@highflame/policy 2.2.34 → 2.2.36

package/dist/service-schemas.gen.d.ts

@@ -3,25 +3,25 @@
  *
  * Full Cedar schema for agent_ops, embedded at codegen time.
  */
-export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n//   - LLM prompt/response (Guardrails path)\n//   - IDE tool calls and file access (Overwatch path)\n//   - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource in AgentOps::Project::\"<uuid>\"          \u2192 project-wide (all agents)\n    //   resource in AgentOps::Agent::\"<external_id>\"     \u2192 named agent + its sessions\n    //   resource == AgentOps::Agent::\"<external_id>\"     \u2192 named agent only (exact match)\n    //   resource in AgentOps::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n    /// Agent only:       resource == AgentOps::Agent::\"<external_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    /// Provision a sandbox for the acting identity (Forge OS-layer envelope).\n    /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):\n    /// Forge evaluates this action's AgentOps bundle at create-time; no decision\n    /// means no sandbox. Context carries the requested capability envelope\n    /// (writable paths, egress, exec allowlist, curated mechanism toggles,\n    /// isolation tier). Raw syscalls are NEVER expressed here \u2014 the enforcement\n    /// generators own the mechanism\u2192syscall translation (ADR 0017 D1).\n    action \"provision_sandbox\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ProvisionSandboxContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n        \"source\"?: String,           // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n        \"event\"?: String,            // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n        \"user_email\"?: String,       // Human operator email (IDE sessions)\n        \"cwd\"?: String,              // Current working directory\n        \"workspace_root\"?: String,   // IDE workspace root path\n\n        // Model context (optional \u2014 present for AI Gateway traffic)\n        \"model_name\"?: String,       // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n        \"model_provider\"?: String,   // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n        \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Boolean,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n\n        // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n        \"highest_severity\"?: String,     // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"threat_count\"?: Long,\n        \"threat_categories\"?: Set<String>,\n        \"detected_threats\"?: Set<String>,\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | ...\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | ...\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Boolean,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Boolean,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Boolean,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100\n        \"keyword_matched\"?: Boolean,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Boolean,\n        \"phishing_detected\"?: Boolean,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Boolean,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Boolean,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Boolean,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n        \"action_params\"?: {\n            \"amount\"?: Long,\n            \"count\"?: Long,\n            \"command\"?: String,\n            \"path\"?: String,\n            \"url\"?: String,\n            \"recipient\"?: String,\n            \"target\"?: String,\n            \"query\"?: String,\n        },\n        \"param_type_violation\"?: Boolean,\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_tool\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Boolean,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Boolean,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,\n        \"pii_score\"?: Long,\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,\n        \"injection_deep_context_score\"?: Long,\n        \"indirect_injection_score\"?: Long,\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n        \"rug_pull_detected\"?: Boolean,\n        \"rug_pull_score\"?: Long,\n        \"rug_pull_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Tool Operation Classifier (optional)\n        \"tool_operation_classes\"?: Set<String>,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // File & Path (optional)\n        \"path\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for provision_sandbox action (Forge sandbox-create envelope).\n    ///\n    /// Every capability field below is OPTIONAL and describes the envelope the\n    /// sandbox is being asked to provision with \u2014 Forge synthesizes it from the\n    /// create request attenuated by the token's scope ceiling (ADR 0019 D1),\n    /// then asks Cedar whether this identity may provision it. Profile templates\n    /// `permit` provision_sandbox only when the requested envelope stays within\n    /// the profile ceiling, and `forbid` any escalation beyond it.\n    ///\n    /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,\n    /// accessing an absent one is a Cedar *evaluation error*, and an errored\n    /// `forbid` is silently skipped \u2014 which fails OPEN. Every rule touching a\n    /// field here MUST guard it first with `has` (e.g.\n    /// `context has mechanism_capabilities && context.mechanism_capabilities.contains(\"sys:ptrace\")`).\n    type ProvisionSandboxContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)\n        \"agent_trust_level\"?: String,    // \"untrusted\" | \"low\" | \"verified\" | \"trusted\"\n\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Requested isolation tier (required) \u2014 the OS-isolation tier the\n        // sandbox will run at, as the lowercased Forge IsolationTier name (ADR\n        // 0016 D1). Ordinal, weakest\u2192strongest: \"none\" (trusted-local) < \"os\"\n        // (bwrap/seatbelt) < \"kernel\" (gVisor) < \"hardware\" (micro-VM + TEE).\n        // Templates assert a floor via set membership (e.g. a KERNEL floor =\n        // {\"kernel\",\"hardware\"}); Forge owns the ordering.\n        \"isolation_tier\": String,\n\n        // Requested capability envelope (all optional \u2014 has-guard mandatory).\n        \"writable_paths\"?: Set<String>,        // Writable path prefixes, e.g. {\"/scratch\"}\n        // Master egress switch. Forge MUST set this true whenever ANY egress is\n        // requested (i.e. whenever egress_hosts is non-empty), so a \"no network\"\n        // profile can gate on this single boolean. egress_hosts then narrows the\n        // host allowlist for profiles that DO permit egress.\n        \"network_egress\"?: Boolean,\n        \"egress_hosts\"?: Set<String>,          // Host allowlist for egress, e.g. {\"pypi.org\"}\n        \"exec_allowlist\"?: Set<String>,        // Executables the sandbox may run, e.g. {\"python\", \"python3\"}\n        // Curated mechanism toggles (ADR 0017 D1.3) \u2014 authorization facts only;\n        // NEVER raw syscalls. Allowed members: \"sys:ptrace\", \"sys:bpf\",\n        // \"sys:raw_socket\", \"dev:gpu\", \"virt:nested\".\n        \"mechanism_capabilities\"?: Set<String>,\n    };\n}\n";
