@oxy.so/contracts 1.0.0

package/dist/types/agency.d.ts

@@ -0,0 +1,2162 @@
+import { z } from 'zod';
+/** Autonomy is ordered from least to most permissive. */
+export declare const AUTONOMY_LEVELS: readonly ["read_only", "draft", "execute_on_request", "autonomous"];
+export declare const autonomyLevelSchema: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
+export declare const CAPABILITY_PACKAGES: readonly ["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"];
+export declare const capabilityPackageSchema: z.ZodEnum<["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"]>;
+export declare const actorRefSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"alia">;
+    ownerAccountId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "alia";
+    ownerAccountId: string;
+}, {
+    type: "alia";
+    ownerAccountId: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"agent">;
+    accountId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "agent";
+    accountId: string;
+}, {
+    type: "agent";
+    accountId: string;
+}>]>;
+export declare const resourceRefSchema: z.ZodObject<{
+    appId: z.ZodString;
+    effectiveAccountId: z.ZodString;
+    resourceType: z.ZodString;
+    resourceId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    appId: string;
+    effectiveAccountId: string;
+    resourceType: string;
+    resourceId: string;
+}, {
+    appId: string;
+    effectiveAccountId: string;
+    resourceType: string;
+    resourceId: string;
+}>;
+export declare const toolGrantOverrideSchema: z.ZodObject<{
+    tool: z.ZodString;
+    decision: z.ZodEnum<["allow", "deny"]>;
+}, "strict", z.ZodTypeAny, {
+    tool: string;
+    decision: "allow" | "deny";
+}, {
+    tool: string;
+    decision: "allow" | "deny";
+}>;
+export declare const grantLimitSchema: z.ZodObject<{
+    tool: z.ZodString;
+    key: z.ZodString;
+    value: z.ZodUnion<[z.ZodNumber, z.ZodBoolean]>;
+}, "strict", z.ZodTypeAny, {
+    value: number | boolean;
+    tool: string;
+    key: string;
+}, {
+    value: number | boolean;
+    tool: string;
+    key: string;
+}>;
+export declare const executionAuthorizationRefSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"direct_request">;
+    id: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "direct_request";
+    id: string;
+}, {
+    kind: "direct_request";
+    id: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"automation">;
+    id: z.ZodString;
+    automationId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "automation";
+    id: string;
+    automationId: string;
+}, {
+    kind: "automation";
+    id: string;
+    automationId: string;
+}>]>;
+export declare const capabilityCoordinatorSchema: z.ZodObject<{
+    applicationId: z.ZodString;
+    credentialId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    applicationId: string;
+    credentialId: string;
+}, {
+    applicationId: string;
+    credentialId: string;
+}>;
+export declare const delegationGrantSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerAccountId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"alia">;
+        ownerAccountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "alia";
+        ownerAccountId: string;
+    }, {
+        type: "alia";
+        ownerAccountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"agent">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "agent";
+        accountId: string;
+    }, {
+        type: "agent";
+        accountId: string;
+    }>]>;
+    resource: z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>;
+    capabilityPackages: z.ZodArray<z.ZodEnum<["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"]>, "many">;
+    capabilities: z.ZodArray<z.ZodString, "many">;
+    toolOverrides: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        decision: z.ZodEnum<["allow", "deny"]>;
+    }, "strict", z.ZodTypeAny, {
+        tool: string;
+        decision: "allow" | "deny";
+    }, {
+        tool: string;
+        decision: "allow" | "deny";
+    }>, "many">>;
+    limits: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodUnion<[z.ZodNumber, z.ZodBoolean]>;
+    }, "strict", z.ZodTypeAny, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }>, "many">>;
+    maximumAutonomy: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
+    canRedelegate: z.ZodDefault<z.ZodBoolean>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    ownerAccountId: string;
+    id: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilityPackages: ("finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate")[];
+    capabilities: string[];
+    toolOverrides: {
+        tool: string;
+        decision: "allow" | "deny";
+    }[];
+    limits: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[];
+    maximumAutonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    canRedelegate: boolean;
+    expiresAt: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}, {
+    ownerAccountId: string;
+    id: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilityPackages: ("finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate")[];
+    capabilities: string[];
