@aigrc/core 0.1.0 → 0.2.0

package/dist/air/index.d.mts

@@ -0,0 +1,1669 @@
+import { z } from 'zod';
+
+/**
+ * AIGRC Intermediate Representation (AIR)
+ *
+ * The AIR is a JSON/YAML schema that represents compiled policy constraints
+ * in a format consumable by enforcement endpoints. It is the output of the
+ * Policy Compiler and the input to the Supply Chain Firewall.
+ *
+ * @see I2E_Engine_Specification_v1.md Section 4.2.2
+ * @module @aigrc/core/air
+ */
+
+declare const AIRVendorSchema: z.ZodObject<{
+    /** Vendor identifier (e.g., "openai", "anthropic", "google") */
+    id: z.ZodString;
+    /** Human-readable vendor name */
+    name: z.ZodOptional<z.ZodString>;
+    /** Status of this vendor */
+    status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+    /** Optional approval ticket ID (Golden Thread) */
+    approval_ticket: z.ZodOptional<z.ZodString>;
+    /** When approval was granted */
+    approved_at: z.ZodOptional<z.ZodString>;
+    /** Who approved this vendor */
+    approved_by: z.ZodOptional<z.ZodString>;
+    /** Expiration date for approval */
+    expires_at: z.ZodOptional<z.ZodString>;
+    /** Vendor-specific notes */
+    notes: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    status: "pending" | "approved" | "blocked";
+    id: string;
+    name?: string | undefined;
+    notes?: string | undefined;
+    approved_by?: string | undefined;
+    approved_at?: string | undefined;
+    approval_ticket?: string | undefined;
+    expires_at?: string | undefined;
+}, {
+    id: string;
+    name?: string | undefined;
+    status?: "pending" | "approved" | "blocked" | undefined;
+    notes?: string | undefined;
+    approved_by?: string | undefined;
+    approved_at?: string | undefined;
+    approval_ticket?: string | undefined;
+    expires_at?: string | undefined;
+}>;
+type AIRVendor = z.infer<typeof AIRVendorSchema>;
+declare const AIRModelSchema: z.ZodObject<{
+    /** Model identifier (e.g., "gpt-4", "claude-3-opus") */
+    id: z.ZodString;
+    /** Vendor that provides this model */
+    vendor_id: z.ZodString;
+    /** Human-readable model name */
+    name: z.ZodOptional<z.ZodString>;
+    /** Model version pattern (supports wildcards like "gpt-4*") */
+    version_pattern: z.ZodOptional<z.ZodString>;
+    /** Status of this model */
+    status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+    /** Maximum allowed parameters (for on-premise deployment considerations) */
+    max_parameters: z.ZodOptional<z.ZodNumber>;
+    /** Risk level assigned to this model */
+    risk_level: z.ZodOptional<z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>>;
+    /** Optional approval ticket ID */
+    approval_ticket: z.ZodOptional<z.ZodString>;
+    /** When approval was granted */
+    approved_at: z.ZodOptional<z.ZodString>;
+    /** Expiration date for approval */
+    expires_at: z.ZodOptional<z.ZodString>;
+    /** Model-specific notes */
+    notes: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    status: "pending" | "approved" | "blocked";
+    id: string;
+    vendor_id: string;
+    name?: string | undefined;
+    notes?: string | undefined;
+    approved_at?: string | undefined;
+    risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+    approval_ticket?: string | undefined;
+    expires_at?: string | undefined;
+    version_pattern?: string | undefined;
+    max_parameters?: number | undefined;
+}, {
+    id: string;
+    vendor_id: string;
+    name?: string | undefined;
+    status?: "pending" | "approved" | "blocked" | undefined;
+    notes?: string | undefined;
+    approved_at?: string | undefined;
+    risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+    approval_ticket?: string | undefined;
+    expires_at?: string | undefined;
+    version_pattern?: string | undefined;
+    max_parameters?: number | undefined;
+}>;
+type AIRModel = z.infer<typeof AIRModelSchema>;
+declare const AIRRegionSchema: z.ZodObject<{
+    /** Region code (e.g., "us-east-1", "eu-west-1", "EU", "US") */
+    code: z.ZodString;
+    /** Human-readable region name */
+    name: z.ZodOptional<z.ZodString>;
+    /** Status of this region */
+    status: z.ZodDefault<z.ZodEnum<["allowed", "restricted", "blocked"]>>;
+    /** Jurisdictions this region falls under (e.g., ["GDPR", "EU-AI-ACT"]) */
+    jurisdictions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Data residency requirements */
+    data_residency: z.ZodDefault<z.ZodEnum<["required", "preferred", "none"]>>;
+    /** Notes about this region */
+    notes: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: string;
+    status: "blocked" | "allowed" | "restricted";
+    jurisdictions: string[];
+    data_residency: "required" | "preferred" | "none";
+    name?: string | undefined;
+    notes?: string | undefined;
+}, {
+    code: string;
+    name?: string | undefined;
+    status?: "blocked" | "allowed" | "restricted" | undefined;
+    notes?: string | undefined;
+    jurisdictions?: string[] | undefined;
+    data_residency?: "required" | "preferred" | "none" | undefined;
+}>;
+type AIRRegion = z.infer<typeof AIRRegionSchema>;
+declare const AIRRegistryConstraintsSchema: z.ZodObject<{
+    /** List of approved vendors */
+    allowed_vendors: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Vendor identifier (e.g., "openai", "anthropic", "google") */
+        id: z.ZodString;
+        /** Human-readable vendor name */
+        name: z.ZodOptional<z.ZodString>;
+        /** Status of this vendor */
+        status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+        /** Optional approval ticket ID (Golden Thread) */
+        approval_ticket: z.ZodOptional<z.ZodString>;
+        /** When approval was granted */
+        approved_at: z.ZodOptional<z.ZodString>;
+        /** Who approved this vendor */
+        approved_by: z.ZodOptional<z.ZodString>;
+        /** Expiration date for approval */
+        expires_at: z.ZodOptional<z.ZodString>;
+        /** Vendor-specific notes */
+        notes: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "pending" | "approved" | "blocked";
+        id: string;
+        name?: string | undefined;
+        notes?: string | undefined;
+        approved_by?: string | undefined;
+        approved_at?: string | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+    }, {
+        id: string;
+        name?: string | undefined;
+        status?: "pending" | "approved" | "blocked" | undefined;
+        notes?: string | undefined;
+        approved_by?: string | undefined;
+        approved_at?: string | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+    }>, "many">>;
+    /** List of blocked vendors */
+    blocked_vendors: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** List of approved regions */
+    allowed_regions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Region code (e.g., "us-east-1", "eu-west-1", "EU", "US") */
+        code: z.ZodString;
+        /** Human-readable region name */
+        name: z.ZodOptional<z.ZodString>;
+        /** Status of this region */
+        status: z.ZodDefault<z.ZodEnum<["allowed", "restricted", "blocked"]>>;
+        /** Jurisdictions this region falls under (e.g., ["GDPR", "EU-AI-ACT"]) */
+        jurisdictions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Data residency requirements */
+        data_residency: z.ZodDefault<z.ZodEnum<["required", "preferred", "none"]>>;
+        /** Notes about this region */
+        notes: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        code: string;
+        status: "blocked" | "allowed" | "restricted";
+        jurisdictions: string[];
+        data_residency: "required" | "preferred" | "none";
+        name?: string | undefined;
+        notes?: string | undefined;
+    }, {
+        code: string;
+        name?: string | undefined;
+        status?: "blocked" | "allowed" | "restricted" | undefined;
+        notes?: string | undefined;
