@odingard/guardian-sdk 0.0.0-stage → 0.2.0

package/dist-dts/contracts/authority.d.ts

@@ -0,0 +1,339 @@
+import { z } from "zod";
+export declare const RecurrencePolicySchema: z.ZodEnum<{
+    never: "never";
+    allowed: "allowed";
+}>;
+export declare const BudgetConsumptionSchema: z.ZodObject<{
+    budgetId: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+    amountCents: z.ZodNumber;
+    transactions: z.ZodNumber;
+}, z.core.$strict>;
+export declare const ActionTypeSchema: z.core.$ZodBranded<z.ZodString, "ActionType", "out">;
+export declare const ResourceRefSchema: z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">;
+export declare const EpochMillisecondsSchema: z.ZodNumber;
+export declare const AgentInterfaceSchema: z.ZodEnum<{
+    mcp: "mcp";
+    rest: "rest";
+    internal: "internal";
+}>;
+export declare const PrincipalSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+}, z.core.$strict>;
+export declare const BudgetStateSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+    scope: z.ZodEnum<{
+        agent: "agent";
+        task: "task";
+    }>;
+    taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
+    limitCents: z.ZodNumber;
+    consumedCents: z.ZodNumber;
+    transactionLimit: z.ZodNumber;
+    consumedTransactions: z.ZodNumber;
+    expiresAtEpochMs: z.ZodOptional<z.ZodNumber>;
+    status: z.ZodEnum<{
+        active: "active";
+        exhausted: "exhausted";
+        revoked: "revoked";
+    }>;
+}, z.core.$strict>;
+export declare const AgentIdentitySchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    ownerPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+        revoked: "revoked";
+    }>;
+    allowedInterfaces: z.ZodPipe<z.ZodArray<z.ZodEnum<{
+        mcp: "mcp";
+        rest: "rest";
+        internal: "internal";
+    }>>, z.ZodTransform<("mcp" | "rest" | "internal")[], ("mcp" | "rest" | "internal")[]>>;
+    boundRuntime: z.ZodOptional<z.ZodString>;
+    boundModel: z.ZodOptional<z.ZodString>;
+    parentAgentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
+}, z.core.$strict>;
+export declare const AuthorityConstraintsSchema: z.ZodObject<{
+    actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
+    resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
+    adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
+    maxValueCents: z.ZodOptional<z.ZodNumber>;
+    maxUsesPerRequest: z.ZodNumber;
+    notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+    expiresAtEpochMs: z.ZodNumber;
+    approvalRequired: z.ZodBoolean;
+    askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+    merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+    categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+    recurrence: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        allowed: "allowed";
+    }>>;
+    budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
+}, z.core.$strict>;
+export declare const AuthorityGrantSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    parentGrantId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
+    issuedBy: z.ZodObject<{
+        type: z.ZodLiteral<"principal">;
+        principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+        revoked: "revoked";
+    }>;
+    version: z.ZodNumber;
+    delegable: z.ZodDefault<z.ZodBoolean>;
+    constraints: z.ZodObject<{
