@oxy.so/contracts 4.8.0 → 4.9.1

package/dist/cjs/accountGraph.js

@@ -67,6 +67,12 @@ exports.childAccountKindSchema = zod_1.z.enum(exports.CHILD_ACCOUNT_KINDS);
  *
  * Consumers must gate on this predicate rather than testing `kind === 'personal'`,
  * which silently admits every kind added after it was written.
+ *
+ * Being act-as-eligible is NOT being without an identity of one's own. A bot is
+ * act-as-eligible AND its own actor (`accountKindActorNature` → `'agent'` in
+ * `accountSubject.ts`): an application acting as it on a person's authority
+ * records that person as the actor, and the bot acting with nobody operating it
+ * records the bot. Neither ever records the bot's owner in the bot's place.
  */
 function isDelegatedActAsEligibleKind(kind) {
     return kind === 'organization' || kind === 'project' || kind === 'bot';
@@ -80,11 +86,13 @@ function isDelegatedActAsEligibleKind(kind) {
  * The two differ on exactly one kind, `bot`, and that difference is the whole
  * reason both exist.
  *
- * **A bot is not something you become. It is something that operates on your
- * behalf.** Its whole purpose is to act while nobody is present: an application
- * holds a credential, names the human whose authority it borrows, and speaks as
- * the bot. That is delegation, and it is what
- * {@link isDelegatedActAsEligibleKind} admits it for.
+ * **A bot is not something you become. It is somebody of its own.** It is an
+ * agent's identity, with its own resources, roles, plan and balance, and it is
+ * the actor of what it does unoperated. A person may still act AS it on their
+ * own authority — that is delegation, recorded with the person as actor, and it
+ * is what {@link isDelegatedActAsEligibleKind} admits it for. What a person
+ * never does is occupy its seat. This is a refusal of a SEAT, not a capability
+ * restriction: nothing a bot may do depends on this predicate.
  *
  * Handing a person the bot's seat instead inverts that. It puts a human inside
  * the identity that exists to act without one, and it does so on the human's own

package/dist/cjs/accountSubject.js

@@ -0,0 +1,189 @@
+"use strict";
+/**
+ * Account subject contract — what an account IS, kept apart from how it proves
+ * itself, who may become it, who may act as it, who acted, and whose money moves.
+ *
+ * `AccountKind` (`accountGraph.ts`) names the nature of an account. Five other
+ * questions are routinely asked of an account, and each has its own answer here
+ * or in `accountGraph.ts`. None of them may be answered by testing `kind`
+ * directly at a call site:
+ *
+ * | question                                  | answered by                              |
+ * |-------------------------------------------|------------------------------------------|
+ * | may a PERSON switch into it?              | `isOperatorSwitchTargetKind`             |
+ * | may someone act AS it on their authority? | `isDelegatedActAsEligibleKind`           |
+ * | who is the ACTOR when it acts unoperated? | {@link accountKindActorNature}           |
+ * | who acted, and as whom, on this request?  | {@link AccountActorChain}                |
+ * | whose money / receipt is an effect?       | {@link attributeFinancialEffect}         |
+ * | roles, resources, plan, balance, payer    | NOT kind — {@link KIND_INDEPENDENT_ACCOUNT_DIMENSIONS} |
+ *
+ * ## A bot is a complete account (issue #1520, I01)
+ *
+ * A `bot` is an AI agent's own identity. It owns resources, holds roles, has a
+ * plan, holds a balance, receives funds and pays for itself under exactly the
+ * rules a personal account does. Nothing commercial derives from it being a bot,
+ * and nothing about it requires its owner's approval merely because it is one.
