@vess-id/ai-identity 0.16.0 → 0.17.0

package/dist/index.d.mts

@@ -865,6 +865,14 @@ interface PolicyRefInline {
      * resolve で取得できるため optional のまま).
      */
     schema_id?: string;
+    /**
+     * Policy engine that authored / evaluates this document. Omitted ⇒ `cedar`
+     * (historical default — all pre-Plan-B refs are Cedar and MUST stay wire-
+     * identical). Corresponds to the Policy Registry `engine` column (Plan B
+     * Task 1). Non-cedar engines (e.g. `'scheduling-delegation/v1'`) carry a
+     * non-Cedar `policy_inline` body and skip Cedar lint.
+     */
+    engine?: string;
 }
 /**
  * Reference policy mode — policy lives in the Policy Registry.
@@ -891,6 +899,15 @@ interface PolicyRefReference {
      * 同梱せず Registry 側で resolve する方針。
      */
     schema_id?: string;
+    /**
+     * Policy engine that authored / evaluates the referenced document. Omitted ⇒
+     * `cedar` (historical default — all pre-Plan-B refs are Cedar and MUST stay
+     * wire-identical). Corresponds to the Policy Registry `engine` column (Plan B
+     * Task 1); the served `/.well-known/policy-registry/:id` document declares the
+     * same value. Non-cedar engines (e.g. `'scheduling-delegation/v1'`) resolve to
+     * a non-Cedar body and skip Cedar lint.
+     */
+    engine?: string;
 }
 /**
  * Tagged union of policy reference shapes. Discriminator: `mode`.
@@ -1089,6 +1106,84 @@ interface VcApprovalClaim {
      */
     action?: string;
 }
+/**
+ * Scheduling Wow Phase 1 §5.3 (Task 7) — the delegation-policy snapshot baked
+ * into a VC that was AUTO-ISSUED (no human approval) because the invocation
+ * fell entirely inside the user's advance scheduling-delegation policy.
+ *
+ * Audit evidence: names WHAT standing authority the auto-issuance relied on
+ * ("何を根拠に自動実行されたか"), so a verifier / auditor can reconstruct the
+ * decision without the DB row (which may have been edited since). It is NOT
+ * read by any enforcement gate — resource_id / delegates semantics (#884
+ * canonical resource checks) are unchanged.
+ *
+ * SD-protected (disclosed via `_sd`) because `contactScope` can contain
+ * third-party emails/domains.
+ *
+ * Item binding (Tasks 9-11, spec §5.3): the optional {@link
+ * VcSchedulingDelegationClaim.itemId} names which negotiation an automated
+ * calendar write belonged to. It is ABSENT on `scheduling.request` issuances
+ * (at that gate the item does not exist yet — it is created by the request
+ * pipeline AFTER the VC gate, so there is nothing to bind) and PRESENT on the
+ * confirm (§7) and tentative-hold (§6) issuance contexts, which operate on a
+ * concrete item.
+ */
+interface VcSchedulingDelegationClaim {
+    /** The policy's allowed weekly window at issuance time. */
+    timeWindow: {
+        /** Allowed weekdays, 0 (Sun) – 6 (Sat). */
+        daysOfWeek: number[];
+        /** 'HH:mm' wall-clock window start (policy timezone). */
+        windowStart: string;
+        /** 'HH:mm' wall-clock window end (policy timezone). */
+        windowEnd: string;
+        /** IANA timezone the window is judged in (e.g. 'Asia/Tokyo'). */
+        timezone: string;
+    };
+    /** Upper bound on meeting duration (minutes) the policy allowed. */
+    maxDurationMinutes: number;
+    /** Counterpart scope the policy allowed. null = no restriction. */
+    contactScope: {
+        emails: string[];
+        domains: string[];
+    } | null;
+    /** ISO-8601 expiry of the delegation policy itself at issuance time. */
+    policyExpiresAt: string;
+    /**
+     * Scheduling Wow Phase 1 (Tasks 9-11, spec §5.3) — the inbox item id the
+     * automated calendar write belonged to. ADDITIVE / OPTIONAL: absent on
+     * `scheduling.request` issuances (the item does not exist yet at that gate),
+     * present on the confirm (§7) and tentative-hold (§6) issuance contexts,
+     * which DO operate on a concrete item and bind it so the audit evidence names
+     * which negotiation the write was for.
