../RELEASE.md) and [complete operation/scope table](../CONTRACT.md). Version 0.1.3 was published on npm as `@aaes-ai/govern-sdk` on 18 October 2026, by a manual first publish rather than the tag workflow (see the changelog). Version 0.2.0 is prepared and tagged `sdk/typescript/v0.2.0`, but the tag workflow's publish run failed, so 0.2.0 is not on npm. Publishing it needs a re-run of that workflow on the tag, or a new version. Earlier releases through 0.1.2 remain under `@aaes-ai/sdk`. Check npm for later releases.
 
 Endpoint transport: bearer credentials require HTTPS. HTTP is accepted only
 for explicit loopback addresses (`localhost`, `127.0.0.0/8`, or `::1`); DNS

package/aaes.d.mts

@@ -26,12 +26,12 @@ export class Refusal {
 export interface Grant {
   grantId: string; actorId: string; tenantId: string; capability: string; tier: string;
   taskId: string; issuedAt: string; expiresAt: string; ttlSeconds: number;
-  spendCapMinor: number; spendCapCurrency: string; nonTransferable: boolean;
+  spendCapMinor: number | null; spendCapMinorPresent: boolean; spendCapCurrency: string; nonTransferable: boolean;
   budgetGrantId: string; issuer: string; signature: string;
 }
 export interface GrantPresent {
   grantId: string; actorId: string; tenantId: string; capability: string; tier: string;
-  taskId: string; issuedAt: string; expiresAt: string; spendCapMinor: number; spendCapCurrency: string;
+  taskId: string; issuedAt: string; expiresAt: string; spendCapMinor: number | null; spendCapMinorPresent: boolean; spendCapCurrency: string;
 }
 export interface Receipt {
   receiptId: string; intentId: string; tenantId: string; taskId: string; approvalId: string;
@@ -117,12 +117,12 @@ export class FederatedMaterial {
 }
 export interface FederatedLocator { capability: string; endpoint: string; method: string; authority: string; resourceId: string }
 export interface FederatedRecord { intentId: string; mode: string; payloadSeen: boolean; markerReceiptHash: string; receiptId: string }
-export interface FederatedScope { capability: string; actions: string[]; resourceId: string; dataClass: string; tier: string; spendCapMinor: number; spendCapCurrency: string; scopeKey: string }
+export interface FederatedScope { capability: string; actions: string[]; resourceId: string; dataClass: string; tier: string; spendCapMinor: number | null; spendCapMinorPresent: boolean; spendCapCurrency: string; scopeKey: string }
 export class FederatedGrant {
   constructor(fields?: Partial<FederatedGrant>);
   federationId: string; intentId: string; decisionGrantId: string; tenantId: string; actorId: string;
   capability: string; capabilityVersion: string; actions: string[]; resourceId: string; taskId: string;
-  dataClass: string; tier: string; spendCapMinor: number; spendCapCurrency: string; scopeKey: string; backend: string;
+  dataClass: string; tier: string; spendCapMinor: number | null; spendCapMinorPresent: boolean; spendCapCurrency: string; scopeKey: string; backend: string;
   locator: FederatedLocator; issuedAt: string; expiresAt: string; ttlSeconds: number;
   material: FederatedMaterial; record: FederatedRecord;
   scope(): FederatedScope; toString(): string;
@@ -142,7 +142,7 @@ export interface TimeFilters extends PageFilters { since?: string; until?: strin
 export interface TaskFilters extends TimeFilters { state?: string; sponsor?: string; assignee?: string; overdue?: boolean }
 export interface ApprovalFilters extends TimeFilters { intentId?: string; taskId?: string; state?: 'pending' | 'all' }
 export interface EntitlementFilters extends PageFilters { actorId?: string; capability?: string; state?: 'all' | 'usable' | 'expired' | 'revoked' }
-export interface ReceiptFilters extends TimeFilters { intentId?: string; taskId?: string; effectClass?: 'denied' | 'minted_unused' | 'authorized' | 'executed'; custody?: string }
+export interface ReceiptFilters extends TimeFilters { intentId?: string; taskId?: string; effectClass?: 'denied' | 'minted_unused' | 'authorized' | 'executed' | 'deferred'; custody?: string }
 export interface ManagerCardDecision { cardId: string; approvalId: string; payloadHash: string; policyId?: string; grant: boolean; reason?: string }
 export class Client {
   constructor(options?: ClientOptions);

