@odingard/guardian-sdk 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,3248 @@
+// src/client.ts
+import { randomBytes } from "node:crypto";
+
+// src/proposal.ts
+import { z as z16 } from "zod";
+
+// src/contracts/action.ts
+import { z as z3 } from "zod";
+
+// src/contracts/authority.ts
+import { z as z2 } from "zod";
+
+// src/contracts/identifiers.ts
+import { z } from "zod";
+function identifier(prefix, brand) {
+  return z.string().regex(
+    new RegExp(`^${prefix}_[A-Za-z0-9][A-Za-z0-9_-]{7,119}$`),
+    `${brand} must use the ${prefix}_ prefix and contain 8-120 safe characters`
+  ).brand();
+}
+var TenantIdSchema = identifier("ten", "TenantId");
+var PrincipalIdSchema = identifier("pri", "PrincipalId");
+var AgentIdSchema = identifier("agt", "AgentId");
+var GrantIdSchema = identifier("grt", "GrantId");
+var PolicyIdSchema = identifier("pol", "PolicyId");
+var RequestIdSchema = identifier("req", "RequestId");
+var ApprovalIdSchema = identifier("apr", "ApprovalId");
+var CapabilityIdSchema = identifier("cap", "CapabilityId");
+var CorrelationIdSchema = identifier("cor", "CorrelationId");
+var EvidenceIdSchema = identifier("evd", "EvidenceId");
+var AdapterIdSchema = identifier("adp", "AdapterId");
+var ConnectionIdSchema = identifier("pcn", "ConnectionId");
+var AttemptIdSchema = identifier("att", "AttemptId");
+var BudgetIdSchema = identifier("bdg", "BudgetId");
+var TaskIdSchema = identifier("tsk", "TaskId");
+var NonceSchema = z.string().regex(
+  /^nce_[A-Za-z0-9_-]{22,116}$/,
+  "Nonce must use the nce_ prefix and contain 22-116 base64url-safe characters"
+).brand();
+
+// src/contracts/authority.ts
+var uniqueStrings = (values) => new Set(values).size === values.length;
+var sorted = (values) => [...values].sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+var CentsSchema = z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var FactLabelSchema = z2.string().trim().min(1).max(256);
+var RecurrencePolicySchema = z2.enum(["never", "allowed"]);
+var BudgetConsumptionSchema = z2.object({
+  budgetId: BudgetIdSchema,
+  amountCents: CentsSchema,
+  transactions: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).strict();
+var ActionTypeSchema = z2.string().trim().min(1).max(128).regex(/^[a-z][a-z0-9]*(?:[._:-][a-z0-9]+)*$/).brand();
+var ResourceRefSchema = z2.string().trim().min(1).max(512).refine(
+  (value) => value.normalize("NFC") === value,
+  "resource references must already use NFC normalization"
+).brand();
+var EpochMillisecondsSchema = z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+var AgentInterfaceSchema = z2.enum(["internal", "mcp", "rest"]);
+var PrincipalSchema = z2.object({
+  id: PrincipalIdSchema,
+  tenantId: TenantIdSchema,
+  status: z2.enum(["active", "disabled"])
+}).strict();
+var BudgetStateSchema = z2.object({
+  id: BudgetIdSchema,
+  scope: z2.enum(["agent", "task"]),
+  taskId: TaskIdSchema.optional(),
+  limitCents: CentsSchema,
+  consumedCents: CentsSchema,
+  transactionLimit: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  consumedTransactions: z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  expiresAtEpochMs: EpochMillisecondsSchema.optional(),
+  status: z2.enum(["active", "exhausted", "revoked"])
+}).strict().superRefine((budget, context) => {
+  if (budget.scope === "task" && budget.taskId === void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "task-scoped budgets must carry a taskId",
+      path: ["taskId"]
+    });
+  }
+});
+var AgentIdentitySchema = z2.object({
+  id: AgentIdSchema,
+  tenantId: TenantIdSchema,
+  ownerPrincipalId: PrincipalIdSchema,
+  status: z2.enum(["active", "disabled", "revoked"]),
+  allowedInterfaces: z2.array(AgentInterfaceSchema).min(1).refine(uniqueStrings, "allowedInterfaces must not contain duplicates").transform(sorted)
+}).strict();
+var AuthorityConstraintsSchema = z2.object({
+  actions: z2.array(ActionTypeSchema).min(1).max(64).refine(uniqueStrings, "actions must not contain duplicates").transform(sorted),
+  resources: z2.array(ResourceRefSchema).min(1).max(256).refine(uniqueStrings, "resources must not contain duplicates").transform(sorted),
+  adapterIds: z2.array(AdapterIdSchema).min(1).max(64).refine(uniqueStrings, "adapterIds must not contain duplicates").transform(sorted),
+  maxValueCents: z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+  maxUsesPerRequest: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  notBeforeEpochMs: EpochMillisecondsSchema.optional(),
+  expiresAtEpochMs: EpochMillisecondsSchema,
+  approvalRequired: z2.boolean(),
+  askAboveValueCents: CentsSchema.optional(),
+  merchantAllowlist: z2.array(FactLabelSchema).min(1).max(256).refine(uniqueStrings, "merchantAllowlist must not contain duplicates").transform(sorted).optional(),
+  categoryAllowlist: z2.array(FactLabelSchema).min(1).max(256).refine(uniqueStrings, "categoryAllowlist must not contain duplicates").transform(sorted).optional(),
+  recurrence: RecurrencePolicySchema.optional(),
+  budgetIds: z2.array(BudgetIdSchema).min(1).max(64).refine(uniqueStrings, "budgetIds must not contain duplicates").transform(sorted).optional()
+}).strict().superRefine((constraints, context) => {
+  if (constraints.askAboveValueCents !== void 0 && constraints.maxValueCents !== void 0 && constraints.askAboveValueCents >= constraints.maxValueCents) {
+    context.addIssue({
+      code: "custom",
+      message: "askAboveValueCents must be below maxValueCents",
+      path: ["askAboveValueCents"]
+    });
+  }
+}).superRefine((constraints, context) => {
+  if (constraints.notBeforeEpochMs !== void 0 && constraints.expiresAtEpochMs !== void 0 && constraints.notBeforeEpochMs >= constraints.expiresAtEpochMs) {
+    context.addIssue({
+      code: "custom",
+      message: "notBeforeEpochMs must be earlier than expiresAtEpochMs",
+      path: ["expiresAtEpochMs"]
+    });
+  }
+});
+var AuthorityGrantSchema = z2.object({
+  id: GrantIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  parentGrantId: GrantIdSchema.optional(),
+  issuedBy: z2.object({
+    type: z2.literal("principal"),
+    principalId: PrincipalIdSchema
+  }).strict(),
+  status: z2.enum(["active", "revoked", "disabled"]),
+  version: z2.number().int().positive(),
+  delegable: z2.boolean().default(false),
+  constraints: AuthorityConstraintsSchema
+}).strict().superRefine((grant, context) => {
+  if (grant.issuedBy.principalId !== grant.principalId) {
+    context.addIssue({
+      code: "custom",
+      message: "issuedBy principal must match the grant principal",
+      path: ["issuedBy", "principalId"]
+    });
+  }
+  if (grant.parentGrantId === grant.id) {
+    context.addIssue({
+      code: "custom",
+      message: "a grant cannot be its own parent",
+      path: ["parentGrantId"]
+    });
+  }
+});
+var AuthorityRequestSchema = z2.object({
+  id: RequestIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  action: ActionTypeSchema,
+  resource: ResourceRefSchema,
+  interface: AgentInterfaceSchema,
+  requestedAdapterId: AdapterIdSchema,
+  valueCents: z2.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+  uses: z2.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  materialActionDigest: z2.string().regex(/^[a-f0-9]{64}$/).optional(),
+  descriptiveContext: z2.string().max(8192).optional(),
+  merchantId: FactLabelSchema.optional(),
+  merchantCategory: FactLabelSchema.optional(),
+  recurring: z2.boolean().optional(),
+  taskId: TaskIdSchema.optional()
+}).strict();
+var DenyReasonCodeSchema = z2.enum([
+  "MALFORMED_INPUT",
+  "TENANT_MISMATCH",
+  "PRINCIPAL_MISMATCH",
+  "PRINCIPAL_NOT_ACTIVE",
+  "AGENT_TENANT_MISMATCH",
+  "AGENT_OWNER_MISMATCH",
+  "AGENT_MISMATCH",
+  "AGENT_NOT_ACTIVE",
+  "INTERFACE_NOT_ALLOWED",
+  "AUTHORITY_CHAIN_MISSING",
+  "DUPLICATE_GRANT_ID",
+  "GRANT_TENANT_MISMATCH",
+  "GRANT_PRINCIPAL_MISMATCH",
+  "GRANT_AGENT_MISMATCH",
+  "GRANT_NOT_ACTIVE",
+  "GRANT_REVOKED",
+  "GRANT_NOT_YET_VALID",
+  "GRANT_EXPIRED",
+  "INVALID_PARENT_LINK",
+  "DELEGATION_NOT_ALLOWED",
+  "AUTHORITY_AMPLIFICATION",
+  "ACTION_NOT_ALLOWED",
+  "RESOURCE_NOT_ALLOWED",
+  "ADAPTER_NOT_ALLOWED",
+  "VALUE_LIMIT_EXCEEDED",
+  "USE_LIMIT_EXCEEDED",
+  "MERCHANT_NOT_ALLOWED",
+  "CATEGORY_NOT_ALLOWED",
+  "RECURRENCE_NOT_ALLOWED",
+  "BUDGET_NOT_FOUND",
+  "BUDGET_SCOPE_MISMATCH",
+  "BUDGET_NOT_ACTIVE",
+  "BUDGET_EXPIRED",
+  "BUDGET_EXCEEDED",
+  "TRANSACTION_LIMIT_EXCEEDED"
+]);
+var PolicyReferenceSchema = z2.object({
+  id: PolicyIdSchema,
+  version: z2.number().int().positive()
+}).strict();
+var DecisionBindingSchema = z2.object({
+  requestId: RequestIdSchema.nullable(),
+  policy: PolicyReferenceSchema.nullable(),
+  evaluatedGrants: z2.array(
+    z2.object({
+      id: GrantIdSchema,
+      version: z2.number().int().positive()
+    }).strict()
+  ).max(32),
+  inputDigest: z2.string().regex(/^[a-f0-9]{64}$/).nullable(),
+  budgetConsumption: z2.array(BudgetConsumptionSchema).max(64).optional()
+}).strict();
+var AuthorityDecisionSchema = z2.discriminatedUnion("decision", [
+  z2.object({
+    decision: z2.literal("ALLOW"),
+    reasonCode: z2.literal("AUTHORIZED"),
+    binding: DecisionBindingSchema
+  }).strict(),
+  z2.object({
+    decision: z2.literal("ASK"),
+    reasonCode: z2.literal("APPROVAL_REQUIRED"),
+    binding: DecisionBindingSchema
+  }).strict(),
+  z2.object({
+    decision: z2.literal("DENY"),
+    reasonCode: DenyReasonCodeSchema,
+    binding: DecisionBindingSchema
+  }).strict()
+]);
+var RevocationSchema = z2.object({
+  grantId: GrantIdSchema,
+  revokedAtEpochMs: EpochMillisecondsSchema,
+  reasonCode: z2.string().trim().min(1).max(128)
+}).strict();
+
+// src/contracts/canonical-json.ts
+var MAX_CANONICAL_NODES = 1e5;
+function serialize(value, ancestors, depth = 0, budget = { remainingNodes: MAX_CANONICAL_NODES }) {
+  budget.remainingNodes -= 1;
+  if (budget.remainingNodes < 0) {
+    throw new TypeError("Canonical JSON exceeds maximum node count");
+  }
+  if (depth > 64) throw new TypeError("Canonical JSON exceeds maximum depth");
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return JSON.stringify(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Canonical JSON does not permit non-finite numbers");
+    }
+    return JSON.stringify(Object.is(value, -0) ? 0 : value);
+  }
+  if (Array.isArray(value)) {
+    if (ancestors.has(value))
+      throw new TypeError("Canonical JSON rejects cycles");
+    ancestors.add(value);
+    const keys2 = Reflect.ownKeys(value);
+    const expectedKeys = /* @__PURE__ */ new Set([
+      "length",
+      ...Array.from({ length: value.length }, (_, index) => String(index))
+    ]);
+    if (keys2.some((key) => typeof key !== "string" || !expectedKeys.has(key)) || keys2.length !== expectedKeys.size) {
+      ancestors.delete(value);
+      throw new TypeError(
+        "Canonical JSON rejects sparse arrays and extra properties"
+      );
+    }
+    const entries2 = Array.from({ length: value.length }, (_, index) => {
+      const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+      if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+        throw new TypeError(
+          "Canonical JSON rejects accessors and hidden values"
+        );
+      }
+      return serialize(descriptor.value, ancestors, depth + 1, budget);
+    });
+    const result2 = `[${entries2.join(",")}]`;
+    ancestors.delete(value);
+    return result2;
+  }
+  if (typeof value !== "object" || value === void 0) {
+    throw new TypeError(`Canonical JSON rejects ${typeof value}`);
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError("Canonical JSON accepts only plain objects and arrays");
+  }
+  if (ancestors.has(value))
+    throw new TypeError("Canonical JSON rejects cycles");
+  ancestors.add(value);
+  const keys = Reflect.ownKeys(value);
+  if (keys.some((key) => typeof key !== "string")) {
+    ancestors.delete(value);
+    throw new TypeError("Canonical JSON rejects symbol keys");
+  }
+  const entries = keys.map((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+      throw new TypeError(
+        "Canonical JSON rejects accessors and hidden values"
+      );
+    }
+    return [key, descriptor.value];
+  }).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+  const result = `{${entries.map(
+    ([key, entry]) => `${JSON.stringify(key)}:${serialize(entry, ancestors, depth + 1, budget)}`
+  ).join(",")}}`;
+  ancestors.delete(value);
+  return result;
+}
+function canonicalJson(value) {
+  return serialize(value, /* @__PURE__ */ new WeakSet());
+}
+
+// src/contracts/digest.ts
+import { createHash } from "node:crypto";
+function canonicalSha256(value) {
+  return createHash("sha256").update(canonicalJson(value), "utf8").digest("hex");
+}
+function sha256Text(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+
+// src/contracts/action.ts
+var SHA256Schema = z3.string().regex(/^[a-f0-9]{64}$/);
+var MAX_MATERIAL_BYTES = 32768;
+var MAX_MATERIAL_NODES = 4096;
+function normalizeCanonicalJson(value, depth = 0, ancestors = /* @__PURE__ */ new WeakSet(), budget = { remainingNodes: MAX_MATERIAL_NODES }) {
+  budget.remainingNodes -= 1;
+  if (budget.remainingNodes < 0) {
+    throw new TypeError("material parameters exceed maximum node count");
+  }
+  if (depth > 8)
+    throw new TypeError("material parameters exceed maximum depth");
+  if (value === null || typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    if (value.length > 8192 || value.normalize("NFC") !== value) {
+      throw new TypeError("material string is too long or not NFC-normalized");
+    }
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || Math.abs(value) > Number.MAX_SAFE_INTEGER || Object.is(value, -0)) {
+      throw new TypeError("material number is not canonical");
+    }
+    return value;
+  }
+  if (typeof value !== "object" || value === void 0 || ancestors.has(value)) {
+    throw new TypeError(