+     */
+    itemId?: string;
+    /**
+     * Scheduling Phase 2 Plan B (Task 3 bakes this) — the Policy Registry id of
+     * the signed delegation-policy document the auto-issuance relied on. Lets an
+     * auditor fetch the exact JWS-signed `/.well-known/policy-registry/:id`
+     * document that this snapshot was derived from, instead of trusting the
+     * inline snapshot alone. ADDITIVE / OPTIONAL: absent on legacy rows minted
+     * before Plan B (which have no registry document).
+     *
+     * AUDIT-ONLY, same principle as the rest of this claim: no enforcement gate
+     * reads it. At invoke time the delegation is re-evaluated against the LIVE
+     * policy row + actual request parameters — the VC claim is never trusted as
+     * an authorization source (#884 canonical resource checks unchanged).
+     */
+    policyRegistryId?: string;
+    /**
+     * Scheduling Phase 2 Plan B (Task 3 bakes this) — `sha256-` prefixed hash of
+     * the canonical policy body the {@link policyRegistryId} document was minted
+     * with. Tamper-evidence linking this snapshot to that exact document version.
+     * ADDITIVE / OPTIONAL: absent on legacy rows minted before Plan B.
+     *
+     * AUDIT-ONLY, same principle as the rest of this claim: no enforcement gate
+     * reads it. Invoke-time evaluation trusts the live policy row + actual
+     * parameters, never the VC claim (#884 unchanged).
+     */
+    policyHash?: string;
+}
 interface PermissionVcClaims_V3 extends Omit<PermissionVcClaims_V2, 'v'> {
     /** Schema version — v3 adds Cedar policy_ref support and chain hierarchy fields. */
     v: '3';
@@ -1118,6 +1213,14 @@ interface PermissionVcClaims_V3 extends Omit<PermissionVcClaims_V2, 'v'> {
      * ledger 経由 fallback)。{@link VcApprovalClaim} 参照。
      */
     approval?: VcApprovalClaim;
+    /**
+     * Scheduling Wow Phase 1 §5.3 (Task 7) — present ONLY when the VC was
+     * auto-issued under the user's advance scheduling-delegation policy
+     * (scheduling.request / confirm / hold contexts). Absent on every other
+     * issuance path (manual approval, Cedar permit, legacy). Audit-only:
+     * no enforcement gate reads it. {@link VcSchedulingDelegationClaim}.
+     */
+    schedulingDelegation?: VcSchedulingDelegationClaim;
 }
 /**
  * Permission VC Claims (canonical union of v2 + v3).
@@ -4841,9 +4944,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -5027,9 +5133,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -5216,9 +5325,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -5415,9 +5527,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -5611,9 +5726,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -5804,9 +5922,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -6000,9 +6121,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -6192,9 +6316,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -6409,9 +6536,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -6627,9 +6757,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -6825,9 +6958,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -7046,9 +7182,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -7258,9 +7397,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -7479,9 +7621,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -7677,9 +7822,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -7891,9 +8039,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -8099,9 +8250,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -8306,9 +8460,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -8513,9 +8670,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -8721,9 +8881,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -8922,9 +9085,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -9113,9 +9279,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -9321,9 +9490,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -9524,9 +9696,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -9726,9 +9901,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -9927,9 +10105,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -10125,9 +10306,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -10345,9 +10529,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -10553,9 +10740,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -10747,9 +10937,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -10945,9 +11138,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -11149,9 +11345,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -11346,9 +11545,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -11560,9 +11762,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -11770,9 +11975,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -11971,9 +12179,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -12174,9 +12385,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -12376,9 +12590,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -12566,9 +12783,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -12764,9 +12984,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -12972,9 +13195,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -13169,9 +13395,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -13376,9 +13605,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -13574,9 +13806,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -13777,9 +14012,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: never[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -13963,9 +14201,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: never[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -14162,9 +14403,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -14365,9 +14609,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -14572,9 +14819,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: never[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -14762,9 +15012,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -14951,9 +15204,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: never[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -15144,9 +15400,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -15344,9 +15603,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -15541,9 +15803,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -15731,9 +15996,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -15933,9 +16201,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: never[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -16131,9 +16402,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -16327,9 +16601,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -16516,9 +16793,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -16726,9 +17006,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -16927,9 +17210,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -17127,9 +17413,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -17320,9 +17609,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -17344,6 +17636,204 @@ declare const ACTION_REGISTRY: {
