@oxy.so/contracts 4.8.0 → 4.9.1

package/dist/esm/accountGraph.js

@@ -58,6 +58,12 @@ export const childAccountKindSchema = z.enum(CHILD_ACCOUNT_KINDS);
  *
  * Consumers must gate on this predicate rather than testing `kind === 'personal'`,
  * which silently admits every kind added after it was written.
+ *
+ * Being act-as-eligible is NOT being without an identity of one's own. A bot is
+ * act-as-eligible AND its own actor (`accountKindActorNature` → `'agent'` in
+ * `accountSubject.ts`): an application acting as it on a person's authority
+ * records that person as the actor, and the bot acting with nobody operating it
+ * records the bot. Neither ever records the bot's owner in the bot's place.
  */
 export function isDelegatedActAsEligibleKind(kind) {
     return kind === 'organization' || kind === 'project' || kind === 'bot';
@@ -71,11 +77,13 @@ export function isDelegatedActAsEligibleKind(kind) {
  * The two differ on exactly one kind, `bot`, and that difference is the whole
  * reason both exist.
  *
- * **A bot is not something you become. It is something that operates on your
- * behalf.** Its whole purpose is to act while nobody is present: an application
- * holds a credential, names the human whose authority it borrows, and speaks as
- * the bot. That is delegation, and it is what
- * {@link isDelegatedActAsEligibleKind} admits it for.
+ * **A bot is not something you become. It is somebody of its own.** It is an
+ * agent's identity, with its own resources, roles, plan and balance, and it is
+ * the actor of what it does unoperated. A person may still act AS it on their
+ * own authority — that is delegation, recorded with the person as actor, and it
+ * is what {@link isDelegatedActAsEligibleKind} admits it for. What a person
+ * never does is occupy its seat. This is a refusal of a SEAT, not a capability
+ * restriction: nothing a bot may do depends on this predicate.
  *
  * Handing a person the bot's seat instead inverts that. It puts a human inside
  * the identity that exists to act without one, and it does so on the human's own