package/aaes.mjs

@@ -263,7 +263,8 @@ export class FederatedGrant {
     this.taskId = "";
     this.dataClass = "";
     this.tier = "";
-    this.spendCapMinor = 0;
+    this.spendCapMinor = null;
+    this.spendCapMinorPresent = false;
     this.spendCapCurrency = "";
     this.scopeKey = "";
     this.backend = "";
@@ -286,6 +287,7 @@ export class FederatedGrant {
       dataClass: this.dataClass,
       tier: this.tier,
       spendCapMinor: this.spendCapMinor,
+      spendCapMinorPresent: this.spendCapMinorPresent,
       spendCapCurrency: this.spendCapCurrency,
       scopeKey: this.scopeKey,
     };
@@ -403,6 +405,9 @@ function scanPayload(value, depth, nodes) {
   if (depth > MAX_PAYLOAD_DEPTH) {
     throw new CallerRouteError(`aaes: payload nests deeper than ${MAX_PAYLOAD_DEPTH} levels; refusing`);
   }
+  if (typeof value === "number" && !Number.isFinite(value)) {
+    throw new CallerRouteError("aaes: payload numbers must be finite JSON values");
+  }
   if (Array.isArray(value)) {
     for (const child of value) scanPayload(child, depth + 1, nodes);
     return;
@@ -477,7 +482,14 @@ export class Client {
     if (base.includes("?") || base.includes("#")) {
       throw new AaesError("aaes: endpoint must not carry a query or fragment");
     }
-    const secret = String(token ?? process.env[TOKEN_ENV] ?? "").trim();
+    const configured = token ?? process.env[TOKEN_ENV] ?? "";
+    if (typeof configured !== "string") {
+      throw new AaesError(`aaes: ${TOKEN_ENV} must be an ASCII bearer token`);
+    }
+    const secret = configured.trim();
+    if ([...secret].some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) > 126)) {
+      throw new AaesError(`aaes: ${TOKEN_ENV} must not contain control or non-ASCII characters`);
+    }
     if (!secret) throw new AaesError(`aaes: a bearer token is required; pass token or set ${TOKEN_ENV}`);
     const doFetch = fetchImpl ?? globalThis.fetch;
     if (typeof doFetch !== "function") {
@@ -616,7 +628,7 @@ export class Client {
     // Connector observations can accompany a refusal after sealing or a
     // duplicate effect; they serve reconciliation, and the decision stays the
     // authority for what happened.
-    return { decision, outcome: body.outcome ?? {} };
+    return { decision, outcome: brokeredOutcome(body, decision, PATH_BROKERED) };
   }
 
   /** POST /v1/brokered/resume: complete a deferred brokered action with the
@@ -642,7 +654,7 @@ export class Client {
     // Connector observations can accompany a refusal after sealing or a
     // duplicate effect; they serve reconciliation, and the decision stays the
     // authority for what happened.
-    return { decision, outcome: body.outcome ?? {} };
+    return { decision, outcome: brokeredOutcome(body, decision, PATH_BROKERED_RESUME) };
   }
 