+export declare const AGENT_OPS_SCHEMA = "// =============================================================================\n// AgentOps Cedar Schema\n// =============================================================================\n// Unified schema for all agent guardrail policies. Covers every request path\n// where an AI agent touches the Highflame platform:\n//   - LLM prompt/response (Guardrails path)\n//   - IDE tool calls and file access (Overwatch path)\n//   - MCP server connections (AI Gateway path)\n//\n// The context types are a superset of Guardrails, Overwatch, and AI Gateway\n// schemas. All extra fields are optional \u2014 Shield projects only what is present\n// in the request, Cedar ignores absent optional attributes.\n//\n// Service: highflame-shield (agent_ops product)\n// Namespace: AgentOps\n// =============================================================================\n\nnamespace AgentOps {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource in AgentOps::Project::\"<uuid>\"          \u2192 project-wide (all agents)\n    //   resource in AgentOps::Agent::\"<external_id>\"     \u2192 named agent + its sessions\n    //   resource == AgentOps::Agent::\"<external_id>\"     \u2192 named agent only (exact match)\n    //   resource in AgentOps::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, MCP client, etc.)\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in AgentOps::Agent::\"<external_id>\" (hierarchy match)\n    /// Agent only:       resource == AgentOps::Agent::\"<external_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    /// Provision a sandbox for the acting identity (Forge OS-layer envelope).\n    /// The MANDATORY authorization gate for sandbox creation (ADR 0019 D1):\n    /// Forge evaluates this action's AgentOps bundle at create-time; no decision\n    /// means no sandbox. Context carries the requested capability envelope\n    /// (writable paths, egress, exec allowlist, curated mechanism toggles,\n    /// isolation tier). Raw syscalls are NEVER expressed here \u2014 the enforcement\n    /// generators own the mechanism\u2192syscall translation (ADR 0017 D1).\n    action \"provision_sandbox\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ProvisionSandboxContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // IDE / workspace context (optional \u2014 present for Overwatch/code-agent traffic)\n        \"source\"?: String,           // Traffic origin: \"ide\" | \"cli\" | \"api\" | \"browser\"\n        \"event\"?: String,            // Event type: \"prompt\" | \"tool_call\" | \"file_read\" | ...\n        \"user_email\"?: String,       // Human operator email (IDE sessions)\n        \"cwd\"?: String,              // Current working directory\n        \"workspace_root\"?: String,   // IDE workspace root path\n\n        // Model context (optional \u2014 present for AI Gateway traffic)\n        \"model_name\"?: String,       // LLM model name: \"claude-3-5-sonnet\", \"gpt-4o\", ...\n        \"model_provider\"?: String,   // Model provider: \"anthropic\" | \"openai\" | \"google\" | ...\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n        \"indirect_injection_score\"?: Long, // Indirect injection via tool outputs (0-100)\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Boolean,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n\n        // Aggregated threat summary (optional \u2014 populated by aggregation detectors)\n        \"highest_severity\"?: String,     // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"threat_count\"?: Long,\n        \"threat_categories\"?: Set<String>,\n        \"detected_threats\"?: Set<String>,\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | ...\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | ...\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Boolean,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Boolean,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Boolean,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100\n        \"keyword_matched\"?: Boolean,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Boolean,\n        \"phishing_detected\"?: Boolean,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Boolean,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Boolean,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Boolean,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation\n        \"action_params\"?: {\n            \"amount\"?: Long,\n            \"count\"?: Long,\n            \"command\"?: String,\n            \"path\"?: String,\n            \"url\"?: String,\n            \"recipient\"?: String,\n            \"target\"?: String,\n            \"query\"?: String,\n        },\n        \"param_type_violation\"?: Boolean,\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_tool\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Boolean,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | ...\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Boolean,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,\n        \"pii_score\"?: Long,\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,\n        \"injection_deep_context_score\"?: Long,\n        \"indirect_injection_score\"?: Long,\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Boolean,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Boolean,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Boolean,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n        \"rug_pull_detected\"?: Boolean,\n        \"rug_pull_score\"?: Long,\n        \"rug_pull_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Tool Operation Classifier (optional)\n        \"tool_operation_classes\"?: Set<String>,\n\n        // --- Bash AST resolved target paths (#411 / CAP-DET-007) \u2014 newline-delimited (leading+trailing \\n); Cedar `like` is anchored so patterns start with \"*\": sub-tree \"*\\n/etc/*\", bare dir \"*\\n/etc\\n*\", exact \"*\\n/etc/passwd\\n*\" ---\n        \"resolved_target_paths\"?: String,  // union of resolved absolute target paths, any capability\n        \"read_target_paths\"?: String,      // paths the command reads or enumerates\n        \"write_target_paths\"?: String,     // paths the command writes, creates, or destroys\n        \"exec_target_paths\"?: String,      // paths executed as a script\n        \"unresolved_target\"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Boolean,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // File & Path (optional)\n        \"path\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // File path (optional)\n        \"path\"?: String,\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Boolean,\n        \"invisible_chars_score\"?: Long,\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Boolean,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Boolean,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Boolean,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (optional)\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,\n        \"principal\"?: String,\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // IDE / workspace context (optional)\n        \"source\"?: String,\n        \"event\"?: String,\n        \"user_email\"?: String,\n        \"cwd\"?: String,\n        \"workspace_root\"?: String,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,\n        \"mcp_server_verified\"?: Boolean,\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Boolean,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Boolean,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Boolean,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Aggregated threat summary (optional)\n        \"highest_severity\"?: String,\n        \"threat_count\"?: Long,\n        \"detected_threats\"?: Set<String>,\n\n        // Session Detection History (optional)\n        \"session_pii_detected\"?: Boolean,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Boolean,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Boolean,\n        \"session_command_injection\"?: Boolean,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,\n        \"session_max_sensitivity\"?: String,\n\n        // Origin Surface \u2014 REQUIRED (ADR 0012 D14.2). Projected by Shield from the\n        // ingress product; never user-supplied. The \"Applies to\" narrowing target:\n        // policies test it with an ordinary condition (context.surface == \"ai_gateway\")\n        // \u2014 no `has` guard needed precisely because it is required. Values are the\n        // product identifiers: \"guardrails\" | \"overwatch\" | \"ai_gateway\" (\"sentry\"\n        // joins at ADR 0012 D17 phase 2). A policy with no surface condition applies\n        // to every surface, including ones added later (inclusive default).\n        \"surface\": String,\n\n        // Data-Flow Labels \u2014 per-value information-flow facts (ADR 0020, optional).\n        // All optional: guard every access with `has` \u2014 an absent-attribute read is\n        // a Cedar evaluation error and an errored forbid is silently skipped (fail-open).\n        \"flow_confidentiality\"?: String,         // \"public\" | \"internal\" | \"confidential\" | \"restricted\" | \"unknown\"\n        \"flow_integrity\"?: String,               // \"trusted\" | \"untrusted\" | \"mixed\" | \"unknown\"\n        \"flow_data_types\"?: Set<String>,         // \"pii\" | \"secrets\" | \"source_code\" | \"financial\" | \"health\" | ...