+    maximumAutonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    expiresAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+    toolOverrides?: {
+        tool: string;
+        decision: "allow" | "deny";
+    }[] | undefined;
+    limits?: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[] | undefined;
+    canRedelegate?: boolean | undefined;
+    revokedAt?: string | null | undefined;
+}>;
+export declare const automationTriggerSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"manual">;
+}, "strict", z.ZodTypeAny, {
+    type: "manual";
+}, {
+    type: "manual";
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"event">;
+    appId: z.ZodString;
+    eventType: z.ZodString;
+    resource: z.ZodOptional<z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    type: "event";
+    appId: string;
+    eventType: string;
+    resource?: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    } | undefined;
+}, {
+    type: "event";
+    appId: string;
+    eventType: string;
+    resource?: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    } | undefined;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"schedule">;
+    cron: z.ZodString;
+    timezone: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "schedule";
+    cron: string;
+    timezone: string;
+}, {
+    type: "schedule";
+    cron: string;
+    timezone: string;
+}>]>;
+export declare const automationActorSelectionSchema: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+    mode: z.ZodLiteral<"fixed">;
+    actor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"alia">;
+        ownerAccountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "alia";
+        ownerAccountId: string;
+    }, {
+        type: "alia";
+        ownerAccountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"agent">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "agent";
+        accountId: string;
+    }, {
+        type: "agent";
+        accountId: string;
+    }>]>;
+}, "strict", z.ZodTypeAny, {
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    mode: "fixed";
+}, {
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    mode: "fixed";
+}>, z.ZodObject<{
+    mode: z.ZodLiteral<"automatic">;
+}, "strict", z.ZodTypeAny, {
+    mode: "automatic";
+}, {
+    mode: "automatic";
+}>]>;
+export declare const automationDataFlowSchema: z.ZodObject<{
+    sources: z.ZodArray<z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>, "many">;
+    destinations: z.ZodArray<z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    sources: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+    destinations: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+}, {
+    sources: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+    destinations: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+}>;
+export declare const automationDefinitionSchema: z.ZodObject<{
+    id: z.ZodString;
+    ownerAccountId: z.ZodString;
+    objective: z.ZodString;
+    trigger: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"manual">;
+    }, "strict", z.ZodTypeAny, {
+        type: "manual";
+    }, {
+        type: "manual";
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"event">;
+        appId: z.ZodString;
+        eventType: z.ZodString;
+        resource: z.ZodOptional<z.ZodObject<{
+            appId: z.ZodString;
+            effectiveAccountId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        type: "event";
+        appId: string;
+        eventType: string;
+        resource?: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        } | undefined;
+    }, {
+        type: "event";
+        appId: string;
+        eventType: string;
+        resource?: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        } | undefined;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"schedule">;
+        cron: z.ZodString;
+        timezone: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "schedule";
+        cron: string;
+        timezone: string;
+    }, {
+        type: "schedule";
+        cron: string;
+        timezone: string;
+    }>]>;
+    actorSelection: z.ZodDiscriminatedUnion<"mode", [z.ZodObject<{
+        mode: z.ZodLiteral<"fixed">;
+        actor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+            type: z.ZodLiteral<"alia">;
+            ownerAccountId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            type: "alia";
+            ownerAccountId: string;
+        }, {
+            type: "alia";
+            ownerAccountId: string;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"agent">;
+            accountId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            type: "agent";
+            accountId: string;
+        }, {
+            type: "agent";
+            accountId: string;
+        }>]>;
+    }, "strict", z.ZodTypeAny, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        };
+        mode: "fixed";
+    }, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        };
+        mode: "fixed";
+    }>, z.ZodObject<{
+        mode: z.ZodLiteral<"automatic">;
+    }, "strict", z.ZodTypeAny, {
+        mode: "automatic";
+    }, {
+        mode: "automatic";
+    }>]>;