   /** POST /v1/grants/present: bind a stored grant to the authenticated caller.
@@ -745,6 +757,15 @@ export class Client {
     if (!grant.federationId || !grant.intentId) {
       throw new AaesError("aaes: the daemon returned a grant that names no federation id or intent id");
     }
+    if (String(grant.record.intentId ?? "").trim() !== String(grant.intentId ?? "").trim()) {
+      throw new AaesError("aaes: the daemon returned a grant whose sealed record does not name this intent");
+    }
+    if (!String(grant.record.markerReceiptHash ?? "").trim()) {
+      throw new AaesError("aaes: the daemon returned a federated grant with no marker receipt hash");
+    }
+    if (!federatedCapabilityMatches(capability, grant) || grant.taskId !== taskId) {
+      throw new AaesError("aaes: the daemon returned a grant whose capability or task is not the federated action requested");
+    }
     return { ok: true, allowed: true, reason: "", grant, refusal: null };
   }
 
@@ -913,6 +934,7 @@ export class Client {
     refuseUnknownKeys(ACTION_KEYS, action, "action");
     const capability = String(action.capability ?? "").trim();
     if (!capability) throw new AaesError("aaes: an action names a capability; none was given");
+    const amountMinor = requireMinorAmount(action.amountMinor, "amountMinor");
     const payload = guardPayload(action.payload);
     const entitled = await this.entitlement();
     const info = {
@@ -939,19 +961,22 @@ export class Client {
       external_refs: Array.isArray(action.externalRefs) && action.externalRefs.length
         ? action.externalRefs
         : undefined,
-      amount_minor: requireMinorAmount(action.amountMinor, "amountMinor"),
+      amount_minor: amountMinor,
       amount_currency: String(action.amountCurrency ?? "").trim().toUpperCase() || undefined,
       grant_ttl_ms: action.grantTtlMs,
       payload,
     });
     const entry = entitled.find(capability);
-    if (entry) {
-      // The tier the daemon published for this caller. A caller cannot raise its
-      // own tier, and the daemon refuses one below the registration.
-      wire.tier = entry.riskTier;
-      if (!wire.task_id) wire.task_id = entry.taskId;
-      if (!wire.caller_task_id) wire.caller_task_id = entry.callerTaskId;
+    if (!entry || typeof entry.riskTier !== "string" || !entry.riskTier.trim()) {
+      throw new AaesError(
+        `aaes: no published risk tier for capability ${JSON.stringify(capability)}; refresh capabilities or request access before an action`,
+      );
     }
+    // The tier the daemon published for this caller. A caller cannot raise its
+    // own tier, and the daemon refuses one below the registration.
+    wire.tier = entry.riskTier;
+    if (!wire.task_id) wire.task_id = entry.taskId;
+    if (!wire.caller_task_id) wire.caller_task_id = entry.callerTaskId;
     return { wire: prune(wire), info };
   }
 
@@ -1126,6 +1151,7 @@ export class Client {
       throw new AaesError(`aaes: ${method} ${path}: ${err.message}`);
     }
     if (response.status >= 300 && response.status < 400) {
+      await cancelBody(response);
       throw new AaesError(
         `aaes: refusing to follow a redirect to ${response.headers.get("location") ?? "another host"}: the daemon must answer at the configured endpoint`,
       );
@@ -1134,6 +1160,7 @@ export class Client {
     try {
       raw = await readBoundedResponse(response, method, path);
     } catch (err) {
+      await cancelBody(response);
       // A body read fails the same way a failed fetch does: the read's own
       // refusals are already typed, and anything the stream or the abort
       // signal throws keeps its original error as the cause.
@@ -1173,6 +1200,35 @@ export class Client {
 