+        jurisdictions?: string[] | undefined;
+        data_residency?: "required" | "preferred" | "none" | undefined;
+    }>, "many">>;
+    /** List of blocked regions */
+    blocked_regions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** List of approved models */
+    allowed_models: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Model identifier (e.g., "gpt-4", "claude-3-opus") */
+        id: z.ZodString;
+        /** Vendor that provides this model */
+        vendor_id: z.ZodString;
+        /** Human-readable model name */
+        name: z.ZodOptional<z.ZodString>;
+        /** Model version pattern (supports wildcards like "gpt-4*") */
+        version_pattern: z.ZodOptional<z.ZodString>;
+        /** Status of this model */
+        status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+        /** Maximum allowed parameters (for on-premise deployment considerations) */
+        max_parameters: z.ZodOptional<z.ZodNumber>;
+        /** Risk level assigned to this model */
+        risk_level: z.ZodOptional<z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>>;
+        /** Optional approval ticket ID */
+        approval_ticket: z.ZodOptional<z.ZodString>;
+        /** When approval was granted */
+        approved_at: z.ZodOptional<z.ZodString>;
+        /** Expiration date for approval */
+        expires_at: z.ZodOptional<z.ZodString>;
+        /** Model-specific notes */
+        notes: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        status: "pending" | "approved" | "blocked";
+        id: string;
+        vendor_id: string;
+        name?: string | undefined;
+        notes?: string | undefined;
+        approved_at?: string | undefined;
+        risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+        version_pattern?: string | undefined;
+        max_parameters?: number | undefined;
+    }, {
+        id: string;
+        vendor_id: string;
+        name?: string | undefined;
+        status?: "pending" | "approved" | "blocked" | undefined;
+        notes?: string | undefined;
+        approved_at?: string | undefined;
+        risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+        version_pattern?: string | undefined;
+        max_parameters?: number | undefined;
+    }>, "many">>;
+    /** List of blocked models (patterns supported) */
+    blocked_models: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Maximum model parameters allowed */
+    max_model_parameters: z.ZodOptional<z.ZodNumber>;
+    /** Require vendor approval before use */
+    require_vendor_approval: z.ZodDefault<z.ZodBoolean>;
+    /** Require model approval before use */
+    require_model_approval: z.ZodDefault<z.ZodBoolean>;
+    /** Default behavior for unknown vendors: "block" or "request_approval" */
+    unknown_vendor_behavior: z.ZodDefault<z.ZodEnum<["block", "request_approval"]>>;
+    /** Default behavior for unknown models */
+    unknown_model_behavior: z.ZodDefault<z.ZodEnum<["block", "request_approval"]>>;
+}, "strip", z.ZodTypeAny, {
+    allowed_vendors: {
+        status: "pending" | "approved" | "blocked";
+        id: string;
+        name?: string | undefined;
+        notes?: string | undefined;
+        approved_by?: string | undefined;
+        approved_at?: string | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+    }[];
+    blocked_vendors: string[];
+    allowed_regions: {
+        code: string;
+        status: "blocked" | "allowed" | "restricted";
+        jurisdictions: string[];
+        data_residency: "required" | "preferred" | "none";
+        name?: string | undefined;
+        notes?: string | undefined;
+    }[];
+    blocked_regions: string[];
+    allowed_models: {
+        status: "pending" | "approved" | "blocked";
+        id: string;
+        vendor_id: string;
+        name?: string | undefined;
+        notes?: string | undefined;
+        approved_at?: string | undefined;
+        risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+        version_pattern?: string | undefined;
+        max_parameters?: number | undefined;
+    }[];
+    blocked_models: string[];
+    require_vendor_approval: boolean;
+    require_model_approval: boolean;
+    unknown_vendor_behavior: "block" | "request_approval";
+    unknown_model_behavior: "block" | "request_approval";
+    max_model_parameters?: number | undefined;
+}, {
+    allowed_vendors?: {
+        id: string;
+        name?: string | undefined;
+        status?: "pending" | "approved" | "blocked" | undefined;
+        notes?: string | undefined;
+        approved_by?: string | undefined;
+        approved_at?: string | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+    }[] | undefined;
+    blocked_vendors?: string[] | undefined;
+    allowed_regions?: {
+        code: string;
+        name?: string | undefined;
+        status?: "blocked" | "allowed" | "restricted" | undefined;
+        notes?: string | undefined;
+        jurisdictions?: string[] | undefined;
+        data_residency?: "required" | "preferred" | "none" | undefined;
+    }[] | undefined;
+    blocked_regions?: string[] | undefined;
+    allowed_models?: {
+        id: string;
+        vendor_id: string;
+        name?: string | undefined;
+        status?: "pending" | "approved" | "blocked" | undefined;
+        notes?: string | undefined;
+        approved_at?: string | undefined;
+        risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+        approval_ticket?: string | undefined;
+        expires_at?: string | undefined;
+        version_pattern?: string | undefined;
+        max_parameters?: number | undefined;
+    }[] | undefined;
+    blocked_models?: string[] | undefined;
+    max_model_parameters?: number | undefined;
+    require_vendor_approval?: boolean | undefined;
+    require_model_approval?: boolean | undefined;
+    unknown_vendor_behavior?: "block" | "request_approval" | undefined;
+    unknown_model_behavior?: "block" | "request_approval" | undefined;
+}>;
+type AIRRegistryConstraints = z.infer<typeof AIRRegistryConstraintsSchema>;
+declare const AIRPIIFilterConfigSchema: z.ZodObject<{
+    /** Whether PII filtering is enabled */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** PII types to filter (e.g., ["email", "phone", "ssn", "credit_card"]) */
+    filter_types: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Action when PII is detected: "redact", "block", "warn", "audit" */
+    action: z.ZodDefault<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+    /** Custom patterns to detect (regex) */
+    custom_patterns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        pattern: z.ZodString;
+        action: z.ZodOptional<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        pattern: string;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+    }, {
+        name: string;
+        pattern: string;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    filter_types: string[];
+    action: "audit" | "block" | "redact" | "warn";
+    custom_patterns: {
+        name: string;
+        pattern: string;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+    }[];
+}, {
+    enabled?: boolean | undefined;
+    filter_types?: string[] | undefined;
+    action?: "audit" | "block" | "redact" | "warn" | undefined;
+    custom_patterns?: {
+        name: string;
+        pattern: string;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+    }[] | undefined;
+}>;
+type AIRPIIFilterConfig = z.infer<typeof AIRPIIFilterConfigSchema>;
+declare const AIRToxicityFilterConfigSchema: z.ZodObject<{
+    /** Whether toxicity filtering is enabled */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Toxicity threshold (0-1) */
+    threshold: z.ZodDefault<z.ZodNumber>;
+    /** Categories to filter (e.g., ["hate", "violence", "sexual"]) */
+    categories: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Action when toxicity is detected */