\n        \"flow_compartments\"?: Set<String>,       // \"tenant:*\" | \"customer:*\" | \"project:*\"\n        \"flow_resolution_status\"?: String,       // \"known\" | \"inferred\" | \"unknown\" | \"conflicted\"\n        \"flow_origins\"?: Set<String>,            // \"mcp_tool_result\" | \"model\" | \"file\" | \"database\" | \"user\"\n        \"flow_sink\"?: String,                    // \"external_model\" | \"local_model\" | \"external_mcp\" | \"trusted_mcp\" | \"user_secure_output\" | \"public_network\" | \"file\"\n        \"flow_sink_is_external\"?: Boolean,\n        \"flow_sink_effects\"?: Set<String>,       // \"network.send\" | \"financial.transfer\" | \"filesystem.write\" | ...\n        \"principal_clearances\"?: Set<String>,    // ADR 0020 D8 \u2014 clearances AuthN mints for the principal\n        \"principal_compartments\"?: Set<String>,  // ADR 0020 D8 \u2014 compartments the principal is admitted to\n\n        // Usage Budget (optional)\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Boolean,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Boolean,\n        \"budget_exceeded_daily\"?: Boolean,\n        \"budget_exceeded_monthly\"?: Boolean,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Boolean,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Boolean,\n\n        // Agent Identity (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n        // Supply-chain / package safety + aggregate threat severity (optional \u2014\n        // ADR 0012 unified port). Projected by Shield's malicious-package and\n        // threat-severity detectors; every read is `has`-guarded in policy.\n        \"malicious_package_detected\"?: Boolean,\n        \"package_install_detected\"?: Boolean,\n        \"package_check_status\"?: String,\n        \"max_threat_severity\"?: Long,\n\n    };\n\n    /// Context for provision_sandbox action (Forge sandbox-create envelope).\n    ///\n    /// Every capability field below is OPTIONAL and describes the envelope the\n    /// sandbox is being asked to provision with \u2014 Forge synthesizes it from the\n    /// create request attenuated by the token's scope ceiling (ADR 0019 D1),\n    /// then asks Cedar whether this identity may provision it. Profile templates\n    /// `permit` provision_sandbox only when the requested envelope stays within\n    /// the profile ceiling, and `forbid` any escalation beyond it.\n    ///\n    /// FAIL-OPEN WARNING (ADR 0019 D3): because these attributes are optional,\n    /// accessing an absent one is a Cedar *evaluation error*, and an errored\n    /// `forbid` is silently skipped \u2014 which fails OPEN. Every rule touching a\n    /// field here MUST guard it first with `has` (e.g.\n    /// `context has mechanism_capabilities && context.mechanism_capabilities.contains(\"sys:ptrace\")`).\n    type ProvisionSandboxContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\" | \"mcp_server\"\n        \"principal\"?: String,            // Stable principal identifier (ZeroID / WIMSE URI or user id)\n        \"agent_trust_level\"?: String,    // \"untrusted\" | \"low\" | \"verified\" | \"trusted\"\n\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Requested isolation tier (required) \u2014 the OS-isolation tier the\n        // sandbox will run at, as the lowercased Forge IsolationTier name (ADR\n        // 0016 D1). Ordinal, weakest\u2192strongest: \"none\" (trusted-local) < \"os\"\n        // (bwrap/seatbelt) < \"kernel\" (gVisor) < \"hardware\" (micro-VM + TEE).\n        // Templates assert a floor via set membership (e.g. a KERNEL floor =\n        // {\"kernel\",\"hardware\"}); Forge owns the ordering.\n        \"isolation_tier\": String,\n\n        // Requested capability envelope (all optional \u2014 has-guard mandatory).\n        \"writable_paths\"?: Set<String>,        // Writable path prefixes, e.g. {\"/scratch\"}\n        // Master egress switch. Forge MUST set this true whenever ANY egress is\n        // requested (i.e. whenever egress_hosts is non-empty), so a \"no network\"\n        // profile can gate on this single boolean. egress_hosts then narrows the\n        // host allowlist for profiles that DO permit egress.\n        \"network_egress\"?: Boolean,\n        \"egress_hosts\"?: Set<String>,          // Host allowlist for egress, e.g. {\"pypi.org\"}\n        \"exec_allowlist\"?: Set<String>,        // Executables the sandbox may run, e.g. {\"python\", \"python3\"}\n        // Curated mechanism toggles (ADR 0017 D1.3) \u2014 authorization facts only;\n        // NEVER raw syscalls. Allowed members: \"sys:ptrace\", \"sys:bpf\",\n        // \"sys:raw_socket\", \"dev:gpu\", \"virt:nested\".\n        \"mechanism_capabilities\"?: Set<String>,\n    };\n}\n";
 /**
  * AiGateway Cedar schema
  *
  * Full Cedar schema for ai_gateway, embedded at codegen time.
  */
-export declare const AI_GATEWAY_SCHEMA = "// AIGateway Cedar Schema\n// ===================================\n// AI Gateway Security & Policy Enforcement\n//\n// AIGateway protects both MCP proxy operations (tool calls, server connections)\n// and LLM chat completions (prompt processing) by evaluating threats detected\n// by the Shield detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   MCP/LLM Client -> Firehog Proxy -> Shield (detection + Cedar) -> Allow/Deny\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01, LLM06)\n//   - OWASP Top 10 for Agentic Applications (ASI01, ASI02, ASI04)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n\nnamespace AIGateway {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// AIGateway does not use App/Session hierarchy.\n//\n// Entity hierarchy:\n//   Account (org root)\n//     -> Project in [Account]\n//          -> Tool/Server in [Project]\n//\n// Policy scoping examples:\n//   resource == AIGateway::Tool::\"get_me\"            -> specific tool\n//   resource in AIGateway::Project::\"<uuid>\"          -> project-wide\n//   resource in AIGateway::Account::\"<uuid>\"          -> org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user authenticated via JWT or API key\nentity User;\n\n/// MCP client (default principal for unauthenticated requests)\nentity MCP_Client;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// MCP tool -- resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server -- resource for connect_server action\nentity Server in [Project];\n\n/// MCP prompt -- resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// File/resource path -- resource for read_file/write_file actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// Call an MCP tool\n// Threat focus: command injection, tool poisoning, rug pull, secrets, PII\naction call_tool appliesTo {\n  principal: [User, MCP_Client],\n  resource: [Tool],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Content ---\n    content: String,                  // Raw content being scanned\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Tool name\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- Threat Detection (from Shield detection pipeline) ---\n    threat_count?: Long,              // Total threats detected\n    highest_severity?: String,        // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories?: Set<String>,  // Threat category names\n    detected_threats?: Set<String>,   // Detection rule names that matched\n    max_threat_severity?: Long,       // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected?: Bool,          // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score?: Long,      // Prompt injection classifier confidence\n    jailbreak_score?: Long,      // Jailbreak detection classifier confidence\n\n    // --- Agent Security (0-100) ---\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,\n    tool_is_builtin?: Bool,\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Behavioral Analysis ---\n    loop_detected?: Bool,\n    loop_count?: Long,\n    loop_tool?: String,\n    suspicious_pattern?: Bool,\n    pattern_type?: String,\n    sequence_risk?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, MCP_Client],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) ---\n    tool_poisoning_score?: Long,\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,\n\n    // --- Secrets ---\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,\n    mcp_config_risk?: Bool,\n    mcp_risk_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Process a prompt (MCP prompts/get or LLM chat completions)\n// Threat focus: injection, jailbreak, secrets, PII, content safety\naction process_prompt appliesTo {\n  principal: [User, MCP_Client],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score?: Long,\n    jailbreak_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- Encoding ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- LLM-specific ---\n    model_name?: String,              // Target model name (e.g., \"gpt-4\", \"claude-3-opus\")\n    model_provider?: String,          // Provider name (e.g., \"openai\", \"anthropic\", \"bedrock\")\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Read an MCP resource (resources/read, resources/list)\n// Threat focus: secrets exposure, PII exposure, sensitive paths\naction read_file appliesTo {\n  principal: [User, MCP_Client],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Write an MCP resource (resources/write)\n// Threat focus: secrets in output, PII in output\naction write_file appliesTo {\n  principal: [User, MCP_Client],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n}\n";