package/dist/esm/accountSubject.js

@@ -0,0 +1,182 @@
+/**
+ * Account subject contract — what an account IS, kept apart from how it proves
+ * itself, who may become it, who may act as it, who acted, and whose money moves.
+ *
+ * `AccountKind` (`accountGraph.ts`) names the nature of an account. Five other
+ * questions are routinely asked of an account, and each has its own answer here
+ * or in `accountGraph.ts`. None of them may be answered by testing `kind`
+ * directly at a call site:
+ *
+ * | question                                  | answered by                              |
+ * |-------------------------------------------|------------------------------------------|
+ * | may a PERSON switch into it?              | `isOperatorSwitchTargetKind`             |
+ * | may someone act AS it on their authority? | `isDelegatedActAsEligibleKind`           |
+ * | who is the ACTOR when it acts unoperated? | {@link accountKindActorNature}           |
+ * | who acted, and as whom, on this request?  | {@link AccountActorChain}                |
+ * | whose money / receipt is an effect?       | {@link attributeFinancialEffect}         |
+ * | roles, resources, plan, balance, payer    | NOT kind — {@link KIND_INDEPENDENT_ACCOUNT_DIMENSIONS} |
+ *
+ * ## A bot is a complete account (issue #1520, I01)
+ *
+ * A `bot` is an AI agent's own identity. It owns resources, holds roles, has a
+ * plan, holds a balance, receives funds and pays for itself under exactly the
+ * rules a personal account does. Nothing commercial derives from it being a bot,
+ * and nothing about it requires its owner's approval merely because it is one.
+ *
+ * Two things DO differ, and both are about seats, not capability:
+ *
+ *  - a person never switches INTO a bot (`isOperatorSwitchTargetKind`): a bot is
+ *    somebody, not a seat a human occupies;
+ *  - when a bot acts with nobody operating it, the actor recorded is the BOT
+ *    ({@link accountKindActorNature} `'agent'`), never its owner.
+ */
+import { z } from 'zod';
+import { oxyAccountIdSchema } from './inference/identifiers.js';
+/** Bumped when any shape in this module changes incompatibly. */
+export const ACCOUNT_SUBJECT_CONTRACT_VERSION = 1;
+// ===========================================================================
+// Actor nature
+// ===========================================================================
+/**
+ * Who is recorded as the ACTOR when an account of this kind acts and no other
+ * account is operating it.
+ *
+ *  - `person` — a human; a personal account is its own actor.
+ *  - `agent`  — an AI agent; a bot is its own actor (ADR 0018 `ActorRef`
+ *    `{type:'agent'}`), and audit records the bot, never the human who owns it.
+ *  - `operated` — never its own actor. An organization, project or channel only
+ *    acts through a member, and that member is the actor.
+ */
+export const ACCOUNT_ACTOR_NATURES = ['person', 'agent', 'operated'];
+export const accountActorNatureSchema = z.enum(ACCOUNT_ACTOR_NATURES);
+/**
+ * The actor nature of a kind. A `Record` over the full union, so a new kind does
+ * not compile until somebody decides this for it.
+ */
+const ACTOR_NATURE_BY_KIND = {
+    personal: 'person',
+    bot: 'agent',
+    organization: 'operated',
+    project: 'operated',
+    channel: 'operated',
+};
+/** `null` for a value that is not an account kind. Never a guess. */
+export function accountKindActorNature(kind) {
+    if (!kind || !Object.prototype.hasOwnProperty.call(ACTOR_NATURE_BY_KIND, kind)) {
+        return null;
+    }
+    return ACTOR_NATURE_BY_KIND[kind];
+}
+/** Whether an account of this kind can be the actor of its own actions. */
+export function accountKindActsAsItself(kind) {
+    const nature = accountKindActorNature(kind);
+    return nature === 'person' || nature === 'agent';
+}
+// ===========================================================================
+// Kind-independent dimensions
+// ===========================================================================
+/**
+ * What an account's KIND never decides.
+ *
+ * There is deliberately no predicate taking a kind for any of these. A member's
+ * role grants the same permissions whatever kind the member is; a plan, a
+ * balance, the payer and the beneficiary are resolved from billing state and
+ * membership, never from `kind`. A bot and a person with the same role and plan