+    inputs: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    resources: z.ZodArray<z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>, "many">;
+    dataFlow: z.ZodObject<{
+        sources: z.ZodArray<z.ZodObject<{
+            appId: z.ZodString;
+            effectiveAccountId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }>, "many">;
+        destinations: z.ZodArray<z.ZodObject<{
+            appId: z.ZodString;
+            effectiveAccountId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }, {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        sources: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+        destinations: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+    }, {
+        sources: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+        destinations: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+    }>;
+    maximumAutonomy: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
+    limits: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodUnion<[z.ZodNumber, z.ZodBoolean]>;
+    }, "strict", z.ZodTypeAny, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }>, "many">>;
+    enabled: z.ZodBoolean;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    ownerAccountId: string;
+    id: string;
+    limits: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[];
+    maximumAutonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    createdAt: string;
+    updatedAt: string;
+    objective: string;
+    trigger: {
+        type: "manual";
+    } | {
+        type: "event";
+        appId: string;
+        eventType: string;
+        resource?: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        } | undefined;
+    } | {
+        type: "schedule";
+        cron: string;
+        timezone: string;
+    };
+    actorSelection: {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        };
+        mode: "fixed";
+    } | {
+        mode: "automatic";
+    };
+    inputs: Record<string, unknown>;
+    resources: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+    dataFlow: {
+        sources: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+        destinations: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+    };
+    enabled: boolean;
+}, {
+    ownerAccountId: string;
+    id: string;
+    maximumAutonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    createdAt: string;
+    updatedAt: string;
+    objective: string;
+    trigger: {
+        type: "manual";
+    } | {
+        type: "event";
+        appId: string;
+        eventType: string;
+        resource?: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        } | undefined;
+    } | {
+        type: "schedule";
+        cron: string;
+        timezone: string;
+    };
+    actorSelection: {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        };
+        mode: "fixed";
+    } | {
+        mode: "automatic";
+    };
+    inputs: Record<string, unknown>;
+    resources: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
+    dataFlow: {
+        sources: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+        destinations: {
+            appId: string;
+            effectiveAccountId: string;
+            resourceType: string;
+            resourceId: string;
+        }[];
+    };
+    enabled: boolean;
+    limits?: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[] | undefined;
+}>;
+export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
+    iss: z.ZodString;
+    aud: z.ZodString;
+    sub: z.ZodString;
+    jti: z.ZodString;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+    runId: z.ZodString;
+    stepId: z.ZodOptional<z.ZodString>;
+    automationId: z.ZodOptional<z.ZodString>;
+    executionAuthorization: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"direct_request">;
+        id: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "direct_request";
+        id: string;
+    }, {
+        kind: "direct_request";
+        id: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"automation">;
+        id: z.ZodString;
+        automationId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    }, {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    }>]>;
+    coordinator: z.ZodObject<{
+        applicationId: z.ZodString;
+        credentialId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        applicationId: string;
+        credentialId: string;
+    }, {
+        applicationId: string;
+        credentialId: string;
+    }>;
+    grantId: z.ZodOptional<z.ZodString>;
+    requesterAccountId: z.ZodString;
+    ownerAccountId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"alia">;
+        ownerAccountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "alia";
+        ownerAccountId: string;
+    }, {
+        type: "alia";
+        ownerAccountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"agent">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "agent";
+        accountId: string;
+    }, {
+        type: "agent";
+        accountId: string;
+    }>]>;
+    resource: z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>;
+    tool: z.ZodString;
+    capabilities: z.ZodArray<z.ZodString, "many">;