+      "material parameters contain an unsupported value or cycle"
+    );
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (value.length > 256)
+        throw new TypeError("material array is too large");
+      const keys2 = Reflect.ownKeys(value);
+      const expectedKeys = /* @__PURE__ */ new Set([
+        "length",
+        ...Array.from({ length: value.length }, (_, index) => String(index))
+      ]);
+      if (keys2.some((key) => typeof key !== "string" || !expectedKeys.has(key)) || keys2.length !== expectedKeys.size) {
+        throw new TypeError(
+          "material arrays must be dense and have no extra properties"
+        );
+      }
+      const normalized2 = Array.from({ length: value.length }, (_, index) => {
+        const descriptor = Object.getOwnPropertyDescriptor(
+          value,
+          String(index)
+        );
+        if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+          throw new TypeError(
+            "material arrays may contain only enumerable data values"
+          );
+        }
+        return normalizeCanonicalJson(
+          descriptor.value,
+          depth + 1,
+          ancestors,
+          budget
+        );
+      });
+      Object.freeze(normalized2);
+      return normalized2;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new TypeError(
+        "material parameters accept only plain objects and arrays"
+      );
+    }
+    const keys = Reflect.ownKeys(value);
+    if (keys.length > 128 || keys.some((key) => typeof key !== "string")) {
+      throw new TypeError(
+        "material objects are too large or contain symbol keys"
+      );
+    }
+    const normalized = /* @__PURE__ */ Object.create(
+      null
+    );
+    for (const key of keys) {
+      if (key.length === 0 || key.length > 128 || key.normalize("NFC") !== key || ["__proto__", "constructor", "prototype"].includes(key)) {
+        throw new TypeError("material object key is invalid");
+      }
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !("value" in descriptor) || !descriptor.enumerable) {
+        throw new TypeError(
+          "material objects may contain only enumerable data properties"
+        );
+      }
+      Object.defineProperty(normalized, key, {
+        value: normalizeCanonicalJson(
+          descriptor.value,
+          depth + 1,
+          ancestors,
+          budget
+        ),
+        enumerable: true,
+        writable: false,
+        configurable: false
+      });
+    }
+    return Object.freeze(normalized);
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function normalizeMaterialParameters(value) {
+  const normalized = normalizeCanonicalJson(value);
+  if (normalized === null || Array.isArray(normalized) || typeof normalized !== "object") {
+    throw new TypeError("material parameters must be an object");
+  }
+  if (new TextEncoder().encode(canonicalJson(normalized)).length > MAX_MATERIAL_BYTES) {
+    throw new TypeError("material parameters exceed maximum encoded size");
+  }
+  return normalized;
+}
+var MaterialParametersSchema = z3.unknown().transform((value, context) => {
+  try {
+    return normalizeMaterialParameters(value);
+  } catch {
+    context.addIssue({
+      code: "custom",
+      message: "material parameters must be a bounded canonical JSON object"
+    });
+    return z3.NEVER;
+  }
+});
+var AuthorityReferenceSchema = z3.object({
+  policy: PolicyReferenceSchema,
+  evaluatedGrants: z3.array(
+    z3.object({
+      id: GrantIdSchema,
+      version: z3.number().int().positive()
+    }).strict()
+  ).min(1).max(32).refine(
+    (grants) => new Set(grants.map((grant) => grant.id)).size === grants.length,
+    "evaluated grant identifiers must be unique"
+  )
+}).strict();
+var MaterialActionSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  action: ActionTypeSchema,
+  resource: ResourceRefSchema,
+  interface: AgentInterfaceSchema,
+  valueCents: z3.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+  merchantId: z3.string().trim().min(1).max(256).optional(),
+  merchantCategory: z3.string().trim().min(1).max(256).optional(),
+  recurring: z3.boolean().optional(),
+  taskId: TaskIdSchema.optional(),
+  uses: z3.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  materialParameters: MaterialParametersSchema,
+  initiatingContext: z3.enum(["user", "scheduled", "agent", "external-event"]),
+  authority: AuthorityReferenceSchema,
+  issuedAtEpochMs: EpochMillisecondsSchema,
+  expiresAtEpochMs: EpochMillisecondsSchema,
+  nonce: NonceSchema,
+  requestedAdapterId: AdapterIdSchema
+}).strict().superRefine((value, context) => {
+  if (!Object.prototype.hasOwnProperty.call(value, "materialParameters")) {
+    context.addIssue({
+      code: "custom",
+      path: ["materialParameters"],
+      message: "materialParameters must be explicitly present"
+    });
+  }
+  if (value.issuedAtEpochMs >= value.expiresAtEpochMs) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAtEpochMs"],
+      message: "expiresAtEpochMs must be later than issuedAtEpochMs"
+    });
+  }
+});
+var CanonicalActionEnvelopeSchema = MaterialActionSchema.extend({
+  purpose: z3.string().trim().min(1).max(1024).refine((value) => value.normalize("NFC") === value)
+}).strict();
+var CanonicalActionSchema = CanonicalActionEnvelopeSchema.extend({
+  materialDigest: SHA256Schema
+}).strict().superRefine((value, context) => {
+  try {
+    const material = MaterialActionSchema.strip().parse(value);
+    if (materialActionDigest(material) === value.materialDigest) return;
+    context.addIssue({
+      code: "custom",
+      path: ["materialDigest"],
+      message: "materialDigest does not match the canonical action"
+    });
+  } catch {
+    context.addIssue({
+      code: "custom",
+      path: ["materialDigest"],
+      message: "canonical action cannot be safely digested"
+    });
+  }
+});
+var RecordedAuthorityEvaluationInputSchema = z3.object({
+  nowEpochMs: EpochMillisecondsSchema,
+  principal: PrincipalSchema,
+  agent: AgentIdentitySchema,
+  request: AuthorityRequestSchema,
+  policy: PolicyReferenceSchema,
+  authorityChain: z3.array(AuthorityGrantSchema).max(32),
+  revocations: z3.array(RevocationSchema).max(256).transform(
+    (values) => [...values].sort(
+      (left, right) => left.grantId < right.grantId ? -1 : left.grantId > right.grantId ? 1 : left.revokedAtEpochMs - right.revokedAtEpochMs
+    )
+  ),
+  budgets: z3.array(BudgetStateSchema).max(64).default([]).transform(
+    (values) => [...values].sort((left, right) => left.id < right.id ? -1 : 1)
+  )
+}).strict();
+var ActionDecisionRecordCoreSchema = z3.object({
+  schemaVersion: z3.literal(1),
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  actionDigest: SHA256Schema,
+  policy: PolicyReferenceSchema,
+  evaluatedGrants: AuthorityReferenceSchema.shape.evaluatedGrants,
+  action: CanonicalActionSchema,
+  authorityRequest: AuthorityRequestSchema,
+  authorityEvaluationInput: RecordedAuthorityEvaluationInputSchema,
+  authorityDecision: AuthorityDecisionSchema,
+  decidedAtEpochMs: EpochMillisecondsSchema
+}).strict();
+var ActionDecisionRecordSchema = ActionDecisionRecordCoreSchema.extend(
+  {
+    recordDigest: SHA256Schema
+  }
+).strict().superRefine((value, context) => {
+  try {
+    const binding = value.authorityDecision.binding;
+    const expectedRequest = toAuthorityRequest(value.action);
+    if (value.tenantId !== value.action.tenantId || value.principalId !== value.action.principalId || value.agentId !== value.action.agentId || value.requestId !== value.action.requestId || value.correlationId !== value.action.correlationId || value.actionDigest !== value.action.materialDigest) {
+      context.addIssue({
+        code: "custom",
+        path: ["actionDigest"],
+        message: "action decision context does not match the canonical action"
+      });
+    }
+    if (value.policy.id !== value.action.authority.policy.id || value.policy.version !== value.action.authority.policy.version || canonicalSha256(value.evaluatedGrants) !== canonicalSha256(value.action.authority.evaluatedGrants)) {
+      context.addIssue({
+        code: "custom",
+        path: ["policy"],
+        message: "action decision authority references do not match the action"
+      });
+    }
+    if (canonicalSha256(value.authorityRequest) !== canonicalSha256(expectedRequest)) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityRequest"],
+        message: "authority request does not match the canonical action"
+      });
+    }
+    if (canonicalSha256(value.authorityEvaluationInput.request) !== canonicalSha256(expectedRequest) || canonicalSha256(value.authorityEvaluationInput.policy) !== canonicalSha256(value.action.authority.policy) || value.authorityEvaluationInput.principal.id !== value.action.principalId || value.authorityEvaluationInput.principal.tenantId !== value.action.tenantId || value.authorityEvaluationInput.agent.id !== value.action.agentId || value.authorityEvaluationInput.agent.tenantId !== value.action.tenantId || value.authorityEvaluationInput.agent.ownerPrincipalId !== value.action.principalId || value.authorityEvaluationInput.principal.status !== "active" || value.authorityEvaluationInput.agent.status !== "active" || !value.authorityEvaluationInput.agent.allowedInterfaces.includes(
+      value.action.interface
+    ) || value.authorityEvaluationInput.authorityChain.some(
+      (grant) => grant.tenantId !== value.action.tenantId || grant.principalId !== value.action.principalId || grant.agentId !== value.action.agentId || grant.status !== "active"
+    )) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityEvaluationInput"],
+        message: "evaluated authority input does not match the canonical action"
+      });
+    }
+    if (binding.requestId !== value.action.requestId) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityDecision", "binding", "requestId"],
+        message: "decision request binding does not match the action"
+      });
+    }
+    if (binding.policy === null || binding.policy.id !== value.action.authority.policy.id || binding.policy.version !== value.action.authority.policy.version) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityDecision", "binding", "policy"],
+        message: "decision policy binding does not match the action"
+      });
+    }
+    if (canonicalSha256(binding.evaluatedGrants) !== canonicalSha256(value.action.authority.evaluatedGrants)) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityDecision", "binding", "evaluatedGrants"],
+        message: "decision grant bindings do not match the action"
+      });
+    }
+    if (binding.inputDigest === null || binding.inputDigest !== canonicalSha256(value.authorityEvaluationInput)) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityDecision", "binding", "inputDigest"],
+        message: "decision input digest does not match the evaluated authority input"
+      });
+    }
+    const grantNotBeforeEpochMs = Math.max(
+      0,
+      ...value.authorityEvaluationInput.authorityChain.map(
+        (grant) => grant.constraints.notBeforeEpochMs ?? 0
+      )
+    );
+    const grantExpiresAtEpochMs = Math.min(
+      ...value.authorityEvaluationInput.authorityChain.map(
+        (grant) => grant.constraints.expiresAtEpochMs
+      )
+    );
+    if (value.authorityEvaluationInput.nowEpochMs !== value.decidedAtEpochMs || value.decidedAtEpochMs < value.action.issuedAtEpochMs || value.decidedAtEpochMs >= value.action.expiresAtEpochMs) {
+      context.addIssue({
+        code: "custom",
+        path: ["decidedAtEpochMs"],
+        message: "decision time must fall within the action validity window"
+      });
+    }
+    if (value.authorityEvaluationInput.authorityChain.length === 0 || value.action.issuedAtEpochMs < grantNotBeforeEpochMs || value.action.expiresAtEpochMs > grantExpiresAtEpochMs) {
+      context.addIssue({
+        code: "custom",
+        path: ["action", "expiresAtEpochMs"],
+        message: "action validity window must be contained by evaluated grants"
+      });
+    }
+    const evaluatedGrantReferences = value.authorityEvaluationInput.authorityChain.map(
+      ({ id, version }) => ({
+        id,
+        version
+      })
+    );
+    if (canonicalSha256(evaluatedGrantReferences) !== canonicalSha256(value.action.authority.evaluatedGrants)) {
+      context.addIssue({
+        code: "custom",
+        path: ["authorityEvaluationInput", "authorityChain"],
+        message: "evaluated authority chain does not match declared grants"
+      });
+    }
+    const core = ActionDecisionRecordCoreSchema.strip().parse(value);
+    if (actionDecisionRecordDigest(core) !== value.recordDigest) {
+      context.addIssue({
+        code: "custom",
+        path: ["recordDigest"],
+        message: "recordDigest does not match the action decision record"
+      });
+    }
+  } catch {
+    context.addIssue({
+      code: "custom",
+      path: ["recordDigest"],
+      message: "action decision record cannot be safely verified"
+    });
+  }
+});
+var MATERIAL_ACTION_KEYS = Object.keys(
+  MaterialActionSchema.shape
+);
+function materialActionDigest(material) {
+  return canonicalSha256({
+    domain: "odingard.guardian.action.v1",
+    materialAction: material
+  });
+}
+function actionDecisionRecordDigest(record) {
+  return canonicalSha256({
+    domain: "odingard.guardian.action-decision.v1",
+    record
+  });
+}
+function toAuthorityRequest(action) {
+  return AuthorityRequestSchema.parse({
+    id: action.requestId,
+    tenantId: action.tenantId,
+    principalId: action.principalId,
+    agentId: action.agentId,
+    action: action.action,
+    resource: action.resource,
+    interface: action.interface,
+    requestedAdapterId: action.requestedAdapterId,
+    ...action.valueCents === void 0 ? {} : { valueCents: action.valueCents },
+    uses: action.uses,
+    materialActionDigest: action.materialDigest,