 // --- helpers ---------------------------------------------------------------
 
+function brokeredOutcome(body, decision, route) {
+  const present = body !== null && typeof body === "object" && Object.prototype.hasOwnProperty.call(body, "outcome");
+  const outcome = present ? body.outcome : undefined;
+  if (outcome === undefined || outcome === null) {
+    if (!decision.ok) return {};
+    throw new AaesError(
+      `aaes: POST ${route} was allowed and the connector may have executed the effect, but its outcome could not be decoded`,
+    );
+  }
+  const typed = typeof outcome === "object" && !Array.isArray(outcome)
+    && (!("executed" in outcome) || typeof outcome.executed === "boolean")
+    && (!("rail_confirmed" in outcome) || typeof outcome.rail_confirmed === "boolean");
+  if (typed) return outcome;
+  if (decision.ok) {
+    throw new AaesError(
+      `aaes: POST ${route} was allowed and the connector may have executed the effect, but its outcome could not be decoded`,
+    );
+  }
+  throw new AaesError(`aaes: POST ${route} outcome could not be decoded; the connector may have executed the effect`);
+}
+
+async function cancelBody(response) {
+  try {
+    await response.body?.cancel();
+  } catch {
+    // The caller's error is the one that matters; this only releases the socket.
+  }
+}
+
 async function readBoundedResponse(response, method, path) {
   if (!response.body) return "";
   const reader = response.body.getReader();
@@ -1257,15 +1313,14 @@ function requireMinorAmount(value, field) {
   return amount;
 }
 
-// minorUnitsFrom reads a daemon-published minor-unit cap. Omitted stays the
-// documented zero (the daemon omits a zero cap); a present value must be a
-// nonnegative safe JSON integer, matching the Python and Go clients.
+// minorUnitsFrom reads a daemon-published minor-unit cap. An omitted cap is
+// unknown (present false, value null). An explicit zero stays zero and present.
 function minorUnitsFrom(value, field) {
-  if (value === undefined) return 0;
+  if (value === undefined) return { value: null, present: false };
   if (!Number.isSafeInteger(value) || value < 0) {
     throw new AaesError("aaes: " + field + " is not a nonnegative JSON integer");
   }
-  return value;
+  return { value, present: true };
 }
 
 // finiteNumberFrom reads a daemon-published nonnegative number such as
@@ -1288,6 +1343,23 @@ function prune(value) {
   return out;
 }
 
+// The grant names the canonical capability and version separately; its locator
+// names that canonical id. A request may pin the pair as canonical@version.
+// Exact equality wins, so a capability id that itself contains "@" stays the
+// id; only then does the last "@" start a pin.
+function federatedCapabilityMatches(requested, grant) {
+  const canonical = String(grant.capability ?? "").trim();
+  const version = String(grant.capabilityVersion ?? "").trim();
+  const locator = String(grant.locator?.capability ?? "").trim();
+  if (!canonical || locator !== canonical) return false;
+  if (requested === canonical) return true;
+  const at = requested.lastIndexOf("@");
+  if (at <= 0 || at === requested.length - 1) return false;
+  const base = requested.slice(0, at).trim();
+  const pin = requested.slice(at + 1).trim();
+  return base === canonical && pin !== "" && pin === version;
+}
+
 function explicitCapabilityPin(spelling, entries) {
   if (!spelling.includes("@")) return false;
   for (const entry of entries) {
@@ -1329,6 +1401,9 @@ function findRequestable(entries, spelling) {
 }
 
 function capabilityFrom(entry) {
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+    throw new AaesError("aaes: capability is not a JSON object");
+  }
   const capabilityId = entry.capability_id ?? "";
   const version = entry.version ?? "";
   const pinned = Boolean(entry.pinned);
@@ -1356,6 +1431,9 @@ function capabilityFrom(entry) {
 }
 
 function catalogueEntryFrom(entry) {
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) {
+    throw new AaesError("aaes: catalogue entry is not a JSON object");
+  }
   const policy = entry.policy ?? {};
   return {
     capabilityId: entry.capability_id ?? "",
@@ -1382,6 +1460,7 @@ function grantFrom(body) {
   if (body.non_transferable !== true) {
     throw new AaesError("aaes: grant non_transferable must be JSON true");
   }
+  const spendCap = minorUnitsFrom(body.spend_cap_minor, "spend_cap_minor");
   return {
     grantId: body.grant_id ?? "",
     actorId: body.actor_id ?? "",
@@ -1392,7 +1471,8 @@ function grantFrom(body) {
     issuedAt: body.issued_at ?? "",
     expiresAt: body.expires_at ?? "",
     ttlSeconds: body.ttl_seconds ?? 0,
-    spendCapMinor: minorUnitsFrom(body.spend_cap_minor, "spend_cap_minor"),
+    spendCapMinor: spendCap.value,
+    spendCapMinorPresent: spendCap.present,
     spendCapCurrency: body.spend_cap_currency ?? "",
     nonTransferable: true,
     budgetGrantId: body.budget_grant_id ?? "",
@@ -1402,6 +1482,7 @@ function grantFrom(body) {
 }
 