+ * get the same action and the same commercial treatment.
+ *
+ * Listed so a consumer can cite the rule, and so the API's static guard
+ * (`commercialTreatmentIgnoresAccountKind.test.ts`) has a single source.
+ */
+export const KIND_INDEPENDENT_ACCOUNT_DIMENSIONS = [
+    'roles',
+    'resources',
+    'plan',
+    'balance',
+    'payer',
+    'beneficiary',
+];
+// ===========================================================================
+// Actor chain
+// ===========================================================================
+/**
+ * Who acted, and as whom, for one authenticated request.
+ *
+ *  - `effectiveAccountId` — the account the request speaks AS (token `sub`).
+ *  - `actorAccountId` — who actually acted (token `act.sub`): the human operating
+ *    a managed account, or the account itself when nobody operates it.
+ *  - `delegated` — exactly `actorAccountId !== effectiveAccountId`. Carried as
+ *    its own field so a consumer reads a fact instead of re-deriving it, and
+ *    refined so the two can never disagree.
+ *
+ * Produced ONLY by the session authority (Oxy's `/session/validate*`) from the
+ * session ROW. A header or an unverified token claim never produces one: that is
+ * what keeps a modified header from changing the actor.
+ */
+export const accountActorChainSchema = z
+    .object({
+    schemaVersion: z.literal(ACCOUNT_SUBJECT_CONTRACT_VERSION),
+    effectiveAccountId: oxyAccountIdSchema,
+    actorAccountId: oxyAccountIdSchema,
+    delegated: z.boolean(),
+})
+    .strict()
+    .refine((chain) => chain.delegated === (chain.actorAccountId !== chain.effectiveAccountId), {
+    message: 'delegated must be true exactly when the actor differs from the effective account',
+    path: ['delegated'],
+});
+/**
+ * Build the chain from a session's binding: its subject and the operator
+ * recorded on it (`sessions.operated_by_user_id`), if any.
+ *
+ * The one constructor, so producers cannot each invent a rule. An operator equal
+ * to the subject is not a delegation.
+ */
+export function accountActorChainFromSession(binding) {
+    const actor = binding.operatedByAccountId || binding.subjectAccountId;
+    return accountActorChainSchema.parse({
+        schemaVersion: ACCOUNT_SUBJECT_CONTRACT_VERSION,
+        effectiveAccountId: binding.subjectAccountId,
+        actorAccountId: actor,
+        delegated: actor !== binding.subjectAccountId,
+    });
+}
+// ===========================================================================
+// Financial subject
+// ===========================================================================
+/** `debit` — the subject pays; `credit` — the subject receives. */
+export const FINANCIAL_EFFECT_DIRECTIONS = ['debit', 'credit'];
+/**
+ * Whose money a financial effect is, and who caused it.
+ *
+ * `subjectAccountId` is the account the effect BELONGS to — the payer of a
+ * debit, the beneficiary of a credit — and it is always the EFFECTIVE account of
+ * the actor chain. Never the operator: a person paying from the bot they operate
+ * spends the bot's money, and the receipt names the bot as payer and the person
+ * as actor. Never the owner: a bot paying for itself is recorded as the bot.
+ *
+ * What this does NOT decide is which balance row FUNDS a debit. That is the
+ * billing walk's answer (ADR 0014: the account's own active profile, else its
+ * nearest ancestor's) and it is kind-independent; this contract only fixes the
+ * subject and the actor the receipt must carry. Moving money is not done here.
+ */
+export const financialEffectAttributionSchema = z
+    .object({
+    schemaVersion: z.literal(ACCOUNT_SUBJECT_CONTRACT_VERSION),
+    direction: z.enum(FINANCIAL_EFFECT_DIRECTIONS),
+    subjectAccountId: oxyAccountIdSchema,
+    actor: accountActorChainSchema,
+})
+    .strict()
+    .refine((effect) => effect.subjectAccountId === effect.actor.effectiveAccountId, {
+    message: 'a financial effect belongs to the effective account, never the operator',
+    path: ['subjectAccountId'],
+});
+/** Attribute a payment or a receipt to the subject the actor chain speaks as. */
+export function attributeFinancialEffect(direction, actor) {
+    return financialEffectAttributionSchema.parse({
+        schemaVersion: ACCOUNT_SUBJECT_CONTRACT_VERSION,
+        direction,
+        subjectAccountId: actor.effectiveAccountId,
+        actor,
+    });
+}