+    limits: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        key: z.ZodString;
+        value: z.ZodUnion<[z.ZodNumber, z.ZodBoolean]>;
+    }, "strict", z.ZodTypeAny, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }, {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }>, "many">>;
+    autonomy: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
+}, "strict", z.ZodTypeAny, {
+    ownerAccountId: string;
+    tool: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    limits: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    runId: string;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    automationId?: string | undefined;
+    stepId?: string | undefined;
+    grantId?: string | undefined;
+}, {
+    ownerAccountId: string;
+    tool: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    runId: string;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    automationId?: string | undefined;
+    limits?: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[] | undefined;
+    stepId?: string | undefined;
+    grantId?: string | undefined;
+}>, {
+    ownerAccountId: string;
+    tool: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    limits: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    runId: string;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    automationId?: string | undefined;
+    stepId?: string | undefined;
+    grantId?: string | undefined;
+}, {
+    ownerAccountId: string;
+    tool: string;
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    runId: string;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    automationId?: string | undefined;
+    limits?: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[] | undefined;
+    stepId?: string | undefined;
+    grantId?: string | undefined;
+}>;
+export declare const policyDecisionSchema: z.ZodObject<{
+    allowed: z.ZodBoolean;
+    reason: z.ZodString;
+    effectiveAutonomy: z.ZodOptional<z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>>;
+    grantId: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    allowed: boolean;
+    reason: string;
+    grantId?: string | undefined;
+    effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+}, {
+    allowed: boolean;
+    reason: string;
+    grantId?: string | undefined;
+    effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+}>;
+export declare const auditResultSchema: z.ZodObject<{
+    status: z.ZodEnum<["planned", "allowed", "denied", "succeeded", "failed", "rolled_back"]>;
+    code: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+    code?: string | undefined;
+}, {
+    status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+    code?: string | undefined;
+}>;
+export declare const auditEventSchema: z.ZodObject<{
+    eventId: z.ZodString;
+    occurredAt: z.ZodString;
+    requesterAccountId: z.ZodString;
+    coordinator: z.ZodObject<{
+        applicationId: z.ZodString;
+        credentialId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        applicationId: string;
+        credentialId: string;
+    }, {
+        applicationId: string;
+        credentialId: string;
+    }>;
+    executor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+        type: z.ZodLiteral<"alia">;
+        ownerAccountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "alia";
+        ownerAccountId: string;
+    }, {
+        type: "alia";
+        ownerAccountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"agent">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "agent";
+        accountId: string;
+    }, {
+        type: "agent";
+        accountId: string;
+    }>]>;
+    effectiveAccountId: z.ZodString;
+    resource: z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>;
+    appId: z.ZodString;
+    tool: z.ZodString;
+    capabilities: z.ZodArray<z.ZodString, "many">;
+    policyDecision: z.ZodObject<{
+        allowed: z.ZodBoolean;
+        reason: z.ZodString;
+        effectiveAutonomy: z.ZodOptional<z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>>;
+        grantId: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        allowed: boolean;
+        reason: string;
+        grantId?: string | undefined;
+        effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+    }, {
+        allowed: boolean;
+        reason: string;
+        grantId?: string | undefined;
+        effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+    }>;
+    result: z.ZodObject<{
+        status: z.ZodEnum<["planned", "allowed", "denied", "succeeded", "failed", "rolled_back"]>;
+        code: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+        code?: string | undefined;
+    }, {
+        status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+        code?: string | undefined;
+    }>;
+    rollback: z.ZodObject<{
+        supported: z.ZodBoolean;
+        attempted: z.ZodBoolean;
+        succeeded: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        supported: boolean;
+        attempted: boolean;
+        succeeded?: boolean | undefined;
+    }, {
+        supported: boolean;
+        attempted: boolean;
+        succeeded?: boolean | undefined;
+    }>;
+    correlation: z.ZodObject<{
