@oxy.so/contracts 4.7.0 → 4.9.0

package/dist/types/agency.d.ts

@@ -23,19 +23,88 @@ export declare const actorRefSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObjec
     type: "agent";
     accountId: string;
 }>]>;
+/** Present requester only; standing grants/automation retain actorRefSchema. */
+export declare const executionActorRefSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+    type: z.ZodLiteral<"alia">;
+    ownerAccountId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "alia";
+    ownerAccountId: string;
+}, {
+    type: "alia";
+    ownerAccountId: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"agent">;
+    accountId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "agent";
+    accountId: string;
+}, {
+    type: "agent";
+    accountId: string;
+}>, z.ZodObject<{
+    type: z.ZodLiteral<"requester">;
+    accountId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    type: "requester";
+    accountId: string;
+}, {
+    type: "requester";
+    accountId: string;
+}>]>;
+/** Separate bearer lives only in the SDK option / authority request body. */
+export declare const foregroundExecutionAuthorizationInputSchema: z.ZodObject<{
+    tool: z.ZodEnum<["recommendProfiles", "readViewerGraph"]>;
+    expectedCatalog: z.ZodObject<{
+        registrationId: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }>;
+    runId: z.ZodString;
+    stepId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    expiresAt: string;
+    tool: "recommendProfiles" | "readViewerGraph";
+    expectedCatalog: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    };
+    runId: string;
+    stepId?: string | undefined;
+}, {
+    expiresAt: string;
+    tool: "recommendProfiles" | "readViewerGraph";
+    expectedCatalog: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    };
+    runId: string;
+    stepId?: string | undefined;
+}>;
 export declare const resourceRefSchema: z.ZodObject<{
     appId: z.ZodString;
     effectiveAccountId: z.ZodString;
     resourceType: z.ZodString;
     resourceId: z.ZodString;
 }, "strict", z.ZodTypeAny, {
-    appId: string;
     effectiveAccountId: string;
+    appId: string;
     resourceType: string;
     resourceId: string;
 }, {
-    appId: string;
     effectiveAccountId: string;
+    appId: string;
     resourceType: string;
     resourceId: string;
 }>;
@@ -107,6 +176,43 @@ export declare const capabilityCoordinatorSchema: z.ZodObject<{
     applicationId: string;
     credentialId: string;
 }>;
+/** Opt-in catalogue pin; legacy issuance omits expectedCatalog and its claim. */
+export declare const capabilityTicketRequestSchema: z.ZodObject<{
+    executionAuthorizationId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+    stepId: z.ZodOptional<z.ZodString>;
+    expectedCatalog: z.ZodOptional<z.ZodObject<{
+        registrationId: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    executionAuthorizationId: string;
+    expectedCatalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
+    runId?: string | undefined;
+    stepId?: string | undefined;
+}, {
+    executionAuthorizationId: string;
+    expectedCatalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
+    runId?: string | undefined;
+    stepId?: string | undefined;
+}>;
 export declare const delegationGrantSchema: z.ZodObject<{
     id: z.ZodString;
     ownerAccountId: z.ZodString;
@@ -135,13 +241,13 @@ export declare const delegationGrantSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>;
@@ -191,8 +297,6 @@ export declare const delegationGrantSchema: z.ZodObject<{
     updatedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     expiresAt: string | null;
-    ownerAccountId: string;
-    id: string;
     actor: {
         type: "alia";
         ownerAccountId: string;
@@ -200,9 +304,11 @@ export declare const delegationGrantSchema: z.ZodObject<{
         type: "agent";
         accountId: string;
     };
+    ownerAccountId: string;
+    id: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -229,8 +335,6 @@ export declare const delegationGrantSchema: z.ZodObject<{
     updatedAt: string;
 }, {
     expiresAt: string | null;
-    ownerAccountId: string;
-    id: string;
     actor: {
         type: "alia";
         ownerAccountId: string;
@@ -238,9 +342,11 @@ export declare const delegationGrantSchema: z.ZodObject<{
         type: "agent";
         accountId: string;
     };
+    ownerAccountId: string;
+    id: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -282,13 +388,13 @@ export declare const automationTriggerSchema: z.ZodDiscriminatedUnion<"type", [z
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>>;
@@ -297,8 +403,8 @@ export declare const automationTriggerSchema: z.ZodDiscriminatedUnion<"type", [z
     appId: string;
     eventType: string;
     resource?: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     } | undefined;
@@ -307,8 +413,8 @@ export declare const automationTriggerSchema: z.ZodDiscriminatedUnion<"type", [z
     appId: string;
     eventType: string;
     resource?: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     } | undefined;
@@ -378,13 +484,13 @@ export declare const automationDataFlowSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>, "many">;