+export declare const AI_GATEWAY_SCHEMA = "// AIGateway Cedar Schema\n// ===================================\n// AI Gateway Security & Policy Enforcement\n//\n// AIGateway protects both MCP proxy operations (tool calls, server connections)\n// and LLM chat completions (prompt processing) by evaluating threats detected\n// by the Shield detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   MCP/LLM Client -> Firehog Proxy -> Shield (detection + Cedar) -> Allow/Deny\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01, LLM06)\n//   - OWASP Top 10 for Agentic Applications (ASI01, ASI02, ASI04)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n\nnamespace AIGateway {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// AIGateway does not use App/Session hierarchy.\n//\n// Entity hierarchy:\n//   Account (org root)\n//     -> Project in [Account]\n//          -> Tool/Server in [Project]\n//\n// Policy scoping examples:\n//   resource == AIGateway::Tool::\"get_me\"            -> specific tool\n//   resource in AIGateway::Project::\"<uuid>\"          -> project-wide\n//   resource in AIGateway::Account::\"<uuid>\"          -> org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user authenticated via JWT or API key\nentity User;\n\n/// MCP client (default principal for unauthenticated requests)\nentity MCP_Client;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// MCP tool -- resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server -- resource for connect_server action\nentity Server in [Project];\n\n/// MCP prompt -- resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// File/resource path -- resource for read_file/write_file actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// Call an MCP tool\n// Threat focus: command injection, tool poisoning, rug pull, secrets, PII\naction call_tool appliesTo {\n  principal: [User, MCP_Client],\n  resource: [Tool],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Content ---\n    content: String,                  // Raw content being scanned\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Tool name\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- Threat Detection (from Shield detection pipeline) ---\n    threat_count?: Long,              // Total threats detected\n    highest_severity?: String,        // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories?: Set<String>,  // Threat category names\n    detected_threats?: Set<String>,   // Detection rule names that matched\n    max_threat_severity?: Long,       // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected?: Bool,          // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score?: Long,      // Prompt injection classifier confidence\n    jailbreak_score?: Long,      // Jailbreak detection classifier confidence\n\n    // --- Agent Security (0-100) ---\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,\n    tool_is_builtin?: Bool,\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Bash AST resolved target paths (#411 / CAP-DET-007) \u2014 newline-delimited (leading+trailing \\n); Cedar `like` is anchored so patterns start with \"*\": sub-tree \"*\\n/etc/*\", bare dir \"*\\n/etc\\n*\", exact \"*\\n/etc/passwd\\n*\" ---\n    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability\n    read_target_paths?: String,      // paths the command reads or enumerates\n    write_target_paths?: String,     // paths the command writes, creates, or destroys\n    exec_target_paths?: String,      // paths executed as a script\n    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Behavioral Analysis ---\n    loop_detected?: Bool,\n    loop_count?: Long,\n    loop_tool?: String,\n    suspicious_pattern?: Bool,\n    pattern_type?: String,\n    sequence_risk?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, MCP_Client],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) ---\n    tool_poisoning_score?: Long,\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,\n\n    // --- Secrets ---\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,\n    mcp_config_risk?: Bool,\n    mcp_risk_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Process a prompt (MCP prompts/get or LLM chat completions)\n// Threat focus: injection, jailbreak, secrets, PII, content safety\naction process_prompt appliesTo {\n  principal: [User, MCP_Client],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    injection_score?: Long,\n    jailbreak_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- Encoding ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- LLM-specific ---\n    model_name?: String,              // Target model name (e.g., \"gpt-4\", \"claude-3-opus\")\n    model_provider?: String,          // Provider name (e.g., \"openai\", \"anthropic\", \"bedrock\")\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Read an MCP resource (resources/read, resources/list)\n// Threat focus: secrets exposure, PII exposure, sensitive paths\naction read_file appliesTo {\n  principal: [User, MCP_Client],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n// Write an MCP resource (resources/write)\n// Threat focus: secrets in output, PII in output\naction write_file appliesTo {\n  principal: [User, MCP_Client],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Session-Aware Threat Aggregation ---\n    session_threat_turns?: Long,                  // Count of turns with detected threats\n    session_cumulative_risk_score?: Long,         // Accumulated risk across turns\n    session_injection_detected?: Bool,            // Injection seen in any prior turn\n    session_command_injection?: Bool,             // Command injection seen in any prior turn\n    session_pii_detected?: Bool,                  // PII seen in any prior turn\n    session_pii_types?: Set<String>,              // PII types accumulated across session\n    session_secrets_detected?: Bool,              // Secrets seen in any prior turn\n    session_secret_types?: Set<String>,           // Secret types accumulated across session\n    session_max_injection_score?: Long,           // Max injection score across session turns\n    session_max_jailbreak_score?: Long,           // Max jailbreak score across session turns\n    session_max_command_injection_score?: Long,   // Max command-injection score across session turns\n    session_max_pii_score?: Long,                 // Max pii score across session turns\n    session_max_secret_score?: Long,              // Max secret score across session turns\n\n    // --- Usage Budget (multi-window, multi-dimension) ---\n    budget_remaining_pct?: Long,\n    budget_exceeded?: Bool,\n    budget_cost_micros_this_turn?: Long,\n    budget_model?: String,\n    budget_tokens_pct_session?: Long,\n    budget_tokens_pct_daily?: Long,\n    budget_tokens_pct_monthly?: Long,\n    budget_cost_pct_daily?: Long,\n    budget_cost_pct_monthly?: Long,\n    budget_exceeded_session?: Bool,\n    budget_exceeded_daily?: Bool,\n    budget_exceeded_monthly?: Bool,\n\n    // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n    rpm_remaining_pct?: Long,\n    rpm_exceeded?: Bool,\n    tpm_remaining_pct?: Long,\n    tpm_exceeded?: Bool,\n  },\n};\n\n}\n";
 /**
  * Guardrails Cedar schema
  *
  * Full Cedar schema for guardrails, embedded at codegen time.