+        runId: z.ZodString;
+        stepId: z.ZodOptional<z.ZodString>;
+        automationId: z.ZodOptional<z.ZodString>;
+        idempotencyKeyHash: z.ZodOptional<z.ZodString>;
+        capabilityTicketId: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        runId: string;
+        automationId?: string | undefined;
+        stepId?: string | undefined;
+        idempotencyKeyHash?: string | undefined;
+        capabilityTicketId?: string | undefined;
+    }, {
+        runId: string;
+        automationId?: string | undefined;
+        stepId?: string | undefined;
+        idempotencyKeyHash?: string | undefined;
+        capabilityTicketId?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    appId: string;
+    effectiveAccountId: string;
+    tool: string;
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    eventId: string;
+    occurredAt: string;
+    executor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    policyDecision: {
+        allowed: boolean;
+        reason: string;
+        grantId?: string | undefined;
+        effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+    };
+    result: {
+        status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+        code?: string | undefined;
+    };
+    rollback: {
+        supported: boolean;
+        attempted: boolean;
+        succeeded?: boolean | undefined;
+    };
+    correlation: {
+        runId: string;
+        automationId?: string | undefined;
+        stepId?: string | undefined;
+        idempotencyKeyHash?: string | undefined;
+        capabilityTicketId?: string | undefined;
+    };
+}, {
+    appId: string;
+    effectiveAccountId: string;
+    tool: string;
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    eventId: string;
+    occurredAt: string;
+    executor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    };
+    policyDecision: {
+        allowed: boolean;
+        reason: string;
+        grantId?: string | undefined;
+        effectiveAutonomy?: "read_only" | "draft" | "execute_on_request" | "autonomous" | undefined;
+    };
+    result: {
+        status: "allowed" | "planned" | "denied" | "succeeded" | "failed" | "rolled_back";
+        code?: string | undefined;
+    };
+    rollback: {
+        supported: boolean;
+        attempted: boolean;
+        succeeded?: boolean | undefined;
+    };
+    correlation: {
+        runId: string;
+        automationId?: string | undefined;
+        stepId?: string | undefined;
+        idempotencyKeyHash?: string | undefined;
+        capabilityTicketId?: string | undefined;
+    };
+}>;
+export declare const catalogToolSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    description: z.ZodString;
+    inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    capabilityPackage: z.ZodEnum<["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"]>;
+    requiredCapabilities: z.ZodArray<z.ZodString, "many">;
+    resourceTypes: z.ZodArray<z.ZodString, "many">;
+    effect: z.ZodEnum<["read", "write", "external", "financial", "security"]>;
+    idempotency: z.ZodEnum<["none", "supported", "required"]>;
+    rollback: z.ZodEnum<["none", "manual", "supported"]>;
+    exposure: z.ZodArray<z.ZodEnum<["internal", "mcp"]>, "many">;
+    limitKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        kind: z.ZodEnum<["maximum_number", "exact_boolean"]>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }, {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }>, "many">>;
+    invocation: z.ZodObject<{
+        method: z.ZodEnum<["GET", "POST", "PATCH", "PUT", "DELETE"]>;
+        path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    }, {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    }>;
+}, "strict", z.ZodTypeAny, {
+    effect: "security" | "read" | "write" | "external" | "financial";
+    name: string;
+    description: string;
+    rollback: "manual" | "supported" | "none";
+    version: string;
+    inputSchema: Record<string, unknown>;
+    capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+    requiredCapabilities: string[];
+    resourceTypes: string[];
+    idempotency: "supported" | "none" | "required";
+    exposure: ("internal" | "mcp")[];
+    limitKeys: {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }[];
+    invocation: {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    };
+    outputSchema?: Record<string, unknown> | undefined;
+}, {
+    effect: "security" | "read" | "write" | "external" | "financial";
+    name: string;
+    description: string;
+    rollback: "manual" | "supported" | "none";
+    version: string;
+    inputSchema: Record<string, unknown>;
+    capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+    requiredCapabilities: string[];
+    resourceTypes: string[];
+    idempotency: "supported" | "none" | "required";
+    exposure: ("internal" | "mcp")[];
+    invocation: {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    };
+    outputSchema?: Record<string, unknown> | undefined;
+    limitKeys?: {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }[] | undefined;
+}>, {
+    effect: "security" | "read" | "write" | "external" | "financial";