package/dist/esm/agency.js

@@ -35,6 +35,23 @@ export const actorRefSchema = z.discriminatedUnion('type', [
         accountId: identifierSchema,
     }).strict(),
 ]);
+/** Present requester only; standing grants/automation retain actorRefSchema. */
+export const executionActorRefSchema = z.discriminatedUnion('type', [
+    ...actorRefSchema.options,
+    z.object({ type: z.literal('requester'), accountId: identifierSchema }).strict(),
+]);
+/** Separate bearer lives only in the SDK option / authority request body. */
+export const foregroundExecutionAuthorizationInputSchema = z.object({
+    tool: z.enum(['recommendProfiles', 'readViewerGraph']),
+    expectedCatalog: z.object({
+        registrationId: identifierSchema,
+        version: identifierSchema,
+        digest: sha256HexSchema,
+    }).strict(),
+    runId: identifierSchema,
+    stepId: identifierSchema.optional(),
+    expiresAt: z.string().datetime(),
+}).strict();
 export const resourceRefSchema = z.object({
     appId: identifierSchema,
     effectiveAccountId: identifierSchema,
@@ -73,6 +90,13 @@ export const capabilityCoordinatorSchema = z.object({
     applicationId: identifierSchema,
     credentialId: identifierSchema,
 }).strict();
+/** Opt-in catalogue pin; legacy issuance omits expectedCatalog and its claim. */
+export const capabilityTicketRequestSchema = z.object({
+    executionAuthorizationId: z.string().min(1),
+    runId: z.string().min(1).optional(),
+    stepId: z.string().min(1).optional(),
+    expectedCatalog: capabilityCatalogBindingSchema.optional(),
+}).strict();
 export const delegationGrantSchema = z.object({
     id: identifierSchema,
     ownerAccountId: identifierSchema,
@@ -139,17 +163,19 @@ export const capabilityTicketClaimsSchema = z.object({
     automationId: identifierSchema.optional(),
     executionAuthorization: executionAuthorizationRefSchema,
     coordinator: capabilityCoordinatorSchema,
+    /** Signed only for callers that explicitly requested a pinned catalogue. */
+    catalog: capabilityCatalogBindingSchema.optional(),
     grantId: identifierSchema.optional(),
     requesterAccountId: identifierSchema,
     ownerAccountId: identifierSchema,
-    actor: actorRefSchema,
+    actor: executionActorRefSchema,
     resource: resourceRefSchema,
     tool: identifierSchema,
     capabilities: z.array(identifierSchema).min(1),
     limits: z.array(grantLimitSchema).default([]),
     autonomy: autonomyLevelSchema,
 }).strict().superRefine((claims, context) => {
-    const expectedSubject = claims.actor.type === 'agent'
+    const expectedSubject = claims.actor.type !== 'alia'
         ? claims.actor.accountId
         : `alia:${claims.actor.ownerAccountId}`;
     if (claims.sub !== expectedSubject) {
@@ -166,6 +192,14 @@ export const capabilityTicketClaimsSchema = z.object({
             path: ['actor', 'ownerAccountId'],
         });
     }
+    if (claims.actor.type === 'requester' && (claims.actor.accountId !== claims.requesterAccountId
+        || claims.executionAuthorization.kind !== 'direct_request'
+        || claims.autonomy !== 'read_only'
+        || claims.grantId !== undefined
+        || claims.automationId !== undefined)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ['actor'],
+            message: 'requester actors require their exact principal and direct read-only authority without standing grants' });
+    }
     if (claims.exp <= claims.iat) {
         context.addIssue({
             code: z.ZodIssueCode.custom,
@@ -199,6 +233,24 @@ export const capabilityTicketClaimsSchema = z.object({
         }
     }
 });
+/** Structural projections only: an authenticated transport must produce these. */
+export const invocationPrincipalSchema = z.discriminatedUnion('kind', [
+    z.object({
+        kind: z.literal('oauth'),
+        subject: identifierSchema,
+        clientId: identifierSchema,
+        originAccountId: identifierSchema,
+        activeAccountId: identifierSchema,
+        scopes: z.array(identifierSchema),
+        resource: z.string().url(),
+    }).strict(),
+    z.object({
+        kind: z.literal('capability'),
+        claims: capabilityTicketClaimsSchema.refine((claims) => claims.catalog !== undefined, {
+            message: 'internal MCP requires a signed catalogue binding',
+        }),
+    }).strict(),
+]);
 export const policyDecisionSchema = z.object({
     allowed: z.boolean(),
     reason: identifierSchema,
@@ -214,7 +266,7 @@ export const auditEventSchema = z.object({
     occurredAt: z.string().datetime(),
     requesterAccountId: identifierSchema,
     coordinator: capabilityCoordinatorSchema,
-    executor: actorRefSchema,
+    executor: executionActorRefSchema,
     effectiveAccountId: identifierSchema,
     resource: resourceRefSchema,
     appId: identifierSchema,