  */
-export declare const GUARDRAILS_SCHEMA = "// =============================================================================\n// Guardrails Cedar Schema\n// =============================================================================\n// Defines entity types, actions, and context attributes for the highflame-shield\n// guardrails service. This schema enables type-safe policy authoring and\n// validation in both Studio UI and backend.\n//\n// Service: highflame-shield (guardrails)\n// Namespace: Guardrails\n// =============================================================================\n\nnamespace Guardrails {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource == Guardrails::App::\"<uuid>\"              \u2192 app-scoped (app only)\n    //   resource == Guardrails::Agent::\"<agent_id>\"        \u2192 agent-only (exact match)\n    //   resource in Guardrails::Agent::\"<agent_id>\"        \u2192 agent + its sessions\n    //   resource in Guardrails::Project::\"<uuid>\"          \u2192 project-wide (apps + agents)\n    //   resource in Guardrails::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests.\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in Guardrails::Agent::\"<agent_id>\" (hierarchy match)\n    /// Agent only:       resource == Guardrails::Agent::\"<agent_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Bool,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100) \u2014 catches novel PII patterns that escape regex detection\n\n        // Threat Severity Aggregation (optional)\n        \"highest_severity\"?: String,     // Highest severity across all detectors: \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Bool,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | \"code_execution\" | \"destructive_command\" | \"data_exfiltration\"\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | \"blind\" | \"error_based\"\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Bool,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Bool,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Bool,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100, percentage of content that is code\n        \"keyword_matched\"?: Bool,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Bool,\n        \"phishing_detected\"?: Bool,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Bool,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // Emitted by usage_budget detector. Enforced across session/daily/monthly windows\n        // and user/app/project/account dimensions. Percentages are 0-100.\n        \"budget_remaining_pct\"?: Long,          // Min remaining % across all windows\n        \"budget_exceeded\"?: Bool,               // Any window limit exceeded\n        \"budget_cost_micros_this_turn\"?: Long,  // Cost of this request in microdollars (USD * 1e6)\n        \"budget_model\"?: String,                // Model name used for cost calculation\n        \"budget_tokens_pct_session\"?: Long,     // Session token usage % (0-100)\n        \"budget_tokens_pct_daily\"?: Long,       // Daily token usage % (0-100)\n        \"budget_tokens_pct_monthly\"?: Long,     // Monthly token usage % (0-100)\n        \"budget_cost_pct_daily\"?: Long,         // Daily cost usage % (0-100)\n        \"budget_cost_pct_monthly\"?: Long,       // Monthly cost usage % (0-100)\n        \"budget_exceeded_session\"?: Bool,       // Session-scoped budget exceeded\n        \"budget_exceeded_daily\"?: Bool,         // Any daily-scoped budget exceeded\n        \"budget_exceeded_monthly\"?: Bool,       // Any monthly-scoped budget exceeded\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        // Present when the request is made by an AI agent (API key or JWT with agent claims).\n        // Empty strings for human user requests. Use these to write agent-specific policies.\n        \"agent_id\"?: String,             // Unique agent identifier (e.g., \"agent_research_v3\")\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,      // Agent framework (e.g., \"claude-code\", \"langchain\", \"crewai\")\n        \"agent_publisher\"?: String,      // Organization that published the agent\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,            // \"shell\", \"write_file\", \"http_post\", etc.\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Bool,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Bool,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation.\n        // Structured tool-call arguments, projected and type-coerced by Shield so\n        // policies can validate them by type / range / pattern / allowlist /\n        // blocklist \u2014 e.g.\n        //   forbid ... when { context.action_params has amount &&\n        //                     context.action_params.amount > 10000 };\n        // Only well-known, safety-relevant argument names are projected; each value\n        // is coerced to its declared type. An argument that is present but NOT\n        // coercible to its declared type is dropped (so policies never read a\n        // wrong-typed value) and its name is recorded in `param_type_violations`.\n        \"action_params\"?: {\n            \"amount\"?: Long,        // numeric \u2014 range limits (e.g. transfer / spend amount)\n            \"count\"?: Long,         // numeric \u2014 range limits (e.g. batch size, fan-out)\n            \"command\"?: String,     // string  \u2014 allowlist / blocklist / pattern (e.g. shell command)\n            \"path\"?: String,        // string  \u2014 pattern (e.g. filesystem path)\n            \"url\"?: String,         // string  \u2014 pattern / allowlist (e.g. egress host)\n            \"recipient\"?: String,   // string  \u2014 allowlist / pattern (e.g. payout / email target)\n            \"target\"?: String,      // string  \u2014 allowlist (e.g. resource / table name)\n            \"query\"?: String,       // string  \u2014 pattern (e.g. SQL / search query)\n        },\n        // True when any projected argument was present but failed type coercion\n        // (e.g. a non-numeric `amount`). Lets a policy deny on a type violation\n        // instead of the wrong-typed value silently vanishing.\n        \"param_type_violation\"?: Bool,\n        // Names of the arguments that were present but failed type coercion.\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional \u2014 only present for MCP tool calls)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_tool\"?: String,             // MCP tool name within the server\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Bool,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | \"db_exfiltration\" | \"credential_theft\" | \"destructive_sequence\" | \"none\"\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Bool,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,          // Min remaining % across all windows\n        \"budget_exceeded\"?: Bool,               // Any window limit exceeded\n        \"budget_cost_micros_this_turn\"?: Long,  // Cost of this request in microdollars\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,              // Number of PII pattern matches in tool content\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // File & Path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path when tool operates on files\n\n        // Security - Invisible Character Detection in tool args (optional)\n        \"invisible_chars_detected\"?: Bool,       // Whether invisible Unicode chars detected in tool args\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,           // 0-100\n        \"tool_poisoning_type\"?: String,          // \"hidden_instructions\" | \"system_prompt_injection\" | \"authority_hijack\"\n        \"rug_pull_detected\"?: Bool,\n        \"rug_pull_score\"?: Long,                 // 0-100\n        \"rug_pull_type\"?: String,                // \"risk_spike\" | \"pattern_change\" | \"combined\" | \"none\"\n\n        // Agentic - Indirect Prompt Injection (optional \u2014 injection via tool outputs/retrieved content)\n        \"indirect_injection_score\"?: Long,       // Indirect injection risk score (0-100)\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,                // \"inline_execution\" | \"suspicious_url\" | \"cross_origin\"\n        \"mcp_risk_score\"?: Long,                 // 0-100\n\n        // Agentic - MCP Input Requests (optional) \u2014 an MCP server asking the CLIENT to act\n        // on its behalf: elicitation/create (prompt a human), sampling/createMessage (drive\n        // the client's model), roots/list (enumerate its filesystem). Carried in-band as\n        // InputRequiredResult.inputRequests under the MRTR pattern (MCP 2026-07-28), and\n        // out-of-band by the gateway relay for earlier peers. INV-DET-002.