@vess-id/ai-identity 0.18.0 → 0.20.0

package/dist/index.js

@@ -76,6 +76,7 @@ __export(index_exports, {
   PHASE_1_VC_LAYER: () => PHASE_1_VC_LAYER,
   PROVIDER_ALIASES: () => PROVIDER_ALIASES,
   REAUTH_REQUIRED_ACTION: () => REAUTH_REQUIRED_ACTION,
+  RESOLVED_PARAMS_KEY: () => RESOLVED_PARAMS_KEY,
   RESOURCE_TYPES: () => RESOURCE_TYPES,
   RESOURCE_TYPE_LABELS: () => RESOURCE_TYPE_LABELS,
   ReceiptStatus: () => ReceiptStatus,
@@ -88,6 +89,7 @@ __export(index_exports, {
   TIER_LIMITS: () => TIER_LIMITS,
   TargetResolver: () => TargetResolver,
   ToolManager: () => ToolManager,
+  UNCLASSIFIED_ACTION_RISK: () => UNCLASSIFIED_ACTION_RISK,
   UserIdentityManager: () => UserIdentityManager,
   UserKeyPairManager: () => UserKeyPairManager,
   VALID_MCP_ACTIONS: () => VALID_MCP_ACTIONS,
@@ -107,6 +109,8 @@ __export(index_exports, {
   buildValidationErrors: () => buildValidationErrors,
   canonicalResourceId: () => canonicalResourceId,
   canonicalizeAction: () => canonicalizeAction,
+  canonicalizeSalient: () => canonicalizeSalient,
+  canonicalizeWithFields: () => canonicalizeWithFields,
   checkPermissionWithVP: () => checkPermissionWithVP,
   classifyCedarErrorMessage: () => classifyCedarErrorMessage,
   compareResourceIds: () => compareResourceIds,
@@ -116,6 +120,7 @@ __export(index_exports, {
   createDidJwk: () => createDidJwk,
   credentialStatusToVCStatus: () => credentialStatusToVCStatus,
   defaultConstraintEvaluator: () => defaultConstraintEvaluator,
+  digestWithFields: () => digestWithFields,
   evaluateConstraints: () => evaluateConstraints,
   extractProjectKey: () => extractProjectKey,
   extractPublicKey: () => extractPublicKey,
@@ -165,9 +170,13 @@ __export(index_exports, {
   resolveProvider: () => resolveProvider,
   resolveResourceType: () => resolveResourceType,
   resolveUserTier: () => resolveUserTier,
+  resolverBackedFieldsFor: () => resolverBackedFieldsFor,
+  salientDigest: () => salientDigest,
+  salientFieldsFor: () => salientFieldsFor,
   sha256Hex: () => sha256Hex,
   signJWT: () => signJWT,
   signRequest: () => signRequest,
+  stripResolvedParams: () => stripResolvedParams,
   validateActionInput: () => validateActionInput,
   validateRegistryObject: () => validateRegistryObject,
   vcStatusToCredentialStatus: () => vcStatusToCredentialStatus,
@@ -2754,6 +2763,8 @@ var CredentialType = /* @__PURE__ */ ((CredentialType2) => {
   CredentialType2["TEMPORARY"] = "TemporaryCredential";
   CredentialType2["ADMIN"] = "AdminCredential";
   CredentialType2["RECEIPT"] = "ReceiptCredential";
+  CredentialType2["ACCOUNT"] = "AccountCredential";
+  CredentialType2["AGENT_CARD"] = "AgentCardCredential";
   return CredentialType2;
 })(CredentialType || {});
 var CredentialStatus = /* @__PURE__ */ ((CredentialStatus2) => {
@@ -3200,6 +3211,38 @@ var DEFAULT_DISCLOSURE_CONFIGS = {
     mandatoryFields: [],
     neverDisclose: DEFAULT_NEVER_DISCLOSE
   },
+  // OEM ⑯ — account attributes an organisation asserts about the holder.
+  //
+  // Everything identifying is selective. An account credential is presented to
+  // decide whether an action is permitted, and that rarely requires knowing
+  // the account number or whose name is on it. Left always-disclosed, every
+  // verifier the holder ever presents to would learn both — and the fallback
+  // for an unregistered type is TEMPORARY, whose selectiveFields is empty,
+  // which is exactly that outcome. Hence this entry.
+  ["AccountCredential" /* ACCOUNT */]: {
+    selectiveFields: ["accountNumber", "accountHolderName", "branchCode"],
+    mandatoryFields: [],
+    neverDisclose: DEFAULT_NEVER_DISCLOSE
+  },
+  // OEM ⑯ Model C — the instance card.
+  //
+  // service_card_url and service_card_hash are absent from selectiveFields,
+  // which is what makes them always-disclosed: the hash proves the fetched
+  // card is the one the issuer signed over, and a holder able to withhold it
+  // could present a card body nobody attested to (AP2 binds checkout_hash for
+  // the same reason).
+  //
+  // 🔴 They are listed in mandatoryFields as documentation, NOT as
+  // enforcement. APIVCManager.issueSDJWTVC passes only `selectiveFields` to
+  // the SD-JWT builder — `mandatoryFields` and `neverDisclose` are not
+  // consumed on that path. Moving these three into selectiveFields would
+  // silently make the hash withholdable and nothing would fail, so the
+  // omission below is the actual guarantee.
+  ["AgentCardCredential" /* AGENT_CARD */]: {
+    selectiveFields: ["version"],
+    mandatoryFields: ["service_card_url", "service_card_hash", "service_id"],
+    neverDisclose: DEFAULT_NEVER_DISCLOSE
+  },
   ["ReceiptCredential" /* RECEIPT */]: {
     selectiveFields: ["action", "resource", "outcome", "amount", "description", "date", "transactionId"],
     mandatoryFields: ["grantId", "auditEventId", "receiptType"],
@@ -4116,6 +4159,13 @@ var actionMetaSchema = {
     },
     risk: { type: "string", enum: ["low", "medium", "high", "critical"] },
     target_bindings: { type: "object" },
+    // Approval-salient parameter names (P1 / #1205). Optional at the schema
+    // level (legacy/low-risk actions may omit it); the completeness test makes
+    // it mandatory for every high/critical action.