+ *
+ * Two things DO differ, and both are about seats, not capability:
+ *
+ *  - a person never switches INTO a bot (`isOperatorSwitchTargetKind`): a bot is
+ *    somebody, not a seat a human occupies;
+ *  - when a bot acts with nobody operating it, the actor recorded is the BOT
+ *    ({@link accountKindActorNature} `'agent'`), never its owner.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.financialEffectAttributionSchema = exports.FINANCIAL_EFFECT_DIRECTIONS = exports.accountActorChainSchema = exports.KIND_INDEPENDENT_ACCOUNT_DIMENSIONS = exports.accountActorNatureSchema = exports.ACCOUNT_ACTOR_NATURES = exports.ACCOUNT_SUBJECT_CONTRACT_VERSION = void 0;
+exports.accountKindActorNature = accountKindActorNature;
+exports.accountKindActsAsItself = accountKindActsAsItself;
+exports.accountActorChainFromSession = accountActorChainFromSession;
+exports.attributeFinancialEffect = attributeFinancialEffect;
+const zod_1 = require("zod");
+const identifiers_1 = require("./inference/identifiers");
+/** Bumped when any shape in this module changes incompatibly. */
+exports.ACCOUNT_SUBJECT_CONTRACT_VERSION = 1;
+// ===========================================================================
+// Actor nature
+// ===========================================================================
+/**
+ * Who is recorded as the ACTOR when an account of this kind acts and no other
+ * account is operating it.
+ *
+ *  - `person` — a human; a personal account is its own actor.
+ *  - `agent`  — an AI agent; a bot is its own actor (ADR 0018 `ActorRef`
+ *    `{type:'agent'}`), and audit records the bot, never the human who owns it.
+ *  - `operated` — never its own actor. An organization, project or channel only
+ *    acts through a member, and that member is the actor.
+ */
+exports.ACCOUNT_ACTOR_NATURES = ['person', 'agent', 'operated'];
+exports.accountActorNatureSchema = zod_1.z.enum(exports.ACCOUNT_ACTOR_NATURES);
+/**
+ * The actor nature of a kind. A `Record` over the full union, so a new kind does
+ * not compile until somebody decides this for it.
+ */
+const ACTOR_NATURE_BY_KIND = {
+    personal: 'person',
+    bot: 'agent',
+    organization: 'operated',
+    project: 'operated',
+    channel: 'operated',
+};
+/** `null` for a value that is not an account kind. Never a guess. */
+function accountKindActorNature(kind) {
+    if (!kind || !Object.prototype.hasOwnProperty.call(ACTOR_NATURE_BY_KIND, kind)) {
+        return null;
+    }
+    return ACTOR_NATURE_BY_KIND[kind];
+}
+/** Whether an account of this kind can be the actor of its own actions. */
+function accountKindActsAsItself(kind) {
+    const nature = accountKindActorNature(kind);
+    return nature === 'person' || nature === 'agent';
+}
+// ===========================================================================
+// Kind-independent dimensions
+// ===========================================================================
+/**
+ * What an account's KIND never decides.
+ *
+ * There is deliberately no predicate taking a kind for any of these. A member's
+ * role grants the same permissions whatever kind the member is; a plan, a
+ * balance, the payer and the beneficiary are resolved from billing state and
+ * membership, never from `kind`. A bot and a person with the same role and plan
+ * get the same action and the same commercial treatment.
+ *
+ * Listed so a consumer can cite the rule, and so the API's static guard
+ * (`commercialTreatmentIgnoresAccountKind.test.ts`) has a single source.
+ */
+exports.KIND_INDEPENDENT_ACCOUNT_DIMENSIONS = [
+    'roles',
+    'resources',
+    'plan',
+    'balance',
+    'payer',
+    'beneficiary',
+];
+// ===========================================================================
+// Actor chain
+// ===========================================================================
+/**
+ * Who acted, and as whom, for one authenticated request.
+ *
+ *  - `effectiveAccountId` — the account the request speaks AS (token `sub`).
+ *  - `actorAccountId` — who actually acted (token `act.sub`): the human operating
+ *    a managed account, or the account itself when nobody operates it.
+ *  - `delegated` — exactly `actorAccountId !== effectiveAccountId`. Carried as
+ *    its own field so a consumer reads a fact instead of re-deriving it, and
+ *    refined so the two can never disagree.
+ *
+ * Produced ONLY by the session authority (Oxy's `/session/validate*`) from the
+ * session ROW. A header or an unverified token claim never produces one: that is
+ * what keeps a modified header from changing the actor.
+ */
+exports.accountActorChainSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.ACCOUNT_SUBJECT_CONTRACT_VERSION),
+    effectiveAccountId: identifiers_1.oxyAccountIdSchema,
+    actorAccountId: identifiers_1.oxyAccountIdSchema,
+    delegated: zod_1.z.boolean(),
+})
+    .strict()
+    .refine((chain) => chain.delegated === (chain.actorAccountId !== chain.effectiveAccountId), {
+    message: 'delegated must be true exactly when the actor differs from the effective account',
+    path: ['delegated'],
+});
+/**
+ * Build the chain from a session's binding: its subject and the operator
+ * recorded on it (`sessions.operated_by_user_id`), if any.