+        actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
+        resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
+        adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
+        maxValueCents: z.ZodOptional<z.ZodNumber>;
+        maxUsesPerRequest: z.ZodNumber;
+        notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+        expiresAtEpochMs: z.ZodNumber;
+        approvalRequired: z.ZodBoolean;
+        askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+        merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+        categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+        recurrence: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            allowed: "allowed";
+        }>>;
+        budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const AuthorityRequestSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "RequestId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    action: z.core.$ZodBranded<z.ZodString, "ActionType", "out">;
+    resource: z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">;
+    interface: z.ZodEnum<{
+        mcp: "mcp";
+        rest: "rest";
+        internal: "internal";
+    }>;
+    requestedAdapterId: z.core.$ZodBranded<z.ZodString, "AdapterId", "out">;
+    valueCents: z.ZodOptional<z.ZodNumber>;
+    uses: z.ZodNumber;
+    materialActionDigest: z.ZodOptional<z.ZodString>;
+    descriptiveContext: z.ZodOptional<z.ZodString>;
+    merchantId: z.ZodOptional<z.ZodString>;
+    merchantCategory: z.ZodOptional<z.ZodString>;
+    recurring: z.ZodOptional<z.ZodBoolean>;
+    taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
+    intentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "IntentId", "out">>;
+    planId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "PlanId", "out">>;
+}, z.core.$strict>;
+export declare const DenyReasonCodeSchema: z.ZodEnum<{
+    MALFORMED_INPUT: "MALFORMED_INPUT";
+    TENANT_MISMATCH: "TENANT_MISMATCH";
+    PRINCIPAL_MISMATCH: "PRINCIPAL_MISMATCH";
+    PRINCIPAL_NOT_ACTIVE: "PRINCIPAL_NOT_ACTIVE";
+    AGENT_TENANT_MISMATCH: "AGENT_TENANT_MISMATCH";
+    AGENT_OWNER_MISMATCH: "AGENT_OWNER_MISMATCH";
+    AGENT_MISMATCH: "AGENT_MISMATCH";
+    AGENT_NOT_ACTIVE: "AGENT_NOT_ACTIVE";
+    INTERFACE_NOT_ALLOWED: "INTERFACE_NOT_ALLOWED";
+    AUTHORITY_PAUSED: "AUTHORITY_PAUSED";
+    AUTHORITY_CHAIN_MISSING: "AUTHORITY_CHAIN_MISSING";
+    DUPLICATE_GRANT_ID: "DUPLICATE_GRANT_ID";
+    GRANT_TENANT_MISMATCH: "GRANT_TENANT_MISMATCH";
+    GRANT_PRINCIPAL_MISMATCH: "GRANT_PRINCIPAL_MISMATCH";
+    GRANT_AGENT_MISMATCH: "GRANT_AGENT_MISMATCH";
+    GRANT_NOT_ACTIVE: "GRANT_NOT_ACTIVE";
+    GRANT_REVOKED: "GRANT_REVOKED";
+    GRANT_NOT_YET_VALID: "GRANT_NOT_YET_VALID";
+    GRANT_EXPIRED: "GRANT_EXPIRED";
+    INVALID_PARENT_LINK: "INVALID_PARENT_LINK";
+    DELEGATION_NOT_ALLOWED: "DELEGATION_NOT_ALLOWED";
+    AUTHORITY_AMPLIFICATION: "AUTHORITY_AMPLIFICATION";
+    ACTION_NOT_ALLOWED: "ACTION_NOT_ALLOWED";
+    RESOURCE_NOT_ALLOWED: "RESOURCE_NOT_ALLOWED";
+    ADAPTER_NOT_ALLOWED: "ADAPTER_NOT_ALLOWED";
+    VALUE_LIMIT_EXCEEDED: "VALUE_LIMIT_EXCEEDED";
+    USE_LIMIT_EXCEEDED: "USE_LIMIT_EXCEEDED";
+    MERCHANT_NOT_ALLOWED: "MERCHANT_NOT_ALLOWED";
+    CATEGORY_NOT_ALLOWED: "CATEGORY_NOT_ALLOWED";
+    RECURRENCE_NOT_ALLOWED: "RECURRENCE_NOT_ALLOWED";