\n        \"mcp_input_request_detected\"?: Bool,\n        \"mcp_input_request_score\"?: Long,        // 0-100\n        \"mcp_input_request_types\"?: Set<String>, // subset of {\"credential_elicitation\", \"sampling_injection\", \"root_probe\"}\n        // The requested methods, independent of content. Lets a policy refuse a capability\n        // outright (\"never permit sampling/createMessage from an unverified server\") rather\n        // than only reacting to a payload we managed to classify.\n        \"mcp_input_request_methods\"?: Set<String>, // subset of {\"elicitation/create\", \"sampling/createMessage\", \"roots/list\"}\n\n        // Tool Operation Classifier (optional) \u2014 populated by AST-based classifiers (bash, python, etc.)\n        \"tool_operation_classes\"?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                 // File path being read\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path being written\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Bool,       // Whether invisible Unicode chars detected in write content\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n}\n";
+export declare const GUARDRAILS_SCHEMA = "// =============================================================================\n// Guardrails Cedar Schema\n// =============================================================================\n// Defines entity types, actions, and context attributes for the highflame-shield\n// guardrails service. This schema enables type-safe policy authoring and\n// validation in both Studio UI and backend.\n//\n// Service: highflame-shield (guardrails)\n// Namespace: Guardrails\n// =============================================================================\n\nnamespace Guardrails {\n    // =========================================================================\n    // Entity Types \u2014 ReBAC Hierarchy\n    // =========================================================================\n    // Entity hierarchy enables Cedar's `in` operator for policy scoping:\n    //   Account (org root)\n    //     \u2514\u2500\u2500 Project in [Account]\n    //           \u251C\u2500\u2500 App in [Project]\n    //           \u2502     \u2514\u2500\u2500 Session in [App, Agent]\n    //           \u2514\u2500\u2500 Agent in [Project]\n    //                 \u2514\u2500\u2500 Session in [App, Agent]\n    //\n    // Policy scoping examples:\n    //   resource == Guardrails::App::\"<uuid>\"              \u2192 app-scoped (app only)\n    //   resource == Guardrails::Agent::\"<agent_id>\"        \u2192 agent-only (exact match)\n    //   resource in Guardrails::Agent::\"<agent_id>\"        \u2192 agent + its sessions\n    //   resource in Guardrails::Project::\"<uuid>\"          \u2192 project-wide (apps + agents)\n    //   resource in Guardrails::Account::\"<uuid>\"          \u2192 org-wide\n    // =========================================================================\n\n    /// Account represents an organization (top-level tenant)\n    entity Account;\n\n    /// Project represents a project within an account\n    entity Project in [Account];\n\n    /// User represents a principal (human or service) making requests\n    entity User;\n\n    /// Agent represents an AI agent (Claude, Cursor, Copilot, etc.) making requests.\n    /// Used as both principal (who is acting) and resource (policy scoping target).\n    /// Agent + sessions: resource in Guardrails::Agent::\"<agent_id>\" (hierarchy match)\n    /// Agent only:       resource == Guardrails::Agent::\"<agent_id>\" (exact match)\n    entity Agent in [Project];\n\n    /// App represents a protected application (guardrails-enabled LLM app)\n    entity App in [Project];\n\n    /// Session represents an agentic conversation session with state tracking.\n    /// Sessions can belong to either an App or an Agent.\n    entity Session in [App, Agent];\n\n    // =========================================================================\n    // Actions\n    // =========================================================================\n\n    /// Process user prompts and AI responses for security threats and content violations\n    action \"process_prompt\" appliesTo {\n        principal: [User, Agent],\n        resource: [App, Agent, Session],\n        context: ProcessPromptContext\n    };\n\n    /// Execute tool calls (shell, file operations, MCP tools)\n    action \"call_tool\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: CallToolContext\n    };\n\n    /// Read file operations\n    action \"read_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileReadContext\n    };\n\n    /// Write file operations\n    action \"write_file\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: FileWriteContext\n    };\n\n    /// Connect to an MCP server\n    action \"connect_server\" appliesTo {\n        principal: [User, Agent],\n        resource: [Agent, Session],\n        context: ConnectServerContext\n    };\n\n    // =========================================================================\n    // Context Types (Action-Specific)\n    // =========================================================================\n\n    /// Context for process_prompt action (user prompts & AI responses)\n    type ProcessPromptContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n        \"direction\": String,        // \"input\" | \"output\"\n        \"content_type\": String,     // \"prompt\" | \"response\" | \"tool_call\" | \"file\"\n        \"detector_count\": Long,\n\n        // Security - Injection & Jailbreak (optional)\n        \"injection_score\"?: Long,  // Combined injection confidence: MAX(pulse, deep_context)\n        \"jailbreak_score\"?: Long,  // Combined jailbreak confidence: MAX(pulse, deep_context)\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"jailbreak_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"jailbreak_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n        \"injection_type\"?: String,       // \"prompt\" | \"sql\" | \"command\" | \"none\"\n\n        // Privacy - Secrets (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,    // [\"aws_access_key\", \"github_token\", ...]\n\n        // Privacy - PII (optional)\n        \"pii_detected\"?: Bool,\n        \"pii_count\"?: Long,\n        \"pii_types\"?: Set<String>,       // [\"email\", \"phone\", \"ssn\", \"credit_card\", ...]\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100) \u2014 catches novel PII patterns that escape regex detection\n\n        // Threat Severity Aggregation (optional)\n        \"highest_severity\"?: String,     // Highest severity across all detectors: \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n\n        // Trust & Safety - Toxicity (optional)\n        \"violence_score\"?: Long,         // 0-100\n        \"hate_speech_score\"?: Long,      // 0-100\n        \"sexual_score\"?: Long,           // 0-100\n        \"weapons_score\"?: Long,          // 0-100\n        \"crime_score\"?: Long,            // 0-100\n        \"profanity_score\"?: Long,        // 0-100\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security - Invisible Character Detection (optional)\n        \"invisible_chars_detected\"?: Bool,\n        \"invisible_chars_score\"?: Long,      // 0-100\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,       // \"reverse_shell\" | \"privilege_escalation\" | \"code_execution\" | \"destructive_command\" | \"data_exfiltration\"\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,      // \"critical\" | \"high\" | \"medium\" | \"low\" | \"none\"\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,           // \"tautology\" | \"union_based\" | \"destructive\" | \"blind\" | \"error_based\"\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,            // \"cross_origin_tool\" | \"cross_origin_server\" | \"none\"\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,           // [\"base64\", \"hex\", \"unicode\", \"url\", ...]