+    approval_salient_fields: {
+      type: "array",
+      items: { type: "string", minLength: 1 }
+    },
     version: { type: "string", minLength: 1 }
   }
 };
@@ -4550,6 +4600,16 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "channel" }
       },
+      // #1205 P1: `channel` IS approval-critical (the human approved posting to
+      // THAT channel) so it is declared salient. ⚠️ HOLE 2 (plan §0.5, resolved
+      // in Step 4.6): the server normalizes `channel` (#name → native Cxxx id)
+      // at execution via a LIVE Slack lookup, so the issued-time digest
+      // (hash of "#general") and the PEP-time digest (hash of "C09…") diverge and
+      // a legitimate approved post fail-closes. Step 4.6 must resolve the
+      // name→id AT APPROVAL TIME and freeze it into actionParams so all
+      // participants hash the same effective value. Do NOT drop `channel` from
+      // this set to paper over HOLE 2 — that would unbind the approved target.
+      approval_salient_fields: ["channel", "text", "blocks"],
       version: "1.0.0"
     },
     {
@@ -4691,6 +4751,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "channel" }
       },
+      approval_salient_fields: ["channel", "ts", "text"],
       version: "1.0.0"
     },
     {
@@ -4714,6 +4775,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "channel" }
       },
+      approval_salient_fields: ["channel", "ts"],
       version: "1.0.0"
     },
     // ─── GitHub Actions ───
@@ -4746,6 +4808,11 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "repo", fallback_param: "repository" }
       },
+      // #1205 P1: assignees (who the issue is assigned to) is approval-critical —
+      // an agent could otherwise reassign it post-approval. labels are part of
+      // the approved issue definition. (milestone is an integer id; not
+      // substance-of-approval so left out — see completeness-test allowlist.)
+      approval_salient_fields: ["owner", "repo", "title", "body", "assignees", "labels"],
       version: "1.0.0"
     },
     {
@@ -4836,6 +4903,10 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "repo", fallback_param: "repository" }
       },
+      // #1205 P1: assignees (who the issue is assigned to) is approval-critical —
+      // an agent could otherwise reassign it post-approval. labels are part of
+      // the approved change.
+      approval_salient_fields: ["owner", "repo", "issueNumber", "title", "body", "state", "assignees", "labels"],
       version: "1.0.0"
     },
     // ─── GitHub Pull Request Actions ───
@@ -4865,6 +4936,9 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      // #1205 P1: draft changes the real-world effect (a non-draft PR notifies
+      // reviewers / can be merged immediately), so it is approval-critical.
+      approval_salient_fields: ["owner", "repo", "title", "head", "base", "body", "draft"],
       version: "1.0.0"
     },
     {
@@ -4947,6 +5021,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "pullNumber", "title", "body", "state", "base"],
       version: "1.0.0"
     },
     {
@@ -4974,6 +5049,9 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      // #1205 P1: commitTitle/commitMessage are persisted into the merge commit
+      // (permanent git history), so they are approval-critical.
+      approval_salient_fields: ["owner", "repo", "pullNumber", "mergeMethod", "commitTitle", "commitMessage"],
       version: "1.0.0"
     },
     {
@@ -5050,6 +5128,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "pullNumber", "event", "body"],
       version: "1.0.0"
     },
     {
@@ -5076,6 +5155,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "pullNumber", "commentId", "body"],
       version: "1.0.0"
     },
     {
@@ -5101,6 +5181,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "pullNumber"],
       version: "1.0.0"
     },
     {
@@ -5479,6 +5560,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["name", "org", "private"],
       version: "1.0.0"
     },
     {
@@ -5503,6 +5585,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "organization"],
       version: "1.0.0"
     },
     {
@@ -5531,6 +5614,14 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      // #1205 P1: sha is a version pin (the blob revision being overwritten). The
+      // executor forwards params.sha verbatim — never recomputed/refetched between
+      // approval and execution (github.service.ts:1194) — so binding it causes NO
+      // false-fail-closed; an unbound sha would let an agent overwrite a different
+      // file revision than the human reviewed. On create sha is omitted → the
+      // serializer represents the missing key as JSON null (salient-digest rule 2),
+      // stable on both issued and PEP sides.
+      approval_salient_fields: ["owner", "repo", "path", "content", "message", "branch", "sha"],
       version: "1.0.0"
     },
     {
@@ -5558,6 +5649,11 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      // #1205 P1: sha (required here) pins the exact blob being deleted; forwarded
+      // verbatim to the API, so binding it prevents an agent from swapping the
+      // target revision post-approval. Same no-false-fail-closed reasoning as
+      // github.content.createOrUpdate.