+    descriptiveContext: action.purpose,
+    ...action.merchantId === void 0 ? {} : { merchantId: action.merchantId },
+    ...action.merchantCategory === void 0 ? {} : { merchantCategory: action.merchantCategory },
+    ...action.recurring === void 0 ? {} : { recurring: action.recurring },
+    ...action.taskId === void 0 ? {} : { taskId: action.taskId }
+  });
+}
+
+// src/contracts/email.ts
+import { z as z4 } from "zod";
+var LOCAL_ATEXT = /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+$/;
+var DOMAIN_LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+function isNoncharacter(codePoint) {
+  return codePoint >= 64976 && codePoint <= 65007 || (codePoint & 65535) === 65534 || (codePoint & 65535) === 65535;
+}
+function hasNoncharacter(value) {
+  return [...value].some(
+    (character) => isNoncharacter(character.codePointAt(0) ?? 0)
+  );
+}
+function isCanonicalEmailAddress(value) {
+  if (![...value].every((character) => (character.codePointAt(0) ?? 128) < 128) || value.length > 254 || value.normalize("NFC") !== value) {
+    return false;
+  }
+  const at = value.indexOf("@");
+  if (at <= 0 || at !== value.lastIndexOf("@")) return false;
+  const local = value.slice(0, at);
+  const domain = value.slice(at + 1);
+  if (local.length > 64 || !LOCAL_ATEXT.test(local) || local.startsWith(".") || local.endsWith(".") || local.includes("..") || domain.length > 253 || domain !== domain.toLowerCase()) {
+    return false;
+  }
+  const labels = domain.split(".");
+  if (labels.length < 2 || labels.some((label) => !DOMAIN_LABEL.test(label))) {
+    return false;
+  }
+  const topLevel = labels.at(-1) ?? "";
+  return /^[a-z]{2,63}$/.test(topLevel) || /^xn--[a-z0-9](?:[a-z0-9-]{0,57}[a-z0-9])?$/.test(topLevel);
+}
+function isSafeSubject(value) {
+  return value === value.trim() && value.normalize("NFC") === value && [...value].length >= 1 && [...value].length <= 200 && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Co}\p{Cs}\p{Cn}]/u.test(value) && !hasNoncharacter(value);
+}
+function isSafeBody(value) {
+  if (value.length < 1 || value.length > 8e3 || value.normalize("NFC") !== value || !/\S/u.test(value) || /\r/u.test(value) || /[\p{Co}\p{Cs}\p{Cn}]/u.test(value) || hasNoncharacter(value)) {
+    return false;
+  }
+  for (const character of value) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    if (codePoint < 32 && codePoint !== 9 && codePoint !== 10 || codePoint === 127 || codePoint === 1564 || codePoint === 8206 || codePoint === 8207 || codePoint >= 8234 && codePoint <= 8238 || codePoint >= 8288 && codePoint <= 8292 || codePoint >= 8294 && codePoint <= 8297 || codePoint === 8203 || codePoint === 65279 || codePoint >= 917504 && codePoint <= 917631) {
+      return false;
+    }
+  }
+  return true;
+}
+var EmailAddressSchema = z4.string().refine(isCanonicalEmailAddress, "email address must be canonical ASCII");
+var EmailSubjectSchema = z4.string().refine(isSafeSubject, "email subject contains unsafe or noncanonical text");
+var EmailBodyTextSchema = z4.string().refine(isSafeBody, "email body contains unsafe or noncanonical text");
+var EmailSendParametersV1Schema = z4.object({
+  schema: z4.literal("odingard.guardian.email.send.v1"),
+  connectionId: ConnectionIdSchema,
+  from: EmailAddressSchema,
+  to: z4.array(EmailAddressSchema).min(1).max(20),
+  cc: z4.array(EmailAddressSchema).max(20),
+  bcc: z4.array(EmailAddressSchema).max(20),
+  replyTo: z4.array(z4.never()).max(0),
+  subject: EmailSubjectSchema,
+  body: z4.object({ format: z4.literal("text/plain"), text: EmailBodyTextSchema }).strict(),
+  attachments: z4.array(z4.never()).max(0),
+  inReplyTo: z4.null()
+}).strict().superRefine((value, context) => {
+  const recipients = [...value.to, ...value.cc, ...value.bcc].map(
+    (address) => address.toLowerCase()
+  );
+  if (recipients.length > 20) {
+    context.addIssue({
+      code: "custom",
+      path: ["to"],
+      message: "at most 20 total recipients are allowed"
+    });
+  }
+  if (new Set(recipients).size !== recipients.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["to"],
+      message: "recipient addresses must be unique across all lists"
+    });
+  }
+});
+function canonicalBodyForComparison(text) {
+  return text.replace(/\r\n?/gu, "\n").replace(/[ \t\n]*$/u, "");
+}
+function canonicalRecipients(addresses) {
+  return [...new Set(addresses.map((address) => address.toLowerCase()))].sort();
+}
+function emailVerificationProjection(input) {
+  const params = EmailSendParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.email-projection.v1",
+    sender: params.from.toLowerCase(),
+    to: canonicalRecipients(params.to),
+    cc: canonicalRecipients(params.cc),
+    bcc: canonicalRecipients(params.bcc),
+    replyTo: [],
+    subject: params.subject,
+    bodyDigest: sha256Text(canonicalBodyForComparison(params.body.text)),
+    attachmentCount: 0,
+    inReplyTo: null
+  });
+}
+function emailEnvelopeProjection(input) {
+  const projection = emailVerificationProjection(input);
+  return Object.freeze({
+    domain: projection.domain,
+    sender: projection.sender,
+    to: projection.to,
+    cc: projection.cc,
+    bcc: projection.bcc,
+    replyTo: projection.replyTo,
+    subject: projection.subject,
+    attachmentCount: projection.attachmentCount,
+    inReplyTo: projection.inReplyTo
+  });
+}
+
+// src/contracts/api.ts
+import { z as z5 } from "zod";
+var ApiRequestMethodSchema = z5.enum([
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE"
+]);
+var API_REQUEST_BODY_MAX_LENGTH = 16384;
+var API_REQUEST_MAX_HEADERS = 32;
+var API_RESPONSE_BODY_CAPTURE_MAX_BYTES = 16 * 1024;
+var HEADER_NAME = /^[a-z0-9][a-z0-9-]{0,126}$/;
+var FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "proxy-authenticate",
+  "www-authenticate",
+  "host",
+  "content-length",
+  "connection",
+  "keep-alive",
+  "transfer-encoding",
+  "te",
+  "trailer",
+  "trailers",
+  "upgrade",
+  "expect",
+  "cookie",
+  "set-cookie"
+]);
+function isSafeApiHeaderValue(value) {
+  if (value.length === 0 || value.length > 8192) return false;
+  for (const character of value) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    if (codePoint < 32 && codePoint !== 9 || codePoint === 127 || codePoint > 255) {
+      return false;
+    }
+  }
+  return true;
+}
+function canonicalizeApiRequestUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:") return null;
+  const urlMap = url;
+  if (urlMap.username !== "" || urlMap["password"] !== "") return null;
+  if (url.hash !== "") return null;
+  if (url.hostname.length === 0) return null;
+  url.hostname = url.hostname.toLowerCase();
+  if (url.port === "443") url.port = "";
+  url.searchParams.sort();
+  return url.toString();
+}
+var ApiRequestUrlSchema = z5.string().min(8).max(2048).refine(
+  (value) => canonicalizeApiRequestUrl(value) === value,
+  "api request url must be an already-canonical https URL"
+);
+var ApiRequestHeaderSchema = z5.object({ name: z5.string().regex(HEADER_NAME), value: z5.string() }).strict();
+var ApiRequestParametersV1Schema = z5.object({
+  schema: z5.literal("odingard.guardian.api.request.v1"),
+  connectionId: ConnectionIdSchema,
+  method: ApiRequestMethodSchema,
+  url: ApiRequestUrlSchema,
+  headers: z5.array(ApiRequestHeaderSchema).max(API_REQUEST_MAX_HEADERS).refine(
+    (headers) => {
+      const seen = /* @__PURE__ */ new Set();
+      for (const header of headers) {
+        if (seen.has(header.name) || FORBIDDEN_HEADERS.has(header.name)) {
+          return false;
+        }
+        seen.add(header.name);
+      }
+      return true;
+    },
+    {
+      message: "header names must be unique lowercase tokens and must not set auth, routing, or hop-by-hop headers"
+    }
+  ).refine(
+    (headers) => headers.every((h) => isSafeApiHeaderValue(h.value)),
+    {
+      message: "header values must be printable latin-1 without controls"
+    }
+  ),
+  body: z5.string().min(1).max(API_REQUEST_BODY_MAX_LENGTH).refine(
+    (value) => value.normalize("NFC") === value,
+    "request body must already use NFC normalization"
+  ).optional(),
+  idempotencyKey: z5.string().min(8).max(128).regex(/^[A-Za-z0-9._-]+$/u).optional()
+}).strict().superRefine((value, context) => {
+  if ((value.method === "GET" || value.method === "HEAD") && value.body !== void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["body"],
+      message: "GET and HEAD requests may not carry a body"
+    });
+  }
+});
+function canonicalHeaders(headers) {
+  return [...headers].map((header) => ({ name: header.name, value: header.value.trim() })).sort((a, b) => a.name.localeCompare(b.name));
+}
+function apiVerificationProjection(input) {
+  const params = ApiRequestParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.api-projection.v1",
+    connectionId: params.connectionId,
+    method: params.method,
+    url: params.url,
+    headersDigest: canonicalSha256({
+      domain: "odingard.guardian.api-headers.v1",
+      headers: canonicalHeaders(params.headers)
+    }),
+    bodyDigest: params.body === void 0 ? null : sha256Text(params.body),
+    idempotencyKey: params.idempotencyKey ?? null
+  });
+}
+function apiEnvelopeProjection(input) {
+  return apiVerificationProjection(input);
+}
+function apiEndpointWithinAllowlist(canonicalUrl, allowlist) {
+  for (const entry of allowlist) {
+    if (canonicalUrl === entry) return true;
+    if (entry.endsWith("/") && canonicalUrl.startsWith(entry)) return true;
+    if (!entry.endsWith("/") && (canonicalUrl.startsWith(`${entry}/`) || canonicalUrl.startsWith(`${entry}?`))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// src/contracts/commerce.ts
+import { z as z6 } from "zod";
+var FactLabelSchema2 = z6.string().trim().min(1).max(256);
+var CentsSchema2 = z6.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var IdempotencyKeySchema = z6.string().trim().min(8).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/);
+var NfcText = (max) => z6.string().trim().min(1).max(max).refine((value) => value.normalize("NFC") === value);
+var CommercePurchaseParametersV1Schema = z6.object({
+  schema: z6.literal("commerce.purchase.v1"),
+  connectionId: ConnectionIdSchema,
+  merchantId: FactLabelSchema2,
+  merchantCategory: FactLabelSchema2,
+  amountCents: CentsSchema2,
+  currency: z6.literal("USD"),
+  orderDescription: NfcText(512),
+  idempotencyKey: IdempotencyKeySchema,
+  taskId: TaskIdSchema.optional()
+}).strict();
+var CommerceRefundParametersV1Schema = z6.object({
+  schema: z6.literal("commerce.refund.v1"),
+  connectionId: ConnectionIdSchema,
+  chargeId: z6.string().trim().min(1).max(128),
+  amountCents: CentsSchema2.optional(),
+  reason: NfcText(256)
+}).strict();
+var CommerceReturnParametersV1Schema = z6.object({
+  schema: z6.literal("commerce.return.v1"),
+  connectionId: ConnectionIdSchema,
+  chargeId: z6.string().trim().min(1).max(128),
+  reason: NfcText(256)
+}).strict();
+var SubscriptionCreateParametersV1Schema = z6.object({
+  schema: z6.literal("subscription.create.v1"),
+  connectionId: ConnectionIdSchema,
+  merchantId: FactLabelSchema2,
+  planId: z6.string().trim().min(1).max(128),
+  amountCents: CentsSchema2,
+  currency: z6.literal("USD"),
+  interval: z6.enum(["week", "month", "year"]),
+  idempotencyKey: IdempotencyKeySchema
+}).strict();
+function commercePurchaseVerificationProjection(input) {
+  const params = CommercePurchaseParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.commerce-projection.v1",
+    action: "commerce.purchase",
+    connectionId: params.connectionId,
+    merchantId: params.merchantId,
+    merchantCategory: params.merchantCategory,
+    amountCents: params.amountCents,
+    currency: params.currency,
+    descriptionDigest: sha256Text(params.orderDescription),
+    idempotencyKey: params.idempotencyKey,
+    taskId: params.taskId ?? null
+  });
+}
+function commercePurchaseEnvelopeProjection(input) {
+  return commercePurchaseVerificationProjection(input);
+}
+function commerceRefundVerificationProjection(input) {
+  const params = CommerceRefundParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.commerce-projection.v1",
+    action: "commerce.refund",
+    connectionId: params.connectionId,
+    chargeId: params.chargeId,
+    amountCents: params.amountCents ?? null,
+    reasonDigest: sha256Text(params.reason)
+  });
+}
+function commerceRefundEnvelopeProjection(input) {
+  return commerceRefundVerificationProjection(input);
+}
+function commerceReturnVerificationProjection(input) {
+  const params = CommerceReturnParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.commerce-projection.v1",
+    action: "commerce.return",
+    connectionId: params.connectionId,
+    chargeId: params.chargeId,
+    reasonDigest: sha256Text(params.reason)
+  });
+}
+function commerceReturnEnvelopeProjection(input) {
+  return commerceReturnVerificationProjection(input);
+}
+function subscriptionCreateVerificationProjection(input) {
+  const params = SubscriptionCreateParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.commerce-projection.v1",
+    action: "subscription.create",
+    connectionId: params.connectionId,
+    merchantId: params.merchantId,
+    planId: params.planId,
+    amountCents: params.amountCents,
+    currency: params.currency,
+    interval: params.interval,
+    idempotencyKey: params.idempotencyKey
+  });
+}
+function subscriptionCreateEnvelopeProjection(input) {
+  return subscriptionCreateVerificationProjection(input);
+}
+
+// src/contracts/calendar.ts
+import { z as z7 } from "zod";
+var CalendarIdSchema = z7.string().trim().min(1).max(256).regex(/^[A-Za-z0-9_][A-Za-z0-9_.@%+-]*$/, "invalid calendar id");
+var EventIdSchema = z7.string().trim().min(1).max(512).regex(/^[A-Za-z0-9_-]+$/, "invalid event id");
+var EventTimeSchema = z7.object({
+  // RFC 3339 timestamp (what the Google Calendar API accepts).