@@ -394,39 +500,39 @@ export declare const automationDataFlowSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
     sources: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }[];
     destinations: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }[];
 }, {
     sources: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }[];
     destinations: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }[];
@@ -451,13 +557,13 @@ export declare const automationDefinitionSchema: z.ZodObject<{
             resourceType: z.ZodString;
             resourceId: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }>>;
@@ -466,8 +572,8 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         appId: string;
         eventType: string;
         resource?: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         } | undefined;
@@ -476,8 +582,8 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         appId: string;
         eventType: string;
         resource?: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         } | undefined;
@@ -547,13 +653,13 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>, "many">;
@@ -564,13 +670,13 @@ export declare const automationDefinitionSchema: z.ZodObject<{
             resourceType: z.ZodString;
             resourceId: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }>, "many">;
@@ -580,39 +686,39 @@ export declare const automationDefinitionSchema: z.ZodObject<{
             resourceType: z.ZodString;
             resourceId: z.ZodString;
         }, "strict", z.ZodTypeAny, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }, {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }>, "many">;
     }, "strict", z.ZodTypeAny, {
         sources: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
         destinations: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
     }, {
         sources: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
         destinations: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
@@ -635,6 +741,12 @@ export declare const automationDefinitionSchema: z.ZodObject<{
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
+    resources: {
+        effectiveAccountId: string;
+        appId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
     ownerAccountId: string;
     id: string;
     limits: {
@@ -653,8 +765,8 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         appId: string;
         eventType: string;
         resource?: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         } | undefined;
@@ -676,28 +788,28 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         mode: "automatic";
     };
     inputs: Record<string, unknown>;
-    resources: {
-        appId: string;
-        effectiveAccountId: string;
-        resourceType: string;
-        resourceId: string;
-    }[];
     dataFlow: {
         sources: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
         destinations: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
     };
     enabled: boolean;
 }, {
+    resources: {
+        effectiveAccountId: string;
+        appId: string;
+        resourceType: string;
+        resourceId: string;
+    }[];
     ownerAccountId: string;
     id: string;
     maximumAutonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
@@ -711,8 +823,8 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         appId: string;
         eventType: string;
         resource?: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         } | undefined;
@@ -734,22 +846,16 @@ export declare const automationDefinitionSchema: z.ZodObject<{
         mode: "automatic";
     };
     inputs: Record<string, unknown>;
-    resources: {
-        appId: string;
-        effectiveAccountId: string;
-        resourceType: string;
-        resourceId: string;
-    }[];
     dataFlow: {
         sources: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
         destinations: {
-            appId: string;
             effectiveAccountId: string;
+            appId: string;
             resourceType: string;
             resourceId: string;
         }[];
@@ -803,6 +909,20 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
         applicationId: string;
         credentialId: string;
     }>;
+    /** Signed only for callers that explicitly requested a pinned catalogue. */
+    catalog: z.ZodOptional<z.ZodObject<{
+        registrationId: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }, {
+        registrationId: string;
+        version: string;
+        digest: string;
+    }>>;
     grantId: z.ZodOptional<z.ZodString>;
     requesterAccountId: z.ZodString;
     ownerAccountId: z.ZodString;
@@ -824,6 +944,15 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     }, {
         type: "agent";
         accountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"requester">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "requester";
+        accountId: string;
+    }, {
+        type: "requester";
+        accountId: string;
     }>]>;
     resource: z.ZodObject<{
         appId: z.ZodString;
@@ -831,13 +960,13 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>;
@@ -858,18 +987,22 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     }>, "many">>;