+    action: z.ZodDefault<z.ZodEnum<["block", "warn", "audit"]>>;
+}, "strip", z.ZodTypeAny, {
+    enabled: boolean;
+    action: "audit" | "block" | "warn";
+    threshold: number;
+    categories: string[];
+}, {
+    enabled?: boolean | undefined;
+    action?: "audit" | "block" | "warn" | undefined;
+    threshold?: number | undefined;
+    categories?: string[] | undefined;
+}>;
+type AIRToxicityFilterConfig = z.infer<typeof AIRToxicityFilterConfigSchema>;
+declare const AIRRuntimeConstraintsSchema: z.ZodObject<{
+    /** PII filtering configuration */
+    pii_filter: z.ZodOptional<z.ZodObject<{
+        /** Whether PII filtering is enabled */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** PII types to filter (e.g., ["email", "phone", "ssn", "credit_card"]) */
+        filter_types: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Action when PII is detected: "redact", "block", "warn", "audit" */
+        action: z.ZodDefault<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+        /** Custom patterns to detect (regex) */
+        custom_patterns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            pattern: z.ZodString;
+            action: z.ZodOptional<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }, {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        filter_types: string[];
+        action: "audit" | "block" | "redact" | "warn";
+        custom_patterns: {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }[];
+    }, {
+        enabled?: boolean | undefined;
+        filter_types?: string[] | undefined;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+        custom_patterns?: {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }[] | undefined;
+    }>>;
+    /** Toxicity filtering configuration */
+    toxicity_filter: z.ZodOptional<z.ZodObject<{
+        /** Whether toxicity filtering is enabled */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Toxicity threshold (0-1) */
+        threshold: z.ZodDefault<z.ZodNumber>;
+        /** Categories to filter (e.g., ["hate", "violence", "sexual"]) */
+        categories: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Action when toxicity is detected */
+        action: z.ZodDefault<z.ZodEnum<["block", "warn", "audit"]>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        action: "audit" | "block" | "warn";
+        threshold: number;
+        categories: string[];
+    }, {
+        enabled?: boolean | undefined;
+        action?: "audit" | "block" | "warn" | undefined;
+        threshold?: number | undefined;
+        categories?: string[] | undefined;
+    }>>;
+    /** Data retention period in days (0 = no retention) */
+    data_retention_days: z.ZodDefault<z.ZodNumber>;
+    /** Whether to enable output watermarking */
+    watermark_enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Logging level: "none", "errors", "all" */
+    logging_level: z.ZodDefault<z.ZodEnum<["none", "errors", "all"]>>;
+    /** Maximum tokens per request */
+    max_tokens_per_request: z.ZodOptional<z.ZodNumber>;
+    /** Maximum requests per minute */
+    max_requests_per_minute: z.ZodOptional<z.ZodNumber>;
+    /** Maximum cost per request in USD */
+    max_cost_per_request_usd: z.ZodOptional<z.ZodNumber>;
+    /** Maximum cost per day in USD */
+    max_cost_per_day_usd: z.ZodOptional<z.ZodNumber>;
+    /** Session timeout in seconds */
+    session_timeout_seconds: z.ZodOptional<z.ZodNumber>;
+    /** Require human approval for specific actions */
+    human_approval_required: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Kill switch configuration */
+    kill_switch: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+        poll_interval_ms: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        poll_interval_ms: number;
+    }, {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        poll_interval_ms?: number | undefined;
+    }>>;
+    /** Grounding check configuration (prevent hallucination) */
+    grounding_check: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        confidence_threshold: z.ZodDefault<z.ZodNumber>;
+        action: z.ZodDefault<z.ZodEnum<["block", "warn", "audit"]>>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        action: "audit" | "block" | "warn";
+        confidence_threshold: number;
+    }, {
+        enabled?: boolean | undefined;
+        action?: "audit" | "block" | "warn" | undefined;
+        confidence_threshold?: number | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    data_retention_days: number;
+    watermark_enabled: boolean;
+    logging_level: "errors" | "none" | "all";
+    human_approval_required: string[];
+    kill_switch?: {
+        enabled: boolean;
+        channel: "sse" | "polling" | "file";
+        poll_interval_ms: number;
+    } | undefined;
+    pii_filter?: {
+        enabled: boolean;
+        filter_types: string[];
+        action: "audit" | "block" | "redact" | "warn";
+        custom_patterns: {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }[];
+    } | undefined;
+    toxicity_filter?: {
+        enabled: boolean;
+        action: "audit" | "block" | "warn";
+        threshold: number;
+        categories: string[];
+    } | undefined;
+    max_tokens_per_request?: number | undefined;
+    max_requests_per_minute?: number | undefined;
+    max_cost_per_request_usd?: number | undefined;
+    max_cost_per_day_usd?: number | undefined;
+    session_timeout_seconds?: number | undefined;
+    grounding_check?: {
+        enabled: boolean;
+        action: "audit" | "block" | "warn";
+        confidence_threshold: number;
+    } | undefined;
+}, {
+    kill_switch?: {
+        enabled?: boolean | undefined;
+        channel?: "sse" | "polling" | "file" | undefined;
+        poll_interval_ms?: number | undefined;
+    } | undefined;
+    pii_filter?: {
+        enabled?: boolean | undefined;
+        filter_types?: string[] | undefined;
+        action?: "audit" | "block" | "redact" | "warn" | undefined;
+        custom_patterns?: {
+            name: string;
+            pattern: string;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+        }[] | undefined;
+    } | undefined;
+    toxicity_filter?: {
+        enabled?: boolean | undefined;
+        action?: "audit" | "block" | "warn" | undefined;
+        threshold?: number | undefined;
+        categories?: string[] | undefined;
+    } | undefined;
+    data_retention_days?: number | undefined;
+    watermark_enabled?: boolean | undefined;
+    logging_level?: "errors" | "none" | "all" | undefined;
+    max_tokens_per_request?: number | undefined;
+    max_requests_per_minute?: number | undefined;
+    max_cost_per_request_usd?: number | undefined;
+    max_cost_per_day_usd?: number | undefined;
+    session_timeout_seconds?: number | undefined;
+    human_approval_required?: string[] | undefined;
+    grounding_check?: {
+        enabled?: boolean | undefined;
+        action?: "audit" | "block" | "warn" | undefined;
+        confidence_threshold?: number | undefined;
+    } | undefined;
+}>;
+type AIRRuntimeConstraints = z.infer<typeof AIRRuntimeConstraintsSchema>;
+declare const AIRBuildConstraintsSchema: z.ZodObject<{
+    /** Require Golden Thread linkage (business justification) */
+    require_golden_thread: z.ZodDefault<z.ZodBoolean>;
+    /** Require asset card for all AI assets */
+    require_asset_card: z.ZodDefault<z.ZodBoolean>;
+    /** Require risk classification */
+    require_risk_classification: z.ZodDefault<z.ZodBoolean>;
+    /** Require model card documentation */
+    require_model_card: z.ZodDefault<z.ZodBoolean>;
+    /** Require security review for high-risk assets */
+    require_security_review: z.ZodDefault<z.ZodBoolean>;
+    /** Minimum risk levels that require security review */
+    security_review_risk_levels: z.ZodDefault<z.ZodArray<z.ZodEnum<["high", "unacceptable"]>, "many">>;