package/dist/esm/agentKeys.js

@@ -0,0 +1,63 @@
+/** Autonomous runtime proof. No private key crosses this contract. */
+import { z } from 'zod';
+import { reauthProofSchema } from './signIn.js';
+import { canonicalJson } from './identityProof.js';
+export const AGENT_PROOF_AUDIENCE = 'oxy-api/agent';
+export const AGENT_PROOF_TTL_MS = 60000;
+export const AGENT_PROOF_ACTIONS = ['agent_signin', 'agent_enroll', 'agent_rotate', 'agent_recover', 'agent_governance'];
+export const agentProofClaimsSchema = z.object({
+    version: z.literal(1),
+    audience: z.literal(AGENT_PROOF_AUDIENCE),
+    action: z.enum(AGENT_PROOF_ACTIONS),
+    accountId: z.string().min(1),
+    actorId: z.string().min(1),
+    authMethodId: z.string().nullable(),
+    publicKey: z.string().min(1),
+    payloadDigest: z.string().regex(/^[0-9a-f]{64}$/),
+    challenge: z.string().regex(/^[0-9a-f]{64}$/),
+    expiresAt: z.number().int().positive(),
+}).strict();
+/** Different proof roles cannot substitute for one another on the same operation. */
+export function buildAgentProofMessage(claims, timestamp, role = 'credential') {
+    return canonicalJson({ domain: 'oxy-agent-proof', ...agentProofClaimsSchema.parse(claims), timestamp, role });
+}
+export const agentSignatureSchema = z.object({
+    challenge: z.string().regex(/^[0-9a-f]{64}$/),
+    signature: z.string().regex(/^[0-9a-f]+$/i).max(160),
+    timestamp: z.number().int().positive(),
+}).strict();
+export const agentChallengeRequestSchema = z.object({ publicKey: z.string().trim().min(1).max(130) }).strict();
+export const agentVerifyRequestSchema = agentSignatureSchema.extend({ publicKey: z.string().trim().min(1).max(130) }).strict();
+const newKey = { publicKey: z.string().trim().min(1).max(130), label: z.string().trim().min(1).max(120) };
+export const agentKeyOperationSchema = z.discriminatedUnion('operation', [
+    z.object({ operation: z.literal('enroll'), ...newKey }).strict(),
+    z.object({ operation: z.literal('recover'), ...newKey }).strict(),
+    z.object({ operation: z.literal('rotate'), ...newKey, retireCurrent: z.boolean().optional() }).strict(),
+    z.object({ operation: z.literal('revoke'), methodId: z.string().min(1) }).strict(),
+]);
+export const agentKeyOperationProofSchema = z.object({
+    challenge: z.string().regex(/^[0-9a-f]{64}$/),
+    timestamp: z.number().int().positive(),
+    keySignature: z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
+    governorSignature: z.string().regex(/^[0-9a-f]+$/i).max(160).optional(),
+    reauth: reauthProofSchema.optional(),
+}).strict();
+export const executeAgentKeyOperationSchema = z.object({
+    operation: agentKeyOperationSchema,
+    proof: agentKeyOperationProofSchema,
+}).strict();
+export const agentKeyOperationChallengeSchema = z.object({
+    claims: agentProofClaimsSchema,
+    governorPublicKey: z.string().nullable(),
+}).strict();
+export const agentKeyOperationResultSchema = z.object({
+    methodId: z.string().nullable(),
+    revokedMethodIds: z.array(z.string()),
+}).strict();
+export const ACCOUNT_AUTH_METHODS = ['identity', 'agent_key'];
+/** Public credential inventory. Never includes a proof, bearer or private key. */
+export const agentKeyListResponseSchema = z.object({ keys: z.array(z.object({
+        id: z.string(), publicKey: z.string(), label: z.string(),
+        enrolledByUserId: z.string().nullable(), enrollmentMethod: z.enum(['governor', 'rotation', 'recovery']),
+        linkedAt: z.string().datetime(), lastUsedAt: z.string().datetime().nullable(), revokedAt: z.string().datetime().nullable(),
+    }).strict()) }).strict();

package/dist/esm/capabilityBindings.js

@@ -0,0 +1,67 @@
+function canonicalValue(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    const record = value;
+    const sorted = Object.create(null);
+    for (const key of Object.keys(record).sort())
+        sorted[key] = canonicalValue(record[key]);
+    return sorted;
+}
+/** Registry-compatible JSON: sorted keys, omitted undefined object properties. */
+export function canonicalCapabilityJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+function valuesAtPath(input, path) {
+    let current = [input];
+    for (const segment of path.split('.')) {
+        const next = [];
+        for (const value of current) {
+            const records = Array.isArray(value) ? value : [value];
+            for (const record of records) {
+                if (typeof record !== 'object' || record === null || Array.isArray(record))
+                    continue;
+                if (Object.prototype.hasOwnProperty.call(record, segment)) {
+                    next.push(record[segment]);
+                }
+            }
+        }
+        if (next.length === 0)
+            return [];
+        current = next;
+    }
+    return current.flatMap((value) => Array.isArray(value) ? value : [value]);
+}
+/** Enforces the signed per-action bounds before a domain handler runs. */
+export function inputSatisfiesCapabilityLimits(tool, input, limits) {
+    for (const limit of limits) {
+        if (limit.tool !== tool)
+            return false;
+        const actualValues = valuesAtPath(input, limit.key);
+        if (actualValues.length === 0)
+            return false;
+        if (typeof limit.value === 'number') {
+            const maximum = limit.value;
+            if (!actualValues.every((actual) => (typeof actual === 'number' && Number.isFinite(actual) && actual <= maximum)))
+                return false;
+            continue;
+        }
+        if (!actualValues.every((actual) => actual === limit.value))
+            return false;
+    }
+    return true;
+}
+export function isLoopbackOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        const host = parsed.hostname.toLowerCase();
+        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/esm/index.js