     autonomy: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
 }, "strict", z.ZodTypeAny, {
-    tool: string;
-    ownerAccountId: string;
     actor: {
         type: "alia";
         ownerAccountId: string;
     } | {
         type: "agent";
         accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
     };
+    tool: string;
+    ownerAccountId: string;
+    runId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -885,7 +1018,6 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     jti: string;
     iat: number;
     exp: number;
-    runId: string;
     executionAuthorization: {
         kind: "direct_request";
         id: string;
@@ -900,22 +1032,31 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     };
     requesterAccountId: string;
     autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
-    automationId?: string | undefined;
     stepId?: string | undefined;
+    automationId?: string | undefined;
+    catalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
     grantId?: string | undefined;
 }, {
-    tool: string;
-    ownerAccountId: string;
     actor: {
         type: "alia";
         ownerAccountId: string;
     } | {
         type: "agent";
         accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
     };
+    tool: string;
+    ownerAccountId: string;
+    runId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -926,7 +1067,6 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     jti: string;
     iat: number;
     exp: number;
-    runId: string;
     executionAuthorization: {
         kind: "direct_request";
         id: string;
@@ -941,107 +1081,715 @@ export declare const capabilityTicketClaimsSchema: z.ZodEffects<z.ZodObject<{
     };
     requesterAccountId: string;
     autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    stepId?: string | undefined;
     automationId?: string | undefined;
+    catalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
     limits?: {
         value: number | boolean;
         tool: string;
-        key: string;
-    }[] | undefined;
-    stepId?: string | undefined;
-    grantId?: string | undefined;
-}>, {
-    tool: string;
-    ownerAccountId: string;
-    actor: {
-        type: "alia";
+        key: string;
+    }[] | undefined;
+    grantId?: string | undefined;
+}>, {
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
+    };
+    tool: string;
+    ownerAccountId: string;
+    runId: string;
+    resource: {
+        effectiveAccountId: string;
+        appId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    limits: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    stepId?: string | undefined;
+    automationId?: string | undefined;
+    catalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
+    grantId?: string | undefined;
+}, {
+    actor: {
+        type: "alia";
+        ownerAccountId: string;
+    } | {
+        type: "agent";
+        accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
+    };
+    tool: string;
+    ownerAccountId: string;
+    runId: string;
+    resource: {
+        effectiveAccountId: string;
+        appId: string;
+        resourceType: string;
+        resourceId: string;
+    };
+    capabilities: string[];
+    iss: string;
+    aud: string;
+    sub: string;
+    jti: string;
+    iat: number;
+    exp: number;
+    executionAuthorization: {
+        kind: "direct_request";
+        id: string;
+    } | {
+        kind: "automation";
+        id: string;
+        automationId: string;
+    };
+    coordinator: {
+        applicationId: string;
+        credentialId: string;
+    };
+    requesterAccountId: string;
+    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+    stepId?: string | undefined;
+    automationId?: string | undefined;
+    catalog?: {
+        registrationId: string;
+        version: string;
+        digest: string;
+    } | undefined;
+    limits?: {
+        value: number | boolean;
+        tool: string;
+        key: string;
+    }[] | undefined;
+    grantId?: string | undefined;
+}>;
+/** Structural projections only: an authenticated transport must produce these. */
+export declare const invocationPrincipalSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"oauth">;
+    subject: z.ZodString;
+    clientId: z.ZodString;
+    originAccountId: z.ZodString;
+    activeAccountId: z.ZodString;
+    scopes: z.ZodArray<z.ZodString, "many">;
+    resource: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "oauth";
+    resource: string;
+    subject: string;
+    clientId: string;
+    originAccountId: string;
+    activeAccountId: string;
+    scopes: string[];
+}, {
+    kind: "oauth";
+    resource: string;
+    subject: string;
+    clientId: string;
+    originAccountId: string;
+    activeAccountId: string;
+    scopes: string[];
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"capability">;
+    claims: z.ZodEffects<z.ZodEffects<z.ZodObject<{
+        iss: z.ZodString;
+        aud: z.ZodString;
+        sub: z.ZodString;
+        jti: z.ZodString;
+        iat: z.ZodNumber;
+        exp: z.ZodNumber;
+        runId: z.ZodString;
+        stepId: z.ZodOptional<z.ZodString>;
+        automationId: z.ZodOptional<z.ZodString>;
+        executionAuthorization: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"direct_request">;