 function grantPresentFrom(body) {
+  const spendCap = minorUnitsFrom(body.spend_cap_minor, "spend_cap_minor");
   return {
     grantId: body.grant_id ?? "",
     actorId: body.actor_id ?? "",
@@ -1411,7 +1492,8 @@ function grantPresentFrom(body) {
     taskId: body.task_id ?? "",
     issuedAt: body.issued_at ?? "",
     expiresAt: body.expires_at ?? "",
-    spendCapMinor: minorUnitsFrom(body.spend_cap_minor, "spend_cap_minor"),
+    spendCapMinor: spendCap.value,
+    spendCapMinorPresent: spendCap.present,
     spendCapCurrency: body.spend_cap_currency ?? "",
   };
 }
@@ -1501,6 +1583,7 @@ function federatedMaterialFrom(body = {}) {
 function federatedGrantFrom(body = {}, intentId = "") {
   const locator = body.locator ?? {};
   const record = body.record ?? {};
+  const spendCap = minorUnitsFrom((body.spend_cap ?? {}).minor, "spend_cap.minor");
   if (record.payload_seen !== true && record.payload_seen !== false) {
     throw new AaesError(
       "aaes: the daemon returned a grant whose record omits payload_seen or did not send a JSON boolean",
@@ -1519,7 +1602,8 @@ function federatedGrantFrom(body = {}, intentId = "") {
     taskId: body.task_id ?? "",
     dataClass: body.data_class ?? "",
     tier: body.tier ?? "",
-    spendCapMinor: minorUnitsFrom((body.spend_cap ?? {}).minor, "spend_cap.minor"),
+    spendCapMinor: spendCap.value,
+    spendCapMinorPresent: spendCap.present,
     spendCapCurrency: (body.spend_cap ?? {}).currency ?? "",
     scopeKey: body.scope_key ?? "",
     backend: body.backend ?? "",
@@ -1535,7 +1619,7 @@ function federatedGrantFrom(body = {}, intentId = "") {
     ttlSeconds: body.ttl_seconds ?? 0,
     material: federatedMaterialFrom(body.material ?? {}),
     record: {
-      intentId: record.intent_id ?? intentId ?? "",
+      intentId: record.intent_id ?? "",
       mode: record.mode ?? "",
       payloadSeen: record.payload_seen,
       markerReceiptHash: record.marker_receipt_hash ?? "",
@@ -1627,7 +1711,8 @@ function readQuery(filters, mapping) {
   const query = new URLSearchParams();
   for (const [key, value] of Object.entries(filters)) {
     if (value === undefined || value === null || value === "") continue;
-    if (key === "limit" && (!Number.isInteger(value) || value < 1 || value > 200)) throw new AaesError("aaes: limit must be an integer between 1 and 200");
+    if (key === "limit" && (!Number.isInteger(value) || value < 0 || value > 200)) throw new AaesError("aaes: limit must be an integer between 0 and 200; pass 0 or omit it for the daemon default");
+    if (key === "limit" && value === 0) continue;
     if (key === "overdue" && typeof value !== "boolean") throw new AaesError("aaes: overdue must be boolean");
     if (key !== "limit" && key !== "overdue" && typeof value !== "string") throw new AaesError("aaes: read filters must be strings");
     query.set(mapping[key], String(value));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaes-ai/govern-sdk",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "TypeScript/JavaScript SDK for AAES — the AI governance platform for the action layer: permissions, human approvals, and spending limits on routed agent actions",
   "license": "LicenseRef-AAES-Proprietary",
   "keywords": ["aaes", "ai-governance", "agentic-ai", "agent-governance", "ai-agents", "agent-permissions", "human-approval", "spending-limits", "audit-trail"],