+      approval_salient_fields: ["owner", "repo", "path", "message", "branch", "sha"],
       version: "1.0.0"
     },
     {
@@ -5583,6 +5679,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "branch", "fromBranch"],
       version: "1.0.0"
     },
     // ─── GitHub Issues 拡張 & Labels Actions ───
@@ -5609,6 +5706,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "issueNumber", "body"],
       version: "1.0.0"
     },
     {
@@ -5634,6 +5732,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "issueNumber", "subIssueId"],
       version: "1.0.0"
     },
     {
@@ -5758,6 +5857,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "name", "newName"],
       version: "1.0.0"
     },
     // ─── GitHub Actions(CI) / Stargazers / Context / Users Actions ───
@@ -5844,6 +5944,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "workflowId", "ref"],
       version: "1.0.0"
     },
     {
@@ -5916,6 +6017,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo"],
       version: "1.0.0"
     },
     {
@@ -5939,6 +6041,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo"],
       version: "1.0.0"
     },
     {
@@ -6106,6 +6209,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["threadId"],
       version: "1.0.0"
     },
     {
@@ -6128,6 +6232,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["lastReadAt"],
       version: "1.0.0"
     },
     {
@@ -6151,6 +6256,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["threadId", "ignored"],
       version: "1.0.0"
     },
     {
@@ -6176,6 +6282,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["owner", "repo", "subscribed", "ignored"],
       version: "1.0.0"
     },
     {
@@ -6204,6 +6311,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["files", "description", "public"],
       version: "1.0.0"
     },
     {
@@ -6279,6 +6387,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "context", key: "resource_id" }
       },
+      approval_salient_fields: ["gistId", "files", "description"],
       version: "1.0.0"
     },
     // ─── Gmail Actions ───
@@ -6358,6 +6467,7 @@ var ACTION_REGISTRY = {
           { name: "bcc", source: { source: "param", param: "bcc" }, type: "recipient" }
         ]
       },
+      approval_salient_fields: ["to", "cc", "bcc", "subject", "body"],
       version: "1.0.0"
     },
     {
@@ -6391,6 +6501,7 @@ var ACTION_REGISTRY = {
           { name: "bcc", source: { source: "param", param: "bcc" }, type: "recipient" }
         ]
       },
+      approval_salient_fields: ["to", "cc", "bcc", "subject", "body"],
       version: "1.0.0"
     },
     {
@@ -6459,6 +6570,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "messageId" }
       },
+      approval_salient_fields: ["messageId"],
       version: "1.0.0"
     },
     {
@@ -6481,6 +6593,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "messageId" }
       },
+      approval_salient_fields: ["messageId"],
       version: "1.0.0"
     },
     // ─── Calendar Actions ───
@@ -6605,6 +6718,9 @@ var ACTION_REGISTRY = {
           { name: "attendees", source: { source: "param", param: "attendees" }, type: "participant" }
         ]
       },
+      // #1205 P1: addMeet changes the real-world effect (attaches a Google Meet
+      // link / video conference), so it is approval-critical.
+      approval_salient_fields: ["calendarId", "summary", "description", "start", "end", "attendees", "location", "addMeet"],
       version: "1.0.0"
     },
     {
@@ -6655,6 +6771,9 @@ var ACTION_REGISTRY = {
           { name: "attendees", source: { source: "param", param: "attendees" }, type: "participant" }
         ]
       },
+      // #1205 P1: addMeet changes the real-world effect (attaches a Google Meet
+      // link), so it is approval-critical.
+      approval_salient_fields: ["calendarId", "eventId", "summary", "description", "start", "end", "attendees", "location", "addMeet"],
       version: "1.0.0"
     },
     {
@@ -6678,6 +6797,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "calendarId", default: "primary" }
       },
+      approval_salient_fields: ["calendarId", "eventId"],
       version: "1.0.0"
     },
     // ─── Jira Actions ───
@@ -6870,6 +6990,10 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "projectKey" }
       },
+      // #1205 P1: assigneeAccountId (who the issue is assigned to) is
+      // approval-critical — an agent could otherwise reassign it post-approval.
+      // labels are part of the approved issue definition.
+      approval_salient_fields: ["projectKey", "summary", "description", "issueTypeName", "assigneeAccountId", "labels"],
       version: "1.0.0"
     },
     {
@@ -6881,6 +7005,15 @@ var ACTION_REGISTRY = {
       input_schema: {
         type: "object",
         properties: {
+          // #1205 P1 / HOLE 2 audit (Step 4.7): issueIdOrKey accepts EITHER a
+          // project key form ("PROJ-123") OR a numeric internal id. VERIFIED:
+          // it is passed VERBATIM into the Jira REST URL path
+          // `/api/3/issue/{issueIdOrKey}` (jira.service.ts) — the API accepts
+          // both forms and nothing canonicalizes one to the other, and no pre-PEP
+          // mutation touches jira params (only normalizeSlackChannelParam mutates,
+          // slack-only). So issuance digest == PEP digest for whichever form the
+          // approver approved — NO resolve-at-approval-time needed (unlike slack
+          // channel). Regression guard: salient-digest.test.ts Step 4.7 block.
           issueIdOrKey: { type: "string", minLength: 1 },
           summary: { type: "string" },
           description: {
@@ -6903,6 +7036,9 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
       },
+      // #1205 P1: assigneeAccountId (reassignment) is approval-critical; labels
+      // are part of the approved change. Same rationale as jira.issue.create.