+    /** Require governance.lock file */
+    require_governance_lock: z.ZodDefault<z.ZodBoolean>;
+    /** governance.lock must be signed */
+    require_lock_signature: z.ZodDefault<z.ZodBoolean>;
+    /** Block merge on validation failure */
+    block_on_failure: z.ZodDefault<z.ZodBoolean>;
+    /** Generate SARIF report for GitHub Security tab */
+    generate_sarif: z.ZodDefault<z.ZodBoolean>;
+    /** Required approvals before deployment */
+    required_approvals: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        role: z.ZodString;
+        count: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        role: string;
+        count: number;
+    }, {
+        role: string;
+        count?: number | undefined;
+    }>, "many">>;
+    /** Allowed deployment environments */
+    allowed_environments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Environment-specific constraints */
+    environment_constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        require_approval: z.ZodDefault<z.ZodBoolean>;
+        approvers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        require_testing: z.ZodDefault<z.ZodBoolean>;
+        test_coverage_threshold: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        require_approval: boolean;
+        approvers: string[];
+        require_testing: boolean;
+        test_coverage_threshold?: number | undefined;
+    }, {
+        require_approval?: boolean | undefined;
+        approvers?: string[] | undefined;
+        require_testing?: boolean | undefined;
+        test_coverage_threshold?: number | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    require_golden_thread: boolean;
+    require_asset_card: boolean;
+    require_risk_classification: boolean;
+    require_model_card: boolean;
+    require_security_review: boolean;
+    security_review_risk_levels: ("high" | "unacceptable")[];
+    require_governance_lock: boolean;
+    require_lock_signature: boolean;
+    block_on_failure: boolean;
+    generate_sarif: boolean;
+    required_approvals: {
+        role: string;
+        count: number;
+    }[];
+    allowed_environments: string[];
+    environment_constraints?: Record<string, {
+        require_approval: boolean;
+        approvers: string[];
+        require_testing: boolean;
+        test_coverage_threshold?: number | undefined;
+    }> | undefined;
+}, {
+    require_golden_thread?: boolean | undefined;
+    require_asset_card?: boolean | undefined;
+    require_risk_classification?: boolean | undefined;
+    require_model_card?: boolean | undefined;
+    require_security_review?: boolean | undefined;
+    security_review_risk_levels?: ("high" | "unacceptable")[] | undefined;
+    require_governance_lock?: boolean | undefined;
+    require_lock_signature?: boolean | undefined;
+    block_on_failure?: boolean | undefined;
+    generate_sarif?: boolean | undefined;
+    required_approvals?: {
+        role: string;
+        count?: number | undefined;
+    }[] | undefined;
+    allowed_environments?: string[] | undefined;
+    environment_constraints?: Record<string, {
+        require_approval?: boolean | undefined;
+        approvers?: string[] | undefined;
+        require_testing?: boolean | undefined;
+        test_coverage_threshold?: number | undefined;
+    }> | undefined;
+}>;
+type AIRBuildConstraints = z.infer<typeof AIRBuildConstraintsSchema>;
+declare const AIRPolicySourceSchema: z.ZodObject<{
+    /** Unique identifier for this source */
+    id: z.ZodString;
+    /** Type of source: "pdf", "url", "confluence", "jira", "manual" */
+    type: z.ZodEnum<["pdf", "url", "confluence", "jira", "manual"]>;
+    /** URI to the source document */
+    uri: z.ZodString;
+    /** SHA-256 hash of the source content */
+    content_hash: z.ZodString;
+    /** When the source was last fetched */
+    fetched_at: z.ZodString;
+    /** Title of the policy document */
+    title: z.ZodOptional<z.ZodString>;
+    /** Version of the policy document */
+    version: z.ZodOptional<z.ZodString>;
+    /** Confidence score of extraction (0-1) */
+    extraction_confidence: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    type: "jira" | "url" | "pdf" | "confluence" | "manual";
+    id: string;
+    uri: string;
+    content_hash: string;
+    fetched_at: string;
+    version?: string | undefined;
+    title?: string | undefined;
+    extraction_confidence?: number | undefined;
+}, {
+    type: "jira" | "url" | "pdf" | "confluence" | "manual";
+    id: string;
+    uri: string;
+    content_hash: string;
+    fetched_at: string;
+    version?: string | undefined;
+    title?: string | undefined;
+    extraction_confidence?: number | undefined;
+}>;
+type AIRPolicySource = z.infer<typeof AIRPolicySourceSchema>;
+declare const AIRMetadataSchema: z.ZodObject<{
+    /** When this AIR was generated */
+    generated_at: z.ZodString;
+    /** Tool/system that generated this AIR */
+    generated_by: z.ZodDefault<z.ZodString>;
+    /** Version of the policy compiler */
+    compiler_version: z.ZodString;
+    /** Organization this AIR belongs to */
+    organization: z.ZodOptional<z.ZodString>;
+    /** Environment this AIR is for (e.g., "production", "staging") */
+    environment: z.ZodOptional<z.ZodString>;
+    /** Human-readable description */
+    description: z.ZodOptional<z.ZodString>;
+    /** Tags for categorization */
+    tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Custom metadata fields */
+    custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    tags: string[];
+    generated_at: string;
+    generated_by: string;
+    compiler_version: string;
+    custom?: Record<string, unknown> | undefined;
+    organization?: string | undefined;
+    description?: string | undefined;
+    environment?: string | undefined;
+}, {
+    generated_at: string;
+    compiler_version: string;
+    custom?: Record<string, unknown> | undefined;
+    organization?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    generated_by?: string | undefined;
+    environment?: string | undefined;
+}>;
+type AIRMetadata = z.infer<typeof AIRMetadataSchema>;
+declare const AIRSchema: z.ZodObject<{
+    /** Schema version for forward compatibility */
+    version: z.ZodLiteral<"1.0">;
+    /** Unique identifier for this AIR */
+    id: z.ZodString;
+    /** Human-readable name */
+    name: z.ZodString;
+    /** SHA-256 hash of this AIR (computed after serialization) */
+    hash: z.ZodOptional<z.ZodString>;
+    /** Policy sources that contributed to this AIR */
+    policy_sources: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Unique identifier for this source */
+        id: z.ZodString;
+        /** Type of source: "pdf", "url", "confluence", "jira", "manual" */
+        type: z.ZodEnum<["pdf", "url", "confluence", "jira", "manual"]>;
+        /** URI to the source document */
+        uri: z.ZodString;
+        /** SHA-256 hash of the source content */
+        content_hash: z.ZodString;
+        /** When the source was last fetched */
+        fetched_at: z.ZodString;
+        /** Title of the policy document */
+        title: z.ZodOptional<z.ZodString>;
+        /** Version of the policy document */
+        version: z.ZodOptional<z.ZodString>;
+        /** Confidence score of extraction (0-1) */
+        extraction_confidence: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        type: "jira" | "url" | "pdf" | "confluence" | "manual";
+        id: string;
+        uri: string;
+        content_hash: string;
+        fetched_at: string;
+        version?: string | undefined;
+        title?: string | undefined;
+        extraction_confidence?: number | undefined;
+    }, {
+        type: "jira" | "url" | "pdf" | "confluence" | "manual";
+        id: string;
+        uri: string;
+        content_hash: string;
+        fetched_at: string;
+        version?: string | undefined;
+        title?: string | undefined;