+    name: string;
+    description: string;
+    rollback: "manual" | "supported" | "none";
+    version: string;
+    inputSchema: Record<string, unknown>;
+    capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+    requiredCapabilities: string[];
+    resourceTypes: string[];
+    idempotency: "supported" | "none" | "required";
+    exposure: ("internal" | "mcp")[];
+    limitKeys: {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }[];
+    invocation: {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    };
+    outputSchema?: Record<string, unknown> | undefined;
+}, {
+    effect: "security" | "read" | "write" | "external" | "financial";
+    name: string;
+    description: string;
+    rollback: "manual" | "supported" | "none";
+    version: string;
+    inputSchema: Record<string, unknown>;
+    capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+    requiredCapabilities: string[];
+    resourceTypes: string[];
+    idempotency: "supported" | "none" | "required";
+    exposure: ("internal" | "mcp")[];
+    invocation: {
+        path: string;
+        method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+    };
+    outputSchema?: Record<string, unknown> | undefined;
+    limitKeys?: {
+        kind: "maximum_number" | "exact_boolean";
+        key: string;
+    }[] | undefined;
+}>;
+export declare const catalogEventSchema: z.ZodObject<{
+    type: z.ZodString;
+    version: z.ZodString;
+    description: z.ZodString;
+    dataSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    resourceTypes: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    type: string;
+    description: string;
+    version: string;
+    resourceTypes: string[];
+    dataSchema: Record<string, unknown>;
+}, {
+    type: string;
+    description: string;
+    version: string;
+    resourceTypes: string[];
+    dataSchema: Record<string, unknown>;
+}>;
+export declare const appCapabilityCatalogSchema: z.ZodEffects<z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    appId: z.ZodString;
+    version: z.ZodString;
+    audience: z.ZodString;
+    /** HTTPS origin that serves the catalog's internal invocation paths. */
+    internalBaseUrl: z.ZodEffects<z.ZodString, string, string>;
+    /** Account-scoped resource used for native Alia bindings without app-specific code. */
+    accountResourceType: z.ZodString;
+    /** Canonical protected-resource URI when this catalog is also exposed as an external MCP server. */
+    externalMcp: z.ZodOptional<z.ZodObject<{
+        resource: z.ZodEffects<z.ZodString, string, string>;
+    }, "strict", z.ZodTypeAny, {
+        resource: string;
+    }, {
+        resource: string;
+    }>>;
+    tools: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        description: z.ZodString;
+        inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        capabilityPackage: z.ZodEnum<["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"]>;
+        requiredCapabilities: z.ZodArray<z.ZodString, "many">;
+        resourceTypes: z.ZodArray<z.ZodString, "many">;
+        effect: z.ZodEnum<["read", "write", "external", "financial", "security"]>;
+        idempotency: z.ZodEnum<["none", "supported", "required"]>;
+        rollback: z.ZodEnum<["none", "manual", "supported"]>;
+        exposure: z.ZodArray<z.ZodEnum<["internal", "mcp"]>, "many">;
+        limitKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            kind: z.ZodEnum<["maximum_number", "exact_boolean"]>;
+        }, "strict", z.ZodTypeAny, {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }, {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }>, "many">>;
+        invocation: z.ZodObject<{
+            method: z.ZodEnum<["GET", "POST", "PATCH", "PUT", "DELETE"]>;
+            path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        }, {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        limitKeys: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+    }, {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+        limitKeys?: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[] | undefined;
+    }>, {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        limitKeys: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+    }, {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+        limitKeys?: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[] | undefined;
+    }>, "many">;
+    events: z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        version: z.ZodString;
+        description: z.ZodString;
+        dataSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        resourceTypes: z.ZodArray<z.ZodString, "many">;
+    }, "strict", z.ZodTypeAny, {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }, {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    appId: string;
+    version: string;
+    schemaVersion: "1";
+    audience: string;
+    internalBaseUrl: string;
+    accountResourceType: string;
+    tools: {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        limitKeys: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+    }[];
+    events: {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }[];
+    externalMcp?: {