@@ -10,6 +10,7 @@
  * expo, no `require()` in the ESM build.
  */
 export { ACCOUNT_KINDS, accountKindSchema, CHILD_ACCOUNT_KINDS, childAccountKindSchema, isAccountKind, isDelegatedActAsEligibleKind, isOperatorSwitchTargetKind, ACCOUNT_CATEGORY_IDS, ACCOUNT_CATEGORY_KINDS, accountCategoriesSchema, accountCategoryIdSchema, isSelectableAccountCategoryId, kindAcceptsAccountCategories, MAX_ACCOUNT_CATEGORIES, newlyAddedRetiredCategories, RETIRED_ACCOUNT_CATEGORY_IDS, SELECTABLE_ACCOUNT_CATEGORY_IDS, createAccountRequestSchema, } from './accountGraph.js';
+export { ACCOUNT_ACTOR_NATURES, ACCOUNT_SUBJECT_CONTRACT_VERSION, FINANCIAL_EFFECT_DIRECTIONS, KIND_INDEPENDENT_ACCOUNT_DIMENSIONS, accountActorChainFromSession, accountActorChainSchema, accountActorNatureSchema, accountKindActorNature, accountKindActsAsItself, attributeFinancialEffect, financialEffectAttributionSchema, } from './accountSubject.js';
 export { usernameSchema, usernameSchemaForAccountKind, isValidUsername, stripDisallowedUsernameCharacters, applyBotUsernameSuffix, USERNAME_MIN_LENGTH, USERNAME_MAX_LENGTH, USERNAME_INVALID_MESSAGE, BOT_USERNAME_INVALID_MESSAGE, RESERVED_USERNAME_MESSAGE, NUMERIC_USERNAME_MESSAGE, } from './username.js';
 export { 
 // Schemas
@@ -173,7 +174,10 @@ export {
 // Product entitlements. Allowances are integer counts and money is an exact
 // decimal, so a plan allowance cannot be added to a balance.
 PRODUCT_PLAN_STATUSES, productPlanStatusSchema, LIVE_PRODUCT_PLAN_STATUSES, planAllowanceSchema, productPlanSchema, payAsYouGoEntitlementSchema, COST_CENTER_STATUSES, costCenterStatusSchema, costCenterSchema, costCenterSpendSchema, productEntitlementSchema, } from './inference/entitlement.js';
-export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
+export { 
+// Economic treatment (I09): derived by the server, never sent by a caller.
+INFERENCE_ECONOMIC_TREATMENTS, inferenceEconomicTreatmentSchema, PROVIDER_COST_SOURCES, providerCostSourceSchema, costCenterUsageSchema, } from './inference/economics.js';
+export { AUTONOMY_LEVELS, CAPABILITY_PACKAGES, autonomyLevelSchema, capabilityPackageSchema, actorRefSchema, executionActorRefSchema, foregroundExecutionAuthorizationInputSchema, resourceRefSchema, toolGrantOverrideSchema, grantLimitSchema, capabilityCatalogBindingSchema, executionAuthorizationRefSchema, capabilityCoordinatorSchema, capabilityTicketRequestSchema, delegationGrantSchema, automationTriggerSchema, automationActorSelectionSchema, automationDataFlowSchema, automationDefinitionSchema, capabilityTicketClaimsSchema, invocationPrincipalSchema, policyDecisionSchema, auditResultSchema, auditEventSchema, catalogToolSchema, catalogEventSchema, appCapabilityCatalogSchema, catalogRegistrationSchema, normalizedAppEventSchema, } from './agency.js';
 export { catalogInvocationPathParameters, catalogInvocationsOverlap, catalogInvocationTemplatesEquivalent, findOverlappingCatalogInvocations, matchCatalogInvocation, resolveCatalogInvocation, } from './capabilityInvocation.js';
 export { emailContextAddressSchema, emailContextMailboxSchema, emailContextMessageSchema, emailAgentContextSchema, } from './emailAgentContext.js';
 export { inboxComposeRequestSchema, inboxDailyBriefRequestSchema, inboxNaturalSearchRequestSchema, inboxMessageInferenceParamsSchema, inboxInferenceTextResponseSchema, inboxNaturalSearchResponseSchema, inboxSmartRepliesResponseSchema, inboxThreadSummaryResponseSchema, inboxInferenceStreamEventSchema, } from './inference/inbox.js';
@@ -186,3 +190,8 @@ export * from './stickers.js';
 export { decisionEffortSchema, decisionQuestionSchema, decisionInputSchema, decisionRequestSchema, decisionAnswerSchema, decisionResultSchema, decisionSuccessSchema, decisionFailureSchema, decisionInputBudget, decisionFitsGateway, decisionAnswersMatch, } from './inference/decisions.js';
 export { SCOPED_EXECUTION_CONTRACT_VERSION, SCOPED_REQUEST_ENVELOPE_VERSION, scopedExecutionAudienceSchema, scopedExecutionSchema, canonicalScopedExecutionJson } from './inference/scopedExecution.js';
 export { scopedInferenceRequestSchema } from './inference/request.js';
+export { productDefinitionSchema, subjectProductAccessQuerySchema, productBenefitSchema, productOfferSchema, productSubscriptionSourceSchema, productAccessGrantSchema, productOfferSegmentSchema, subjectProductAccessSchema, } from './products/access.js';
+export { meteredGenerationSchema } from "./inference/economics.js";
+export { canonicalCapabilityJson, inputSatisfiesCapabilityLimits, isLoopbackOrigin } from './capabilityBindings.js';
+export * from './agentKeys.js';
+export { productSubscriptionSummarySchema, productSubscriptionsResponseSchema, subscriptionCreditGrantSchema, subscriptionCreditGrantsResponseSchema, cancelProductSubscriptionSchema, productSubscriptionCancellationResultSchema } from './products/billing.js';