+            id: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "direct_request";
+            id: string;
+        }, {
+            kind: "direct_request";
+            id: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"automation">;
+            id: z.ZodString;
+            automationId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        }, {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        }>]>;
+        coordinator: z.ZodObject<{
+            applicationId: z.ZodString;
+            credentialId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            applicationId: string;
+            credentialId: string;
+        }, {
+            applicationId: string;
+            credentialId: string;
+        }>;
+        /** Signed only for callers that explicitly requested a pinned catalogue. */
+        catalog: z.ZodOptional<z.ZodObject<{
+            registrationId: z.ZodString;
+            version: z.ZodString;
+            digest: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            registrationId: string;
+            version: string;
+            digest: string;
+        }, {
+            registrationId: string;
+            version: string;
+            digest: string;
+        }>>;
+        grantId: z.ZodOptional<z.ZodString>;
+        requesterAccountId: z.ZodString;
+        ownerAccountId: z.ZodString;
+        actor: z.ZodDiscriminatedUnion<"type", [z.ZodObject<{
+            type: z.ZodLiteral<"alia">;
+            ownerAccountId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            type: "alia";
+            ownerAccountId: string;
+        }, {
+            type: "alia";
+            ownerAccountId: string;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"agent">;
+            accountId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            type: "agent";
+            accountId: string;
+        }, {
+            type: "agent";
+            accountId: string;
+        }>, z.ZodObject<{
+            type: z.ZodLiteral<"requester">;
+            accountId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            type: "requester";
+            accountId: string;
+        }, {
+            type: "requester";
+            accountId: string;
+        }>]>;
+        resource: z.ZodObject<{
+            appId: z.ZodString;
+            effectiveAccountId: z.ZodString;
+            resourceType: z.ZodString;
+            resourceId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        }, {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        }>;
+        tool: z.ZodString;
+        capabilities: z.ZodArray<z.ZodString, "many">;
+        limits: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            key: z.ZodString;
+            value: z.ZodUnion<[z.ZodNumber, z.ZodBoolean]>;
+        }, "strict", z.ZodTypeAny, {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }, {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }>, "many">>;
+        autonomy: z.ZodEnum<["read_only", "draft", "execute_on_request", "autonomous"]>;
+    }, "strict", z.ZodTypeAny, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        limits: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        grantId?: string | undefined;
+    }, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        limits?: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[] | undefined;
+        grantId?: string | undefined;
+    }>, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        limits: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        grantId?: string | undefined;
+    }, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        limits?: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[] | undefined;
+        grantId?: string | undefined;
+    }>, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        limits: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        grantId?: string | undefined;
+    }, {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
         ownerAccountId: string;
-    } | {
-        type: "agent";
-        accountId: string;
-    };
-    resource: {
-        appId: string;
-        effectiveAccountId: string;
-        resourceType: string;
-        resourceId: string;
-    };
-    capabilities: string[];
-    limits: {
-        value: number | boolean;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        limits?: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[] | undefined;
+        grantId?: string | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    kind: "capability";
+    claims: {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
         tool: string;
-        key: string;
-    }[];
-    iss: string;
-    aud: string;
-    sub: string;
-    jti: string;
-    iat: number;
-    exp: number;
-    runId: string;
-    executionAuthorization: {
-        kind: "direct_request";
-        id: string;
-    } | {
-        kind: "automation";
-        id: string;
-        automationId: string;
-    };
-    coordinator: {
-        applicationId: string;
-        credentialId: string;
+        ownerAccountId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        limits: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        grantId?: string | undefined;