\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Language & Script Detection (optional)\n        \"detected_language\"?: String,            // ISO language code\n        \"is_english\"?: Bool,\n        \"language_confidence\"?: Long,            // 0-100\n        \"detected_script\"?: String,              // \"latin\" | \"cyrillic\" | \"arabic\" | \"unknown\" | ...\n        \"is_latin_script\"?: Bool,\n        \"script_confidence\"?: Long,              // 0-100\n\n        // Content Analysis (optional)\n        \"hallucination_score\"?: Long,\n        \"factuality_score\"?: Long,               // 0-100\n        \"sentiment_score\"?: Long,\n        \"contains_code\"?: Bool,\n        \"code_languages\"?: Set<String>,\n        \"code_ratio\"?: Long,                     // 0-100, percentage of content that is code\n        \"keyword_matched\"?: Bool,\n        \"keyword_categories\"?: Set<String>,\n        \"keyword_count\"?: Long,\n        \"contains_non_ascii\"?: Bool,\n        \"phishing_detected\"?: Bool,\n        \"content_safety_score\"?: Long,           // 0-100\n        \"content_safety_blocked\"?: Bool,\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // Emitted by usage_budget detector. Enforced across session/daily/monthly windows\n        // and user/app/project/account dimensions. Percentages are 0-100.\n        \"budget_remaining_pct\"?: Long,          // Min remaining % across all windows\n        \"budget_exceeded\"?: Bool,               // Any window limit exceeded\n        \"budget_cost_micros_this_turn\"?: Long,  // Cost of this request in microdollars (USD * 1e6)\n        \"budget_model\"?: String,                // Model name used for cost calculation\n        \"budget_tokens_pct_session\"?: Long,     // Session token usage % (0-100)\n        \"budget_tokens_pct_daily\"?: Long,       // Daily token usage % (0-100)\n        \"budget_tokens_pct_monthly\"?: Long,     // Monthly token usage % (0-100)\n        \"budget_cost_pct_daily\"?: Long,         // Daily cost usage % (0-100)\n        \"budget_cost_pct_monthly\"?: Long,       // Monthly cost usage % (0-100)\n        \"budget_exceeded_session\"?: Bool,       // Session-scoped budget exceeded\n        \"budget_exceeded_daily\"?: Bool,         // Any daily-scoped budget exceeded\n        \"budget_exceeded_monthly\"?: Bool,       // Any monthly-scoped budget exceeded\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        // Present when the request is made by an AI agent (API key or JWT with agent claims).\n        // Empty strings for human user requests. Use these to write agent-specific policies.\n        \"agent_id\"?: String,             // Unique agent identifier (e.g., \"agent_research_v3\")\n        \"agent_type\"?: String,           // \"orchestrator\" | \"autonomous\" | \"tool_agent\" | \"human_proxy\"\n        \"agent_trust_level\"?: String,    // \"first_party\" | \"verified_third_party\" | \"unverified\"\n        \"agent_framework\"?: String,      // Agent framework (e.g., \"claude-code\", \"langchain\", \"crewai\")\n        \"agent_publisher\"?: String,      // Organization that published the agent\n\n    };\n\n    /// Context for call_tool action (agentic tool execution)\n    type CallToolContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // Tool Risk (optional)\n        \"tool_name\"?: String,            // \"shell\", \"write_file\", \"http_post\", etc.\n        \"tool_risk_score\"?: Long,        // 0-100\n        \"tool_is_sensitive\"?: Bool,\n        \"tool_category\"?: String,        // \"safe\" | \"sensitive\" | \"dangerous\"\n        \"tool_is_builtin\"?: Bool,\n\n        // AARM R3 (CAP-ENF-007) \u2014 Action Parameter Validation.\n        // Structured tool-call arguments, projected and type-coerced by Shield so\n        // policies can validate them by type / range / pattern / allowlist /\n        // blocklist \u2014 e.g.\n        //   forbid ... when { context.action_params has amount &&\n        //                     context.action_params.amount > 10000 };\n        // Only well-known, safety-relevant argument names are projected; each value\n        // is coerced to its declared type. An argument that is present but NOT\n        // coercible to its declared type is dropped (so policies never read a\n        // wrong-typed value) and its name is recorded in `param_type_violations`.\n        \"action_params\"?: {\n            \"amount\"?: Long,        // numeric \u2014 range limits (e.g. transfer / spend amount)\n            \"count\"?: Long,         // numeric \u2014 range limits (e.g. batch size, fan-out)\n            \"command\"?: String,     // string  \u2014 allowlist / blocklist / pattern (e.g. shell command)\n            \"path\"?: String,        // string  \u2014 pattern (e.g. filesystem path)\n            \"url\"?: String,         // string  \u2014 pattern / allowlist (e.g. egress host)\n            \"recipient\"?: String,   // string  \u2014 allowlist / pattern (e.g. payout / email target)\n            \"target\"?: String,      // string  \u2014 allowlist (e.g. resource / table name)\n            \"query\"?: String,       // string  \u2014 pattern (e.g. SQL / search query)\n        },\n        // True when any projected argument was present but failed type coercion\n        // (e.g. a non-numeric `amount`). Lets a policy deny on a type violation\n        // instead of the wrong-typed value silently vanishing.\n        \"param_type_violation\"?: Bool,\n        // Names of the arguments that were present but failed type coercion.\n        \"param_type_violations\"?: Set<String>,\n\n        // MCP context (optional \u2014 only present for MCP tool calls)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_tool\"?: String,             // MCP tool name within the server\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Behavioral Patterns (optional)\n        \"suspicious_pattern\"?: Bool,\n        \"pattern_type\"?: String,         // \"data_exfiltration\" | \"secret_exfiltration\" | \"db_exfiltration\" | \"credential_theft\" | \"destructive_sequence\" | \"none\"\n        \"sequence_risk\"?: Long,          // 0-100\n\n        // Agentic - Loop Detection (optional)\n        \"loop_detected\"?: Bool,\n        \"loop_count\"?: Long,\n        \"loop_tool\"?: String,\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,          // Min remaining % across all windows\n        \"budget_exceeded\"?: Bool,               // Any window limit exceeded\n        \"budget_cost_micros_this_turn\"?: Long,  // Cost of this request in microdollars\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Semantic - Topic Classification (optional)\n        \"content_topics\"?: Set<String>,      // [\"controlled_substances\", \"weapons_manufacturing\", ...]