+      approval_salient_fields: ["issueIdOrKey", "summary", "description", "assigneeAccountId", "labels"],
       version: "1.0.0"
     },
     {
@@ -6925,6 +7061,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
       },
+      approval_salient_fields: ["issueIdOrKey"],
       version: "1.0.0"
     },
     {
@@ -6955,6 +7092,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
       },
+      approval_salient_fields: ["issueIdOrKey", "body"],
       version: "1.0.0"
     },
     {
@@ -6983,6 +7121,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
       },
+      approval_salient_fields: ["issueIdOrKey", "commentId"],
       version: "1.0.0"
     },
     {
@@ -7028,6 +7167,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueIdOrKey", fallback_param: "issueKey", derive: "project_key" }
       },
+      approval_salient_fields: ["issueIdOrKey", "transitionId"],
       version: "1.0.0"
     },
     {
@@ -7102,6 +7242,7 @@ var ACTION_REGISTRY = {
         // 完全な制御をしたい場合は別途 inwardIssueKey 側も grant チェックする運用を要する。
         resource_id: { source: "param", param: "outwardIssueKey", derive: "project_key" }
       },
+      approval_salient_fields: ["typeName", "inwardIssueKey", "outwardIssueKey", "commentBody"],
       version: "1.0.0"
     },
     {
@@ -7124,6 +7265,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "linkId" }
       },
+      approval_salient_fields: ["linkId"],
       version: "1.0.0"
     },
     {
@@ -7205,6 +7347,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "file_path" }
       },
+      approval_salient_fields: ["file_path"],
       version: "1.0.0"
     },
     {
@@ -7226,6 +7369,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "file_path" }
       },
+      approval_salient_fields: ["file_path", "content"],
       version: "1.0.0"
     },
     {
@@ -7262,6 +7406,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "command" }
       },
+      approval_salient_fields: ["command", "working_directory", "env_profile"],
       version: "1.0.0"
     },
     // ─── HubSpot CRM Objects (objectType 汎用) ───
@@ -7382,6 +7527,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "objectType" }
       },
+      approval_salient_fields: ["objectType", "inputs"],
       version: "1.0.0"
     },
     {
@@ -7414,6 +7560,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "objectType" }
       },
+      approval_salient_fields: ["objectType", "inputs"],
       version: "1.0.0"
     },
     {
@@ -7503,6 +7650,7 @@ var ACTION_REGISTRY = {
       effects: ["Create:CrmProperty"],
       risk: "high",
       target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      approval_salient_fields: ["objectType", "name", "label", "type", "fieldType"],
       version: "1.0.0"
     },
     {
@@ -7530,6 +7678,7 @@ var ACTION_REGISTRY = {
       effects: ["Update:CrmProperty"],
       risk: "high",
       target_bindings: { resource_id: { source: "param", param: "objectType" } },
+      approval_salient_fields: ["objectType", "propertyName", "label"],
       version: "1.0.0"
     },
     // ─── HubSpot Associations (v4) ───
@@ -7598,6 +7747,7 @@ var ACTION_REGISTRY = {
       effects: ["Create:CrmAssociation"],
       risk: "high",
       target_bindings: { resource_id: { source: "param", param: "fromObjectType" } },
+      approval_salient_fields: ["fromObjectType", "toObjectType", "inputs"],
       version: "1.0.0"
     },
     // ─── HubSpot Engagements (legacy v1: NOTE / TASK) ───
@@ -7629,8 +7779,20 @@ var ACTION_REGISTRY = {
         type: "object",
         properties: {
           type: { type: "string", enum: ["NOTE", "TASK"] },
-          ownerId: { type: "number" },
-          timestamp: { type: "number" },
+          // #1205 P1: HubSpot owner ids are integers; retyped from `number` to
+          // `integer` so this ownership field is bindable (float-ban rule 5).
+          // DRIFT (follow-up, out of Step 2 scope): the API adapter still types
+          // ownerId/timestamp as `number` (hubspot.adapter.ts:294-295,317-318).
+          // No test enforces registry↔adapter type identity, so nothing breaks;
+          // a later step should align the adapter schemas to `integer`.
+          ownerId: { type: "integer" },
+          // #1205 P1: caller-supplied epoch-ms activity time when present, else
+          // the service defaults to Date.now() (hubspot.service.ts:555
+          // `params.timestamp ?? Date.now()`). Retyped to `integer` (epoch ms)
+          // so it is bindable; when the caller omits it both the issued and PEP
+          // digests see the same JSON null (the default is applied server-side
+          // AFTER the salient params are read), so binding it is safe.
+          timestamp: { type: "integer" },
           associations: { type: "object" },
           metadata: { type: "object" }
         },
@@ -7643,6 +7805,10 @@ var ACTION_REGISTRY = {
       // Bind to the engagement type (NOTE/TASK) as the container that exists at
       // call time, consistent with other create actions (see CREATE-binding note above).
       target_bindings: { resource_id: { source: "param", param: "type" } },
+      // #1205 P1: ownerId (who owns the engagement) is approval-critical — an
+      // agent could otherwise reassign ownership post-approval. timestamp binds
+      // the activity time. associations/metadata carry the note/task substance.
+      approval_salient_fields: ["type", "ownerId", "timestamp", "associations", "metadata"],
       version: "1.0.0"
     },
     {
@@ -7655,8 +7821,13 @@ var ACTION_REGISTRY = {
         type: "object",
         properties: {
           engagementId: { type: "string" },
-          ownerId: { type: "number" },
-          timestamp: { type: "number" },
+          // #1205 P1: retyped `number` → `integer` (HubSpot owner id) so this
+          // ownership field is bindable (float-ban rule 5).
+          ownerId: { type: "integer" },
+          // #1205 P1: caller-supplied epoch-ms activity time (update sets it
+          // directly, no default here — hubspot.service.ts:577 only assigns when
+          // provided). Retyped to `integer` so it is bindable.
+          timestamp: { type: "integer" },
           associations: { type: "object" },
           metadata: { type: "object" }
         },
@@ -7667,6 +7838,9 @@ var ACTION_REGISTRY = {
       effects: ["Update:CrmEngagement"],
       risk: "high",
       target_bindings: { resource_id: { source: "param", param: "engagementId" } },
+      // #1205 P1: ownerId (reassignment) + timestamp are approval-critical on
+      // update, same as create.
+      approval_salient_fields: ["engagementId", "ownerId", "timestamp", "metadata"],
       version: "1.0.0"
     },
     // ─── HubSpot Workflows (automation v4 flows, read-only) ───
@@ -7837,7 +8011,11 @@ var ACTION_REGISTRY = {
           description: { type: "string", description: "Issue description (Markdown)" },
           assigneeId: { type: "string", description: "Assignee user ID" },
           stateId: { type: "string", description: "Workflow state ID" },
-          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          // #1205 P1: priority is always an integer 0-4; retyped `number` →
+          // `integer` so it is bindable (float-ban rule 5). DRIFT (follow-up): the
+          // API adapter still types priority as `number` (linear.adapter.ts:93,112);
+          // align in a later step (no test enforces the mirror, nothing breaks).