             secondary?: undefined;
         };
         version: string;
+    } | {
+        action: string;
+        resource_type: string;
+        required_relations: string[];
+        required_scopes: string[];
+        capability: string;
+        input_schema: {
+            type: string;
+            properties: {
+                calendarId: {
+                    type: string;
+                    description: string;
+                };
+                timeMin: {
+                    type: string;
+                    description: string;
+                };
+                timeMax: {
+                    type: string;
+                    description: string;
+                };
+                channel?: undefined;
+                text?: undefined;
+                thread_ts?: undefined;
+                username?: undefined;
+                icon_emoji?: undefined;
+                blocks?: undefined;
+                userId?: undefined;
+                latest?: undefined;
+                oldest?: undefined;
+                limit?: undefined;
+                inclusive?: undefined;
+                cursor?: undefined;
+                ts?: undefined;
+                owner?: undefined;
+                repo?: undefined;
+                title?: undefined;
+                body?: undefined;
+                labels?: undefined;
+                assignees?: undefined;
+                milestone?: undefined;
+                state?: undefined;
+                sort?: undefined;
+                direction?: undefined;
+                per_page?: undefined;
+                page?: undefined;
+                issueNumber?: undefined;
+                head?: undefined;
+                base?: undefined;
+                draft?: undefined;
+                pullNumber?: undefined;
+                commitTitle?: undefined;
+                commitMessage?: undefined;
+                mergeMethod?: undefined;
+                event?: undefined;
+                commentId?: undefined;
+                expectedHeadSha?: undefined;
+                query?: undefined;
+                order?: undefined;
+                path?: undefined;
+                ref?: undefined;
+                treeSha?: undefined;
+                recursive?: undefined;
+                sha?: undefined;
+                author?: undefined;
+                since?: undefined;
+                until?: undefined;
+                tag?: undefined;
+                name?: undefined;
+                description?: undefined;
+                private?: undefined;
+                org?: undefined;
+                autoInit?: undefined;
+                organization?: undefined;
+                message?: undefined;
+                content?: undefined;
+                branch?: undefined;
+                fromBranch?: undefined;
+                subIssueId?: undefined;
+                color?: undefined;
+                newName?: undefined;
+                workflowId?: undefined;
+                inputs?: undefined;
+                jobId?: undefined;
+                teamSlug?: undefined;
+                all?: undefined;
+                participating?: undefined;
+                before?: undefined;
+                threadId?: undefined;
+                lastReadAt?: undefined;
+                ignored?: undefined;
+                subscribed?: undefined;
+                files?: undefined;
+                public?: undefined;
+                gistId?: undefined;
+                maxResults?: undefined;
+                messageId?: undefined;
+                to?: undefined;
+                subject?: undefined;
+                cc?: undefined;
+                bcc?: undefined;
+                inReplyTo?: undefined;
+                references?: undefined;
+                messageIds?: undefined;
+                eventId?: undefined;
+                summary?: undefined;
+                start?: undefined;
+                end?: undefined;
+                attendees?: undefined;
+                location?: undefined;
+                addMeet?: undefined;
+                meetRequestId?: undefined;
+                recent?: undefined;
+                projectKeyOrId?: undefined;
+                type?: undefined;
+                boardId?: undefined;
+                sprintId?: undefined;
+                jql?: undefined;
+                startAt?: undefined;
+                issueIdOrKey?: undefined;
+                projectKey?: undefined;
+                issueTypeName?: undefined;
+                priority?: undefined;
+                assigneeAccountId?: undefined;
+                transitionId?: undefined;
+                typeName?: undefined;
+                inwardIssueKey?: undefined;
+                outwardIssueKey?: undefined;
+                commentBody?: undefined;
+                linkId?: undefined;
+                file_path?: undefined;
+                command?: undefined;
+                working_directory?: undefined;
+                env_profile?: undefined;
+                timeout_seconds?: undefined;
+                objectType?: undefined;
+                after?: undefined;
+                properties?: undefined;
+                archived?: undefined;
+                filterGroups?: undefined;
+                sorts?: undefined;
+                idProperty?: undefined;
+                propertyName?: undefined;
+                label?: undefined;
+                fieldType?: undefined;
+                groupName?: undefined;
+                options?: undefined;
+                objectId?: undefined;
+                toObjectType?: undefined;
+                fromObjectType?: undefined;
+                engagementId?: undefined;
+                ownerId?: undefined;
+                timestamp?: undefined;
+                associations?: undefined;
+                metadata?: undefined;
+                flowId?: undefined;
+                portalId?: undefined;
+                uiDomain?: undefined;
+                pageRequests?: undefined;
+                taskType?: undefined;
+                payload?: undefined;
+                id?: undefined;
+                action?: undefined;
+                data?: undefined;
+                types?: undefined;
+                status?: undefined;
+                token?: undefined;
+                result?: undefined;
+                topic?: undefined;
+                durationMinutes?: undefined;
+                candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
+            };
+            required: string[];
+            additionalProperties: boolean;
+            oneOf?: undefined;
+        };
+        constraints: {
+            rate_bucket: string;
+        };
+        effects: string[];
+        risk: string;
+        target_bindings: {
+            resource_id: {