+        extraction_confidence?: number | undefined;
+    }>, "many">>;
+    /** Registry constraints (vendor/model/region governance) */
+    registry: z.ZodDefault<z.ZodObject<{
+        /** List of approved vendors */
+        allowed_vendors: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** Vendor identifier (e.g., "openai", "anthropic", "google") */
+            id: z.ZodString;
+            /** Human-readable vendor name */
+            name: z.ZodOptional<z.ZodString>;
+            /** Status of this vendor */
+            status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+            /** Optional approval ticket ID (Golden Thread) */
+            approval_ticket: z.ZodOptional<z.ZodString>;
+            /** When approval was granted */
+            approved_at: z.ZodOptional<z.ZodString>;
+            /** Who approved this vendor */
+            approved_by: z.ZodOptional<z.ZodString>;
+            /** Expiration date for approval */
+            expires_at: z.ZodOptional<z.ZodString>;
+            /** Vendor-specific notes */
+            notes: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }, {
+            id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }>, "many">>;
+        /** List of blocked vendors */
+        blocked_vendors: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** List of approved regions */
+        allowed_regions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** Region code (e.g., "us-east-1", "eu-west-1", "EU", "US") */
+            code: z.ZodString;
+            /** Human-readable region name */
+            name: z.ZodOptional<z.ZodString>;
+            /** Status of this region */
+            status: z.ZodDefault<z.ZodEnum<["allowed", "restricted", "blocked"]>>;
+            /** Jurisdictions this region falls under (e.g., ["GDPR", "EU-AI-ACT"]) */
+            jurisdictions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Data residency requirements */
+            data_residency: z.ZodDefault<z.ZodEnum<["required", "preferred", "none"]>>;
+            /** Notes about this region */
+            notes: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            code: string;
+            status: "blocked" | "allowed" | "restricted";
+            jurisdictions: string[];
+            data_residency: "required" | "preferred" | "none";
+            name?: string | undefined;
+            notes?: string | undefined;
+        }, {
+            code: string;
+            name?: string | undefined;
+            status?: "blocked" | "allowed" | "restricted" | undefined;
+            notes?: string | undefined;
+            jurisdictions?: string[] | undefined;
+            data_residency?: "required" | "preferred" | "none" | undefined;
+        }>, "many">>;
+        /** List of blocked regions */
+        blocked_regions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** List of approved models */
+        allowed_models: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            /** Model identifier (e.g., "gpt-4", "claude-3-opus") */
+            id: z.ZodString;
+            /** Vendor that provides this model */
+            vendor_id: z.ZodString;
+            /** Human-readable model name */
+            name: z.ZodOptional<z.ZodString>;
+            /** Model version pattern (supports wildcards like "gpt-4*") */
+            version_pattern: z.ZodOptional<z.ZodString>;
+            /** Status of this model */
+            status: z.ZodDefault<z.ZodEnum<["approved", "pending", "blocked"]>>;
+            /** Maximum allowed parameters (for on-premise deployment considerations) */
+            max_parameters: z.ZodOptional<z.ZodNumber>;
+            /** Risk level assigned to this model */
+            risk_level: z.ZodOptional<z.ZodEnum<["minimal", "limited", "high", "unacceptable"]>>;
+            /** Optional approval ticket ID */
+            approval_ticket: z.ZodOptional<z.ZodString>;
+            /** When approval was granted */
+            approved_at: z.ZodOptional<z.ZodString>;
+            /** Expiration date for approval */
+            expires_at: z.ZodOptional<z.ZodString>;
+            /** Model-specific notes */
+            notes: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }, {
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }>, "many">>;
+        /** List of blocked models (patterns supported) */
+        blocked_models: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Maximum model parameters allowed */
+        max_model_parameters: z.ZodOptional<z.ZodNumber>;
+        /** Require vendor approval before use */
+        require_vendor_approval: z.ZodDefault<z.ZodBoolean>;
+        /** Require model approval before use */
+        require_model_approval: z.ZodDefault<z.ZodBoolean>;
+        /** Default behavior for unknown vendors: "block" or "request_approval" */
+        unknown_vendor_behavior: z.ZodDefault<z.ZodEnum<["block", "request_approval"]>>;
+        /** Default behavior for unknown models */
+        unknown_model_behavior: z.ZodDefault<z.ZodEnum<["block", "request_approval"]>>;
+    }, "strip", z.ZodTypeAny, {
+        allowed_vendors: {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }[];
+        blocked_vendors: string[];
+        allowed_regions: {
+            code: string;
+            status: "blocked" | "allowed" | "restricted";
+            jurisdictions: string[];
+            data_residency: "required" | "preferred" | "none";
+            name?: string | undefined;
+            notes?: string | undefined;
+        }[];
+        blocked_regions: string[];
+        allowed_models: {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }[];
+        blocked_models: string[];
+        require_vendor_approval: boolean;
+        require_model_approval: boolean;
+        unknown_vendor_behavior: "block" | "request_approval";
+        unknown_model_behavior: "block" | "request_approval";
+        max_model_parameters?: number | undefined;
+    }, {
+        allowed_vendors?: {
+            id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }[] | undefined;
+        blocked_vendors?: string[] | undefined;
+        allowed_regions?: {
+            code: string;
+            name?: string | undefined;
+            status?: "blocked" | "allowed" | "restricted" | undefined;
+            notes?: string | undefined;
+            jurisdictions?: string[] | undefined;
+            data_residency?: "required" | "preferred" | "none" | undefined;
+        }[] | undefined;
+        blocked_regions?: string[] | undefined;
+        allowed_models?: {
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }[] | undefined;
+        blocked_models?: string[] | undefined;
+        max_model_parameters?: number | undefined;
+        require_vendor_approval?: boolean | undefined;
+        require_model_approval?: boolean | undefined;
+        unknown_vendor_behavior?: "block" | "request_approval" | undefined;
+        unknown_model_behavior?: "block" | "request_approval" | undefined;
+    }>>;
+    /** Runtime constraints (execution-time governance) */
+    runtime: z.ZodDefault<z.ZodObject<{
+        /** PII filtering configuration */
+        pii_filter: z.ZodOptional<z.ZodObject<{
+            /** Whether PII filtering is enabled */
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** PII types to filter (e.g., ["email", "phone", "ssn", "credit_card"]) */
+            filter_types: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Action when PII is detected: "redact", "block", "warn", "audit" */
+            action: z.ZodDefault<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+            /** Custom patterns to detect (regex) */
+            custom_patterns: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                pattern: z.ZodString;
+                action: z.ZodOptional<z.ZodEnum<["redact", "block", "warn", "audit"]>>;