+          priority: { type: "integer", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
           labelIds: { type: "array", items: { type: "string" }, description: "Label IDs to attach" }
         },
         required: ["teamId", "title"],
@@ -7849,6 +8027,10 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "teamId" }
       },
+      // #1205 P1: assigneeId (who the issue is assigned to) is approval-critical
+      // — an agent could otherwise reassign the issue post-approval. priority and
+      // labelIds are part of the approved issue definition.
+      approval_salient_fields: ["teamId", "title", "description", "assigneeId", "priority", "labelIds"],
       version: "1.0.0"
     },
     {
@@ -7860,12 +8042,23 @@ var ACTION_REGISTRY = {
       input_schema: {
         type: "object",
         properties: {
+          // #1205 P1 / HOLE 2 audit (Step 4.7): issueId accepts EITHER a uuid OR
+          // a human identifier like "ENG-123". VERIFIED: it is passed VERBATIM
+          // into the Linear GraphQL `issue(id: $issueId)` / `issueUpdate(id:)`
+          // arg (linear.service.ts) — the API accepts both forms and nothing
+          // canonicalizes identifier→uuid, and no pre-PEP mutation touches linear
+          // params (only normalizeSlackChannelParam mutates, slack-only). So
+          // issuance digest == PEP digest for whichever form the approver
+          // approved — NO resolve-at-approval-time needed (unlike slack channel).
+          // Regression guard: salient-digest.test.ts Step 4.7 block. Do NOT drop
+          // issueId (it IS the target).
           issueId: { type: "string", minLength: 1, description: "Issue ID or identifier (e.g. ENG-123)" },
           title: { type: "string", description: "New title" },
           description: { type: "string", description: "New description (Markdown)" },
           assigneeId: { type: "string", description: "Assignee user ID (null to unassign)" },
           stateId: { type: "string", description: "Workflow state ID" },
-          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          // #1205 P1: retyped `number` → `integer` (priority is always int 0-4).
+          priority: { type: "integer", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
           labelIds: { type: "array", items: { type: "string" }, description: "New set of label IDs" }
         },
         required: ["issueId"],
@@ -7877,6 +8070,9 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      // #1205 P1: assigneeId (reassignment) is approval-critical; priority and
+      // labelIds are part of the approved change.
+      approval_salient_fields: ["issueId", "title", "description", "assigneeId", "stateId", "priority", "labelIds"],
       version: "1.0.0"
     },
     {
@@ -7900,6 +8096,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId", "body"],
       version: "1.0.0"
     },
     {
@@ -8101,6 +8298,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId"],
       version: "1.0.0"
     },
     {
@@ -8136,6 +8334,7 @@ var ACTION_REGISTRY = {
         // resource binding 必須契約を明示 (teamIds は minItems:1 なので常に解決する)。
         resource_id: { source: "param", param: "teamId", fallback_param: "teamIds", required: true }
       },
+      approval_salient_fields: ["teamId", "teamIds", "name", "description"],
       version: "1.0.0"
     },
     {
@@ -8163,6 +8362,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "projectId" }
       },
+      approval_salient_fields: ["projectId", "name", "description"],
       version: "1.0.0"
     },
     // ─── Linear Comment ops ───
@@ -8187,6 +8387,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "commentId" }
       },
+      approval_salient_fields: ["commentId", "body"],
       version: "1.0.0"
     },
     {
@@ -8209,6 +8410,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "commentId" }
       },
+      approval_salient_fields: ["commentId"],
       version: "1.0.0"
     },
     {
@@ -8231,6 +8433,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "commentId" }
       },
+      approval_salient_fields: ["commentId"],
       version: "1.0.0"
     },
     {
@@ -8253,6 +8456,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "commentId" }
       },
+      approval_salient_fields: ["commentId"],
       version: "1.0.0"
     },
     // ─── Linear Issue ops ───
@@ -8276,6 +8480,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId"],
       version: "1.0.0"
     },
     {
@@ -8299,6 +8504,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId", "labelId"],
       version: "1.0.0"
     },
     {
@@ -8322,6 +8528,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId", "labelId"],
       version: "1.0.0"
     },
     {
@@ -8344,6 +8551,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId"],
       version: "1.0.0"
     },
     {
@@ -8366,6 +8574,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId"],
       version: "1.0.0"
     },
     // ─── Linear Issue Relations ───
@@ -8391,6 +8600,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId", "relatedIssueId", "type"],
       version: "1.0.0"
     },
     {
@@ -8435,6 +8645,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "relationId" }
       },
+      approval_salient_fields: ["relationId"],
       version: "1.0.0"
     },
     // ─── Linear Cycles ───
@@ -8506,6 +8717,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "teamId" }
       },
+      approval_salient_fields: ["teamId", "name", "startsAt", "endsAt"],
       version: "1.0.0"
     },
     {
@@ -8533,6 +8745,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "cycleId" }
       },
+      approval_salient_fields: ["cycleId", "name", "startsAt", "endsAt"],
       version: "1.0.0"
     },
     // ─── Linear Labels ───
@@ -8559,6 +8772,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "teamId", required: false }
       },
+      approval_salient_fields: ["teamId", "name"],
       version: "1.0.0"
     },
     {
@@ -8584,6 +8798,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "labelId" }
       },
+      approval_salient_fields: ["labelId", "name"],
       version: "1.0.0"
     },
     // ─── Linear Attachments ───
@@ -8610,6 +8825,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "issueId" }
       },
+      approval_salient_fields: ["issueId", "title", "url"],
       version: "1.0.0"
     },
     {
@@ -8654,6 +8870,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "attachmentId" }
       },
+      approval_salient_fields: ["attachmentId"],
       version: "1.0.0"
     },
     // ─── Agent Inbox Actions (internal) ───
@@ -8684,6 +8901,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "to" }
       },
+      approval_salient_fields: ["to", "taskType", "payload", "message"],
       version: "1.0.0"
     },
     {
@@ -8714,6 +8932,7 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "id" }
       },
+      approval_salient_fields: ["id", "action", "data"],
       version: "1.0.0"
     },
     {
@@ -8886,6 +9105,110 @@ var ACTION_REGISTRY = {
       target_bindings: {
         resource_id: { source: "param", param: "to" }
       },
+      // #1205 P1: hold changes the real-world effect — when true it tentatively
+      // books [仮] events on the sender's calendar for every offered slot, so it
+      // is approval-critical.