+  dateTime: z7.string().regex(
+    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,
+    "dateTime must be an RFC 3339 timestamp"
+  ),
+  timeZone: z7.string().trim().min(1).max(64).optional()
+}).strict();
+var SendUpdatesSchema = z7.enum(["all", "externalOnly", "none"]).optional();
+var AttendeeSchema = z7.object({
+  email: z7.string().trim().min(3).max(320).regex(/^[^\s@]+@[^\s@]+\.[^\s@]+$/, "invalid attendee email"),
+  optional: z7.boolean().optional()
+}).strict();
+var CalendarBaseSchema = z7.object({
+  connectionId: ConnectionIdSchema,
+  calendarId: CalendarIdSchema
+});
+var CalendarCreateParametersV1Schema = CalendarBaseSchema.extend({
+  schema: z7.literal("odingard.guardian.calendar.create.v1"),
+  summary: z7.string().trim().min(1).max(1024),
+  description: z7.string().max(8192).optional(),
+  location: z7.string().max(1024).optional(),
+  start: EventTimeSchema,
+  end: EventTimeSchema,
+  idempotencyKey: z7.string().min(8).max(128).optional()
+}).strict();
+var CalendarUpdateParametersV1Schema = CalendarBaseSchema.extend({
+  schema: z7.literal("odingard.guardian.calendar.update.v1"),
+  eventId: EventIdSchema,
+  summary: z7.string().trim().min(1).max(1024).optional(),
+  description: z7.string().max(8192).optional(),
+  location: z7.string().max(1024).optional(),
+  start: EventTimeSchema.optional(),
+  end: EventTimeSchema.optional(),
+  sendUpdates: SendUpdatesSchema
+}).strict().refine(
+  (params) => params.summary !== void 0 || params.description !== void 0 || params.location !== void 0 || params.start !== void 0 || params.end !== void 0,
+  "calendar.update must carry at least one changed field"
+);
+var CalendarCancelParametersV1Schema = CalendarBaseSchema.extend({
+  schema: z7.literal("odingard.guardian.calendar.cancel.v1"),
+  eventId: EventIdSchema,
+  sendUpdates: SendUpdatesSchema
+}).strict();
+var CalendarInviteParametersV1Schema = CalendarBaseSchema.extend({
+  schema: z7.literal("odingard.guardian.calendar.invite.v1"),
+  eventId: EventIdSchema,
+  attendees: z7.array(AttendeeSchema).min(1).max(50),
+  sendUpdates: SendUpdatesSchema
+}).strict();
+var CalendarParametersV1Schema = z7.discriminatedUnion("schema", [
+  CalendarCreateParametersV1Schema,
+  CalendarUpdateParametersV1Schema,
+  CalendarCancelParametersV1Schema,
+  CalendarInviteParametersV1Schema
+]);
+function attendeeEmails(attendees) {
+  return [...new Set(attendees.map((a) => a.email.toLowerCase()))].sort();
+}
+function calendarVerificationProjection(params) {
+  switch (params.schema) {
+    case "odingard.guardian.calendar.create.v1":
+      return {
+        kind: "calendar.create",
+        calendarId: params.calendarId,
+        summary: params.summary,
+        ...params.description === void 0 ? {} : { description: params.description },
+        ...params.location === void 0 ? {} : { location: params.location },
+        start: params.start,
+        end: params.end
+      };
+    case "odingard.guardian.calendar.update.v1":
+      return {
+        kind: "calendar.update",
+        calendarId: params.calendarId,
+        eventId: params.eventId,
+        ...params.summary === void 0 ? {} : { summary: params.summary },
+        ...params.description === void 0 ? {} : { description: params.description },
+        ...params.location === void 0 ? {} : { location: params.location },
+        ...params.start === void 0 ? {} : { start: params.start },
+        ...params.end === void 0 ? {} : { end: params.end },
+        sendUpdates: params.sendUpdates ?? "none"
+      };
+    case "odingard.guardian.calendar.cancel.v1":
+      return {
+        kind: "calendar.cancel",
+        calendarId: params.calendarId,
+        eventId: params.eventId,
+        outcome: "cancelled",
+        sendUpdates: params.sendUpdates ?? "none"
+      };
+    case "odingard.guardian.calendar.invite.v1":
+      return {
+        kind: "calendar.invite",
+        calendarId: params.calendarId,
+        eventId: params.eventId,
+        attendees: attendeeEmails(params.attendees),
+        sendUpdates: params.sendUpdates ?? "none"
+      };
+  }
+}
+function calendarEnvelopeProjection(params) {
+  const base = {
+    calendarId: params.calendarId,
+    ..."eventId" in params && params.eventId !== void 0 ? { eventId: params.eventId } : {}
+  };
+  switch (params.schema) {
+    case "odingard.guardian.calendar.create.v1":
+      return { kind: "calendar.create", ...base };
+    case "odingard.guardian.calendar.update.v1":
+      return { kind: "calendar.update", ...base };
+    case "odingard.guardian.calendar.cancel.v1":
+      return { kind: "calendar.cancel", ...base };
+    case "odingard.guardian.calendar.invite.v1":
+      return { kind: "calendar.invite", ...base };
+  }
+}
+
+// src/contracts/files.ts
+import { z as z8 } from "zod";
+var FILE_PATH_MAX_LENGTH = 512;
+var FILE_CONTENT_MAX_LENGTH = 64e3;
+var FILE_GRANTEE_MAX_LENGTH = 256;
+var FILE_PATH_SEGMENT = /^[A-Za-z0-9._~-]+$/;
+function isCanonicalFilePath(value) {
+  if (value.length < 2 || value.length > FILE_PATH_MAX_LENGTH) return false;
+  if (!value.startsWith("/") || value.endsWith("/")) return false;
+  if (value.includes("//")) return false;
+  for (const segment of value.slice(1).split("/")) {
+    if (segment === "." || segment === "..") return false;
+    if (!FILE_PATH_SEGMENT.test(segment)) return false;
+  }
+  return true;
+}
+var FilePathSchema = z8.string().min(2).max(FILE_PATH_MAX_LENGTH).refine(isCanonicalFilePath, "file path must be canonical posix");
+var CounterpartyTokenSchema = z8.string().min(1).max(FILE_GRANTEE_MAX_LENGTH).regex(/^[A-Za-z0-9._~+@-]+$/u, "counterparty token charset");
+var FILE_READ_SCHEMA = "odingard.guardian.file.read.v1";
+var FILE_WRITE_SCHEMA = "odingard.guardian.file.write.v1";
+var FILE_SHARE_SCHEMA = "odingard.guardian.file.share.v1";
+var FILE_DELETE_SCHEMA = "odingard.guardian.file.delete.v1";
+var FileReadParametersV1Schema = z8.object({
+  schema: z8.literal(FILE_READ_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  path: FilePathSchema
+}).strict();
+var FileWriteParametersV1Schema = z8.object({
+  schema: z8.literal(FILE_WRITE_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  path: FilePathSchema,
+  content: z8.string().max(FILE_CONTENT_MAX_LENGTH).refine(
+    (value) => value.normalize("NFC") === value,
+    "file content must already use NFC normalization"
+  )
+}).strict();
+var FileShareParametersV1Schema = z8.object({
+  schema: z8.literal(FILE_SHARE_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  path: FilePathSchema,
+  grantee: CounterpartyTokenSchema,
+  expiresAtEpochMs: z8.number().int().positive().safe().optional()
+}).strict();
+var FileDeleteParametersV1Schema = z8.object({
+  schema: z8.literal(FILE_DELETE_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  path: FilePathSchema
+}).strict();
+function filePathWithinAllowlist(path, allowlist) {
+  for (const entry of allowlist) {
+    if (!isCanonicalFilePath(entry) && !entry.endsWith("/")) continue;
+    if (path === entry) return true;
+    if (entry.endsWith("/") && path.startsWith(entry)) return true;
+    if (path.startsWith(`${entry}/`)) return true;
+  }
+  return false;
+}
+function fileReadVerificationProjection(input) {
+  const params = FileReadParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.file-read-projection.v1",
+    connectionId: params.connectionId,
+    path: params.path
+  });
+}
+function fileWriteVerificationProjection(input) {
+  const params = FileWriteParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.file-write-projection.v1",
+    connectionId: params.connectionId,
+    path: params.path,
+    contentDigest: sha256Text(params.content),
+    bytes: params.content.length
+  });
+}
+function fileShareVerificationProjection(input) {
+  const params = FileShareParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.file-share-projection.v1",
+    connectionId: params.connectionId,
+    path: params.path,
+    grantee: params.grantee,
+    expiresAtEpochMs: params.expiresAtEpochMs ?? null
+  });
+}
+function fileDeleteVerificationProjection(input) {
+  const params = FileDeleteParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.file-delete-projection.v1",
+    connectionId: params.connectionId,
+    path: params.path
+  });
+}
+
+// src/contracts/protected-data.ts
+import { z as z9 } from "zod";
+var PROTECTED_FIELD_REF_MAX_LENGTH = 64;
+var PROTECTED_VALUE_MAX_LENGTH = 4096;
+var PROTECTED_CATALOG_MAX_ENTRIES = 128;
+var PROTECTED_USE_SINKS_MAX_ENTRIES = 16;
+var PROTECTED_DISCLOSE_TARGETS_MAX_ENTRIES = 32;
+var ProtectedFieldRefSchema = z9.string().min(1).max(PROTECTED_FIELD_REF_MAX_LENGTH).regex(
+  /^[a-z0-9][a-z0-9._-]*$/u,
+  "field refs are lowercase tokens (no traversal, no globs)"
+);
+var ProtectedUseSinkSchema = z9.object({
+  /** The file connection whose store receives the injected value. */
+  connectionId: ConnectionIdSchema,
+  /** Canonical path prefix the agent's sink path must sit under. */
+  pathPrefix: z9.string().min(1).max(512).refine(
+    (value) => isCanonicalFilePath(value) || value.startsWith("/") && !value.endsWith("/") && value.length > 1 && isCanonicalFilePath(value.slice(0, -1)),
+    "useSink pathPrefix must be a canonical path or directory prefix"
+  )
+}).strict();
+var ProtectedCatalogEntrySchema = z9.object({
+  fieldRef: ProtectedFieldRefSchema,
+  label: z9.string().min(1).max(200),
+  /** Safe preview for slips/receipts — never the plaintext. */
+  maskedPreview: z9.string().max(120),
+  allowUse: z9.boolean(),
+  allowView: z9.boolean(),
+  allowPersist: z9.boolean(),
+  /** Declared sinks `protected_data.use` may inject into. */
+  useSinks: z9.array(ProtectedUseSinkSchema).max(PROTECTED_USE_SINKS_MAX_ENTRIES),
+  /** Declared counterparties `protected_data.disclose` may send to. */
+  discloseTargets: z9.array(CounterpartyTokenSchema).max(PROTECTED_DISCLOSE_TARGETS_MAX_ENTRIES)
+}).strict();
+var ProtectedCatalogSchema = z9.array(ProtectedCatalogEntrySchema).max(PROTECTED_CATALOG_MAX_ENTRIES).refine(
+  (entries) => new Set(entries.map((entry) => entry.fieldRef)).size === entries.length,
+  "catalog field refs must be unique"
+);
+var PROTECTED_USE_SCHEMA = "odingard.guardian.protected-data.use.v1";
+var PROTECTED_VIEW_SCHEMA = "odingard.guardian.protected-data.view.v1";
+var PROTECTED_DISCLOSE_SCHEMA = "odingard.guardian.protected-data.disclose.v1";
+var PROTECTED_PERSIST_SCHEMA = "odingard.guardian.protected-data.persist.v1";
+var ProtectedUseParametersV1Schema = z9.object({
+  schema: z9.literal(PROTECTED_USE_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  fieldRef: ProtectedFieldRefSchema,
+  /** Where the adapter injects the resolved value. Agent sees no plaintext. */
+  sink: z9.object({
+    connectionId: ConnectionIdSchema,
+    path: FilePathSchema
+  }).strict()
+}).strict();
+var ProtectedViewParametersV1Schema = z9.object({
+  schema: z9.literal(PROTECTED_VIEW_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  fieldRef: ProtectedFieldRefSchema
+}).strict();
+var ProtectedDiscloseParametersV1Schema = z9.object({
+  schema: z9.literal(PROTECTED_DISCLOSE_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  fieldRef: ProtectedFieldRefSchema,
+  counterparty: CounterpartyTokenSchema
+}).strict();
+var ProtectedPersistParametersV1Schema = z9.object({
+  schema: z9.literal(PROTECTED_PERSIST_SCHEMA),
+  connectionId: ConnectionIdSchema,
+  fieldRef: ProtectedFieldRefSchema,
+  value: z9.string().min(1).max(PROTECTED_VALUE_MAX_LENGTH).refine(
+    (value) => value.normalize("NFC") === value,
+    "protected value must already use NFC normalization"
+  )
+}).strict();
+function protectedCatalogField(catalog, fieldRef) {
+  return catalog?.find((entry) => entry.fieldRef === fieldRef) ?? null;
+}
+function protectedSinkWithinUseSinks(sink, useSinks) {
+  for (const entry of useSinks) {
+    if (entry.connectionId !== sink.connectionId) continue;
+    if (entry.pathPrefix.endsWith("/")) {
+      if (sink.path.startsWith(entry.pathPrefix)) return true;
+    } else if (sink.path === entry.pathPrefix || sink.path.startsWith(`${entry.pathPrefix}/`)) {
+      return true;
+    }
+  }
+  return false;
+}
+function protectedUseVerificationProjection(input) {
+  const params = ProtectedUseParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.protected-use-projection.v1",
+    connectionId: params.connectionId,
+    fieldRef: params.fieldRef,
+    sinkConnectionId: params.sink.connectionId,
+    sinkPath: params.sink.path
+  });
+}
+function protectedViewVerificationProjection(input) {
+  const params = ProtectedViewParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.protected-view-projection.v1",
+    connectionId: params.connectionId,
+    fieldRef: params.fieldRef
+  });
+}
+function protectedDiscloseVerificationProjection(input) {
+  const params = ProtectedDiscloseParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.protected-disclose-projection.v1",
+    connectionId: params.connectionId,
+    fieldRef: params.fieldRef,
+    counterparty: params.counterparty
+  });
+}
+function protectedPersistVerificationProjection(input) {
+  const params = ProtectedPersistParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.protected-persist-projection.v1",
+    connectionId: params.connectionId,
+    fieldRef: params.fieldRef,
+    valueDigest: sha256Text(params.value)
+  });
+}
+
+// src/contracts/tools.ts
+import { z as z10 } from "zod";
+var TOOL_NAME_MAX_LENGTH = 64;
+var TOOL_ARGUMENTS_MAX_BYTES = 16384;
+var TOOL_CATALOG_MAX_TOOLS = 64;
+var TOOL_SERVER_NAME_MAX_LENGTH = 128;
+var TOOL_SERVER_VERSION_MAX_LENGTH = 64;
+var TOOL_DESCRIPTION_MAX_LENGTH = 512;
+var ToolNameSchema = z10.string().min(1).max(TOOL_NAME_MAX_LENGTH).regex(
+  /^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/,
+  "tool names are lowercase dotted/dashed identifiers"
+);
+var ToolDescriptorSchema = z10.object({
+  name: ToolNameSchema,
+  description: z10.string().max(TOOL_DESCRIPTION_MAX_LENGTH).optional(),
+  method: ApiRequestMethodSchema,
+  url: ApiRequestUrlSchema
+}).strict();
+var ToolServerCatalogSchema = z10.object({
+  serverName: z10.string().min(1).max(TOOL_SERVER_NAME_MAX_LENGTH),
+  serverVersion: z10.string().min(1).max(TOOL_SERVER_VERSION_MAX_LENGTH),
+  tools: z10.array(ToolDescriptorSchema).max(TOOL_CATALOG_MAX_TOOLS).refine(
+    (tools) => new Set(tools.map((tool) => tool.name)).size === tools.length,
+    "tool names must be unique within a catalog"
+  )
+}).strict();
+var ToolArgumentsSchema = z10.record(z10.string(), z10.unknown()).refine(
+  (value) => {
+    try {
+      return canonicalJson(value).length <= TOOL_ARGUMENTS_MAX_BYTES;
+    } catch {
+      return false;
+    }
+  },
+  {
+    message: "arguments must be a bounded canonical JSON object (no cycles, accessors, or exotic prototypes)"
+  }
+);
+var ToolInvokeParametersV1Schema = z10.object({
+  schema: z10.literal("odingard.guardian.tool.invoke.v1"),
+  connectionId: ConnectionIdSchema,
+  toolName: ToolNameSchema,
+  arguments: ToolArgumentsSchema
+}).strict();
+var McpInstallParametersV1Schema = z10.object({
+  schema: z10.literal("odingard.guardian.mcp.install.v1"),
+  connectionId: ConnectionIdSchema,
+  tool: ToolDescriptorSchema
+}).strict();
+var McpEnableParametersV1Schema = z10.object({
+  schema: z10.literal("odingard.guardian.mcp.enable.v1"),
+  connectionId: ConnectionIdSchema,
+  toolName: ToolNameSchema
+}).strict();
+function toolVerificationProjection(input) {
+  const params = ToolInvokeParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.tool-invoke-projection.v1",
+    connectionId: params.connectionId,
+    toolName: params.toolName,
+    argumentsDigest: sha256Text(canonicalJson(params.arguments))