+        resource: string;
+    } | undefined;
+}, {
+    appId: string;
+    version: string;
+    schemaVersion: "1";
+    audience: string;
+    internalBaseUrl: string;
+    accountResourceType: string;
+    tools: {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+        limitKeys?: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[] | undefined;
+    }[];
+    events: {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }[];
+    externalMcp?: {
+        resource: string;
+    } | undefined;
+}>, {
+    appId: string;
+    version: string;
+    schemaVersion: "1";
+    audience: string;
+    internalBaseUrl: string;
+    accountResourceType: string;
+    tools: {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        limitKeys: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+    }[];
+    events: {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }[];
+    externalMcp?: {
+        resource: string;
+    } | undefined;
+}, {
+    appId: string;
+    version: string;
+    schemaVersion: "1";
+    audience: string;
+    internalBaseUrl: string;
+    accountResourceType: string;
+    tools: {
+        effect: "security" | "read" | "write" | "external" | "financial";
+        name: string;
+        description: string;
+        rollback: "manual" | "supported" | "none";
+        version: string;
+        inputSchema: Record<string, unknown>;
+        capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+        requiredCapabilities: string[];
+        resourceTypes: string[];
+        idempotency: "supported" | "none" | "required";
+        exposure: ("internal" | "mcp")[];
+        invocation: {
+            path: string;
+            method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+        };
+        outputSchema?: Record<string, unknown> | undefined;
+        limitKeys?: {
+            kind: "maximum_number" | "exact_boolean";
+            key: string;
+        }[] | undefined;
+    }[];
+    events: {
+        type: string;
+        description: string;
+        version: string;
+        resourceTypes: string[];
+        dataSchema: Record<string, unknown>;
+    }[];
+    externalMcp?: {
+        resource: string;
+    } | undefined;
+}>;
+export declare const catalogRegistrationSchema: z.ZodObject<{
+    catalog: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<"1">;
+        appId: z.ZodString;
+        version: z.ZodString;
+        audience: z.ZodString;
+        /** HTTPS origin that serves the catalog's internal invocation paths. */
+        internalBaseUrl: z.ZodEffects<z.ZodString, string, string>;
+        /** Account-scoped resource used for native Alia bindings without app-specific code. */
+        accountResourceType: z.ZodString;
+        /** Canonical protected-resource URI when this catalog is also exposed as an external MCP server. */
+        externalMcp: z.ZodOptional<z.ZodObject<{
+            resource: z.ZodEffects<z.ZodString, string, string>;
+        }, "strict", z.ZodTypeAny, {
+            resource: string;
+        }, {
+            resource: string;
+        }>>;
+        tools: z.ZodArray<z.ZodEffects<z.ZodObject<{
+            name: z.ZodString;
+            version: z.ZodString;
+            description: z.ZodString;
+            inputSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            outputSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            capabilityPackage: z.ZodEnum<["read", "create", "publish", "communicate", "administer", "finance", "security", "delegate"]>;
+            requiredCapabilities: z.ZodArray<z.ZodString, "many">;
+            resourceTypes: z.ZodArray<z.ZodString, "many">;
+            effect: z.ZodEnum<["read", "write", "external", "financial", "security"]>;
+            idempotency: z.ZodEnum<["none", "supported", "required"]>;
+            rollback: z.ZodEnum<["none", "manual", "supported"]>;
+            exposure: z.ZodArray<z.ZodEnum<["internal", "mcp"]>, "many">;
+            limitKeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                kind: z.ZodEnum<["maximum_number", "exact_boolean"]>;
+            }, "strict", z.ZodTypeAny, {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }, {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }>, "many">>;
+            invocation: z.ZodObject<{
+                method: z.ZodEnum<["GET", "POST", "PATCH", "PUT", "DELETE"]>;
+                path: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            }, {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            limitKeys: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+        }, {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+            limitKeys?: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[] | undefined;
+        }>, {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            limitKeys: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+        }, {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+            limitKeys?: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[] | undefined;
+        }>, "many">;
+        events: z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            version: z.ZodString;
+            description: z.ZodString;