+      approval_salient_fields: ["to", "topic", "durationMinutes", "candidates", "candidateWindow", "hold"],
+      version: "1.0.0"
+    },
+    // ─── PR-R2 (design §3.2): the raw booking executor's ONE new action ───
+    // The booking agent submits its scheduling proposal through a REAL PEP
+    // crossing instead of a managed custom_tool. Registered here in R2; the
+    // adapter dispatch case lands in R3.
+    //
+    // 🔴 risk: 'high' is deliberate and must NOT be downgraded. Every writing
+    // sibling (inbox.send / inbox.respond / scheduling.request) is high, and
+    // inbox.respond's own comment states that agent-mediated responses must
+    // always go through human approval. The approval basis here is the
+    // visitor's explicit "AIで日程調整する" click (or the flag-gated OIDC
+    // auto-consent), captured at mint time as a first-class ApprovalToken
+    // ledger row — NOT an absence of approval.
+    //
+    // 🪤 target_bindings.resource_id binds the BARE `itemId`. It must equal
+    // canonicalResourceId('scheduling.submit_response', { itemId }) exactly.
+    // A prefixed value (e.g. 'inbox:item/<id>') does not match the approval
+    // assertion at invoke time and the call SILENTLY falls through to
+    // auth_required (202) — no error surfaces, which is why the api side
+    // carries a preflight-parity spec asserting three-way equality
+    // (migration grant resource == assertion resource_id == invoke-time
+    // canonicalResourceId).
+    {
+      action: "scheduling.submit_response",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          itemId: { type: "string", minLength: 1, description: "The inbox item the proposal answers" },
+          decision: { type: "string", enum: ["propose", "decline"], description: "Whether the agent proposes slots or declines" },
+          slots: {
+            type: "array",
+            maxItems: 10,
+            description: "Proposed candidate slots (empty for a decline)",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          recommendedSlotIndex: { type: ["integer", "null"], description: "Index into slots of the recommended option, or null" },
+          recommendationReason: { type: "string", description: "Short rationale shown to the visitor" }
+        },
+        required: ["itemId", "decision"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "itemId" }
+      },
+      approval_salient_fields: ["itemId", "decision", "slots"],
+      version: "1.0.0"
+    },
+    {
+      action: "doc_review.submit_response",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          itemId: { type: "string", minLength: 1, description: "The inbox item the review answers" },
+          decision: { type: "string", enum: ["reviewed", "declined"], description: "Whether the agent returns review findings or declines" },
+          findings: {
+            type: "array",
+            maxItems: 50,
+            description: "Review findings (empty for a decline). Each cites a verbatim quote from the document.",
+            items: {
+              type: "object",
+              properties: {
+                quote: { type: "string", description: "Verbatim excerpt from the reviewed document that the comment refers to" },
+                comment: { type: "string", description: "The reviewer comment on that excerpt" }
+              },
+              required: ["quote", "comment"],
+              additionalProperties: false
+            }
+          },
+          summary: { type: "string", description: "Optional overall summary of the review" }
+        },
+        required: ["itemId", "decision"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "itemId" }
+      },
+      approval_salient_fields: ["itemId", "decision", "findings", "summary"],
       version: "1.0.0"
     }
   ],
@@ -8983,7 +9306,7 @@ var ACTION_REGISTRY = {
     {
       capability: "inbox.write",
       description: "Send and respond to agent inbox tasks",
-      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request", "scheduling.submit_response", "doc_review.submit_response"],
       version: "1.0.0"
     },
     {
@@ -9043,18 +9366,6 @@ var ACTION_REGISTRY = {
         "linear.attachment.delete"
       ],
       version: "1.0.0"
-    },
-    {
-      capability: "inbox.write",
-      description: "Send and respond to agent inbox tasks",
-      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
-      version: "1.0.0"
-    },
-    {
-      capability: "inbox.read",
-      description: "Read agent inbox tasks",
-      includes: ["inbox.check", "inbox.checkByToken"],
-      version: "1.0.0"
     }
   ]
 };
@@ -9384,6 +9695,27 @@ var GATEWAY_ERROR_CODE = {
   APPROVAL_REQUIRED: "APPROVAL_REQUIRED"
 };
 
+// src/resolver/approval-time-resolution.ts
+var RESOLVED_PARAMS_KEY = "__resolvedParams";
+function stripResolvedParams(params) {
+  if (!params || typeof params !== "object") return params;
+  if (!Object.prototype.hasOwnProperty.call(params, RESOLVED_PARAMS_KEY)) return params;
+  const { [RESOLVED_PARAMS_KEY]: _dropped, ...rest } = params;
+  return rest;
+}
+var RESOLVER_BACKED_FIELDS = {
+  "slack.message.post": [{ field: "channel", kind: "slack-channel" }],
+  "slack.message.update": [{ field: "channel", kind: "slack-channel" }],
+  "slack.message.delete": [{ field: "channel", kind: "slack-channel" }]
+  // jira `issueIdOrKey` / linear `issueId` are intentionally NOT here — verified
+  // verbatim passthrough, no pre-PEP server canonicalization (see the block
+  // above). Do not add them without a real, demonstrated pre-PEP rewrite.