+ *
+ * The one constructor, so producers cannot each invent a rule. An operator equal
+ * to the subject is not a delegation.
+ */
+function accountActorChainFromSession(binding) {
+    const actor = binding.operatedByAccountId || binding.subjectAccountId;
+    return exports.accountActorChainSchema.parse({
+        schemaVersion: exports.ACCOUNT_SUBJECT_CONTRACT_VERSION,
+        effectiveAccountId: binding.subjectAccountId,
+        actorAccountId: actor,
+        delegated: actor !== binding.subjectAccountId,
+    });
+}
+// ===========================================================================
+// Financial subject
+// ===========================================================================
+/** `debit` — the subject pays; `credit` — the subject receives. */
+exports.FINANCIAL_EFFECT_DIRECTIONS = ['debit', 'credit'];
+/**
+ * Whose money a financial effect is, and who caused it.
+ *
+ * `subjectAccountId` is the account the effect BELONGS to — the payer of a
+ * debit, the beneficiary of a credit — and it is always the EFFECTIVE account of
+ * the actor chain. Never the operator: a person paying from the bot they operate
+ * spends the bot's money, and the receipt names the bot as payer and the person
+ * as actor. Never the owner: a bot paying for itself is recorded as the bot.
+ *
+ * What this does NOT decide is which balance row FUNDS a debit. That is the
+ * billing walk's answer (ADR 0014: the account's own active profile, else its
+ * nearest ancestor's) and it is kind-independent; this contract only fixes the
+ * subject and the actor the receipt must carry. Moving money is not done here.
+ */
+exports.financialEffectAttributionSchema = zod_1.z
+    .object({
+    schemaVersion: zod_1.z.literal(exports.ACCOUNT_SUBJECT_CONTRACT_VERSION),
+    direction: zod_1.z.enum(exports.FINANCIAL_EFFECT_DIRECTIONS),
+    subjectAccountId: identifiers_1.oxyAccountIdSchema,
+    actor: exports.accountActorChainSchema,
+})
+    .strict()
+    .refine((effect) => effect.subjectAccountId === effect.actor.effectiveAccountId, {
+    message: 'a financial effect belongs to the effective account, never the operator',
+    path: ['subjectAccountId'],
+});
+/** Attribute a payment or a receipt to the subject the actor chain speaks as. */
+function attributeFinancialEffect(direction, actor) {
+    return exports.financialEffectAttributionSchema.parse({
+        schemaVersion: exports.ACCOUNT_SUBJECT_CONTRACT_VERSION,
+        direction,
+        subjectAccountId: actor.effectiveAccountId,
+        actor,
+    });
+}

package/dist/cjs/agency.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.delegationGrantSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.CAPABILITY_PACKAGES = exports.autonomyLevelSchema = exports.AUTONOMY_LEVELS = void 0;
+exports.normalizedAppEventSchema = exports.catalogRegistrationSchema = exports.appCapabilityCatalogSchema = exports.catalogEventSchema = exports.catalogToolSchema = exports.auditEventSchema = exports.auditResultSchema = exports.policyDecisionSchema = exports.invocationPrincipalSchema = exports.capabilityTicketClaimsSchema = exports.automationDefinitionSchema = exports.automationDataFlowSchema = exports.automationActorSelectionSchema = exports.automationTriggerSchema = exports.delegationGrantSchema = exports.capabilityTicketRequestSchema = exports.capabilityCoordinatorSchema = exports.executionAuthorizationRefSchema = exports.capabilityCatalogBindingSchema = exports.grantLimitSchema = exports.toolGrantOverrideSchema = exports.resourceRefSchema = exports.foregroundExecutionAuthorizationInputSchema = exports.executionActorRefSchema = exports.actorRefSchema = exports.capabilityPackageSchema = exports.CAPABILITY_PACKAGES = exports.autonomyLevelSchema = exports.AUTONOMY_LEVELS = void 0;
 const zod_1 = require("zod");
 const capabilityInvocation_1 = require("./capabilityInvocation");
 const nonEmptyStringSchema = zod_1.z.string().trim().min(1);