     };
-    requesterAccountId: string;
-    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
-    automationId?: string | undefined;
-    stepId?: string | undefined;
-    grantId?: string | undefined;
 }, {
-    tool: string;
-    ownerAccountId: string;
-    actor: {
-        type: "alia";
+    kind: "capability";
+    claims: {
+        actor: {
+            type: "alia";
+            ownerAccountId: string;
+        } | {
+            type: "agent";
+            accountId: string;
+        } | {
+            type: "requester";
+            accountId: string;
+        };
+        tool: string;
         ownerAccountId: string;
-    } | {
-        type: "agent";
-        accountId: string;
-    };
-    resource: {
-        appId: string;
-        effectiveAccountId: string;
-        resourceType: string;
-        resourceId: string;
-    };
-    capabilities: string[];
-    iss: string;
-    aud: string;
-    sub: string;
-    jti: string;
-    iat: number;
-    exp: number;
-    runId: string;
-    executionAuthorization: {
-        kind: "direct_request";
-        id: string;
-    } | {
-        kind: "automation";
-        id: string;
-        automationId: string;
-    };
-    coordinator: {
-        applicationId: string;
-        credentialId: string;
+        runId: string;
+        resource: {
+            effectiveAccountId: string;
+            appId: string;
+            resourceType: string;
+            resourceId: string;
+        };
+        capabilities: string[];
+        iss: string;
+        aud: string;
+        sub: string;
+        jti: string;
+        iat: number;
+        exp: number;
+        executionAuthorization: {
+            kind: "direct_request";
+            id: string;
+        } | {
+            kind: "automation";
+            id: string;
+            automationId: string;
+        };
+        coordinator: {
+            applicationId: string;
+            credentialId: string;
+        };
+        requesterAccountId: string;
+        autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
+        stepId?: string | undefined;
+        automationId?: string | undefined;
+        catalog?: {
+            registrationId: string;
+            version: string;
+            digest: string;
+        } | undefined;
+        limits?: {
+            value: number | boolean;
+            tool: string;
+            key: string;
+        }[] | undefined;
+        grantId?: string | undefined;
     };
-    requesterAccountId: string;
-    autonomy: "read_only" | "draft" | "execute_on_request" | "autonomous";
-    automationId?: string | undefined;
-    limits?: {
-        value: number | boolean;
-        tool: string;
-        key: string;
-    }[] | undefined;
-    stepId?: string | undefined;
-    grantId?: string | undefined;
-}>;
+}>]>;
+export type InvocationPrincipal = z.infer<typeof invocationPrincipalSchema>;
 export declare const policyDecisionSchema: z.ZodObject<{
     allowed: z.ZodBoolean;
     reason: z.ZodString;
@@ -1100,6 +1848,15 @@ export declare const auditEventSchema: z.ZodObject<{
     }, {
         type: "agent";
         accountId: string;
+    }>, z.ZodObject<{
+        type: z.ZodLiteral<"requester">;
+        accountId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "requester";
+        accountId: string;
+    }, {
+        type: "requester";
+        accountId: string;
     }>]>;
     effectiveAccountId: z.ZodString;
     resource: z.ZodObject<{
@@ -1108,13 +1865,13 @@ export declare const auditEventSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>;
@@ -1168,24 +1925,24 @@ export declare const auditEventSchema: z.ZodObject<{
         capabilityTicketId: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         runId: string;
-        automationId?: string | undefined;
         stepId?: string | undefined;
+        automationId?: string | undefined;
         idempotencyKeyHash?: string | undefined;
         capabilityTicketId?: string | undefined;
     }, {
         runId: string;
-        automationId?: string | undefined;
         stepId?: string | undefined;
+        automationId?: string | undefined;
         idempotencyKeyHash?: string | undefined;
         capabilityTicketId?: string | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
+    effectiveAccountId: string;
     tool: string;
     appId: string;
-    effectiveAccountId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -1203,6 +1960,9 @@ export declare const auditEventSchema: z.ZodObject<{
     } | {
         type: "agent";
         accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
     };
     policyDecision: {
         allowed: boolean;
@@ -1221,18 +1981,18 @@ export declare const auditEventSchema: z.ZodObject<{
     };
     correlation: {
         runId: string;
-        automationId?: string | undefined;
         stepId?: string | undefined;
+        automationId?: string | undefined;
         idempotencyKeyHash?: string | undefined;
         capabilityTicketId?: string | undefined;
     };
 }, {
+    effectiveAccountId: string;
     tool: string;
     appId: string;
-    effectiveAccountId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -1250,6 +2010,9 @@ export declare const auditEventSchema: z.ZodObject<{