+  });
+}
+function toolEnvelopeProjection(input) {
+  return toolVerificationProjection(input);
+}
+function mcpInstallProjection(input) {
+  const params = McpInstallParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.mcp-projection.v1",
+    operation: "install",
+    connectionId: params.connectionId,
+    toolName: params.tool.name,
+    descriptorDigest: sha256Text(canonicalJson(params.tool))
+  });
+}
+function mcpEnableProjection(input) {
+  const params = McpEnableParametersV1Schema.parse(input);
+  return Object.freeze({
+    domain: "odingard.guardian.mcp-projection.v1",
+    operation: "enable",
+    connectionId: params.connectionId,
+    toolName: params.toolName,
+    descriptorDigest: null
+  });
+}
+function findCatalogTool(connection, toolName) {
+  return connection.toolServer?.tools.find((tool) => tool.name === toolName);
+}
+function validateToolInvokeBinding(input) {
+  const tool = findCatalogTool(input.connection, input.params.toolName);
+  if (tool === void 0) {
+    return { ok: false, reasonCode: "TOOL_NOT_IN_CATALOG" };
+  }
+  if (input.connection.enabledToolNames !== void 0 && !input.connection.enabledToolNames.includes(tool.name)) {
+    return { ok: false, reasonCode: "TOOL_NOT_GRANTED" };
+  }
+  const rendered = ToolDescriptorSchema.safeParse(tool);
+  if (!rendered.success || !apiEndpointWithinAllowlist(
+    rendered.data.url,
+    input.connection.endpointAllowlist ?? []
+  )) {
+    return { ok: false, reasonCode: "ENDPOINT_OUTSIDE_ALLOWLIST" };
+  }
+  return { ok: true };
+}
+function validateMcpInstallBinding(input) {
+  const tools = input.connection.toolServer?.tools;
+  if (tools === void 0) {
+    return { ok: false, reasonCode: "CONNECTION_UNAVAILABLE" };
+  }
+  if (tools.length >= TOOL_CATALOG_MAX_TOOLS) {
+    return { ok: false, reasonCode: "TOOL_CATALOG_FULL" };
+  }
+  if (tools.some((tool) => tool.name === input.params.tool.name)) {
+    return { ok: false, reasonCode: "TOOL_ALREADY_INSTALLED" };
+  }
+  if (!apiEndpointWithinAllowlist(
+    input.params.tool.url,
+    input.connection.endpointAllowlist ?? []
+  )) {
+    return { ok: false, reasonCode: "ENDPOINT_OUTSIDE_ALLOWLIST" };
+  }
+  return { ok: true };
+}
+function validateMcpEnableBinding(input) {
+  const tool = findCatalogTool(input.connection, input.params.toolName);
+  if (tool === void 0) {
+    return { ok: false, reasonCode: "TOOL_NOT_IN_CATALOG" };
+  }
+  if (input.connection.enabledToolNames?.includes(tool.name)) {
+    return { ok: false, reasonCode: "TOOL_ALREADY_ENABLED" };
+  }
+  return { ok: true };
+}
+
+// src/contracts/action-registry.ts
+function createActionRegistry(definitions) {
+  const byAction = /* @__PURE__ */ new Map();
+  for (const definition of definitions) {
+    if (byAction.has(definition.actionId)) {
+      throw new TypeError(
+        `duplicate action definition: ${definition.actionId}`
+      );
+    }
+    byAction.set(definition.actionId, definition);
+  }
+  const entries = Object.freeze([...definitions]);
+  return Object.freeze({
+    get: (actionId) => byAction.get(actionId),
+    entries: () => entries
+  });
+}
+var emailSendDefinition = {
+  actionId: "email.send",
+  schemaVersion: 1,
+  actionFamily: "communication",
+  humanLabel: "Send email",
+  description: "Send an email message from a leased mailbox connection.",
+  parametersKind: "email.send.v1",
+  requiredParameters: ["connectionId", "from", "to", "subject", "body"],
+  materialParameters: [
+    "connectionId",
+    "from",
+    "to",
+    "cc",
+    "bcc",
+    "replyTo",
+    "subject",
+    "body",
+    "attachments",
+    "inReplyTo"
+  ],
+  resourceType: "email:mailbox",
+  providers: ["gmail", "graph"],
+  counterpartyRules: "Recipients are external counterparties; every recipient is material.",
+  dataEffects: "Discloses message content to external recipients.",
+  reversibility: "limited",
+  riskClass: "R3",
+  defaultDecisionPosture: "deny",
+  approvalPresentationSchema: [
+    "from",
+    "to",
+    "subject",
+    "bodyPreview",
+    "attachments"
+  ],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: {
+    level: "pre-commit-content+post-commit-envelope"
+  },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = EmailSendParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding({ params, connection }) {
+    return connection.mailboxAddress !== void 0 && params.from === connection.mailboxAddress ? { ok: true } : { ok: false, reasonCode: "CONNECTION_UNAVAILABLE" };
+  },
+  verificationProjection: (params) => emailVerificationProjection(params),
+  envelopeProjection: (params) => emailEnvelopeProjection(params)
+};
+var apiRequestDefinition = {
+  actionId: "api.request",
+  schemaVersion: 1,
+  actionFamily: "networking",
+  humanLabel: "Call external API",
+  description: "Issue an outbound https request within a connection's endpoint allowlist; the adapter injects the leased bearer token at commit.",
+  parametersKind: "api.request.v1",
+  requiredParameters: ["connectionId", "method", "url", "headers"],
+  materialParameters: [
+    "connectionId",
+    "method",
+    "url",
+    "headers",
+    "body",
+    "idempotencyKey"
+  ],
+  resourceType: "api:endpoint",
+  providers: ["api"],
+  counterpartyRules: "Host+path must stay inside the connection endpoint allowlist; https only; agent may not set credential or hop-by-hop headers.",
+  dataEffects: "May mutate or read external state; response metadata (status, byte count, headers digest, bounded body digest) is evidenced.",
+  reversibility: "difficult",
+  riskClass: "R3",
+  defaultDecisionPosture: "deny",
+  approvalPresentationSchema: ["method", "url", "headers", "bodyPreview"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected; observe never re-issues the request.",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = ApiRequestParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding({ params, connection }) {
+    return apiEndpointWithinAllowlist(
+      params.url,
+      connection.endpointAllowlist ?? []
+    ) ? { ok: true } : { ok: false, reasonCode: "ENDPOINT_OUTSIDE_ALLOWLIST" };
+  },
+  verificationProjection: (params) => apiVerificationProjection(params),
+  envelopeProjection: (params) => apiEnvelopeProjection(params)
+};
+var toolInvokeDefinition = {
+  actionId: "tool.invoke",
+  schemaVersion: 1,
+  actionFamily: "tooling",
+  humanLabel: "Invoke tool",
+  description: "Invoke a catalog tool enabled for the agent on a leased tool-server connection; renders to a bounded https call inside the connection endpoint allowlist.",
+  parametersKind: "tool.invoke.v1",
+  requiredParameters: ["connectionId", "toolName", "arguments"],
+  materialParameters: ["connectionId", "toolName", "arguments"],
+  resourceType: "tool:server",
+  providers: ["tool"],
+  counterpartyRules: "Tool name must exist in the connection catalog and be enabled for the requesting agent; the rendered endpoint stays inside the allowlist.",
+  dataEffects: "May read or mutate external state through the tool; bounded invocation and result metadata is evidenced.",
+  reversibility: "limited",
+  riskClass: "R3",
+  defaultDecisionPosture: "deny",
+  approvalPresentationSchema: ["toolName", "serverName", "argumentsPreview"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected; observe never re-issues the invocation.",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = ToolInvokeParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding({ params, connection }) {
+    return validateToolInvokeBinding({ params, connection });
+  },
+  verificationProjection: (params) => toolVerificationProjection(params),
+  envelopeProjection: (params) => toolEnvelopeProjection(params)
+};
+var mcpInstallDefinition = {
+  actionId: "mcp.install",
+  schemaVersion: 1,
+  actionFamily: "capability-governance",
+  humanLabel: "Install MCP tool",
+  description: "Register an additional tool on a human-installed tool-server connection; capability-expanding \u2014 requires an explicit human grant, never auto-derived.",
+  parametersKind: "mcp.install.v1",
+  requiredParameters: ["connectionId", "tool"],
+  materialParameters: ["connectionId", "tool"],
+  resourceType: "mcp:server",
+  providers: ["tool"],
+  counterpartyRules: "Tool descriptor must be new to the catalog and its url must stay inside the existing endpoint allowlist; installs never create connections or widen scopes.",
+  dataEffects: "Mutates the connection's tool catalog (adds one callable tool).",
+  reversibility: "limited",
+  riskClass: "R3",
+  defaultDecisionPosture: "ask",
+  approvalPresentationSchema: ["tool", "serverName"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  requiresExplicitGrant: true,
+  validateParameters(materialParameters) {
+    const parsed = McpInstallParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding({ params, connection }) {
+    return validateMcpInstallBinding({ params, connection });
+  },
+  verificationProjection: (params) => mcpInstallProjection(params),
+  envelopeProjection: (params) => mcpInstallProjection(params)
+};
+var mcpEnableDefinition = {
+  actionId: "mcp.enable",
+  schemaVersion: 1,
+  actionFamily: "capability-governance",
+  humanLabel: "Enable MCP tool",
+  description: "Enable a catalog tool for the requesting agent on a tool-server connection; capability-expanding \u2014 requires an explicit human grant, never auto-derived.",
+  parametersKind: "mcp.enable.v1",
+  requiredParameters: ["connectionId", "toolName"],
+  materialParameters: ["connectionId", "toolName"],
+  resourceType: "mcp:server",
+  providers: ["tool"],
+  counterpartyRules: "Tool name must exist in the catalog; enabling writes to the per-agent tool registry with the granting evidence.",
+  dataEffects: "Mutates the agent's tool registry (enables one catalog tool).",
+  reversibility: "reversible",
+  riskClass: "R2",
+  defaultDecisionPosture: "ask",
+  approvalPresentationSchema: ["toolName", "serverName"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  requiresExplicitGrant: true,
+  validateParameters(materialParameters) {
+    const parsed = McpEnableParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding({ params, connection }) {
+    return validateMcpEnableBinding({ params, connection });
+  },
+  verificationProjection: (params) => mcpEnableProjection(params),
+  envelopeProjection: (params) => mcpEnableProjection(params)
+};
+var GCAL_ADAPTER_ID = "adp_00000003";
+var calendarBinding = (params, connection) => connection.provider === "gcalendar" && connection.calendarId !== void 0 && params.calendarId === connection.calendarId ? { ok: true } : { ok: false, reasonCode: "CONNECTION_UNAVAILABLE" };
+var calendarValidate = (schema) => (materialParameters) => {
+  const parsed = schema.safeParse(materialParameters);
+  return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+};
+var calendarDefinitionBase = {
+  schemaVersion: 1,
+  actionFamily: "scheduling",
+  resourceType: "calendar:calendar",
+  providers: ["gcalendar"],
+  adapterIds: [GCAL_ADAPTER_ID],
+  counterpartyRules: "Events live on the connection's authorized calendar only; external invitees are counterparties and are material.",
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected; observe never re-issues the request.",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active"
+};
+var calendarCreateDefinition = {
+  ...calendarDefinitionBase,
+  actionId: "calendar.create",
+  humanLabel: "Create calendar event",
+  description: "Create an event on the connection's authorized calendar; attendees are never settable here \u2014 inviting people is a separate material commitment.",
+  parametersKind: "calendar.create.v1",
+  requiredParameters: ["connectionId", "calendarId", "summary", "start", "end"],
+  materialParameters: [
+    "connectionId",
+    "calendarId",
+    "summary",
+    "description",
+    "location",
+    "start",
+    "end",
+    "idempotencyKey"
+  ],
+  dataEffects: "Creates an event record on the authorized calendar.",
+  reversibility: "reversible",
+  riskClass: "R2",
+  defaultDecisionPosture: "allow",
+  approvalPresentationSchema: ["summary", "start", "end", "location"],
+  validateParameters: calendarValidate(CalendarCreateParametersV1Schema),
+  validateBinding: ({ params, connection }) => calendarBinding(params, connection),
+  verificationProjection: (params) => calendarVerificationProjection(params),
+  envelopeProjection: (params) => calendarEnvelopeProjection(params)
+};
+var calendarUpdateDefinition = {
+  ...calendarDefinitionBase,
+  actionId: "calendar.update",
+  humanLabel: "Update calendar event",
+  description: "Change fields of an existing event \u2014 including its committed start/end time \u2014 on the authorized calendar; a material external commitment.",
+  parametersKind: "calendar.update.v1",
+  requiredParameters: ["connectionId", "calendarId", "eventId"],
+  materialParameters: [
+    "connectionId",
+    "calendarId",
+    "eventId",
+    "summary",
+    "description",
+    "location",
+    "start",
+    "end",
+    "sendUpdates"
+  ],
+  dataEffects: "Mutates a live commitment; a changed time moves every attendee's schedule.",
+  reversibility: "limited",
+  riskClass: "R3",
+  defaultDecisionPosture: "ask",
+  approvalPresentationSchema: [
+    "eventId",
+    "summary",
+    "start",
+    "end",
+    "location"
+  ],
+  validateParameters: calendarValidate(CalendarUpdateParametersV1Schema),
+  validateBinding: ({ params, connection }) => calendarBinding(params, connection),
+  verificationProjection: (params) => calendarVerificationProjection(params),
+  envelopeProjection: (params) => calendarEnvelopeProjection(params)
+};
+var calendarCancelDefinition = {
+  ...calendarDefinitionBase,
+  actionId: "calendar.cancel",
+  humanLabel: "Cancel calendar event",
+  description: "Cancel (delete) an existing event on the authorized calendar; destroys a commitment.",
+  parametersKind: "calendar.cancel.v1",
+  requiredParameters: ["connectionId", "calendarId", "eventId"],
+  materialParameters: ["connectionId", "calendarId", "eventId", "sendUpdates"],
+  dataEffects: "Removes a commitment; may send cancellation notices to attendees.",
+  reversibility: "difficult",
+  riskClass: "R3",
+  defaultDecisionPosture: "ask",
+  approvalPresentationSchema: ["eventId", "sendUpdates"],
+  validateParameters: calendarValidate(CalendarCancelParametersV1Schema),
+  validateBinding: ({ params, connection }) => calendarBinding(params, connection),
+  verificationProjection: (params) => calendarVerificationProjection(params),
+  envelopeProjection: (params) => calendarEnvelopeProjection(params)
+};
+var calendarInviteDefinition = {
+  ...calendarDefinitionBase,
+  actionId: "calendar.invite",
+  humanLabel: "Invite attendees to event",
+  description: "Add external attendees to an existing event on the authorized calendar; creates a material external commitment to each invitee.",
+  parametersKind: "calendar.invite.v1",
+  requiredParameters: ["connectionId", "calendarId", "eventId", "attendees"],
+  materialParameters: [
+    "connectionId",
+    "calendarId",
+    "eventId",
+    "attendees",
+    "sendUpdates"
+  ],
+  dataEffects: "Sends invitations to external addresses; the attendee set is material and approval-bound.",
+  reversibility: "limited",
+  riskClass: "R3",
+  defaultDecisionPosture: "ask",
+  approvalPresentationSchema: ["eventId", "attendees", "sendUpdates"],
+  validateParameters: calendarValidate(CalendarInviteParametersV1Schema),
+  validateBinding: ({ params, connection }) => calendarBinding(params, connection),
+  verificationProjection: (params) => calendarVerificationProjection(params),