+    BUDGET_NOT_FOUND: "BUDGET_NOT_FOUND";
+    BUDGET_SCOPE_MISMATCH: "BUDGET_SCOPE_MISMATCH";
+    BUDGET_NOT_ACTIVE: "BUDGET_NOT_ACTIVE";
+    BUDGET_EXPIRED: "BUDGET_EXPIRED";
+    BUDGET_EXCEEDED: "BUDGET_EXCEEDED";
+    TRANSACTION_LIMIT_EXCEEDED: "TRANSACTION_LIMIT_EXCEEDED";
+}>;
+export declare const DENY_PRECEDENCE: readonly ["MALFORMED_INPUT", "TENANT_MISMATCH", "PRINCIPAL_MISMATCH", "PRINCIPAL_NOT_ACTIVE", "AGENT_TENANT_MISMATCH", "AGENT_OWNER_MISMATCH", "AGENT_MISMATCH", "AGENT_NOT_ACTIVE", "INTERFACE_NOT_ALLOWED", "AUTHORITY_PAUSED", "AUTHORITY_CHAIN_MISSING", "DUPLICATE_GRANT_ID", "GRANT_TENANT_MISMATCH", "GRANT_PRINCIPAL_MISMATCH", "GRANT_AGENT_MISMATCH", "GRANT_REVOKED", "GRANT_NOT_ACTIVE", "GRANT_NOT_YET_VALID", "GRANT_EXPIRED", "INVALID_PARENT_LINK", "DELEGATION_NOT_ALLOWED", "AUTHORITY_AMPLIFICATION", "ACTION_NOT_ALLOWED", "RESOURCE_NOT_ALLOWED", "ADAPTER_NOT_ALLOWED", "VALUE_LIMIT_EXCEEDED", "USE_LIMIT_EXCEEDED", "MERCHANT_NOT_ALLOWED", "CATEGORY_NOT_ALLOWED", "RECURRENCE_NOT_ALLOWED", "BUDGET_NOT_FOUND", "BUDGET_SCOPE_MISMATCH", "BUDGET_NOT_ACTIVE", "BUDGET_EXPIRED", "BUDGET_EXCEEDED", "TRANSACTION_LIMIT_EXCEEDED"];
+export declare const PolicyReferenceSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+    version: z.ZodNumber;
+}, z.core.$strict>;
+export declare const DecisionBindingSchema: z.ZodObject<{
+    requestId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "RequestId", "out">>;
+    policy: z.ZodNullable<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+        version: z.ZodNumber;
+    }, z.core.$strict>>;
+    evaluatedGrants: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+        version: z.ZodNumber;
+    }, z.core.$strict>>;
+    inputDigest: z.ZodNullable<z.ZodString>;
+    budgetConsumption: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        budgetId: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+        amountCents: z.ZodNumber;
+        transactions: z.ZodNumber;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export declare const AuthorityDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    decision: z.ZodLiteral<"ALLOW">;
+    reasonCode: z.ZodLiteral<"AUTHORIZED">;
+    binding: z.ZodObject<{
+        requestId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "RequestId", "out">>;
+        policy: z.ZodNullable<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        evaluatedGrants: z.ZodArray<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        inputDigest: z.ZodNullable<z.ZodString>;
+        budgetConsumption: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            budgetId: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+            amountCents: z.ZodNumber;
+            transactions: z.ZodNumber;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    decision: z.ZodLiteral<"ASK">;
+    reasonCode: z.ZodLiteral<"APPROVAL_REQUIRED">;
+    binding: z.ZodObject<{
+        requestId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "RequestId", "out">>;
+        policy: z.ZodNullable<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        evaluatedGrants: z.ZodArray<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        inputDigest: z.ZodNullable<z.ZodString>;
+        budgetConsumption: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            budgetId: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+            amountCents: z.ZodNumber;