     } | {
         type: "agent";
         accountId: string;
+    } | {
+        type: "requester";
+        accountId: string;
     };
     policyDecision: {
         allowed: boolean;
@@ -1268,8 +2031,8 @@ export declare const auditEventSchema: z.ZodObject<{
     };
     correlation: {
         runId: string;
-        automationId?: string | undefined;
         stepId?: string | undefined;
+        automationId?: string | undefined;
         idempotencyKeyHash?: string | undefined;
         capabilityTicketId?: string | undefined;
     };
@@ -1566,9 +2329,9 @@ export declare const appCapabilityCatalogSchema: z.ZodEffects<z.ZodObject<{
         dataSchema: Record<string, unknown>;
     }>, "many">;
 }, "strict", z.ZodTypeAny, {
-    appId: string;
-    version: string;
     schemaVersion: "1";
+    version: string;
+    appId: string;
     audience: string;
     internalBaseUrl: string;
     accountResourceType: string;
@@ -1605,9 +2368,9 @@ export declare const appCapabilityCatalogSchema: z.ZodEffects<z.ZodObject<{
         resource: string;
     } | undefined;
 }, {
-    appId: string;
-    version: string;
     schemaVersion: "1";
+    version: string;
+    appId: string;
     audience: string;
     internalBaseUrl: string;
     accountResourceType: string;
@@ -1644,9 +2407,9 @@ export declare const appCapabilityCatalogSchema: z.ZodEffects<z.ZodObject<{
         resource: string;
     } | undefined;
 }>, {
-    appId: string;
-    version: string;
     schemaVersion: "1";
+    version: string;
+    appId: string;
     audience: string;
     internalBaseUrl: string;
     accountResourceType: string;
@@ -1683,9 +2446,9 @@ export declare const appCapabilityCatalogSchema: z.ZodEffects<z.ZodObject<{
         resource: string;
     } | undefined;
 }, {
-    appId: string;
-    version: string;
     schemaVersion: "1";
+    version: string;
+    appId: string;
     audience: string;
     internalBaseUrl: string;
     accountResourceType: string;
@@ -1878,9 +2641,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
             dataSchema: Record<string, unknown>;
         }>, "many">;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -1917,9 +2680,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
             resource: string;
         } | undefined;
     }, {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -1956,9 +2719,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
             resource: string;
         } | undefined;
     }>, {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -1995,9 +2758,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
             resource: string;
         } | undefined;
     }, {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -2040,9 +2803,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     digest: string;
     catalog: {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -2084,9 +2847,9 @@ export declare const catalogRegistrationSchema: z.ZodObject<{
 }, {
     digest: string;
     catalog: {
-        appId: string;
-        version: string;
         schemaVersion: "1";
+        version: string;
+        appId: string;
         audience: string;
         internalBaseUrl: string;
         accountResourceType: string;
@@ -2136,13 +2899,13 @@ export declare const normalizedAppEventSchema: z.ZodObject<{
         resourceType: z.ZodString;
         resourceId: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }, {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     }>;
@@ -2154,8 +2917,8 @@ export declare const normalizedAppEventSchema: z.ZodObject<{
     accountId: string;
     appId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -2167,8 +2930,8 @@ export declare const normalizedAppEventSchema: z.ZodObject<{
     accountId: string;
     appId: string;
     resource: {
-        appId: string;
         effectiveAccountId: string;
+        appId: string;
         resourceType: string;
         resourceId: string;
     };
@@ -2178,6 +2941,8 @@ export declare const normalizedAppEventSchema: z.ZodObject<{
 }>;
 export type AutonomyLevel = z.infer<typeof autonomyLevelSchema>;
 export type CapabilityPackage = z.infer<typeof capabilityPackageSchema>;
+export type ExecutionActorRef = z.infer<typeof executionActorRefSchema>;
+export type ForegroundExecutionAuthorizationInput = z.infer<typeof foregroundExecutionAuthorizationInputSchema>;
 export type ActorRef = z.infer<typeof actorRefSchema>;
 export type ResourceRef = z.infer<typeof resourceRefSchema>;
 export type ToolGrantOverride = z.infer<typeof toolGrantOverrideSchema>;
@@ -2185,6 +2950,7 @@ export type GrantLimit = z.infer<typeof grantLimitSchema>;
 export type CapabilityCatalogBinding = z.infer<typeof capabilityCatalogBindingSchema>;
 export type ExecutionAuthorizationRef = z.infer<typeof executionAuthorizationRefSchema>;
 export type CapabilityCoordinator = z.infer<typeof capabilityCoordinatorSchema>;
+export type CapabilityTicketRequest = z.infer<typeof capabilityTicketRequestSchema>;
 export type DelegationGrant = z.infer<typeof delegationGrantSchema>;
 export type AutomationTrigger = z.infer<typeof automationTriggerSchema>;
 export type AutomationActorSelection = z.infer<typeof automationActorSelectionSchema>;