+            }, "strip", z.ZodTypeAny, {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }, {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }>, "many">>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            filter_types: string[];
+            action: "audit" | "block" | "redact" | "warn";
+            custom_patterns: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[];
+        }, {
+            enabled?: boolean | undefined;
+            filter_types?: string[] | undefined;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+            custom_patterns?: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[] | undefined;
+        }>>;
+        /** Toxicity filtering configuration */
+        toxicity_filter: z.ZodOptional<z.ZodObject<{
+            /** Whether toxicity filtering is enabled */
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** Toxicity threshold (0-1) */
+            threshold: z.ZodDefault<z.ZodNumber>;
+            /** Categories to filter (e.g., ["hate", "violence", "sexual"]) */
+            categories: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Action when toxicity is detected */
+            action: z.ZodDefault<z.ZodEnum<["block", "warn", "audit"]>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            threshold: number;
+            categories: string[];
+        }, {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            threshold?: number | undefined;
+            categories?: string[] | undefined;
+        }>>;
+        /** Data retention period in days (0 = no retention) */
+        data_retention_days: z.ZodDefault<z.ZodNumber>;
+        /** Whether to enable output watermarking */
+        watermark_enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Logging level: "none", "errors", "all" */
+        logging_level: z.ZodDefault<z.ZodEnum<["none", "errors", "all"]>>;
+        /** Maximum tokens per request */
+        max_tokens_per_request: z.ZodOptional<z.ZodNumber>;
+        /** Maximum requests per minute */
+        max_requests_per_minute: z.ZodOptional<z.ZodNumber>;
+        /** Maximum cost per request in USD */
+        max_cost_per_request_usd: z.ZodOptional<z.ZodNumber>;
+        /** Maximum cost per day in USD */
+        max_cost_per_day_usd: z.ZodOptional<z.ZodNumber>;
+        /** Session timeout in seconds */
+        session_timeout_seconds: z.ZodOptional<z.ZodNumber>;
+        /** Require human approval for specific actions */
+        human_approval_required: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Kill switch configuration */
+        kill_switch: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            channel: z.ZodDefault<z.ZodEnum<["sse", "polling", "file"]>>;
+            poll_interval_ms: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+        }, {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            poll_interval_ms?: number | undefined;
+        }>>;
+        /** Grounding check configuration (prevent hallucination) */
+        grounding_check: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            confidence_threshold: z.ZodDefault<z.ZodNumber>;
+            action: z.ZodDefault<z.ZodEnum<["block", "warn", "audit"]>>;
+        }, "strip", z.ZodTypeAny, {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            confidence_threshold: number;
+        }, {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            confidence_threshold?: number | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        data_retention_days: number;
+        watermark_enabled: boolean;
+        logging_level: "errors" | "none" | "all";
+        human_approval_required: string[];
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+        } | undefined;
+        pii_filter?: {
+            enabled: boolean;
+            filter_types: string[];
+            action: "audit" | "block" | "redact" | "warn";
+            custom_patterns: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[];
+        } | undefined;
+        toxicity_filter?: {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            threshold: number;
+            categories: string[];
+        } | undefined;
+        max_tokens_per_request?: number | undefined;
+        max_requests_per_minute?: number | undefined;
+        max_cost_per_request_usd?: number | undefined;
+        max_cost_per_day_usd?: number | undefined;
+        session_timeout_seconds?: number | undefined;
+        grounding_check?: {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            confidence_threshold: number;
+        } | undefined;
+    }, {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            poll_interval_ms?: number | undefined;
+        } | undefined;
+        pii_filter?: {
+            enabled?: boolean | undefined;
+            filter_types?: string[] | undefined;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+            custom_patterns?: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[] | undefined;
+        } | undefined;
+        toxicity_filter?: {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            threshold?: number | undefined;
+            categories?: string[] | undefined;
+        } | undefined;
+        data_retention_days?: number | undefined;
+        watermark_enabled?: boolean | undefined;
+        logging_level?: "errors" | "none" | "all" | undefined;
+        max_tokens_per_request?: number | undefined;
+        max_requests_per_minute?: number | undefined;
+        max_cost_per_request_usd?: number | undefined;
+        max_cost_per_day_usd?: number | undefined;
+        session_timeout_seconds?: number | undefined;
+        human_approval_required?: string[] | undefined;
+        grounding_check?: {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            confidence_threshold?: number | undefined;
+        } | undefined;
+    }>>;
+    /** Build constraints (CI/CD governance) */
+    build: z.ZodDefault<z.ZodObject<{
+        /** Require Golden Thread linkage (business justification) */
+        require_golden_thread: z.ZodDefault<z.ZodBoolean>;
+        /** Require asset card for all AI assets */
+        require_asset_card: z.ZodDefault<z.ZodBoolean>;
+        /** Require risk classification */
+        require_risk_classification: z.ZodDefault<z.ZodBoolean>;
+        /** Require model card documentation */
+        require_model_card: z.ZodDefault<z.ZodBoolean>;
+        /** Require security review for high-risk assets */
+        require_security_review: z.ZodDefault<z.ZodBoolean>;
+        /** Minimum risk levels that require security review */
+        security_review_risk_levels: z.ZodDefault<z.ZodArray<z.ZodEnum<["high", "unacceptable"]>, "many">>;
+        /** Require governance.lock file */
+        require_governance_lock: z.ZodDefault<z.ZodBoolean>;
+        /** governance.lock must be signed */
+        require_lock_signature: z.ZodDefault<z.ZodBoolean>;
+        /** Block merge on validation failure */
+        block_on_failure: z.ZodDefault<z.ZodBoolean>;
+        /** Generate SARIF report for GitHub Security tab */
+        generate_sarif: z.ZodDefault<z.ZodBoolean>;
+        /** Required approvals before deployment */
+        required_approvals: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            role: z.ZodString;
+            count: z.ZodDefault<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            role: string;
+            count: number;
+        }, {
+            role: string;
+            count?: number | undefined;
+        }>, "many">>;
+        /** Allowed deployment environments */
+        allowed_environments: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Environment-specific constraints */
+        environment_constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            require_approval: z.ZodDefault<z.ZodBoolean>;
+            approvers: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            require_testing: z.ZodDefault<z.ZodBoolean>;