+            transactions: z.ZodNumber;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    decision: z.ZodLiteral<"DENY">;
+    reasonCode: z.ZodEnum<{
+        MALFORMED_INPUT: "MALFORMED_INPUT";
+        TENANT_MISMATCH: "TENANT_MISMATCH";
+        PRINCIPAL_MISMATCH: "PRINCIPAL_MISMATCH";
+        PRINCIPAL_NOT_ACTIVE: "PRINCIPAL_NOT_ACTIVE";
+        AGENT_TENANT_MISMATCH: "AGENT_TENANT_MISMATCH";
+        AGENT_OWNER_MISMATCH: "AGENT_OWNER_MISMATCH";
+        AGENT_MISMATCH: "AGENT_MISMATCH";
+        AGENT_NOT_ACTIVE: "AGENT_NOT_ACTIVE";
+        INTERFACE_NOT_ALLOWED: "INTERFACE_NOT_ALLOWED";
+        AUTHORITY_PAUSED: "AUTHORITY_PAUSED";
+        AUTHORITY_CHAIN_MISSING: "AUTHORITY_CHAIN_MISSING";
+        DUPLICATE_GRANT_ID: "DUPLICATE_GRANT_ID";
+        GRANT_TENANT_MISMATCH: "GRANT_TENANT_MISMATCH";
+        GRANT_PRINCIPAL_MISMATCH: "GRANT_PRINCIPAL_MISMATCH";
+        GRANT_AGENT_MISMATCH: "GRANT_AGENT_MISMATCH";
+        GRANT_NOT_ACTIVE: "GRANT_NOT_ACTIVE";
+        GRANT_REVOKED: "GRANT_REVOKED";
+        GRANT_NOT_YET_VALID: "GRANT_NOT_YET_VALID";
+        GRANT_EXPIRED: "GRANT_EXPIRED";
+        INVALID_PARENT_LINK: "INVALID_PARENT_LINK";
+        DELEGATION_NOT_ALLOWED: "DELEGATION_NOT_ALLOWED";
+        AUTHORITY_AMPLIFICATION: "AUTHORITY_AMPLIFICATION";
+        ACTION_NOT_ALLOWED: "ACTION_NOT_ALLOWED";
+        RESOURCE_NOT_ALLOWED: "RESOURCE_NOT_ALLOWED";
+        ADAPTER_NOT_ALLOWED: "ADAPTER_NOT_ALLOWED";
+        VALUE_LIMIT_EXCEEDED: "VALUE_LIMIT_EXCEEDED";
+        USE_LIMIT_EXCEEDED: "USE_LIMIT_EXCEEDED";
+        MERCHANT_NOT_ALLOWED: "MERCHANT_NOT_ALLOWED";
+        CATEGORY_NOT_ALLOWED: "CATEGORY_NOT_ALLOWED";
+        RECURRENCE_NOT_ALLOWED: "RECURRENCE_NOT_ALLOWED";
+        BUDGET_NOT_FOUND: "BUDGET_NOT_FOUND";
+        BUDGET_SCOPE_MISMATCH: "BUDGET_SCOPE_MISMATCH";
+        BUDGET_NOT_ACTIVE: "BUDGET_NOT_ACTIVE";
+        BUDGET_EXPIRED: "BUDGET_EXPIRED";
+        BUDGET_EXCEEDED: "BUDGET_EXCEEDED";
+        TRANSACTION_LIMIT_EXCEEDED: "TRANSACTION_LIMIT_EXCEEDED";
+    }>;
+    binding: z.ZodObject<{
+        requestId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "RequestId", "out">>;
+        policy: z.ZodNullable<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        evaluatedGrants: z.ZodArray<z.ZodObject<{
+            id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+            version: z.ZodNumber;
+        }, z.core.$strict>>;
+        inputDigest: z.ZodNullable<z.ZodString>;
+        budgetConsumption: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            budgetId: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+            amountCents: z.ZodNumber;
+            transactions: z.ZodNumber;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "decision">;
+export declare const RevocationSchema: z.ZodObject<{
+    grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+    revokedAtEpochMs: z.ZodNumber;
+    reasonCode: z.ZodString;
+}, z.core.$strict>;
+/**
+ * WO-010 — a scoped authority suspension recorded in authority state. The
+ * control plane resolves each pause into the identifiers the kernel checks
+ * (grant ids as emitted on the chain, adapter ids for connection scope), so
+ * the kernel needs no persistence knowledge to fail closed (K15).