@@ -38,6 +38,23 @@ exports.actorRefSchema = zod_1.z.discriminatedUnion('type', [
         accountId: identifierSchema,
     }).strict(),
 ]);
+/** Present requester only; standing grants/automation retain actorRefSchema. */
+exports.executionActorRefSchema = zod_1.z.discriminatedUnion('type', [
+    ...exports.actorRefSchema.options,
+    zod_1.z.object({ type: zod_1.z.literal('requester'), accountId: identifierSchema }).strict(),
+]);
+/** Separate bearer lives only in the SDK option / authority request body. */
+exports.foregroundExecutionAuthorizationInputSchema = zod_1.z.object({
+    tool: zod_1.z.enum(['recommendProfiles', 'readViewerGraph']),
+    expectedCatalog: zod_1.z.object({
+        registrationId: identifierSchema,
+        version: identifierSchema,
+        digest: sha256HexSchema,
+    }).strict(),
+    runId: identifierSchema,
+    stepId: identifierSchema.optional(),
+    expiresAt: zod_1.z.string().datetime(),
+}).strict();
 exports.resourceRefSchema = zod_1.z.object({
     appId: identifierSchema,
     effectiveAccountId: identifierSchema,
@@ -76,6 +93,13 @@ exports.capabilityCoordinatorSchema = zod_1.z.object({
     applicationId: identifierSchema,
     credentialId: identifierSchema,
 }).strict();
+/** Opt-in catalogue pin; legacy issuance omits expectedCatalog and its claim. */
+exports.capabilityTicketRequestSchema = zod_1.z.object({
+    executionAuthorizationId: zod_1.z.string().min(1),
+    runId: zod_1.z.string().min(1).optional(),
+    stepId: zod_1.z.string().min(1).optional(),
+    expectedCatalog: exports.capabilityCatalogBindingSchema.optional(),
+}).strict();
 exports.delegationGrantSchema = zod_1.z.object({
     id: identifierSchema,
     ownerAccountId: identifierSchema,
@@ -142,17 +166,19 @@ exports.capabilityTicketClaimsSchema = zod_1.z.object({
     automationId: identifierSchema.optional(),
     executionAuthorization: exports.executionAuthorizationRefSchema,
     coordinator: exports.capabilityCoordinatorSchema,
+    /** Signed only for callers that explicitly requested a pinned catalogue. */
+    catalog: exports.capabilityCatalogBindingSchema.optional(),
     grantId: identifierSchema.optional(),
     requesterAccountId: identifierSchema,
     ownerAccountId: identifierSchema,
-    actor: exports.actorRefSchema,
+    actor: exports.executionActorRefSchema,
     resource: exports.resourceRefSchema,
     tool: identifierSchema,
     capabilities: zod_1.z.array(identifierSchema).min(1),
     limits: zod_1.z.array(exports.grantLimitSchema).default([]),
     autonomy: exports.autonomyLevelSchema,
 }).strict().superRefine((claims, context) => {
-    const expectedSubject = claims.actor.type === 'agent'
+    const expectedSubject = claims.actor.type !== 'alia'
         ? claims.actor.accountId
         : `alia:${claims.actor.ownerAccountId}`;
     if (claims.sub !== expectedSubject) {
@@ -169,6 +195,14 @@ exports.capabilityTicketClaimsSchema = zod_1.z.object({
             path: ['actor', 'ownerAccountId'],
         });
     }
+    if (claims.actor.type === 'requester' && (claims.actor.accountId !== claims.requesterAccountId
+        || claims.executionAuthorization.kind !== 'direct_request'
+        || claims.autonomy !== 'read_only'
+        || claims.grantId !== undefined
+        || claims.automationId !== undefined)) {
+        context.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['actor'],
+            message: 'requester actors require their exact principal and direct read-only authority without standing grants' });
+    }
     if (claims.exp <= claims.iat) {
         context.addIssue({
             code: zod_1.z.ZodIssueCode.custom,
@@ -202,6 +236,24 @@ exports.capabilityTicketClaimsSchema = zod_1.z.object({
         }
     }
 });
+/** Structural projections only: an authenticated transport must produce these. */
+exports.invocationPrincipalSchema = zod_1.z.discriminatedUnion('kind', [
+    zod_1.z.object({
+        kind: zod_1.z.literal('oauth'),