+  envelopeProjection: (params) => calendarEnvelopeProjection(params)
+};
+var commercePurchaseDefinition = {
+  actionId: "commerce.purchase",
+  schemaVersion: 1,
+  actionFamily: "commerce",
+  humanLabel: "Purchase",
+  description: "Charge a leased payment connection for a one-shot purchase; the adapter charges adapter-side and no reusable payment credential reaches the agent.",
+  parametersKind: "commerce.purchase.v1",
+  requiredParameters: [
+    "connectionId",
+    "merchantId",
+    "merchantCategory",
+    "amountCents",
+    "currency",
+    "orderDescription",
+    "idempotencyKey"
+  ],
+  materialParameters: [
+    "connectionId",
+    "merchantId",
+    "merchantCategory",
+    "amountCents",
+    "currency",
+    "orderDescription",
+    "idempotencyKey",
+    "taskId"
+  ],
+  resourceType: "commerce:account",
+  providers: ["payment-sandbox"],
+  counterpartyRules: "merchantId is the external counterparty; merchant/category facts are re-derived from parameters and bound into the material digest.",
+  dataEffects: "Moves money within sandbox/test scope only; charge metadata is evidenced.",
+  reversibility: "limited",
+  riskClass: "R4",
+  defaultDecisionPosture: "allow",
+  approvalPresentationSchema: [
+    "merchantId",
+    "merchantCategory",
+    "amountCents",
+    "currency",
+    "orderDescription",
+    "taskId"
+  ],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit (charge) \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = CommercePurchaseParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding() {
+    return { ok: true };
+  },
+  verificationProjection: (params) => commercePurchaseVerificationProjection(params),
+  envelopeProjection: (params) => commercePurchaseEnvelopeProjection(params),
+  authorityFacts: (params) => ({
+    valueCents: params.amountCents,
+    merchantId: params.merchantId,
+    merchantCategory: params.merchantCategory,
+    recurring: false,
+    ...params.taskId === void 0 ? {} : { taskId: params.taskId }
+  })
+};
+var commerceRefundDefinition = {
+  actionId: "commerce.refund",
+  schemaVersion: 1,
+  actionFamily: "commerce",
+  humanLabel: "Refund",
+  description: "Refund a prior sandbox charge by chargeId; adapter-side only, full refund when amountCents is omitted.",
+  parametersKind: "commerce.refund.v1",
+  requiredParameters: ["connectionId", "chargeId", "reason"],
+  materialParameters: ["connectionId", "chargeId", "amountCents", "reason"],
+  resourceType: "commerce:account",
+  providers: ["payment-sandbox"],
+  counterpartyRules: "Refunds settle to the original charge's counterparty.",
+  dataEffects: "Returns money within sandbox/test scope only.",
+  reversibility: "difficult",
+  riskClass: "R3",
+  defaultDecisionPosture: "allow",
+  approvalPresentationSchema: ["chargeId", "amountCents", "reason"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit (refund) \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = CommerceRefundParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding() {
+    return { ok: true };
+  },
+  verificationProjection: (params) => commerceRefundVerificationProjection(params),
+  envelopeProjection: (params) => commerceRefundEnvelopeProjection(params),
+  authorityFacts: (params) => params.amountCents === void 0 ? {} : { valueCents: params.amountCents }
+};
+var commerceReturnDefinition = {
+  actionId: "commerce.return",
+  schemaVersion: 1,
+  actionFamily: "commerce",
+  humanLabel: "Return",
+  description: "Record a return against a prior sandbox charge by chargeId; adapter-side only.",
+  parametersKind: "commerce.return.v1",
+  requiredParameters: ["connectionId", "chargeId", "reason"],
+  materialParameters: ["connectionId", "chargeId", "reason"],
+  resourceType: "commerce:account",
+  providers: ["payment-sandbox"],
+  counterpartyRules: "Returns settle to the original charge's counterparty.",
+  dataEffects: "Records a goods return within sandbox/test scope only.",
+  reversibility: "reversible",
+  riskClass: "R2",
+  defaultDecisionPosture: "allow",
+  approvalPresentationSchema: ["chargeId", "reason"],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit (return) \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = CommerceReturnParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding() {
+    return { ok: true };
+  },
+  verificationProjection: (params) => commerceReturnVerificationProjection(params),
+  envelopeProjection: (params) => commerceReturnEnvelopeProjection(params),
+  authorityFacts: () => ({})
+};
+var subscriptionCreateDefinition = {
+  actionId: "subscription.create",
+  schemaVersion: 1,
+  actionFamily: "commerce",
+  humanLabel: "Create subscription",
+  description: "Start a recurring subscription charge on a leased payment connection; recurrence is a derived authority fact the kernel can deny.",
+  parametersKind: "subscription.create.v1",
+  requiredParameters: [
+    "connectionId",
+    "merchantId",
+    "planId",
+    "amountCents",
+    "currency",
+    "interval",
+    "idempotencyKey"
+  ],
+  materialParameters: [
+    "connectionId",
+    "merchantId",
+    "planId",
+    "amountCents",
+    "currency",
+    "interval",
+    "idempotencyKey"
+  ],
+  resourceType: "commerce:account",
+  providers: ["payment-sandbox"],
+  counterpartyRules: "merchantId is the external counterparty; recurring is derived as true so recurrence control applies.",
+  dataEffects: "Creates a recurring payment obligation within sandbox/test scope only.",
+  reversibility: "limited",
+  riskClass: "R4",
+  defaultDecisionPosture: "deny",
+  approvalPresentationSchema: [
+    "merchantId",
+    "planId",
+    "amountCents",
+    "currency",
+    "interval"
+  ],
+  capabilityRequirements: { uses: 1 },
+  executionContract: "prepare \u2192 readback \u2192 commit (subscribe) \u2192 observe \u2192 verified/unknown/rejected",
+  verificationContract: { level: "post-commit-content" },
+  evidenceRequirements: [
+    "effect.prepared",
+    "commit.authorized",
+    "effect.verified | effect.unknown | commit.rejected"
+  ],
+  version: 1,
+  status: "active",
+  validateParameters(materialParameters) {
+    const parsed = SubscriptionCreateParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  validateBinding() {
+    return { ok: true };
+  },
+  verificationProjection: (params) => subscriptionCreateVerificationProjection(params),
+  envelopeProjection: (params) => subscriptionCreateEnvelopeProjection(params),
+  authorityFacts: (params) => ({
+    valueCents: params.amountCents,
+    merchantId: params.merchantId,
+    recurring: true
+  })
+};
+function fileDefinition(input) {
+  return {
+    actionId: input.actionId,
+    schemaVersion: 1,
+    actionFamily: "files",
+    humanLabel: input.humanLabel,
+    description: input.description,
+    parametersKind: input.parametersKind,
+    requiredParameters: input.requiredParameters,
+    materialParameters: input.materialParameters,
+    resourceType: "file:store",
+    providers: ["file"],
+    counterpartyRules: "Paths must be canonical and inside the connection path allowlist; shares additionally require the declared share allowlist.",
+    dataEffects: input.dataEffects,
+    reversibility: input.reversibility,
+    riskClass: input.riskClass,
+    defaultDecisionPosture: "deny",
+    approvalPresentationSchema: ["path", "grantee", "bytes"],
+    capabilityRequirements: { uses: 1 },
+    executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected",
+    verificationContract: { level: "post-commit-content" },
+    evidenceRequirements: [
+      "effect.prepared",
+      "commit.authorized",
+      "effect.verified | effect.unknown | commit.rejected"
+    ],
+    version: 1,
+    status: "active",
+    validateParameters: input.parse,
+    validateBinding: input.bind,
+    verificationProjection: input.projection,
+    envelopeProjection: input.projection
+  };
+}
+var fileReadDefinition = fileDefinition({
+  actionId: "file.read",
+  humanLabel: "Read file",
+  description: "Read a file from the connection's file store; content is delivered to the agent in the execution receipt, digest-correlated with the evidence.",
+  parametersKind: "file.read.v1",
+  requiredParameters: ["connectionId", "path"],
+  materialParameters: ["connectionId", "path"],
+  dataEffects: "Returns stored content to the agent (a SEE-equivalent on files); sealed files are rejected before effect.",
+  reversibility: "reversible",
+  riskClass: "R2",
+  parse: (materialParameters) => {
+    const parsed = FileReadParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, connection }) => filePathWithinAllowlist(params.path, connection.pathAllowlist ?? []) ? { ok: true } : { ok: false, reasonCode: "PATH_OUTSIDE_ALLOWLIST" },
+  projection: (params) => fileReadVerificationProjection(params)
+});
+var fileWriteDefinition = fileDefinition({
+  actionId: "file.write",
+  humanLabel: "Write file",
+  description: "Write agent-supplied content to a path inside the connection path allowlist; the written bytes are verified post-commit.",
+  parametersKind: "file.write.v1",
+  requiredParameters: ["connectionId", "path", "content"],
+  materialParameters: ["connectionId", "path", "content"],
+  dataEffects: "Creates or replaces a stored file.",
+  reversibility: "limited",
+  riskClass: "R2",
+  parse: (materialParameters) => {
+    const parsed = FileWriteParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, connection }) => filePathWithinAllowlist(params.path, connection.pathAllowlist ?? []) ? { ok: true } : { ok: false, reasonCode: "PATH_OUTSIDE_ALLOWLIST" },
+  projection: (params) => fileWriteVerificationProjection(params)
+});
+var fileShareDefinition = fileDefinition({
+  actionId: "file.share",
+  humanLabel: "Share file",
+  description: "Create a share grant for a file inside the connection's declared share allowlist; sealed (protected-materialized) files cannot be shared.",
+  parametersKind: "file.share.v1",
+  requiredParameters: ["connectionId", "path", "grantee"],
+  materialParameters: ["connectionId", "path", "grantee", "expiresAtEpochMs"],
+  dataEffects: "Grants the named grantee read access to the file (a DISCLOSE-equivalent on files); shares outside the declared scope deny before effect.",
+  reversibility: "limited",
+  riskClass: "R3",
+  parse: (materialParameters) => {
+    const parsed = FileShareParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, connection }) => filePathWithinAllowlist(params.path, connection.shareAllowlist ?? []) ? { ok: true } : { ok: false, reasonCode: "SHARE_OUTSIDE_ALLOWLIST" },
+  projection: (params) => fileShareVerificationProjection(params)
+});
+var fileDeleteDefinition = fileDefinition({
+  actionId: "file.delete",
+  humanLabel: "Delete file",
+  description: "Remove a file inside the connection path allowlist; absence is verified post-commit.",
+  parametersKind: "file.delete.v1",
+  requiredParameters: ["connectionId", "path"],
+  materialParameters: ["connectionId", "path"],
+  dataEffects: "Irreversibly removes the stored file.",
+  reversibility: "destructive",
+  riskClass: "R3",
+  parse: (materialParameters) => {
+    const parsed = FileDeleteParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, connection }) => filePathWithinAllowlist(params.path, connection.pathAllowlist ?? []) ? { ok: true } : { ok: false, reasonCode: "PATH_OUTSIDE_ALLOWLIST" },
+  projection: (params) => fileDeleteVerificationProjection(params)
+});
+function protectedDefinition(input) {
+  return {
+    actionId: input.actionId,
+    schemaVersion: 1,
+    actionFamily: "protected-data",
+    humanLabel: input.humanLabel,
+    description: input.description,
+    parametersKind: input.parametersKind,
+    requiredParameters: input.requiredParameters,
+    materialParameters: input.materialParameters,
+    resourceType: "protected:data",
+    providers: ["protected_data"],
+    counterpartyRules: "USE/SEE/DISCLOSE are independent policy operations; the connection's declared catalog binds each one at field level (K12).",
+    dataEffects: input.dataEffects,
+    reversibility: input.reversibility,
+    riskClass: input.riskClass,
+    defaultDecisionPosture: "deny",
+    approvalPresentationSchema: [
+      "fieldRef",
+      "counterparty",
+      "sink",
+      "maskedPreview"
+    ],
+    capabilityRequirements: { uses: 1 },
+    executionContract: "prepare \u2192 readback \u2192 commit \u2192 observe \u2192 verified/unknown/rejected; the adapter resolves and injects the protected value at execution.",
+    verificationContract: { level: "post-commit-content" },
+    evidenceRequirements: [
+      "effect.prepared",
+      "commit.authorized",
+      "effect.verified | effect.unknown | commit.rejected"
+    ],
+    version: 1,
+    status: "active",
+    validateParameters: input.parse,
+    validateBinding: ({ params, connection }) => {
+      const field = protectedCatalogField(
+        connection.protectedCatalog,
+        params.fieldRef
+      );
+      if (!field) {
+        return { ok: false, reasonCode: "FIELD_NOT_IN_CATALOG" };
+      }
+      return input.bind({ params, field });
+    },
+    verificationProjection: input.projection,
+    envelopeProjection: input.projection
+  };
+}
+var protectedUseDefinition = protectedDefinition({
+  actionId: "protected_data.use",
+  humanLabel: "Use protected data",
+  description: "Inject a catalog-declared protected field into a declared file sink at execution time; the agent never receives the plaintext.",
+  parametersKind: "protected-data.use.v1",
+  requiredParameters: ["connectionId", "fieldRef", "sink"],
+  materialParameters: ["connectionId", "fieldRef", "sink"],
+  dataEffects: "Materializes the protected value inside the declared sink file (sealed); the agent receives only path + digest evidence.",
+  reversibility: "limited",
+  riskClass: "R3",
+  parse: (materialParameters) => {
+    const parsed = ProtectedUseParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, field }) => field?.allowUse !== true ? { ok: false, reasonCode: "USE_NOT_ALLOWED" } : protectedSinkWithinUseSinks(params.sink, field.useSinks) ? { ok: true } : { ok: false, reasonCode: "SINK_OUTSIDE_DECLARED" },
+  projection: (params) => protectedUseVerificationProjection(params)
+});
+var protectedViewDefinition = protectedDefinition({
+  actionId: "protected_data.view",
+  humanLabel: "View protected data",
+  description: "Deliver a catalog-declared protected field to the agent once, via the execution receipt's delivered channel; requires allowView.",
+  parametersKind: "protected-data.view.v1",
+  requiredParameters: ["connectionId", "fieldRef"],
+  materialParameters: ["connectionId", "fieldRef"],
+  dataEffects: "Discloses the protected value to the agent (SEE); not persisted in the ledger.",
+  reversibility: "limited",
+  riskClass: "R3",
+  parse: (materialParameters) => {
+    const parsed = ProtectedViewParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ field }) => field?.allowView === true ? { ok: true } : { ok: false, reasonCode: "VIEW_NOT_ALLOWED" },
+  projection: (params) => protectedViewVerificationProjection(params)
+});
+var protectedDiscloseDefinition = protectedDefinition({
+  actionId: "protected_data.disclose",
+  humanLabel: "Disclose protected data",
+  description: "Send a catalog-declared protected field to a catalog-declared counterparty; without explicit authority the action denies before execution.",
+  parametersKind: "protected-data.disclose.v1",
+  requiredParameters: ["connectionId", "fieldRef", "counterparty"],
+  materialParameters: ["connectionId", "fieldRef", "counterparty"],
+  dataEffects: "Delivers the protected value to the declared counterparty only (DISCLOSE); the agent never receives it.",