+ */
+export declare const AuthorityPauseSchema: z.ZodObject<{
+    id: z.core.$ZodBranded<z.ZodString, "PauseId", "out">;
+    scope: z.ZodEnum<{
+        agent: "agent";
+        principal: "principal";
+        grant: "grant";
+        connection: "connection";
+    }>;
+    agentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
+    grantIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>, z.ZodTransform<(string & z.core.$brand<"GrantId">)[], (string & z.core.$brand<"GrantId">)[]>>>;
+    adapterIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>>;
+}, z.core.$strict>;
+export type ActionType = z.infer<typeof ActionTypeSchema>;
+export type ResourceRef = z.infer<typeof ResourceRefSchema>;
+export type Principal = z.infer<typeof PrincipalSchema>;
+export type AgentIdentity = z.infer<typeof AgentIdentitySchema>;
+export type AgentInterface = z.infer<typeof AgentInterfaceSchema>;
+export type AuthorityConstraints = z.infer<typeof AuthorityConstraintsSchema>;
+export type AuthorityGrant = z.infer<typeof AuthorityGrantSchema>;
+export type AuthorityRequest = z.infer<typeof AuthorityRequestSchema>;
+export type AuthorityDecision = z.infer<typeof AuthorityDecisionSchema>;
+export type DenyReasonCode = z.infer<typeof DenyReasonCodeSchema>;
+export type Revocation = z.infer<typeof RevocationSchema>;
+export type AuthorityPause = z.infer<typeof AuthorityPauseSchema>;
+export type PolicyReference = z.infer<typeof PolicyReferenceSchema>;
+export type DecisionBinding = z.infer<typeof DecisionBindingSchema>;
+export type RecurrencePolicy = z.infer<typeof RecurrencePolicySchema>;
+export type BudgetConsumption = z.infer<typeof BudgetConsumptionSchema>;
+export type BudgetState = z.infer<typeof BudgetStateSchema>;
+export declare const AUTHORITY_CONSTRAINT_KEYS: readonly ["actions", "resources", "adapterIds", "maxValueCents", "maxUsesPerRequest", "notBeforeEpochMs", "expiresAtEpochMs", "approvalRequired", "askAboveValueCents", "merchantAllowlist", "categoryAllowlist", "recurrence", "budgetIds"];

package/dist-dts/contracts/billing.d.ts

@@ -0,0 +1,32 @@
+import { z } from "zod";
+export declare const BillingPlanIdSchema: z.ZodEnum<{
+    family: "family";
+    free: "free";
+    personal: "personal";
+    developer: "developer";
+    pilot: "pilot";
+}>;
+export type BillingPlanId = z.infer<typeof BillingPlanIdSchema>;
+export declare const CheckoutIntervalSchema: z.ZodEnum<{
+    month: "month";
+    year: "year";
+}>;
+export type CheckoutInterval = z.infer<typeof CheckoutIntervalSchema>;
+export type PlanLimits = Readonly<{
+    connections: number;
+    agents: number;
+    protectedActionsPerMonth: number;
+}>;
+export declare const PLAN_LIMITS: Record<BillingPlanId, PlanLimits>;
+export declare const PURCHASABLE_PLANS: readonly ["personal", "family", "developer"];
+export type PurchasablePlan = (typeof PURCHASABLE_PLANS)[number];
+export type PlanPricing = Readonly<{
+    displayName: string;
+    monthlyUsd: number | null;
+    annualUsd: number | null;
+    usageMetered: boolean;
+    tagline: string;
+}>;
+export declare const PLAN_PRICING: Record<BillingPlanId, PlanPricing>;
+export declare function purchasableIntervals(plan: BillingPlanId): readonly CheckoutInterval[];
+export declare function formatPlanPrice(plan: BillingPlanId, interval: CheckoutInterval): string;

package/dist-dts/contracts/calendar.d.ts

@@ -0,0 +1,146 @@
+import { z } from "zod";
+export declare const CalendarCreateParametersV1Schema: z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.create.v1">;
+    summary: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodString>;
+    start: z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    end: z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const CalendarUpdateParametersV1Schema: z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.update.v1">;
+    eventId: z.ZodString;
+    summary: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodString>;
+    start: z.ZodOptional<z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    end: z.ZodOptional<z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>;
+export declare const CalendarCancelParametersV1Schema: z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.cancel.v1">;