+        subject: identifierSchema,
+        clientId: identifierSchema,
+        originAccountId: identifierSchema,
+        activeAccountId: identifierSchema,
+        scopes: zod_1.z.array(identifierSchema),
+        resource: zod_1.z.string().url(),
+    }).strict(),
+    zod_1.z.object({
+        kind: zod_1.z.literal('capability'),
+        claims: exports.capabilityTicketClaimsSchema.refine((claims) => claims.catalog !== undefined, {
+            message: 'internal MCP requires a signed catalogue binding',
+        }),
+    }).strict(),
+]);
 exports.policyDecisionSchema = zod_1.z.object({
     allowed: zod_1.z.boolean(),
     reason: identifierSchema,
@@ -217,7 +269,7 @@ exports.auditEventSchema = zod_1.z.object({
     occurredAt: zod_1.z.string().datetime(),
     requesterAccountId: identifierSchema,
     coordinator: exports.capabilityCoordinatorSchema,
-    executor: exports.actorRefSchema,
+    executor: exports.executionActorRefSchema,
     effectiveAccountId: identifierSchema,
     resource: exports.resourceRefSchema,
     appId: identifierSchema,

package/dist/cjs/agentKeys.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentKeyListResponseSchema = exports.ACCOUNT_AUTH_METHODS = exports.agentKeyOperationResultSchema = exports.agentKeyOperationChallengeSchema = exports.executeAgentKeyOperationSchema = exports.agentKeyOperationProofSchema = exports.agentKeyOperationSchema = exports.agentVerifyRequestSchema = exports.agentChallengeRequestSchema = exports.agentSignatureSchema = exports.agentProofClaimsSchema = exports.AGENT_PROOF_ACTIONS = exports.AGENT_PROOF_TTL_MS = exports.AGENT_PROOF_AUDIENCE = void 0;
+exports.buildAgentProofMessage = buildAgentProofMessage;
+/** Autonomous runtime proof. No private key crosses this contract. */
+const zod_1 = require("zod");
+const signIn_1 = require("./signIn");
+const identityProof_1 = require("./identityProof");
+exports.AGENT_PROOF_AUDIENCE = 'oxy-api/agent';
+exports.AGENT_PROOF_TTL_MS = 60000;
+exports.AGENT_PROOF_ACTIONS = ['agent_signin', 'agent_enroll', 'agent_rotate', 'agent_recover', 'agent_governance'];
+exports.agentProofClaimsSchema = zod_1.z.object({
+    version: zod_1.z.literal(1),
+    audience: zod_1.z.literal(exports.AGENT_PROOF_AUDIENCE),
+    action: zod_1.z.enum(exports.AGENT_PROOF_ACTIONS),
+    accountId: zod_1.z.string().min(1),
+    actorId: zod_1.z.string().min(1),
+    authMethodId: zod_1.z.string().nullable(),
+    publicKey: zod_1.z.string().min(1),
+    payloadDigest: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    expiresAt: zod_1.z.number().int().positive(),
+}).strict();
+/** Different proof roles cannot substitute for one another on the same operation. */
+function buildAgentProofMessage(claims, timestamp, role = 'credential') {
+    return (0, identityProof_1.canonicalJson)({ domain: 'oxy-agent-proof', ...exports.agentProofClaimsSchema.parse(claims), timestamp, role });
+}
+exports.agentSignatureSchema = zod_1.z.object({
+    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    signature: zod_1.z.string().regex(/^[0-9a-f]+$/i).max(160),
+    timestamp: zod_1.z.number().int().positive(),
+}).strict();
+exports.agentChallengeRequestSchema = zod_1.z.object({ publicKey: zod_1.z.string().trim().min(1).max(130) }).strict();
+exports.agentVerifyRequestSchema = exports.agentSignatureSchema.extend({ publicKey: zod_1.z.string().trim().min(1).max(130) }).strict();
+const newKey = { publicKey: zod_1.z.string().trim().min(1).max(130), label: zod_1.z.string().trim().min(1).max(120) };
+exports.agentKeyOperationSchema = zod_1.z.discriminatedUnion('operation', [
+    zod_1.z.object({ operation: zod_1.z.literal('enroll'), ...newKey }).strict(),
+    zod_1.z.object({ operation: zod_1.z.literal('recover'), ...newKey }).strict(),
+    zod_1.z.object({ operation: zod_1.z.literal('rotate'), ...newKey, retireCurrent: zod_1.z.boolean().optional() }).strict(),
+    zod_1.z.object({ operation: zod_1.z.literal('revoke'), methodId: zod_1.z.string().min(1) }).strict(),