+                source: "param";
+                param: string;
+                required: boolean;
+                default: string;
+                fallback_param?: undefined;
+                key?: undefined;
+                multi?: undefined;
+                separator?: undefined;
+                derive?: undefined;
+            };
+            secondary?: undefined;
+        };
+        version: string;
     } | {
         action: string;
         resource_type: string;
@@ -17571,9 +18061,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -17833,9 +18326,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18033,9 +18529,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18221,9 +18720,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18412,9 +18914,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18605,9 +19110,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18799,9 +19307,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -18996,9 +19507,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -19185,9 +19699,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -19398,9 +19915,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -19607,9 +20127,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -19796,9 +20319,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -19998,9 +20524,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -20192,9 +20721,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -20384,9 +20916,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -20581,9 +21116,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -20779,9 +21317,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -20969,9 +21510,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -21165,9 +21709,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -21353,9 +21900,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         effects: string[];
         risk: string;
@@ -21544,9 +22094,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         effects: string[];
         risk: string;
@@ -21743,9 +22296,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         effects: string[];
         risk: string;
@@ -21944,9 +22500,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -22156,9 +22715,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -22369,9 +22931,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -22577,9 +23142,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -22785,9 +23353,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -22976,9 +23547,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -23168,9 +23742,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -23376,9 +23953,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -23583,9 +24163,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -23782,9 +24365,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -23972,9 +24558,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -24168,9 +24757,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -24356,9 +24948,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -24553,9 +25148,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -24749,9 +25347,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -24941,9 +25542,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -25129,9 +25733,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -25322,9 +25929,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -25523,9 +26133,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -25720,9 +26333,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -25915,9 +26531,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             additionalProperties: boolean;
             required?: undefined;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -26105,9 +26724,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -26298,9 +26920,12 @@ declare const ACTION_REGISTRY: {
                 topic?: undefined;
                 durationMinutes?: undefined;
                 candidates?: undefined;
+                candidateWindow?: undefined;
+                hold?: undefined;
             };
             required: string[];
             additionalProperties: boolean;
+            oneOf?: undefined;
         };
         constraints: {
             rate_bucket: string;
@@ -26368,6 +26993,26 @@ declare const ACTION_REGISTRY: {
                         additionalProperties: boolean;
                     };
                 };
+                candidateWindow: {
+                    type: string;
+                    description: string;
+                    properties: {
+                        start: {
+                            type: string;
+                            description: string;
+                        };
+                        end: {
+                            type: string;
+                            description: string;
+                        };
+                    };
+                    required: string[];
+                    additionalProperties: boolean;
+                };
+                hold: {
+                    type: string;
+                    description: string;
+                };
                 message: {
                     type: string;
                     description: string;
@@ -26523,6 +27168,19 @@ declare const ACTION_REGISTRY: {
                 result?: undefined;
             };
             required: string[];
+            oneOf: ({
+                required: string[];
+                properties: {
+                    candidates: {};
+                    candidateWindow?: undefined;
+                };
+            } | {
+                required: string[];
+                properties: {
+                    candidateWindow: {};
+                    candidates?: undefined;
+                };
+            })[];
             additionalProperties: boolean;
         };
         constraints: {
@@ -27748,7 +28406,23 @@ declare function isDecision(value: unknown): value is Decision;
  * lookup (registry keys are all lowercase), so `gmail.message.TRASH` still
  * hits the registry `high` instead of mis-falling-back to the suffix value.
  */
-type ActionRisk = 'low' | 'medium' | 'high';
+/**
+ * Risk tiers an action can declare. Aligned with the registry JSON-schema
+ * enum (`action-registry.ts` → `risk: ['low','medium','high','critical']`)
+ * and the Cedar-facing `RiskLevel` (types/context.ts) — PR #931 review: the
+ * previous 3-value union LIED about the runtime, because a registry entry
+ * declaring `risk: 'critical'` flowed through the `as ActionRisk` cast below
+ * and `resolveActionRisk` returned the string `'critical'` while its type
+ * said it could not. Every STRICTNESS seam (Gate-2 strict arm, the
+ * autoIssueVC permit-arm pin, `stripHighRiskWildcardActions`,
+ * `validateHighRiskResources`, agentd's wildcard-approval refuse) must treat
+ * `'critical'` at least as strictly as `'high'` — never compare
+ * `=== 'high'` alone.