+    eventId: z.ZodString;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>;
+export declare const CalendarInviteParametersV1Schema: z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.invite.v1">;
+    eventId: z.ZodString;
+    attendees: z.ZodArray<z.ZodObject<{
+        email: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>;
+export declare const CalendarParametersV1Schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.create.v1">;
+    summary: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodString>;
+    start: z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    end: z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.update.v1">;
+    eventId: z.ZodString;
+    summary: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    location: z.ZodOptional<z.ZodString>;
+    start: z.ZodOptional<z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    end: z.ZodOptional<z.ZodObject<{
+        dateTime: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.cancel.v1">;
+    eventId: z.ZodString;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>, z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    calendarId: z.ZodString;
+    schema: z.ZodLiteral<"odingard.guardian.calendar.invite.v1">;
+    eventId: z.ZodString;
+    attendees: z.ZodArray<z.ZodObject<{
+        email: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    sendUpdates: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        all: "all";
+        externalOnly: "externalOnly";
+    }>>;
+}, z.core.$strict>], "schema">;
+export type CalendarCreateParametersV1 = z.infer<typeof CalendarCreateParametersV1Schema>;
+export type CalendarUpdateParametersV1 = z.infer<typeof CalendarUpdateParametersV1Schema>;
+export type CalendarCancelParametersV1 = z.infer<typeof CalendarCancelParametersV1Schema>;
+export type CalendarInviteParametersV1 = z.infer<typeof CalendarInviteParametersV1Schema>;
+export type CalendarParametersV1 = z.infer<typeof CalendarParametersV1Schema>;
+/**
+ * The verification projection is the semantic external effect the commit must
+ * produce — the same shape the adapter rebuilds from the provider's
+ * post-commit state so digests compare equal only when the observed effect
+ * matches what authority approved.
+ */
+export declare function calendarVerificationProjection(params: CalendarParametersV1): Readonly<Record<string, unknown>>;
+/**
+ * The envelope projection is the lower-fidelity view: which calendar action on
+ * which calendar/event, without event content (summary/description/attendee
+ * detail).
+ */
+export declare function calendarEnvelopeProjection(params: CalendarParametersV1): Readonly<Record<string, unknown>>;

package/dist-dts/contracts/canonical-json.d.ts

@@ -0,0 +1,4 @@
+export type CanonicalJsonValue = null | boolean | number | string | CanonicalJsonValue[] | {
+    [key: string]: CanonicalJsonValue;
+};
+export declare function canonicalJson(value: CanonicalJsonValue | unknown): string;

package/dist-dts/contracts/capability.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const CapabilityKeyIdSchema: z.core.$ZodBranded<z.ZodString, "CapabilityKeyId", "out">;
+export declare const CapabilityClaimsSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    capabilityId: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    requestId: z.core.$ZodBranded<z.ZodString, "RequestId", "out">;
+    actionDigest: z.ZodString;
+    actionNonce: z.core.$ZodBranded<z.ZodString, "Nonce", "out">;
+    audience: z.core.$ZodBranded<z.ZodString, "AdapterId", "out">;
+    policy: z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+        version: z.ZodNumber;
+    }, z.core.$strict>;
+    evaluatedGrants: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+        version: z.ZodNumber;
+    }, z.core.$strict>>;
+    issuedAtEpochMs: z.ZodNumber;
+    expiresAtEpochMs: z.ZodNumber;
+    maxUses: z.ZodLiteral<1>;
+    keyId: z.core.$ZodBranded<z.ZodString, "CapabilityKeyId", "out">;
+    algorithm: z.ZodLiteral<"HS256">;
+}, z.core.$strict>;
+export type CapabilityKeyId = z.infer<typeof CapabilityKeyIdSchema>;
+export type CapabilityClaims = z.infer<typeof CapabilityClaimsSchema>;