package/dist/esm/inference/decisions.js

@@ -69,7 +69,48 @@ export function decisionInputBudget(payload) {
 export function decisionFitsGateway(payload) {
     return decisionInputBudget(payload).gateway <= 32000;
 }
+/** JSON permits escaped lone UTF-16 units; Go replaces them after decoding. */
+function hasUnpairedSurrogate(value) {
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(i + 1);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return true;
+            i++;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff)
+            return true;
+    }
+    return false;
+}
 function validateInput(payload, ctx) {
+    const fields = [
+        { value: payload.state, path: ["state"] },
+        { value: payload.instructions, path: ["instructions"] },
+    ];
+    for (const [index, question] of payload.questions.entries()) {
+        for (const field of ["id", "question", "criteria"]) {
+            fields.push({ value: question[field], path: ["questions", index, field] });
+        }
+        if (question.kind === "choice" || question.kind === "score") {
+            const field = question.kind === "choice" ? "options" : "levels";
+            const labels = question.kind === "choice" ? question.options : question.levels;
+            for (const [labelIndex, value] of labels.entries()) {
+                fields.push({ value, path: ["questions", index, field, labelIndex] });
+            }
+        }
+    }
+    let invalidUnicode = false;
+    for (const { value, path } of fields) {
+        if (value !== undefined && hasUnpairedSurrogate(value)) {
+            invalidUnicode = true;
+            ctx.addIssue({ code: "custom", path, message: "Decisions require paired UTF-16 surrogates." });
+        }
+    }
+    // Reject before measuring/reserving text that the execution runtime would change.
+    if (invalidUnicode)
+        return;
     if (new Set(payload.questions.map((q) => q.id)).size !==
         payload.questions.length)
         ctx.addIssue({