+  reversibility: "difficult",
+  riskClass: "R4",
+  parse: (materialParameters) => {
+    const parsed = ProtectedDiscloseParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ params, field }) => field?.discloseTargets.includes(params.counterparty) === true ? { ok: true } : { ok: false, reasonCode: "DISCLOSE_TARGET_NOT_DECLARED" },
+  projection: (params) => protectedDiscloseVerificationProjection(params)
+});
+var protectedPersistDefinition = protectedDefinition({
+  actionId: "protected_data.persist",
+  humanLabel: "Persist protected data",
+  description: "Store an agent-supplied value into a catalog-declared protected field; requires allowPersist on the declared field.",
+  parametersKind: "protected-data.persist.v1",
+  requiredParameters: ["connectionId", "fieldRef", "value"],
+  materialParameters: ["connectionId", "fieldRef", "value"],
+  dataEffects: "Writes a new protected value into the declared field slot.",
+  reversibility: "limited",
+  riskClass: "R3",
+  parse: (materialParameters) => {
+    const parsed = ProtectedPersistParametersV1Schema.safeParse(materialParameters);
+    return parsed.success ? { ok: true, params: parsed.data } : { ok: false };
+  },
+  bind: ({ field }) => field?.allowPersist === true ? { ok: true } : { ok: false, reasonCode: "PERSIST_NOT_ALLOWED" },
+  projection: (params) => protectedPersistVerificationProjection(params)
+});
+var universalActionRegistry = createActionRegistry([
+  emailSendDefinition,
+  apiRequestDefinition,
+  toolInvokeDefinition,
+  mcpInstallDefinition,
+  mcpEnableDefinition,
+  calendarCreateDefinition,
+  calendarUpdateDefinition,
+  calendarCancelDefinition,
+  calendarInviteDefinition,
+  commercePurchaseDefinition,
+  commerceRefundDefinition,
+  commerceReturnDefinition,
+  subscriptionCreateDefinition,
+  fileReadDefinition,
+  fileWriteDefinition,
+  fileShareDefinition,
+  fileDeleteDefinition,
+  protectedUseDefinition,
+  protectedViewDefinition,
+  protectedDiscloseDefinition,
+  protectedPersistDefinition
+]);
+
+// src/contracts/approval.ts
+import { z as z12 } from "zod";
+
+// src/contracts/evidence.ts
+import { z as z11 } from "zod";
+var Sha256DigestSchema = z11.string().regex(/^[a-f0-9]{64}$/);
+var AttemptReferenceSchema = z11.string().trim().min(1).max(256).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
+var FailureCodeSchema = z11.string().trim().min(1).max(128).regex(/^[A-Z][A-Z0-9_]*$/);
+var payload = (eventType, shape) => z11.object({
+  eventType: z11.literal(eventType),
+  payload: z11.object(shape).strict()
+}).strict();
+var EvidenceEventSchema = z11.discriminatedUnion("eventType", [
+  payload("AUTHENTICATION_RECORDED", {
+    interface: AgentInterfaceSchema,
+    outcome: z11.enum(["authenticated", "rejected"]),
+    credentialReference: z11.string().trim().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/)
+  }),
+  payload("ADAPTER_AUTHENTICATION_RECORDED", {
+    adapterId: AdapterIdSchema,
+    outcome: z11.literal("authenticated"),
+    credentialReference: AttemptReferenceSchema
+  }),
+  payload("REQUEST_RECEIVED", { actionDigest: Sha256DigestSchema }),
+  payload("ACTION_NORMALIZED", { actionDigest: Sha256DigestSchema }),
+  z11.object({
+    eventType: z11.literal("DECISION_RECORDED"),
+    payload: z11.discriminatedUnion("decision", [
+      z11.object({
+        actionDigest: Sha256DigestSchema,
+        actionDecisionDigest: Sha256DigestSchema,
+        decision: z11.literal("ALLOW"),
+        reasonCode: z11.literal("AUTHORIZED")
+      }).strict(),
+      z11.object({
+        actionDigest: Sha256DigestSchema,
+        actionDecisionDigest: Sha256DigestSchema,
+        decision: z11.literal("ASK"),
+        reasonCode: z11.literal("APPROVAL_REQUIRED")
+      }).strict(),
+      z11.object({
+        actionDigest: Sha256DigestSchema,
+        actionDecisionDigest: Sha256DigestSchema,
+        decision: z11.literal("DENY"),
+        reasonCode: DenyReasonCodeSchema
+      }).strict()
+    ])
+  }).strict(),
+  payload("APPROVAL_STATE_REFERENCED", {
+    approvalId: ApprovalIdSchema,
+    /** Approval record version this state evidence describes; versions are contiguous per chain. */
+    version: z11.number().int().positive().safe(),
+    state: z11.enum([
+      "pending",
+      "approved",
+      "denied",
+      "expired",
+      "revoked",
+      "superseded",
+      "consumed"
+    ]),
+    approvalDigest: Sha256DigestSchema
+  }),
+  payload("APPROVAL_PRESENTED", {
+    approvalId: ApprovalIdSchema,
+    presentationDigest: Sha256DigestSchema,
+    viewerReference: AttemptReferenceSchema
+  }),
+  payload("APPROVAL_DECISION_RECORDED", {
+    approvalId: ApprovalIdSchema,
+    /** Approval record version the human decision produced. */
+    version: z11.number().int().positive().safe(),
+    decision: z11.enum(["approve", "deny", "revoke"]),
+    actorPrincipalId: PrincipalIdSchema,
+    actorReference: AttemptReferenceSchema,
+    presentationDigest: Sha256DigestSchema
+  }),
+  payload("APPROVAL_REJECTED", {
+    approvalId: ApprovalIdSchema,
+    reasonCode: FailureCodeSchema
+  }),
+  payload("CAPABILITY_STATE_REFERENCED", {
+    actionDigest: Sha256DigestSchema,
+    capabilityId: CapabilityIdSchema,
+    state: z11.enum(["issued", "used", "expired", "revoked"]),
+    capabilityDigest: Sha256DigestSchema
+  }),
+  payload("CAPABILITY_REJECTED", {
+    actionDigest: Sha256DigestSchema,
+    reasonCode: FailureCodeSchema
+  }),
+  payload("EXECUTION_ATTEMPTED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    idempotencyDigest: Sha256DigestSchema
+  }),
+  payload("EXECUTION_ABORTED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    reasonCode: FailureCodeSchema
+  }),
+  payload("EFFECT_PREPARED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    preparedDigest: Sha256DigestSchema
+  }),
+  payload("EFFECT_COMMIT_AUTHORIZED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    actionDecisionDigest: Sha256DigestSchema
+  }),
+  payload("EFFECT_OUTCOME_UNKNOWN", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    reasonCode: FailureCodeSchema
+  }),
+  payload("EFFECT_UNRESOLVED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema
+  }),
+  payload("EFFECT_VERIFIED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    effectDigest: Sha256DigestSchema
+  }),
+  payload("EXECUTION_FAILED", {
+    actionDigest: Sha256DigestSchema,
+    adapterId: AdapterIdSchema,
+    attemptReference: AttemptReferenceSchema,
+    failureCode: FailureCodeSchema,
+    failureDigest: Sha256DigestSchema.optional()
+  }),
+  payload("AUTHORITY_REVOKED", {
+    grantId: GrantIdSchema,
+    grantVersion: z11.number().int().positive(),
+    revocationDigest: Sha256DigestSchema
+  })
+]);
+var EvidenceContextShape = {
+  schemaVersion: z11.literal(1),
+  id: EvidenceIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  eventTimeEpochMs: EpochMillisecondsSchema
+};
+var EvidenceChainContextSchema = z11.object({
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema
+}).strict();
+var EvidenceEventDraftSchema = z11.object({ ...EvidenceContextShape, event: EvidenceEventSchema }).strict();
+var EvidenceRecordCoreSchema = z11.object({
+  ...EvidenceContextShape,
+  event: EvidenceEventSchema,
+  sequence: z11.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  previousRecordHash: Sha256DigestSchema.nullable(),
+  payloadDigest: Sha256DigestSchema
+}).strict();
+var EvidenceRecordSchema = z11.object({
+  ...EvidenceRecordCoreSchema.shape,
+  recordHash: Sha256DigestSchema
+}).strict();
+var HumanSessionRejectionSchema = z11.enum([
+  "UNAUTHENTICATED",
+  "NOT_HUMAN",
+  "UNSAFE_SESSION_REFERENCE"
+]);
+var PreIdentitySecurityEventSchema = z11.discriminatedUnion(
+  "eventType",
+  [
+    z11.object({
+      eventType: z11.literal("AUTHENTICATION_REJECTED"),
+      payload: z11.object({
+        interface: z11.enum(["mcp", "rest"]),
+        reasonCode: z11.literal("UNAUTHENTICATED")
+      }).strict()
+    }).strict(),
+    z11.object({
+      eventType: z11.literal("HUMAN_AUTHENTICATION_REJECTED"),
+      payload: z11.object({
+        surface: z11.literal("approval-service"),
+        reasonCode: HumanSessionRejectionSchema
+      }).strict()
+    }).strict(),
+    z11.object({
+      eventType: z11.literal("ADAPTER_AUTHENTICATION_REJECTED"),
+      payload: z11.object({
+        surface: z11.literal("redemption"),
+        reasonCode: z11.literal("UNAUTHENTICATED")
+      }).strict()
+    }).strict()
+  ]
+);
+var PreIdentitySecurityRecordCoreSchema = z11.object({
+  schemaVersion: z11.literal(1),
+  id: EvidenceIdSchema,
+  eventTimeEpochMs: EpochMillisecondsSchema,
+  event: PreIdentitySecurityEventSchema
+}).strict();
+var PreIdentitySecurityRecordSchema = PreIdentitySecurityRecordCoreSchema.extend({
+  recordHash: Sha256DigestSchema
+}).strict();
+
+// src/contracts/approval.ts
+var GrantVersionReferenceSchema = z12.object({ id: GrantIdSchema, version: z12.number().int().positive() }).strict();
+var AgentStatementSchema = z12.object({
+  source: z12.literal("agent"),
+  authoritative: z12.literal(false),
+  text: z12.string().trim().min(1).max(1024)
+}).strict();
+var ApprovalReasonSchema = z12.object({
+  source: z12.literal("guardian"),
+  code: z12.literal("APPROVAL_REQUIRED"),
+  authority: AuthorityReferenceSchema
+}).strict();
+var ApprovalPresentationSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  approvalId: ApprovalIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  action: ActionTypeSchema,
+  resource: ResourceRefSchema,
+  adapterId: AdapterIdSchema,
+  interface: AgentInterfaceSchema,
+  initiatingContext: z12.enum(["user", "scheduled", "agent", "external-event"]),
+  materialParameters: MaterialParametersSchema,
+  valueCents: z12.number().int().nonnegative().safe().optional(),
+  uses: z12.number().int().positive().safe(),
+  agentStatement: AgentStatementSchema,
+  reason: ApprovalReasonSchema,
+  actionDigest: Sha256DigestSchema,
+  expiresAtEpochMs: EpochMillisecondsSchema
+}).strict();
+var ApprovalBindingSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  approvalId: ApprovalIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  actionDigest: Sha256DigestSchema,
+  /**
+   * Evidence link to the exact ASK decision record that created the approval.
+   * It covers evaluation time, so it is never re-derived; askDecisionDigest is
+   * the decision binding that issuance and redemption verify.
+   */
+  actionDecisionRecordDigest: Sha256DigestSchema,
+  /**
+   * Digest of the time-independent projection of that ASK decision: the exact
+   * canonical action, the ASK outcome, and the principal, agent, and complete
+   * grant chain it was evaluated under. Every later use recomputes it from the
+   * fresh decision or the current trusted authority and requires it to match.
+   */
+  askDecisionDigest: Sha256DigestSchema,
+  adapterId: AdapterIdSchema,
+  policy: PolicyReferenceSchema,
+  evaluatedGrants: z12.array(GrantVersionReferenceSchema).min(1).max(32),
+  presentationDigest: Sha256DigestSchema,
+  requestedAtEpochMs: EpochMillisecondsSchema,
+  expiresAtEpochMs: EpochMillisecondsSchema
+}).strict().superRefine((binding, context) => {
+  if (binding.requestedAtEpochMs >= binding.expiresAtEpochMs) {
+    context.addIssue({
+      code: "custom",
+      message: "approval expiry must follow request time",
+      path: ["expiresAtEpochMs"]
+    });
+  }
+});
+var ApprovalStateSchema = z12.enum([
+  "pending",
+  "approved",
+  "denied",
+  "expired",
+  "revoked",
+  "superseded",
+  "consumed"
+]);
+var ApprovalRecordSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  binding: ApprovalBindingSchema,
+  state: ApprovalStateSchema,
+  version: z12.number().int().positive(),
+  updatedAtEpochMs: EpochMillisecondsSchema,
+  decidedByPrincipalId: PrincipalIdSchema.nullable()
+}).strict().superRefine((record, context) => {
+  const humanDecision = ["approved", "denied", "revoked"].includes(
+    record.state
+  );
+  if (humanDecision !== (record.decidedByPrincipalId !== null)) {
+    context.addIssue({
+      code: "custom",
+      message: "human decisions require the deciding principal",
+      path: ["decidedByPrincipalId"]
+    });
+  }
+  if (record.updatedAtEpochMs < record.binding.requestedAtEpochMs || record.updatedAtEpochMs > record.binding.expiresAtEpochMs) {
+    context.addIssue({
+      code: "custom",
+      message: "approval update time must stay inside its validity window",
+      path: ["updatedAtEpochMs"]
+    });
+  }
+});
+var ApprovalDecisionRequestSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  decision: z12.enum(["approve", "deny"]),
+  expectedVersion: z12.number().int().positive().safe(),
+  presentationDigest: Sha256DigestSchema
+}).strict();
+var ApprovalRevocationRequestSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  expectedVersion: z12.number().int().positive().safe()
+}).strict();
+var ApprovalChallengeSchema = z12.object({
+  approvalId: ApprovalIdSchema,
+  version: z12.number().int().positive().safe(),
+  presentationDigest: Sha256DigestSchema,
+  expiresAtEpochMs: EpochMillisecondsSchema
+}).strict();
+var ApprovalReceiptSchema = z12.object({
+  schemaVersion: z12.literal(1),
+  approvalId: ApprovalIdSchema,
+  state: ApprovalStateSchema,
+  version: z12.number().int().positive().safe(),
+  updatedAtEpochMs: EpochMillisecondsSchema,
+  approvalDigest: Sha256DigestSchema
+}).strict();
+
+// src/contracts/authority-state.ts
+import { z as z13 } from "zod";
+var AuthorityStateSnapshotSchema = z13.object({
+  principal: PrincipalSchema,
+  agent: AgentIdentitySchema,
+  policy: PolicyReferenceSchema,
+  authorityChain: z13.array(AuthorityGrantSchema).max(32),
+  revocations: z13.array(RevocationSchema).max(256),
+  allowedAdapterIds: z13.array(AdapterIdSchema).max(64),
+  budgets: z13.array(BudgetStateSchema).max(64).default([])
+}).strict();
+
+// src/contracts/capability.ts
+import { z as z14 } from "zod";
+var CapabilityKeyIdSchema = z14.string().regex(/^key_[A-Za-z0-9][A-Za-z0-9_-]{7,119}$/).brand();
+var CapabilityClaimsSchema = z14.object({
+  schemaVersion: z14.literal(1),
+  capabilityId: CapabilityIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  actionDigest: z14.string().regex(/^[a-f0-9]{64}$/),
+  actionNonce: NonceSchema,
+  audience: AdapterIdSchema,
+  policy: PolicyReferenceSchema,
+  evaluatedGrants: z14.array(
+    z14.object({
+      id: GrantIdSchema,
+      version: z14.number().int().positive()
+    }).strict()
+  ).min(1).max(32),
+  issuedAtEpochMs: z14.number().int().nonnegative(),
+  expiresAtEpochMs: z14.number().int().positive(),
+  maxUses: z14.literal(1),
+  keyId: CapabilityKeyIdSchema,
+  algorithm: z14.literal("HS256")
+}).strict().superRefine((value, context) => {
+  if (value.issuedAtEpochMs >= value.expiresAtEpochMs) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAtEpochMs"],
+      message: "capability expiry must be later than issuance"
+    });
+  }
+  if (new Set(value.evaluatedGrants.map(({ id }) => id)).size !== value.evaluatedGrants.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["evaluatedGrants"],
+      message: "evaluated grant identifiers must be unique"
+    });
+  }
+});
+
+// src/contracts/execution.ts
+import { z as z15 } from "zod";
+var ProviderSchema = z15.enum([
+  "gmail",
+  "graph",
+  "api",
+  "tool",
+  "gcalendar",
+  "payment-sandbox",
+  "file",
+  "protected_data"
+]);
+var ConnectionProfileSchema = z15.enum([
+  "gmail-split-compose-metadata",
+  "gmail-compose-readonly",
+  "graph-readwrite-send",
+  "api-bearer-request",
+  "tool-mcp-server",
+  "gcalendar-events-v1",
+  "payment-sandbox-charge",
+  "file-local-store",
+  "protected-data-store"