+ *
+ * The suffix heuristic never yields 'critical' (only a registry entry can
+ * declare it); no registry action uses it yet as of 2026-07-05.
+ */
+type ActionRisk = 'low' | 'medium' | 'high' | 'critical';
 /**
  * Resolve the risk level for a dotted action name.
  *
@@ -27771,4 +28445,4 @@ declare function resolveActionRisk(action: string | undefined | null): ActionRis
 
 declare const version = "0.0.1";
 
-export { type ABACPolicyEngine, ACTION_PARAMS_MAX_SIZE, ACTION_PREFIXES, ACTION_REGISTRY, AIdentityClient, type AIdentityConfig, AIdentityError, type APIAgent, type APICredential, APIVCManager, APPROVAL_REQUIRED_ACTION, type AbacDecision, type AbacInput, type AcceptInvitationRequest, type AckEventResponse, type ActionInputSchema, type ActionMapping, type ActionMeta, type ActionParamDisplay, type ActionRegistry, type ActionRisk, type ActionRiskLevel, type Agent, type AgentCreateOptions, type AgentDIDConfig, AgentDIDManager, AgentManager, AgentStatus, AgentType, type AgentWithId, AllowAllAbac, type AnyProvider, type ApiKeyValidationResult, type ApprovalContext, type AuditEvent, type AuditQuery, AuthProvider, type AuthState, AuthenticationError, type AutoApproveConfig, type BindingSource, type BuildKbJwtPayloadArgs, type BuildKbJwtPayloadDeps, CANONICAL_PROVIDERS, type CanonicalProvider, type CapabilityMeta, type CedarDecision, type CedarDecisionDiagnostic, type CedarDecisionValue, type CedarEngine, CedarEngineUnavailableError, type CedarEntitiesInput, type CedarEntity, type CedarEntityDescriptor, type CedarError, type CedarEvaluateRequest, CedarParseError, type CedarPolicySetHandle, type CedarSchema, type CedarSchemaHandle, type CheckGrantPermissionRequest, type CheckGrantPermissionResult, type CheckPermissionInput, type CheckPermissionResult, type CollectContextRequest, type ConfirmGrantSuggestionRequest, type ConnectorAction, type ConnectorConfig, type ConnectorExecutionContext, type ConnectorResponse, type ConnectorResponseMetadata, type ConnectorTokenConfig, type ConstraintEvaluationResult, ConstraintEvaluator, type ConstraintEvaluatorOptions, type ConstraintViolation, type ConstraintWarning, type ContextBindingSource, type ContextProvider, type CreateGrantRequest, type CreateInvitationRequest, type CreateReceiptRequest, type CredentialRef, CredentialStatus, type CredentialStore, CredentialType, DECISION_VALUES, DEFAULT_CONSTRAINTS_BY_RISK, type DIDDocument, type DataAccessVC, type Decision, type DecisionTrace, type DelegationVC, DeviceEnrollManager, type DeviceEnrollPollResult, type DeviceEnrollServerSideParams, type DeviceEnrollStartParams, type DeviceEnrollStartResult, type DisclosureFields, DummyCreds, DummyVpVerifier, type EmployeeVPRequest, type EvaluateInput, type EvaluateResult, type EvaluationContext, type ExternalActionRequest, FREEMAIL_DOMAINS, FilesystemKeyStorage, GATEWAY_ERROR_CODE, GatewayClient, GatewayError, type GatewayErrorCode, type GatewayEvent, type GetEventsOptions, type GetEventsResponse, type GitHubConfig, type GoogleConfig, type Grant, type GrantConstraints, type GrantResource, GrantResourceType, GrantScope, GrantStatus, type GrantUsage, type IConnectorService, type IStateStore, type Intent, type IntentEvaluationResult, type IntentObligation, type IntentResource, type InternalHmacSignerKey, InvalidVPError, type Invitation, type InvitationRole, InvitationStatus, type IssueSDJWTVCRequest, type IssueSDJWTVCResult, type JiraBoard, type JiraConfig, type JiraIssue, type JiraIssueLink, type JiraIssueLinkType, type JiraIssueType, type JiraProject, type JiraSprint, type JiraStatus, type JiraUser, type JiraWorklog, type JsonSchema, JsonStateStore, KB_JWT_DEFAULT_LIFETIME_SECONDS, type KbJwtPayload, KeyManager, type KeyPairGenerationResult, type KeyStorageConfig, type KeyStorageProvider, LEGACY_RESOURCE_TYPE_MAP, MIN_SIGNER_KEY_BYTES, MemoryKeyStorage, NetworkError, type