+]);
+exports.agentKeyOperationProofSchema = zod_1.z.object({
+    challenge: zod_1.z.string().regex(/^[0-9a-f]{64}$/),
+    timestamp: zod_1.z.number().int().positive(),
+    keySignature: zod_1.z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
+    governorSignature: zod_1.z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
+    reauth: signIn_1.reauthProofSchema.optional(),
+}).strict();
+exports.executeAgentKeyOperationSchema = zod_1.z.object({
+    operation: exports.agentKeyOperationSchema,
+    proof: exports.agentKeyOperationProofSchema,
+}).strict();
+exports.agentKeyOperationChallengeSchema = zod_1.z.object({
+    claims: exports.agentProofClaimsSchema,
+    governorPublicKey: zod_1.z.string().nullable(),
+}).strict();
+exports.agentKeyOperationResultSchema = zod_1.z.object({
+    methodId: zod_1.z.string().nullable(),
+    revokedMethodIds: zod_1.z.array(zod_1.z.string()),
+}).strict();
+exports.ACCOUNT_AUTH_METHODS = ['identity', 'agent_key'];
+/** Public credential inventory. Never includes a proof, bearer or private key. */
+exports.agentKeyListResponseSchema = zod_1.z.object({ keys: zod_1.z.array(zod_1.z.object({
+        id: zod_1.z.string(), publicKey: zod_1.z.string(), label: zod_1.z.string(),
+        enrolledByUserId: zod_1.z.string().nullable(), enrollmentMethod: zod_1.z.enum(['governor', 'rotation', 'recovery']),
+        linkedAt: zod_1.z.string().datetime(), lastUsedAt: zod_1.z.string().datetime().nullable(), revokedAt: zod_1.z.string().datetime().nullable(),
+    }).strict()) }).strict();

package/dist/cjs/capabilityBindings.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalCapabilityJson = canonicalCapabilityJson;
+exports.inputSatisfiesCapabilityLimits = inputSatisfiesCapabilityLimits;
+exports.isLoopbackOrigin = isLoopbackOrigin;
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    const record = value;
+    const sorted = Object.create(null);
+    for (const key of Object.keys(record).sort())
+        sorted[key] = canonicalValue(record[key]);
+    return sorted;
+}
+/** Registry-compatible JSON: sorted keys, omitted undefined object properties. */
+function canonicalCapabilityJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+function valuesAtPath(input, path) {
+    let current = [input];
+    for (const segment of path.split('.')) {
+        const next = [];
+        for (const value of current) {
+            const records = Array.isArray(value) ? value : [value];
+            for (const record of records) {
+                if (typeof record !== 'object' || record === null || Array.isArray(record))
+                    continue;
+                if (Object.prototype.hasOwnProperty.call(record, segment)) {
+                    next.push(record[segment]);
+                }
+            }
+        }
+        if (next.length === 0)
+            return [];
+        current = next;
+    }
+    return current.flatMap((value) => Array.isArray(value) ? value : [value]);
+}
+/** Enforces the signed per-action bounds before a domain handler runs. */
+function inputSatisfiesCapabilityLimits(tool, input, limits) {
+    for (const limit of limits) {
+        if (limit.tool !== tool)
+            return false;
+        const actualValues = valuesAtPath(input, limit.key);
+        if (actualValues.length === 0)
+            return false;
+        if (typeof limit.value === 'number') {
+            const maximum = limit.value;
+            if (!actualValues.every((actual) => (typeof actual === 'number' && Number.isFinite(actual) && actual <= maximum)))
+                return false;
+            continue;
+        }
+        if (!actualValues.every((actual) => actual === limit.value))
+            return false;
+    }
+    return true;
+}
+function isLoopbackOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        const host = parsed.hostname.toLowerCase();
+        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}