+            dataSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+            resourceTypes: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }, {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            limitKeys: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    }, {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+            limitKeys?: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[] | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    }>, {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            limitKeys: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    }, {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+            limitKeys?: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[] | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    }>;
+    digest: z.ZodString;
+    signature: z.ZodString;
+    deployedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    catalog: {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            limitKeys: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    };
+    digest: string;
+    signature: string;
+    deployedAt: string;
+}, {
+    catalog: {
+        appId: string;
+        version: string;
+        schemaVersion: "1";
+        audience: string;
+        internalBaseUrl: string;
+        accountResourceType: string;
+        tools: {
+            effect: "security" | "read" | "write" | "external" | "financial";
+            name: string;
+            description: string;
+            rollback: "manual" | "supported" | "none";
+            version: string;
+            inputSchema: Record<string, unknown>;
+            capabilityPackage: "finance" | "security" | "read" | "create" | "publish" | "communicate" | "administer" | "delegate";
+            requiredCapabilities: string[];
+            resourceTypes: string[];
+            idempotency: "supported" | "none" | "required";
+            exposure: ("internal" | "mcp")[];
+            invocation: {
+                path: string;
+                method: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
+            };
+            outputSchema?: Record<string, unknown> | undefined;
+            limitKeys?: {
+                kind: "maximum_number" | "exact_boolean";
+                key: string;
+            }[] | undefined;
+        }[];
+        events: {
+            type: string;
+            description: string;
+            version: string;
+            resourceTypes: string[];
+            dataSchema: Record<string, unknown>;
+        }[];
+        externalMcp?: {
+            resource: string;
+        } | undefined;
+    };
+    digest: string;
+    signature: string;
+    deployedAt: string;
+}>;
+export declare const normalizedAppEventSchema: z.ZodObject<{
+    eventId: z.ZodString;
+    appId: z.ZodString;
+    accountId: z.ZodString;
+    resource: z.ZodObject<{
+        appId: z.ZodString;
+        effectiveAccountId: z.ZodString;
+        resourceType: z.ZodString;
+        resourceId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }, {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    }>;
+    type: z.ZodString;
+    occurredAt: z.ZodString;
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strict", z.ZodTypeAny, {
+    type: string;
+    accountId: string;
+    appId: string;
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    eventId: string;
+    occurredAt: string;
+    data: Record<string, unknown>;
+}, {
+    type: string;
+    accountId: string;
+    appId: string;
+    resource: {
+        appId: string;
+        effectiveAccountId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    eventId: string;
+    occurredAt: string;
+    data: Record<string, unknown>;
+}>;
+export type AutonomyLevel = z.infer<typeof autonomyLevelSchema>;
+export type CapabilityPackage = z.infer<typeof capabilityPackageSchema>;
+export type ActorRef = z.infer<typeof actorRefSchema>;
+export type ResourceRef = z.infer<typeof resourceRefSchema>;
+export type ToolGrantOverride = z.infer<typeof toolGrantOverrideSchema>;
+export type GrantLimit = z.infer<typeof grantLimitSchema>;
+export type ExecutionAuthorizationRef = z.infer<typeof executionAuthorizationRefSchema>;
+export type CapabilityCoordinator = z.infer<typeof capabilityCoordinatorSchema>;
+export type DelegationGrant = z.infer<typeof delegationGrantSchema>;
+export type AutomationTrigger = z.infer<typeof automationTriggerSchema>;
+export type AutomationActorSelection = z.infer<typeof automationActorSelectionSchema>;
+export type AutomationDefinition = z.infer<typeof automationDefinitionSchema>;
+export type CapabilityTicketClaims = z.infer<typeof capabilityTicketClaimsSchema>;
+export type PolicyDecision = z.infer<typeof policyDecisionSchema>;
+export type AuditEvent = z.infer<typeof auditEventSchema>;
+export type CatalogTool = z.infer<typeof catalogToolSchema>;
+export type CatalogEvent = z.infer<typeof catalogEventSchema>;
+export type AppCapabilityCatalog = z.infer<typeof appCapabilityCatalogSchema>;
+export type CatalogRegistration = z.infer<typeof catalogRegistrationSchema>;
+export type NormalizedAppEvent = z.infer<typeof normalizedAppEventSchema>;