NormalizeIntentRequest, type NormalizedIntent, type OAuthAuthorizeRequest, type OAuthCallbackParams, type OAuthConnection, OAuthProvider, type OAuthToken, type OrganizationConfig, type OrganizationPermission, type OrganizationPolicy, type OrganizationVC, PHASE_1_VC_LAYER, PROVIDER_ALIASES, type ParamBindingSource, type ParsedResourceType, type ParsedSignature, type PermissionConstraints, type PermissionMode, type PermissionResource, type PermissionRule, type PermissionTimeConstraint, type PermissionVcClaims, type PermissionVcClaims_V2, type PermissionVcClaims_V3, type Phase1VcLayer, type PlanDelegationInput, type PlanDelegationResult, type PolicyCondition, type PolicyEvaluationResult, type PolicyInput, type PolicyRef, type PolicyRefInline, type PolicyRefReference, type PolicyRule, type PolicySetHandle, type PolicyTarget, type PolicyValidationError, type Provider, REAUTH_REQUIRED_ACTION, RESOURCE_TYPES, RESOURCE_TYPE_LABELS, type ReBACChecker, type Receipt, type ReceiptListResult, type ReceiptOutcome, type ReceiptSearchQuery, ReceiptStatus, type Relation, type ResolvedTargets, type ResourceIdBinding, type ResourceMatch, type ResourceRef, type ResourceScope, type ResourceType, type RiskAssessmentResult, type RiskFactor, type RiskLevel, SDJwtClient, SIGNATURE_HEADER, SIGNATURE_VERSION_PREFIX, type SchemaHandle, ScopeUnmatchedError, type SecondaryBinding, type SignRequestArgs, SimpleRebac, type SlackConfig, StandardActionCategory, type SuggestGrantRequest, type SuggestedAction, type SuggestedConstraints, type SuggestedGrant, type SuggestedResource, type SuggestionRiskLevel, TIER_LIMITS, type TargetBindings, type TargetConstraint, TargetResolver, type TierLimits, type TimeWindowCheckResult, type TimeWindowConstraint, type ToolDefinition, type ToolInvocation, ToolManager, type ToolPermissionRequest, type ToolPermissionVC, type UnifiedResourceType, type UpdateGrantRequest, type UserIdentity, type UserIdentityConfig, type UserIdentityCreateOptions, UserIdentityManager, UserKeyPairManager, type UserTier, VALID_MCP_ACTIONS, VALID_MCP_TOOLS, VCExpiredError, VCManager, VCRevokedError, VCStatus, type VCTemplate, VCType, VPManager, type VPRequest, type ValidateActionInputResult, type VcApprovalClaim, type VerifiablePresentation, type VerificationMethod, type VerifiedVcClaims, type VerifyInvitationResponse, type VerifyReceiptRequest, type VerifyReceiptResult, type VerifySDJWTVCResult, type VpVerifier, WRITE_ACTION_NAMES, type WeeklyReportData, type WeeklyReportSummary, buildCanonicalString, buildCedarEntities, buildGrantIdFields, buildKbJwtPayload, buildPhase1VcClaims, buildValidationErrors, canonicalResourceId, canonicalizeAction, checkPermissionWithVP, classifyCedarErrorMessage, compareResourceIds, configure, createAjv, createCedarEngine, createDidJwk, credentialStatusToVCStatus, defaultConstraintEvaluator, evaluateConstraints, extractProjectKey, extractPublicKey, extractPublicKeyFromDid, formatSignatureHeader, generateActionParamsDisplay, generateActionSummary, generateKeyPair, generateNonce, getActionAliases, getAllActionForms, getAllValidMcpActionNames, getClient, getDefaultDisclosureFields, getKeyIdFromDid, getRequiredRelations, getRequiredScopes, getTierLimits, getValidMcpActionNames, grantConstraintsToPermissionConstraints, grantToPermissionRules, indexActions, indexCapabilities, isActionEquivalent, isCanonicalProvider, isDecision, isFreemailDomain, isPolicyRefInline, isPolicyRefReference, isUnlimited, isValidDidJwk, isValidProvider, isWriteAction, loadActionRegistryFromFile, loadActionRegistryFromObject, looksLikeNativeId, normalizeDomain, normalizeMcpActionName, parseGrantAction, parseGrantResourceType, parseSignatureHeader, planDelegationForVC, publicKeysMatch, readVcExpSeconds, resolveActionRisk, resolveActionsFromSelection, resolveProvider, resolveResourceType, resolveUserTier, sha256Hex, signJWT, signRequest, validateActionInput, validateRegistryObject, vcStatusToCredentialStatus, verifyJWT, version };