+};
+function resolverBackedFieldsFor(action) {
+  const fields = RESOLVER_BACKED_FIELDS[action];
+  return fields && fields.length > 0 ? fields : void 0;
+}
+
 // src/registry/action-summary.ts
 function extractJiraAssigneeDisplay(params) {
   const pickFromShape = (value) => {
@@ -9438,6 +9770,37 @@ var ACTION_DISPLAY_CONFIGS = {
       { key: "text", label: "Message" }
     ]
   },
+  // #1205 P1 Step 4.6 — update / delete need explicit display configs so the
+  // approval UI renders a labeled `Channel` field (which the API-side enricher
+  // upserts the frozen id→name mapping into) instead of falling through to the
+  // all-keys fallback branch, which would (a) render a raw lowercase `channel`
+  // id row that the enricher then DUPLICATES with a `Channel` name row, and
+  // (b) risk leaking the reserved __resolvedParams key.
+  "slack.message.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.channel) parts.push(p.channel + ":");
+      if (p.text) parts.push(String(p.text));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "channel", label: "Channel" },
+      { key: "ts", label: "Timestamp" },
+      { key: "text", label: "Message" }
+    ]
+  },
+  "slack.message.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.channel) parts.push(p.channel + ":");
+      if (p.ts) parts.push(String(p.ts));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "channel", label: "Channel" },
+      { key: "ts", label: "Timestamp" }
+    ]
+  },
   "gmail.message.send": {
     summaryTemplate: (p) => {
       const parts = [];
@@ -10267,6 +10630,35 @@ var ACTION_DISPLAY_CONFIGS = {
       { key: "candidates", label: "Candidates" },
       { key: "message", label: "Message" }
     ]
+  },
+  // PR-R2 (design §3.2), registry checklist B. This action is risk:'high', so
+  // its summary/displayFields are what a human actually reads in the approval
+  // and audit surfaces — the string is user-facing, not decoration. Names the
+  // item being answered (the counterpart anchor available on this action's
+  // params) the way scheduling.request names its topic.
+  "scheduling.submit_response": {
+    summaryTemplate: (p) => p.decision === "decline" ? `Decline the scheduling request for item ${p.itemId ?? "(unknown)"}` : `Submit a scheduling proposal for item ${p.itemId ?? "(unknown)"}`,
+    displayFields: [
+      { key: "itemId", label: "Inbox item" },
+      { key: "decision", label: "Decision" },
+      { key: "slots", label: "Proposed slots" },
+      { key: "recommendedSlotIndex", label: "Recommended index" },
+      { key: "recommendationReason", label: "Reason" }
+    ]
+  },
+  // Phase D D0 (doc-review design §3.1), registry checklist B. Like
+  // scheduling.submit_response this is risk:'high', so its summary/displayFields
+  // are what a human actually reads in the approval and audit surfaces — the
+  // string is user-facing, not decoration. Names the item being answered the way
+  // scheduling.submit_response does.
+  "doc_review.submit_response": {
+    summaryTemplate: (p) => p.decision === "declined" ? `Decline the document review for item ${p.itemId ?? "(unknown)"}` : `Submit a document review for item ${p.itemId ?? "(unknown)"}`,
+    displayFields: [
+      { key: "itemId", label: "Inbox item" },
+      { key: "decision", label: "Decision" },
+      { key: "findings", label: "Findings" },
+      { key: "summary", label: "Summary" }
+    ]
   }
 };
 function truncate(text, maxLength) {
@@ -10429,6 +10821,7 @@ function generateActionSummary(action, params, maxLength = 50) {
     return raw ? truncate(raw, maxLength) : "";
   }
   for (const [key, val] of Object.entries(params)) {
+    if (key === RESOLVED_PARAMS_KEY) continue;
     if (val !== null && val !== void 0 && typeof val !== "object") {
       return truncate(`${key}: ${String(val)}`, maxLength);
     }
@@ -10444,7 +10837,7 @@ function generateActionParamsDisplay(action, params) {
       return { label: f.label, raw };
     }).filter((item) => item.raw !== void 0).map((item) => ({ label: item.label, value: formatValueFull(item.raw) }));
   }
-  return Object.entries(params).filter(([, v]) => v !== void 0 && v !== null).map(([key, val]) => ({
+  return Object.entries(params).filter(([key, v]) => key !== RESOLVED_PARAMS_KEY && v !== void 0 && v !== null).map(([key, val]) => ({
     label: key,
     value: formatValueFull(val)
   }));
@@ -10548,6 +10941,102 @@ function canonicalResourceId(action, params, ctx) {
   return id;
 }
 
+// src/resolver/salient-digest.ts
+var import_node_crypto3 = require("crypto");
+function serializeValue(value) {
+  if (value === null || value === void 0) return "null";
+  const t = typeof value;
+  if (t === "boolean") return value ? "true" : "false";
+  if (t === "number") {
+    const n = value;
+    if (!Number.isFinite(n)) {
+      throw new Error(`salient-digest: non-finite number is not allowed in salient params: ${String(n)}`);
+    }
+    if (!Number.isInteger(n)) {
+      throw new Error(
+        `salient-digest: float value is not allowed in salient params (phase 1 forbids non-integer numbers): ${String(n)}`
+      );
+    }
+    if (!Number.isSafeInteger(n)) {
+      throw new Error(
+        `salient-digest: unsafe integer is not allowed in salient params (exceeds 2^53-1, cannot round-trip losslessly): ${String(n)}`