package/wire.d.ts

@@ -1,11 +1,13 @@
 // Wire response shapes from api/openapi.yaml. These retain daemon field names.
 export type ModelRequest = { "model": string; "stream"?: boolean; };
-export type ModelUsage = { "input_tokens": number; "output_tokens": number; "total_tokens": number; "settled_minor": number; "currency": string; };
+export type ModelUsage = { "input_tokens": number; "output_tokens": number; "total_tokens": number; "settled_minor": number; "currency": string; "estimated"?: true; };
+export type ModelListOpenAI = { "object": "list"; "data": Array<{ "id": string; "object": "model"; "created": number; "owned_by": "aaes-govern"; }>; };
+export type ModelListAnthropic = { "data": Array<{ "type": "model"; "id": string; "display_name": string; "created_at": string; }>; "has_more": false; "first_id": string | null; "last_id": string | null; };
 export type ModelResponse = Record<string, unknown>;
 export type AnthropicError = { "type": "error"; "error": { "type": "authentication_error" | "permission_error" | "rate_limit_error" | "request_too_large" | "invalid_request_error" | "api_error"; "message": string; }; };
 export type OpenAIError = { "error": { "message": string; "type": "invalid_request_error" | "permission_error" | "insufficient_quota" | "api_error"; "param"?: string | null; "code": "invalid_api_key" | "govern_refused" | "govern_approval_required" | "insufficient_quota" | "request_too_large" | "invalid_request" | "upstream_error" | "govern_unavailable"; }; };
 export type ExecutionConstraints = { "business_id": string; "purpose": string; "configuration_hash": string; "policy_bundle_hash": string; "actor_ids": Array<string>; "steps": Array<ExecutionStep>; };
-export type ExecutionStep = { "step_id": string; "capability_hash": string; "capability_id": string; "version": string; "action": "read" | "write" | "create" | "update" | "delete" | "send" | "execute" | "pay" | "deploy" | "invoke" | "approve"; "resource_id": string; "endpoint": string; "method": string; "payload_hash": string; "amount": { "minor": number; "currency"?: string; }; "require_scoped_delegation"?: boolean; "require_human_approval"?: boolean; "prerequisites"?: Array<string>; };
+export type ExecutionStep = { "step_id": string; "capability_hash": string; "capability_id": string; "version": string; "action": "read" | "write" | "create" | "update" | "delete" | "send" | "execute" | "pay" | "deploy" | "invoke" | "approve" | "share" | "transfer"; "resource_id": string; "endpoint": string; "method": string; "payload_hash": string; "amount": { "minor": number; "currency"?: string; }; "require_scoped_delegation"?: boolean; "require_human_approval"?: boolean; "prerequisites"?: Array<string>; };
 export type ExecutionContext = { "root_task_id": string; "constraints": ExecutionConstraints; "constraints_hash": string; "reservations": Record<string, unknown>; };
 export type Refusal = { "reason": string; "remedy"?: string; };
 export type IntegrationCredentialRef = { "path": string; "version"?: string; "key"?: string; };
@@ -16,8 +18,8 @@ export type IntegrationRotateResponse = { "surface": string; "from": string; "to
 export type IntegrationRevokeRequest = { "surface": string; "reason"?: string; };
 export type IntegrationRevokeResponse = { "surface": string; "at": string; "authority": string; "reason": string; "note": string; };
 export type MeteringError = { "error": string; };
-export type LicenseStatus = { "state": string; "label": string; "reason": string; "warning": boolean; "persistent": boolean; "governance": string; "checked_at": string; "license": Record<string, unknown>; "usage": Record<string, unknown>; };