+            test_coverage_threshold: z.ZodOptional<z.ZodNumber>;
+        }, "strip", z.ZodTypeAny, {
+            require_approval: boolean;
+            approvers: string[];
+            require_testing: boolean;
+            test_coverage_threshold?: number | undefined;
+        }, {
+            require_approval?: boolean | undefined;
+            approvers?: string[] | undefined;
+            require_testing?: boolean | undefined;
+            test_coverage_threshold?: number | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        require_golden_thread: boolean;
+        require_asset_card: boolean;
+        require_risk_classification: boolean;
+        require_model_card: boolean;
+        require_security_review: boolean;
+        security_review_risk_levels: ("high" | "unacceptable")[];
+        require_governance_lock: boolean;
+        require_lock_signature: boolean;
+        block_on_failure: boolean;
+        generate_sarif: boolean;
+        required_approvals: {
+            role: string;
+            count: number;
+        }[];
+        allowed_environments: string[];
+        environment_constraints?: Record<string, {
+            require_approval: boolean;
+            approvers: string[];
+            require_testing: boolean;
+            test_coverage_threshold?: number | undefined;
+        }> | undefined;
+    }, {
+        require_golden_thread?: boolean | undefined;
+        require_asset_card?: boolean | undefined;
+        require_risk_classification?: boolean | undefined;
+        require_model_card?: boolean | undefined;
+        require_security_review?: boolean | undefined;
+        security_review_risk_levels?: ("high" | "unacceptable")[] | undefined;
+        require_governance_lock?: boolean | undefined;
+        require_lock_signature?: boolean | undefined;
+        block_on_failure?: boolean | undefined;
+        generate_sarif?: boolean | undefined;
+        required_approvals?: {
+            role: string;
+            count?: number | undefined;
+        }[] | undefined;
+        allowed_environments?: string[] | undefined;
+        environment_constraints?: Record<string, {
+            require_approval?: boolean | undefined;
+            approvers?: string[] | undefined;
+            require_testing?: boolean | undefined;
+            test_coverage_threshold?: number | undefined;
+        }> | undefined;
+    }>>;
+    /** Metadata about this AIR */
+    metadata: z.ZodObject<{
+        /** When this AIR was generated */
+        generated_at: z.ZodString;
+        /** Tool/system that generated this AIR */
+        generated_by: z.ZodDefault<z.ZodString>;
+        /** Version of the policy compiler */
+        compiler_version: z.ZodString;
+        /** Organization this AIR belongs to */
+        organization: z.ZodOptional<z.ZodString>;
+        /** Environment this AIR is for (e.g., "production", "staging") */
+        environment: z.ZodOptional<z.ZodString>;
+        /** Human-readable description */
+        description: z.ZodOptional<z.ZodString>;
+        /** Tags for categorization */
+        tags: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        /** Custom metadata fields */
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        tags: string[];
+        generated_at: string;
+        generated_by: string;
+        compiler_version: string;
+        custom?: Record<string, unknown> | undefined;
+        organization?: string | undefined;
+        description?: string | undefined;
+        environment?: string | undefined;
+    }, {
+        generated_at: string;
+        compiler_version: string;
+        custom?: Record<string, unknown> | undefined;
+        organization?: string | undefined;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+        generated_by?: string | undefined;
+        environment?: string | undefined;
+    }>;
+    /** When this AIR expires (forces re-compilation) */
+    expires_at: z.ZodOptional<z.ZodString>;
+    /** Digital signatures for verification */
+    signatures: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        /** Signer identity (email or system ID) */
+        signer: z.ZodString;
+        /** Algorithm used (RS256, ES256) */
+        algorithm: z.ZodEnum<["RS256", "ES256"]>;
+        /** Base64-encoded signature */
+        signature: z.ZodString;
+        /** When the signature was created */
+        signed_at: z.ZodString;
+        /** Key ID for verification */
+        key_id: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        signature: string;
+        algorithm: "RS256" | "ES256";
+        signer: string;
+        signed_at: string;
+        key_id?: string | undefined;
+    }, {
+        signature: string;
+        algorithm: "RS256" | "ES256";
+        signer: string;
+        signed_at: string;
+        key_id?: string | undefined;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    runtime: {
+        data_retention_days: number;
+        watermark_enabled: boolean;
+        logging_level: "errors" | "none" | "all";
+        human_approval_required: string[];
+        kill_switch?: {
+            enabled: boolean;
+            channel: "sse" | "polling" | "file";
+            poll_interval_ms: number;
+        } | undefined;
+        pii_filter?: {
+            enabled: boolean;
+            filter_types: string[];
+            action: "audit" | "block" | "redact" | "warn";
+            custom_patterns: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[];
+        } | undefined;
+        toxicity_filter?: {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            threshold: number;
+            categories: string[];
+        } | undefined;
+        max_tokens_per_request?: number | undefined;
+        max_requests_per_minute?: number | undefined;
+        max_cost_per_request_usd?: number | undefined;
+        max_cost_per_day_usd?: number | undefined;
+        session_timeout_seconds?: number | undefined;
+        grounding_check?: {
+            enabled: boolean;
+            action: "audit" | "block" | "warn";
+            confidence_threshold: number;
+        } | undefined;
+    };
+    id: string;
+    version: "1.0";
+    metadata: {
+        tags: string[];
+        generated_at: string;
+        generated_by: string;
+        compiler_version: string;
+        custom?: Record<string, unknown> | undefined;
+        organization?: string | undefined;
+        description?: string | undefined;
+        environment?: string | undefined;
+    };
+    build: {
+        require_golden_thread: boolean;
+        require_asset_card: boolean;
+        require_risk_classification: boolean;
+        require_model_card: boolean;
+        require_security_review: boolean;
+        security_review_risk_levels: ("high" | "unacceptable")[];
+        require_governance_lock: boolean;
+        require_lock_signature: boolean;
+        block_on_failure: boolean;
+        generate_sarif: boolean;
+        required_approvals: {
+            role: string;
+            count: number;
+        }[];
+        allowed_environments: string[];
+        environment_constraints?: Record<string, {
+            require_approval: boolean;
+            approvers: string[];
+            require_testing: boolean;
+            test_coverage_threshold?: number | undefined;
+        }> | undefined;
+    };
+    policy_sources: {
+        type: "jira" | "url" | "pdf" | "confluence" | "manual";
+        id: string;
+        uri: string;
+        content_hash: string;
+        fetched_at: string;
+        version?: string | undefined;
+        title?: string | undefined;
+        extraction_confidence?: number | undefined;
+    }[];
+    registry: {
+        allowed_vendors: {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }[];
+        blocked_vendors: string[];
+        allowed_regions: {
+            code: string;