+      );
+    }
+    return String(n);
+  }
+  if (t === "string") return JSON.stringify(value.normalize("NFC"));
+  if (Array.isArray(value)) {
+    return "[" + value.map(serializeValue).join(",") + "]";
+  }
+  if (t === "object") {
+    const obj = value;
+    const seen = /* @__PURE__ */ new Map();
+    for (const rawKey of Object.keys(obj)) {
+      const normKey = rawKey.normalize("NFC");
+      const prior = seen.get(normKey);
+      if (prior !== void 0 && prior !== rawKey) {
+        throw new Error(
+          `salient-digest: duplicate object key after NFC normalization ("${prior}" and "${rawKey}" both normalize to "${normKey}")`
+        );
+      }
+      seen.set(normKey, rawKey);
+    }
+    const normKeys = [...seen.keys()].sort();
+    const parts = normKeys.map((normKey) => {
+      const rawKey = seen.get(normKey);
+      return JSON.stringify(normKey) + ":" + serializeValue(obj[rawKey]);
+    });
+    return "{" + parts.join(",") + "}";
+  }
+  throw new Error(`salient-digest: unsupported value type in salient params: ${t}`);
+}
+function canonicalizeWithFields(fields, params) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const field of fields) {
+    const normField = field.normalize("NFC");
+    const prior = seen.get(normField);
+    if (prior !== void 0 && prior !== field) {
+      throw new Error(
+        `salient-digest: duplicate salient field after NFC normalization ("${prior}" and "${field}" both normalize to "${normField}")`
+      );
+    }
+    seen.set(normField, field);
+  }
+  const normFields = [...seen.keys()].sort();
+  const parts = normFields.map((normField) => {
+    const field = seen.get(normField);
+    const present = Object.prototype.hasOwnProperty.call(params, field);
+    const value = present ? params[field] : null;
+    return JSON.stringify(normField) + ":" + serializeValue(value);
+  });
+  return "{" + parts.join(",") + "}";
+}
+function digestWithFields(fields, params) {
+  const canonical = canonicalizeWithFields(fields, params);
+  const hex = (0, import_node_crypto3.createHash)("sha256").update(canonical, "utf8").digest("hex");
+  return `sha256:${hex}`;
+}
+function salientFieldsFor(action) {
+  const def = ACTION_REGISTRY.actions.find((a) => a.action === action);
+  if (!def) return void 0;
+  const fields = def.approval_salient_fields;
+  if (!Array.isArray(fields)) return void 0;
+  if (!fields.every((f) => typeof f === "string")) return void 0;
+  return fields;
+}
+function canonicalizeSalient(action, params) {
+  const fields = salientFieldsFor(action);
+  if (!fields) {
+    throw new Error(`salient-digest: action "${action}" has no declared approval-salient fields`);
+  }
+  return canonicalizeWithFields(fields, params);
+}
+function salientDigest(action, params) {
+  const fields = salientFieldsFor(action);
+  if (!fields) return void 0;
+  return digestWithFields(fields, params);
+}
+
 // src/resolver/compare-resource-id.ts
 function looksLikeNativeId(value) {
   if (/^[CDG][A-Z0-9]{8,}$/.test(value)) return true;
@@ -10883,6 +11372,7 @@ function parseEntityUid(uid) {
 }
 
 // src/registry/action-risk.ts
+var UNCLASSIFIED_ACTION_RISK = "high";
 var HIGH_RISK_SUFFIXES = /* @__PURE__ */ new Set([
   "send",
   "post",
@@ -10926,13 +11416,13 @@ var REGISTRY_RISK_BY_ACTION = (() => {
 function resolveActionRiskBySuffix(lowerAction) {
   const segments = lowerAction.split(".");
   const last = segments[segments.length - 1] ?? "";
-  if (!last) return "medium";
+  if (!last) return UNCLASSIFIED_ACTION_RISK;
   if (HIGH_RISK_SUFFIXES.has(last)) return "high";
   if (LOW_RISK_SUFFIXES.has(last)) return "low";
-  return "medium";
+  return UNCLASSIFIED_ACTION_RISK;
 }
 function resolveActionRisk(action) {
-  if (!action || typeof action !== "string") return "medium";
+  if (!action || typeof action !== "string") return UNCLASSIFIED_ACTION_RISK;
   const lower = action.toLowerCase();
   const registryRisk = REGISTRY_RISK_BY_ACTION.get(lower);
   if (registryRisk) return registryRisk;
@@ -11024,6 +11514,7 @@ var version = "0.0.1";
   PHASE_1_VC_LAYER,
   PROVIDER_ALIASES,
   REAUTH_REQUIRED_ACTION,
+  RESOLVED_PARAMS_KEY,
   RESOURCE_TYPES,
   RESOURCE_TYPE_LABELS,
   ReceiptStatus,
@@ -11036,6 +11527,7 @@ var version = "0.0.1";
   TIER_LIMITS,
   TargetResolver,
   ToolManager,
+  UNCLASSIFIED_ACTION_RISK,
   UserIdentityManager,
   UserKeyPairManager,
   VALID_MCP_ACTIONS,
@@ -11055,6 +11547,8 @@ var version = "0.0.1";
   buildValidationErrors,
   canonicalResourceId,
   canonicalizeAction,
+  canonicalizeSalient,
+  canonicalizeWithFields,
   checkPermissionWithVP,
   classifyCedarErrorMessage,
   compareResourceIds,
@@ -11064,6 +11558,7 @@ var version = "0.0.1";
   createDidJwk,
   credentialStatusToVCStatus,
   defaultConstraintEvaluator,
+  digestWithFields,
   evaluateConstraints,
   extractProjectKey,
   extractPublicKey,
@@ -11113,9 +11608,13 @@ var version = "0.0.1";
   resolveProvider,
   resolveResourceType,
   resolveUserTier,
+  resolverBackedFieldsFor,
+  salientDigest,
+  salientFieldsFor,
   sha256Hex,
   signJWT,
   signRequest,
+  stripResolvedParams,
   validateActionInput,
   validateRegistryObject,
   vcStatusToCredentialStatus,