-export type UsageSummary = { "period": Record<string, unknown>; "index": "ok" | "unknown"; "governed_decisions": number; "records": Record<string, unknown>; "dedupe": "full" | "partial"; "retention_inside_period": boolean; "term": Record<string, unknown>; };
+export type LicenseStatus = { "state": string; "label": string; "reason": string; "warning": boolean; "persistent": boolean; "governance": string; "checked_at": string; "license": Record<string, unknown> | null; "usage": Record<string, unknown> | null; };
+export type UsageSummary = { "period": Record<string, unknown>; "index": "ok" | "unknown"; "governed_decisions": number; "records": Record<string, unknown>; "dedupe": "full" | "partial"; "retention_inside_period": boolean; "term": Record<string, unknown> | null; };
 export type IntegrationOpsError = { "error": string; };
 export type ActionRequest = { "tenant_id": string; "actor_id": string; "caller_task_id"?: string; "task_id"?: string; "effect_key_step"?: string; "capability": string; "tier": "R0" | "R1" | "R2" | "R3" | "R4" | number; "action"?: string; "correlation_id"?: string; "parent_intent_id"?: string; "contract_id"?: string; "model"?: string; "amount_minor": number; "amount_currency"?: string; "grant_ttl_ms"?: number; "provenance_status"?: "asserted" | "unknown"; "external_refs"?: Array<ExternalRef>; "payload"?: unknown; };
 export type ExternalRef = { "registry": string; "kind": string; "value": string; "source": "registered"; };
@@ -72,5 +74,5 @@ export type Approval = { "approval_id": string; "tenant_id": string; "task_id"?:
 export type ApprovalPage = { "items": Array<Approval>; "page": PageInfo; };
 export type Entitlement = { "request_id": string; "tenant_id": string; "actor_id": string; "capability": string; "actions"?: Array<string>; "resource_id"?: string; "data_class"?: string; "tier": string; "budget"?: { "minor"?: number; "currency"?: string; }; "state": "usable" | "expired" | "revoked"; "expires_at": string; "granted_by"?: string; "revoked_at"?: string; "revoked_by"?: string; };
 export type EntitlementPage = { "items": Array<Entitlement>; "page": PageInfo; };
-export type ReceiptView = { "execution_state"?: "claimed" | "not_dispatched"; "receipt_id": string; "intent_id": string; "tenant_id": string; "task_id"?: string; "approval_id"?: string; "custody"?: string; "grant_id"?: string; "effect_id"?: string; "effect"?: string; "class": "denied" | "minted_unused" | "authorized" | "executed"; "record_hash": string; "issued_at": string; "rail_confirmed": boolean; "confirmed_at"?: string; "reported_by"?: string; "reported_at"?: string; "observed_at"?: string; "reported_outcome"?: string; "note"?: string; "receipt_hash"?: string; "policy_bundle_hash": string; "input_hash": string; "engine_version": string; "counts_toward_coverage": boolean; "result_mode"?: "digest" | "inline_bounded" | "rendezvous"; "payload_returned"?: true; "result_resource_id"?: string; "model_usage"?: ModelUsage; };
+export type ReceiptView = { "execution_state"?: "claimed" | "not_dispatched"; "receipt_id": string; "intent_id": string; "tenant_id": string; "task_id"?: string; "approval_id"?: string; "custody"?: string; "grant_id"?: string; "effect_id"?: string; "effect"?: string; "class": "denied" | "minted_unused" | "authorized" | "executed" | "deferred"; "record_hash": string; "issued_at": string; "rail_confirmed": boolean; "confirmed_at"?: string; "reported_by"?: string; "reported_at"?: string; "observed_at"?: string; "reported_outcome"?: string; "note"?: string; "receipt_hash"?: string; "policy_bundle_hash": string; "input_hash": string; "engine_version": string; "counts_toward_coverage": boolean; "result_mode"?: "digest" | "inline_bounded" | "rendezvous"; "payload_returned"?: true; "result_resource_id"?: string; "model_usage"?: ModelUsage; };
 export type ReceiptPage = { "items": Array<ReceiptView>; "page": PageInfo; };