+export { type ABACPolicyEngine, ACTION_PARAMS_MAX_SIZE, ACTION_PREFIXES, ACTION_REGISTRY, AIdentityClient, type AIdentityConfig, AIdentityError, type APIAgent, type APICredential, APIVCManager, APPROVAL_REQUIRED_ACTION, type AbacDecision, type AbacInput, type AcceptInvitationRequest, type AckEventResponse, type ActionInputSchema, type ActionMapping, type ActionMeta, type ActionParamDisplay, type ActionRegistry, type ActionRisk, type ActionRiskLevel, type Agent, type AgentCreateOptions, type AgentDIDConfig, AgentDIDManager, AgentManager, AgentStatus, AgentType, type AgentWithId, AllowAllAbac, type AnyProvider, type ApiKeyValidationResult, type ApprovalContext, type AuditEvent, type AuditQuery, AuthProvider, type AuthState, AuthenticationError, type AutoApproveConfig, type BindingSource, type BuildKbJwtPayloadArgs, type BuildKbJwtPayloadDeps, CANONICAL_PROVIDERS, type CanonicalProvider, type CapabilityMeta, type CedarDecision, type CedarDecisionDiagnostic, type CedarDecisionValue, type CedarEngine, CedarEngineUnavailableError, type CedarEntitiesInput, type CedarEntity, type CedarEntityDescriptor, type CedarError, type CedarEvaluateRequest, CedarParseError, type CedarPolicySetHandle, type CedarSchema, type CedarSchemaHandle, type CheckGrantPermissionRequest, type CheckGrantPermissionResult, type CheckPermissionInput, type CheckPermissionResult, type CollectContextRequest, type ConfirmGrantSuggestionRequest, type ConnectorAction, type ConnectorConfig, type ConnectorExecutionContext, type ConnectorResponse, type ConnectorResponseMetadata, type ConnectorTokenConfig, type ConstraintEvaluationResult, ConstraintEvaluator, type ConstraintEvaluatorOptions, type ConstraintViolation, type ConstraintWarning, type ContextBindingSource, type ContextProvider, type CreateGrantRequest, type CreateInvitationRequest, type CreateReceiptRequest, type CredentialRef, CredentialStatus, type CredentialStore, CredentialType, DECISION_VALUES, DEFAULT_CONSTRAINTS_BY_RISK, type DIDDocument, type DataAccessVC, type Decision, type DecisionTrace, type DelegationVC, DeviceEnrollManager, type DeviceEnrollPollResult, type DeviceEnrollServerSideParams, type DeviceEnrollStartParams, type DeviceEnrollStartResult, type DisclosureFields, DummyCreds, DummyVpVerifier, type EmployeeVPRequest, type EvaluateInput, type EvaluateResult, type EvaluationContext, type ExternalActionRequest, FREEMAIL_DOMAINS, FilesystemKeyStorage, GATEWAY_ERROR_CODE, GatewayClient, GatewayError, type GatewayErrorCode, type GatewayEvent, type GetEventsOptions, type GetEventsResponse, type GitHubConfig, type GoogleConfig, type Grant, type GrantConstraints, type GrantResource, GrantResourceType, GrantScope, GrantStatus, type GrantUsage, type IConnectorService, type IStateStore, type Intent, type IntentEvaluationResult, type IntentObligation, type IntentResource, type InternalHmacSignerKey, InvalidVPError, type Invitation, type InvitationRole, InvitationStatus, type IssueSDJWTVCRequest, type IssueSDJWTVCResult, type JiraBoard, type JiraConfig, type JiraIssue, type JiraIssueLink, type JiraIssueLinkType, type JiraIssueType, type JiraProject, type JiraSprint, type JiraStatus, type JiraUser, type JiraWorklog, type JsonSchema, JsonStateStore, KB_JWT_DEFAULT_LIFETIME_SECONDS, type KbJwtPayload, KeyManager, type KeyPairGenerationResult, type KeyStorageConfig, type KeyStorageProvider, LEGACY_RESOURCE_TYPE_MAP, MIN_SIGNER_KEY_BYTES, MemoryKeyStorage, NetworkError, type NormalizeIntentRequest, type NormalizedIntent, type OAuthAuthorizeRequest, type OAuthCallbackParams, type OAuthConnection, OAuthProvider, type OAuthToken, type OrganizationConfig, type