+]);
+var VerificationLevelSchema = z15.enum([
+  "post-commit-content",
+  "pre-commit-content+post-commit-envelope"
+]);
+var LeasePurposeSchema = z15.enum([
+  "account",
+  "prepare",
+  "readback",
+  "commit",
+  "observe",
+  "cleanup"
+]);
+var ExecutionStateSchema = z15.enum([
+  "reserved",
+  "redeemed",
+  "preparing",
+  "prepared",
+  "committing",
+  "unknown",
+  "unresolved",
+  "verified",
+  "mismatch",
+  "commit-rejected",
+  "aborted"
+]);
+var ExecutionFailureCodeSchema = z15.enum([
+  "SENDER_ACCOUNT_MISMATCH",
+  "CREDENTIAL_UNAVAILABLE",
+  "PREPARE_REJECTED",
+  "PREPARE_AMBIGUOUS",
+  "READBACK_UNAVAILABLE",
+  "PREPARED_CONTENT_MISMATCH",
+  "COMMIT_NOT_AUTHORIZED",
+  "AUTHORITY_REVOKED_BEFORE_COMMIT",
+  "COMMIT_DEADLINE_EXPIRED",
+  "ABORTED_BEFORE_COMMIT",
+  "COMMIT_NOT_ISSUED",
+  "COMMIT_REJECTED",
+  "EFFECT_MISMATCH",
+  "DUPLICATE_EFFECT_DETECTED"
+]);
+var ExecutionAbortReasonSchema = z15.literal(
+  "INTERRUPTED_BEFORE_ATTEMPT"
+);
+var ExecutionUnknownReasonSchema = z15.enum([
+  "COMMIT_RESPONSE_LOST",
+  "COMMIT_TIMEOUT",
+  "COMMIT_SERVER_ERROR",
+  "COMMIT_RESPONSE_INVALID",
+  "COMMIT_REDIRECT_REFUSED",
+  "COMMIT_TARGET_NOT_FOUND",
+  "REJECTION_UNCONFIRMED",
+  "AWAITING_PROVIDER_RECORD",
+  "VERIFICATION_UNAVAILABLE"
+]);
+var ProviderIdSchema = z15.string().regex(/^[A-Za-z0-9_=+/-]{1,512}$/);
+var InternetMessageIdSchema = z15.string().regex(/^<[\x21-\x3b\x3d\x3f-\x7e]{1,995}>$/);
+var ProviderObjectRefSchema = z15.discriminatedUnion("kind", [
+  z15.object({
+    kind: z15.literal("gmail-draft"),
+    draftId: ProviderIdSchema,
+    messageId: ProviderIdSchema,
+    threadId: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("graph-message"),
+    immutableId: ProviderIdSchema,
+    internetMessageId: InternetMessageIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("api-request"),
+    requestDigest: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("tool-call"),
+    callDigest: Sha256DigestSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("gcalendar-plan"),
+    requestDigest: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("payment-order"),
+    orderId: ProviderIdSchema,
+    intentId: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("file-request"),
+    requestDigest: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("protected_data-op"),
+    operationDigest: ProviderIdSchema
+  }).strict()
+]);
+var ProviderSentRefSchema = z15.discriminatedUnion("kind", [
+  z15.object({
+    kind: z15.literal("gmail-message"),
+    messageId: ProviderIdSchema,
+    threadId: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("graph-message"),
+    immutableId: ProviderIdSchema
+  }).strict(),
+  z15.object({
+    kind: z15.literal("api-response"),
+    status: z15.number().int().min(0).max(999),
+    bodyBytes: z15.number().int().min(0),
+    headersDigest: Sha256DigestSchema,
+    bodyDigest: Sha256DigestSchema,
+    bodyPreview: z15.string().max(512),
+    truncated: z15.boolean()
+  }).strict(),
+  z15.object({
+    kind: z15.literal("tool-response"),
+    operation: z15.enum(["invoke", "install", "enable"]),
+    toolName: z15.string().min(1).max(64),
+    status: z15.number().int().min(0).max(999).nullable(),
+    resultDigest: Sha256DigestSchema,
+    detail: z15.string().max(256)
+  }).strict(),
+  z15.object({
+    kind: z15.literal("gcalendar-event"),
+    eventId: ProviderIdSchema,
+    status: z15.enum(["confirmed", "cancelled"])
+  }).strict(),
+  z15.object({
+    kind: z15.literal("payment-charge"),
+    chargeId: ProviderIdSchema,
+    amountCents: z15.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    currency: z15.string().trim().min(3).max(3),
+    status: z15.enum(["succeeded", "refunded", "returned", "voided"])
+  }).strict(),
+  z15.object({
+    kind: z15.literal("file-effect"),
+    operation: z15.enum(["read", "write", "share", "delete"]),
+    path: z15.string().min(1).max(512),
+    contentDigest: Sha256DigestSchema.nullable(),
+    bytes: z15.number().int().min(0),
+    shareId: ProviderIdSchema.nullable(),
+    grantee: z15.string().max(256).nullable()
+  }).strict(),
+  z15.object({
+    kind: z15.literal("protected_data-effect"),
+    operation: z15.enum(["use", "view", "disclose", "persist"]),
+    fieldRef: z15.string().min(1).max(64),
+    valueDigest: Sha256DigestSchema,
+    counterparty: z15.string().max(256).nullable(),
+    maskedPreview: z15.string().max(120).nullable()
+  }).strict()
+]);
+var VerifiedOutcomeSchema = z15.object({
+  kind: z15.literal("verified"),
+  sentRef: ProviderSentRefSchema,
+  observedDigest: Sha256DigestSchema,
+  effectDigest: Sha256DigestSchema,
+  level: VerificationLevelSchema,
+  observedAtEpochMs: EpochMillisecondsSchema
+}).strict();
+var MismatchOutcomeSchema = z15.object({
+  kind: z15.literal("mismatch"),
+  code: z15.enum(["EFFECT_MISMATCH", "DUPLICATE_EFFECT_DETECTED"]),
+  observedDigest: Sha256DigestSchema.nullable()
+}).strict();
+var CommitRejectedOutcomeSchema = z15.object({
+  kind: z15.literal("commit-rejected"),
+  providerStatus: z15.union([
+    z15.literal(0),
+    z15.literal(400),
+    z15.literal(401),
+    z15.literal(403),
+    z15.literal(404),
+    z15.literal(409),
+    z15.literal(413),
+    z15.literal(422),
+    z15.literal(429)
+  ]),
+  confirmedAtEpochMs: EpochMillisecondsSchema
+}).strict();
+var UnknownOutcomeSchema = z15.object({
+  kind: z15.literal("unknown"),
+  reason: ExecutionUnknownReasonSchema
+}).strict();
+var AbortedOutcomeSchema = z15.object({
+  kind: z15.literal("aborted"),
+  code: ExecutionFailureCodeSchema,
+  orphanDraftPossible: z15.boolean()
+}).strict();
+var UnresolvedOutcomeSchema = z15.object({
+  kind: z15.literal("unresolved"),
+  reason: ExecutionUnknownReasonSchema
+}).strict();
+var OutcomeSchema = z15.discriminatedUnion("kind", [
+  VerifiedOutcomeSchema,
+  MismatchOutcomeSchema,
+  CommitRejectedOutcomeSchema,
+  UnknownOutcomeSchema,
+  AbortedOutcomeSchema,
+  UnresolvedOutcomeSchema
+]);
+var PendingOutcomeSchema = OutcomeSchema;
+var ExecutionRecordSchema = z15.object({
+  schemaVersion: z15.literal(1),
+  attemptId: AttemptIdSchema,
+  tenantId: TenantIdSchema,
+  principalId: PrincipalIdSchema,
+  agentId: AgentIdSchema,
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  capabilityId: CapabilityIdSchema,
+  actionDigest: Sha256DigestSchema,
+  adapterId: AdapterIdSchema,
+  connectionId: ConnectionIdSchema,
+  provider: ProviderSchema,
+  profile: ConnectionProfileSchema,
+  effectKey: Sha256DigestSchema,
+  expectedProjectionDigest: Sha256DigestSchema,
+  expectedEnvelopeDigest: Sha256DigestSchema,
+  state: ExecutionStateSchema,
+  version: z15.number().int().positive().safe(),
+  reservedAtEpochMs: EpochMillisecondsSchema,
+  updatedAtEpochMs: EpochMillisecondsSchema,
+  commitDeadlineEpochMs: EpochMillisecondsSchema,
+  commitLeaseDeadlineEpochMs: EpochMillisecondsSchema.nullable(),
+  reconcileDeadlineEpochMs: EpochMillisecondsSchema.nullable(),
+  lateReconcileDeadlineEpochMs: EpochMillisecondsSchema.nullable(),
+  commitLeaseIssued: z15.boolean(),
+  providerObjectRef: ProviderObjectRefSchema.nullable(),
+  sentRef: ProviderSentRefSchema.nullable(),
+  orphanDraftPossible: z15.boolean(),
+  pendingOutcome: PendingOutcomeSchema.nullable(),
+  outcome: OutcomeSchema.nullable()
+}).strict();
+var AdapterRedemptionRequestSchema = z15.object({
+  schemaVersion: z15.literal(1),
+  capabilityToken: z15.string().min(1).max(512),
+  requestId: RequestIdSchema,
+  presentedBy: z15.object({
+    tenantId: TenantIdSchema,
+    principalId: PrincipalIdSchema,
+    agentId: AgentIdSchema
+  }).strict()
+}).strict();
+var ExecutionGrantSchema = z15.object({
+  schemaVersion: z15.literal(1),
+  attemptId: AttemptIdSchema,
+  version: z15.number().int().positive().safe(),
+  connectionId: ConnectionIdSchema,
+  provider: ProviderSchema,
+  profile: ConnectionProfileSchema,
+  action: CanonicalActionSchema,
+  expectedProjectionDigest: Sha256DigestSchema,
+  expectedEnvelopeDigest: Sha256DigestSchema,
+  commitDeadlineEpochMs: EpochMillisecondsSchema
+}).strict();
+var expectedVersion = z15.number().int().positive().safe();
+var CommandOutcomeSchema = z15.discriminatedUnion("kind", [
+  VerifiedOutcomeSchema.omit({ effectDigest: true }),
+  MismatchOutcomeSchema,
+  CommitRejectedOutcomeSchema,
+  UnknownOutcomeSchema
+]);
+var ExecutionStageCommandSchema = z15.discriminatedUnion("command", [
+  z15.object({ command: z15.literal("begin-prepare"), expectedVersion }).strict(),
+  z15.object({
+    command: z15.literal("prepared"),
+    expectedVersion,
+    providerObjectRef: ProviderObjectRefSchema,
+    preparedProjectionDigest: Sha256DigestSchema
+  }).strict(),
+  z15.object({ command: z15.literal("commit-request"), expectedVersion }).strict(),
+  z15.object({
+    command: z15.literal("outcome"),
+    expectedVersion,
+    outcome: CommandOutcomeSchema
+  }).strict(),
+  z15.object({
+    command: z15.literal("abort"),
+    expectedVersion,
+    code: ExecutionFailureCodeSchema,
+    orphanDraftPossible: z15.boolean()
+  }).strict()
+]);
+var AgentExecutionRequestSchema = z15.object({
+  schemaVersion: z15.literal(1),
+  requestId: RequestIdSchema,
+  capabilityToken: z15.string().min(1).max(512)
+}).strict();
+var AgentExecutionReceiptSchema = z15.object({
+  schemaVersion: z15.literal(1),
+  requestId: RequestIdSchema,
+  receiptReference: AttemptIdSchema,
+  status: z15.enum([
+    "sent-verified",
+    "not-sent",
+    "outcome-pending",
+    "outcome-unconfirmed"
+  ]),
+  /**
+   * Inline-only delivery channel (WO-013). Carries the value the action was
+   * authorized to hand the agent — a file's content for `file.read` or the
+   * field value for `protected_data.view` — digest-correlated with the
+   * sentRef. Never written to the ledger; only `protected_data.view` and
+   * `file.read` produce it and only on a `sent-verified` receipt.
+   */
+  delivered: z15.object({
+    kind: z15.enum(["file-content", "protected-value"]),
+    fieldRef: z15.string().min(1).max(64).nullable(),
+    path: z15.string().min(1).max(512).nullable(),
+    value: z15.string().max(64e3),
+    valueDigest: Sha256DigestSchema
+  }).strict().optional()
+}).strict();
+
+// src/proposal.ts
+var AgentActionProposalSchema = z16.object({
+  schemaVersion: z16.literal(1),
+  requestId: RequestIdSchema,
+  correlationId: CorrelationIdSchema,
+  action: ActionTypeSchema,
+  resource: ResourceRefSchema,
+  valueCents: z16.number().int().nonnegative().safe().optional(),
+  merchantId: z16.string().trim().min(1).max(256).optional(),
+  merchantCategory: z16.string().trim().min(1).max(256).optional(),
+  recurring: z16.boolean().optional(),
+  taskId: TaskIdSchema.optional(),
+  uses: z16.literal(1),
+  materialParameters: MaterialParametersSchema,
+  purpose: z16.string().trim().min(1).max(1024),
+  initiatingContext: z16.enum(["user", "scheduled", "agent", "external-event"]),
+  requestedAdapterId: AdapterIdSchema,
+  requestedTtlMs: z16.number().int().positive().max(3e5)
+}).strict();
+
+// src/client.ts
+function randomId(prefix) {
+  return `${prefix}_${randomBytes(16).toString("hex")}`;
+}
+function materialParametersFor(invocation) {
+  if (invocation.action === "tool.invoke") {
+    const params2 = ToolInvokeParametersV1Schema.parse({
+      schema: "odingard.guardian.tool.invoke.v1",
+      connectionId: invocation.connectionId,
+      toolName: invocation.toolName,
+      arguments: invocation.arguments
+    });
+    return { ...params2 };
+  }
+  if (invocation.action === "mcp.install") {
+    const params2 = McpInstallParametersV1Schema.parse({
+      schema: "odingard.guardian.mcp.install.v1",
+      connectionId: invocation.connectionId,
+      tool: invocation.tool
+    });
+    return { ...params2 };
+  }
+  const params = McpEnableParametersV1Schema.parse({
+    schema: "odingard.guardian.mcp.enable.v1",
+    connectionId: invocation.connectionId,
+    toolName: invocation.toolName
+  });
+  return { ...params };
+}
+var RESOURCE_TYPE = {
+  "tool.invoke": "tool:server",
+  "mcp.install": "mcp:server",
+  "mcp.enable": "mcp:server"
+};
+function createGuardianClient(config) {
+  const transport = config.fetch ?? fetch;
+  const base = config.baseUrl.replace(/\/+$/, "");
+  const call = async (path, body, method = "POST") => {
+    const init = {
+      method,
+      headers: {
+        authorization: `Bearer ${config.credential}`,
+        ...body === void 0 ? {} : { "content-type": "application/json" }
+      },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) }
+    };
+    const response = await transport(`${base}${path}`, init);
+    const parsed = await response.json().catch(() => null);
+    return { status: response.status, body: parsed };
+  };
+  const requestCapability = async (path, body) => {
+    const response = await call(path, body);
+    const data = response.body;
+    if (!data || data.ok !== true) {
+      return {
+        ok: false,
+        reasonCode: typeof data?.reasonCode === "string" ? data.reasonCode : `HTTP_${response.status}`
+      };
+    }
+    return {
+      ok: true,
+      requestId: typeof data.requestId === "string" ? data.requestId : body.requestId ?? "",
+      decision: data.decision === "ASK" || data.decision === "DENY" ? data.decision : "ALLOW",
+      ...typeof data.capabilityToken === "string" ? { capabilityToken: data.capabilityToken } : typeof data.token === "string" ? { capabilityToken: data.token } : {},
+      ...typeof data.reasonCode === "string" ? { reasonCode: data.reasonCode } : {}
+    };
+  };
+  return {
+    request(invocation) {
+      const requestId = randomId("req");
+      const proposal = AgentActionProposalSchema.parse({
+        schemaVersion: 1,
+        requestId,
+        correlationId: randomId("cor"),
+        action: invocation.action,
+        resource: `${RESOURCE_TYPE[invocation.action]}:${invocation.connectionId}`,
+        uses: 1,
+        materialParameters: materialParametersFor(invocation),
+        purpose: invocation.purpose ?? `Guardian ${invocation.action}`,
+        initiatingContext: "agent",
+        requestedAdapterId: invocation.adapterId ?? "adp_00000006",
+        requestedTtlMs: 12e4
+      });
+      return requestCapability("/v1/agent/requests", proposal);
+    },
+    claim(requestId) {
+      return requestCapability("/v1/agent/claims", {
+        schemaVersion: 1,
+        requestId
+      });
+    },
+    async execute({ requestId, capabilityToken }) {
+      const request = AgentExecutionRequestSchema.parse({
+        schemaVersion: 1,
+        requestId,
+        capabilityToken
+      });
+      const response = await call("/v1/agent/execute", request);
+      const data = response.body;
+      const receipt = AgentExecutionReceiptSchema.safeParse(data?.receipt);
+      if (!data || data.ok !== true || !receipt.success) {
+        return {
+          ok: false,
+          reasonCode: typeof data?.reasonCode === "string" ? data.reasonCode : `HTTP_${response.status}`
+        };
+      }
+      return { ok: true, receipt: receipt.data };
+    },
+    async receipts(requestId) {
+      const response = await call(
+        `/v1/agent/receipts/${encodeURIComponent(requestId)}`,
+        void 0,
+        "GET"
+      );
+      const data = response.body;
+      if (!data || data.ok !== true || !Array.isArray(data.receipts)) {
+        return {
+          ok: false,
+          reasonCode: typeof data?.code === "string" ? data.code : `HTTP_${response.status}`
+        };
+      }
+      return {
+        ok: true,
+        requestId: data.requestId,
+        receipts: data.receipts
+      };
+    }
+  };
+}
+export {
+  createGuardianClient
+};