+            status: "blocked" | "allowed" | "restricted";
+            jurisdictions: string[];
+            data_residency: "required" | "preferred" | "none";
+            name?: string | undefined;
+            notes?: string | undefined;
+        }[];
+        blocked_regions: string[];
+        allowed_models: {
+            status: "pending" | "approved" | "blocked";
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }[];
+        blocked_models: string[];
+        require_vendor_approval: boolean;
+        require_model_approval: boolean;
+        unknown_vendor_behavior: "block" | "request_approval";
+        unknown_model_behavior: "block" | "request_approval";
+        max_model_parameters?: number | undefined;
+    };
+    signatures: {
+        signature: string;
+        algorithm: "RS256" | "ES256";
+        signer: string;
+        signed_at: string;
+        key_id?: string | undefined;
+    }[];
+    hash?: string | undefined;
+    expires_at?: string | undefined;
+}, {
+    name: string;
+    id: string;
+    version: "1.0";
+    metadata: {
+        generated_at: string;
+        compiler_version: string;
+        custom?: Record<string, unknown> | undefined;
+        organization?: string | undefined;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+        generated_by?: string | undefined;
+        environment?: string | undefined;
+    };
+    runtime?: {
+        kill_switch?: {
+            enabled?: boolean | undefined;
+            channel?: "sse" | "polling" | "file" | undefined;
+            poll_interval_ms?: number | undefined;
+        } | undefined;
+        pii_filter?: {
+            enabled?: boolean | undefined;
+            filter_types?: string[] | undefined;
+            action?: "audit" | "block" | "redact" | "warn" | undefined;
+            custom_patterns?: {
+                name: string;
+                pattern: string;
+                action?: "audit" | "block" | "redact" | "warn" | undefined;
+            }[] | undefined;
+        } | undefined;
+        toxicity_filter?: {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            threshold?: number | undefined;
+            categories?: string[] | undefined;
+        } | undefined;
+        data_retention_days?: number | undefined;
+        watermark_enabled?: boolean | undefined;
+        logging_level?: "errors" | "none" | "all" | undefined;
+        max_tokens_per_request?: number | undefined;
+        max_requests_per_minute?: number | undefined;
+        max_cost_per_request_usd?: number | undefined;
+        max_cost_per_day_usd?: number | undefined;
+        session_timeout_seconds?: number | undefined;
+        human_approval_required?: string[] | undefined;
+        grounding_check?: {
+            enabled?: boolean | undefined;
+            action?: "audit" | "block" | "warn" | undefined;
+            confidence_threshold?: number | undefined;
+        } | undefined;
+    } | undefined;
+    hash?: string | undefined;
+    build?: {
+        require_golden_thread?: boolean | undefined;
+        require_asset_card?: boolean | undefined;
+        require_risk_classification?: boolean | undefined;
+        require_model_card?: boolean | undefined;
+        require_security_review?: boolean | undefined;
+        security_review_risk_levels?: ("high" | "unacceptable")[] | undefined;
+        require_governance_lock?: boolean | undefined;
+        require_lock_signature?: boolean | undefined;
+        block_on_failure?: boolean | undefined;
+        generate_sarif?: boolean | undefined;
+        required_approvals?: {
+            role: string;
+            count?: number | undefined;
+        }[] | undefined;
+        allowed_environments?: string[] | undefined;
+        environment_constraints?: Record<string, {
+            require_approval?: boolean | undefined;
+            approvers?: string[] | undefined;
+            require_testing?: boolean | undefined;
+            test_coverage_threshold?: number | undefined;
+        }> | undefined;
+    } | undefined;
+    expires_at?: string | undefined;
+    policy_sources?: {
+        type: "jira" | "url" | "pdf" | "confluence" | "manual";
+        id: string;
+        uri: string;
+        content_hash: string;
+        fetched_at: string;
+        version?: string | undefined;
+        title?: string | undefined;
+        extraction_confidence?: number | undefined;
+    }[] | undefined;
+    registry?: {
+        allowed_vendors?: {
+            id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_by?: string | undefined;
+            approved_at?: string | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+        }[] | undefined;
+        blocked_vendors?: string[] | undefined;
+        allowed_regions?: {
+            code: string;
+            name?: string | undefined;
+            status?: "blocked" | "allowed" | "restricted" | undefined;
+            notes?: string | undefined;
+            jurisdictions?: string[] | undefined;
+            data_residency?: "required" | "preferred" | "none" | undefined;
+        }[] | undefined;
+        blocked_regions?: string[] | undefined;
+        allowed_models?: {
+            id: string;
+            vendor_id: string;
+            name?: string | undefined;
+            status?: "pending" | "approved" | "blocked" | undefined;
+            notes?: string | undefined;
+            approved_at?: string | undefined;
+            risk_level?: "minimal" | "limited" | "high" | "unacceptable" | undefined;
+            approval_ticket?: string | undefined;
+            expires_at?: string | undefined;
+            version_pattern?: string | undefined;
+            max_parameters?: number | undefined;
+        }[] | undefined;
+        blocked_models?: string[] | undefined;
+        max_model_parameters?: number | undefined;
+        require_vendor_approval?: boolean | undefined;
+        require_model_approval?: boolean | undefined;
+        unknown_vendor_behavior?: "block" | "request_approval" | undefined;
+        unknown_model_behavior?: "block" | "request_approval" | undefined;
+    } | undefined;
+    signatures?: {
+        signature: string;
+        algorithm: "RS256" | "ES256";
+        signer: string;
+        signed_at: string;
+        key_id?: string | undefined;
+    }[] | undefined;
+}>;
+type AIR = z.infer<typeof AIRSchema>;
+/**
+ * Creates an empty AIR with default values
+ */
+declare function createEmptyAIR(name: string, compilerVersion?: string): AIR;
+/**
+ * Validates an AIR document
+ */
+declare function validateAIR(air: unknown): {
+    valid: boolean;
+    errors: string[];
+};
+/**
+ * Checks if a vendor is allowed by registry constraints
+ */
+declare function isVendorAllowed(vendorId: string, registry: AIRRegistryConstraints): {
+    allowed: boolean;
+    reason: string;
+    requiresApproval: boolean;
+};
+/**
+ * Checks if a model is allowed by registry constraints
+ */
+declare function isModelAllowed(modelId: string, vendorId: string, registry: AIRRegistryConstraints): {
+    allowed: boolean;
+    reason: string;
+    requiresApproval: boolean;
+};
+/**
+ * Checks if a region is allowed by registry constraints
+ */
+declare function isRegionAllowed(regionCode: string, registry: AIRRegistryConstraints): {
+    allowed: boolean;
+    reason: string;
+    dataResidency: "required" | "preferred" | "none";
+};
+
+export { type AIR, type AIRBuildConstraints, AIRBuildConstraintsSchema, type AIRMetadata, AIRMetadataSchema, type AIRModel, AIRModelSchema, type AIRPIIFilterConfig, AIRPIIFilterConfigSchema, type AIRPolicySource, AIRPolicySourceSchema, type AIRRegion, AIRRegionSchema, type AIRRegistryConstraints, AIRRegistryConstraintsSchema, type AIRRuntimeConstraints, AIRRuntimeConstraintsSchema, AIRSchema, type AIRToxicityFilterConfig, AIRToxicityFilterConfigSchema, type AIRVendor, AIRVendorSchema, createEmptyAIR, isModelAllowed, isRegionAllowed, isVendorAllowed, validateAIR };