OrganizationPermission, type OrganizationPolicy, type OrganizationVC, PHASE_1_VC_LAYER, PROVIDER_ALIASES, type ParamBindingSource, type ParsedResourceType, type ParsedSignature, type PermissionConstraints, type PermissionMode, type PermissionResource, type PermissionRule, type PermissionTimeConstraint, type PermissionVcClaims, type PermissionVcClaims_V2, type PermissionVcClaims_V3, type Phase1VcLayer, type PlanDelegationInput, type PlanDelegationResult, type PolicyCondition, type PolicyEvaluationResult, type PolicyInput, type PolicyRef, type PolicyRefInline, type PolicyRefReference, type PolicyRule, type PolicySetHandle, type PolicyTarget, type PolicyValidationError, type Provider, REAUTH_REQUIRED_ACTION, RESOURCE_TYPES, RESOURCE_TYPE_LABELS, type ReBACChecker, type Receipt, type ReceiptListResult, type ReceiptOutcome, type ReceiptSearchQuery, ReceiptStatus, type Relation, type ResolvedTargets, type ResourceIdBinding, type ResourceMatch, type ResourceRef, type ResourceScope, type ResourceType, type RiskAssessmentResult, type RiskFactor, type RiskLevel, SDJwtClient, SIGNATURE_HEADER, SIGNATURE_VERSION_PREFIX, type SchemaHandle, ScopeUnmatchedError, type SecondaryBinding, type SignRequestArgs, SimpleRebac, type SlackConfig, StandardActionCategory, type SuggestGrantRequest, type SuggestedAction, type SuggestedConstraints, type SuggestedGrant, type SuggestedResource, type SuggestionRiskLevel, TIER_LIMITS, type TargetBindings, type TargetConstraint, TargetResolver, type TierLimits, type TimeWindowCheckResult, type TimeWindowConstraint, type ToolDefinition, type ToolInvocation, ToolManager, type ToolPermissionRequest, type ToolPermissionVC, type UnifiedResourceType, type UpdateGrantRequest, type UserIdentity, type UserIdentityConfig, type UserIdentityCreateOptions, UserIdentityManager, UserKeyPairManager, type UserTier, VALID_MCP_ACTIONS, VALID_MCP_TOOLS, VCExpiredError, VCManager, VCRevokedError, VCStatus, type VCTemplate, VCType, VPManager, type VPRequest, type ValidateActionInputResult, type VcApprovalClaim, type VcSchedulingDelegationClaim, type VerifiablePresentation, type VerificationMethod, type VerifiedVcClaims, type VerifyInvitationResponse, type VerifyReceiptRequest, type VerifyReceiptResult, type VerifySDJWTVCResult, type VpVerifier, WRITE_ACTION_NAMES, type WeeklyReportData, type WeeklyReportSummary, buildCanonicalString, buildCedarEntities, buildGrantIdFields, buildKbJwtPayload, buildPhase1VcClaims, buildValidationErrors, canonicalResourceId, canonicalizeAction, checkPermissionWithVP, classifyCedarErrorMessage, compareResourceIds, configure, createAjv, createCedarEngine, createDidJwk, credentialStatusToVCStatus, defaultConstraintEvaluator, evaluateConstraints, extractProjectKey, extractPublicKey, extractPublicKeyFromDid, formatSignatureHeader, generateActionParamsDisplay, generateActionSummary, generateKeyPair, generateNonce, getActionAliases, getAllActionForms, getAllValidMcpActionNames, getClient, getDefaultDisclosureFields, getKeyIdFromDid, getRequiredRelations, getRequiredScopes, getTierLimits, getValidMcpActionNames, grantConstraintsToPermissionConstraints, grantToPermissionRules, indexActions, indexCapabilities, isActionEquivalent, isCanonicalProvider, isDecision, isFreemailDomain, isPolicyRefInline, isPolicyRefReference, isUnlimited, isValidDidJwk, isValidProvider, isWriteAction, loadActionRegistryFromFile, loadActionRegistryFromObject, looksLikeNativeId, normalizeDomain, normalizeMcpActionName, parseGrantAction, parseGrantResourceType, parseSignatureHeader, planDelegationForVC, publicKeysMatch, readVcExpSeconds, resolveActionRisk, resolveActionsFromSelection, resolveProvider, resolveResourceType, resolveUserTier, sha256Hex, signJWT, signRequest, validateActionInput, validateRegistryObject, vcStatusToCredentialStatus, verifyJWT, version };