\n        \"topic_confidence\"?: Long,           // 0-100\n\n        // Security checks on tool arguments (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n        \"pii_count\"?: Long,              // Number of PII pattern matches in tool content\n        \"pii_score\"?: Long,         // PII ML classifier confidence (0-100)\n        \"injection_score\"?: Long,\n        \"injection_pulse_score\"?: Long,  // 0-100 Pulse single-turn classifier\n        \"injection_deep_context_score\"?: Long, // 0-100 DeepContext multi-turn\n\n        // Security - Pattern Detection (optional)\n        \"command_injection_detected\"?: Bool,\n        \"command_injection_type\"?: String,\n        \"command_injection_score\"?: Long,        // 0-100\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n        \"sql_injection_detected\"?: Bool,\n        \"sql_injection_type\"?: String,\n        \"sql_injection_score\"?: Long,            // 0-100\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,             // 0-100\n\n        // File & Path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path when tool operates on files\n\n        // Security - Invisible Character Detection in tool args (optional)\n        \"invisible_chars_detected\"?: Bool,       // Whether invisible Unicode chars detected in tool args\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security - Encoded Injection (optional)\n        \"encoded_content_detected\"?: Bool,\n        \"encoded_types\"?: Set<String>,\n        \"encoded_count\"?: Long,\n        \"encoded_score\"?: Long,                  // 0-100\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,           // 0-100\n        \"tool_poisoning_type\"?: String,          // \"hidden_instructions\" | \"system_prompt_injection\" | \"authority_hijack\"\n        \"rug_pull_detected\"?: Bool,\n        \"rug_pull_score\"?: Long,                 // 0-100\n        \"rug_pull_type\"?: String,                // \"risk_spike\" | \"pattern_change\" | \"combined\" | \"none\"\n\n        // Agentic - Indirect Prompt Injection (optional \u2014 injection via tool outputs/retrieved content)\n        \"indirect_injection_score\"?: Long,       // Indirect injection risk score (0-100)\n        \"indirect_injection_type\"?: String,      // Type of indirect injection detected\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,                // \"inline_execution\" | \"suspicious_url\" | \"cross_origin\"\n        \"mcp_risk_score\"?: Long,                 // 0-100\n\n        // Agentic - MCP Input Requests (optional) \u2014 an MCP server asking the CLIENT to act\n        // on its behalf: elicitation/create (prompt a human), sampling/createMessage (drive\n        // the client's model), roots/list (enumerate its filesystem). Carried in-band as\n        // InputRequiredResult.inputRequests under the MRTR pattern (MCP 2026-07-28), and\n        // out-of-band by the gateway relay for earlier peers. INV-DET-002.\n        \"mcp_input_request_detected\"?: Bool,\n        \"mcp_input_request_score\"?: Long,        // 0-100\n        \"mcp_input_request_types\"?: Set<String>, // subset of {\"credential_elicitation\", \"sampling_injection\", \"root_probe\"}\n        // The requested methods, independent of content. Lets a policy refuse a capability\n        // outright (\"never permit sampling/createMessage from an unverified server\") rather\n        // than only reacting to a payload we managed to classify.\n        \"mcp_input_request_methods\"?: Set<String>, // subset of {\"elicitation/create\", \"sampling/createMessage\", \"roots/list\"}\n\n        // Tool Operation Classifier (optional) \u2014 populated by AST-based classifiers (bash, python, etc.)\n        \"tool_operation_classes\"?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n        // --- Bash AST resolved target paths (#411 / CAP-DET-007) \u2014 newline-delimited (leading+trailing \\n); Cedar `like` is anchored so patterns start with \"*\": sub-tree \"*\\n/etc/*\", bare dir \"*\\n/etc\\n*\", exact \"*\\n/etc/passwd\\n*\" ---\n        \"resolved_target_paths\"?: String,  // union of resolved absolute target paths, any capability\n        \"read_target_paths\"?: String,      // paths the command reads or enumerates\n        \"write_target_paths\"?: String,     // paths the command writes, creates, or destroys\n        \"exec_target_paths\"?: String,      // paths executed as a script\n        \"unresolved_target\"?: Bool,        // a target hid behind a variable/glob/$()/inline code, or the path-list cap truncated\n\n        // Agentic - Multi-Turn Context (optional)\n        \"conversation_turn\"?: Long,\n        \"multi_turn_detection\"?: Bool,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for read_file action\n    type FileReadContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                 // File path being read\n\n        // Security checks on file content (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for write_file action\n    type FileWriteContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // File path (optional \u2014 for path-based access control policies)\n        \"path\"?: String,                         // File path being written\n\n        // Security - Invisible Character Detection in write content (optional)\n        \"invisible_chars_detected\"?: Bool,       // Whether invisible Unicode chars detected in write content\n        \"invisible_chars_score\"?: Long,          // Invisible character attack severity (0-100)\n\n        // Security checks on content being written (optional)\n        \"secrets_detected\"?: Bool,\n        \"secret_count\"?: Long,\n        \"secret_types\"?: Set<String>,\n        \"pii_detected\"?: Bool,\n        \"pii_types\"?: Set<String>,\n\n        // Security - Path Traversal (optional)\n        \"path_traversal_detected\"?: Bool,\n        \"path_traversal_severity\"?: String,\n        \"path_traversal_type\"?: String,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n\n    /// Context for connect_server action (MCP server connections)\n    type ConnectServerContext = {\n        // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n        \"role\"?: String,\n        \"privilege_scope\"?: Set<String>,\n        \"identity_type\"?: String,        // Principal identity class: \"human\" | \"agent\" | \"service\"\n        \"principal\"?: String,            // Stable principal identifier (e.g. ZeroID / WIMSE URI or user id)\n        // Core metadata (required)\n        \"request_id\": String,\n        \"timestamp\": Long,\n\n        // MCP context (optional)\n        \"mcp_server\"?: String,           // MCP server name (e.g., \"github\", \"filesystem\")\n        \"mcp_server_verified\"?: Bool,    // Whether server is from verified registry\n\n        // Agentic - Agent Security (optional)\n        \"tool_poisoning_detected\"?: Bool,\n        \"tool_poisoning_score\"?: Long,\n        \"tool_poisoning_type\"?: String,\n\n        // Agentic - MCP Risk (optional)\n        \"mcp_config_risk\"?: Bool,\n        \"mcp_risk_type\"?: String,\n        \"mcp_risk_score\"?: Long,\n\n        // Security - Cross-Origin Escalation (optional)\n        \"cross_origin_detected\"?: Bool,\n        \"cross_origin_type\"?: String,\n        \"cross_origin_score\"?: Long,\n\n        // Session Detection History \u2014 cross-turn sticky flags (optional)\n        \"session_pii_detected\"?: Bool,\n        \"session_pii_types\"?: Set<String>,\n        \"session_secrets_detected\"?: Bool,\n        \"session_secret_types\"?: Set<String>,\n        \"session_injection_detected\"?: Bool,\n        \"session_command_injection\"?: Bool,\n        \"session_threat_turns\"?: Long,\n        \"session_max_injection_score\"?: Long,\n        \"session_max_jailbreak_score\"?: Long,\n        \"session_max_command_injection_score\"?: Long,\n        \"session_max_pii_score\"?: Long,\n        \"session_max_secret_score\"?: Long,\n        \"session_cumulative_risk_score\"?: Long,\n        \"session_original_request\"?: String,     // The session's first user request (drift / goal-hijack policies)\n        \"session_max_sensitivity\"?: String,      // Highest data-sensitivity tier seen this session\n\n        // Usage Budget \u2014 multi-window token & cost enforcement (optional)\n        // See ProcessPromptContext for full documentation.\n        \"budget_remaining_pct\"?: Long,\n        \"budget_exceeded\"?: Bool,\n        \"budget_cost_micros_this_turn\"?: Long,\n        \"budget_model\"?: String,\n        \"budget_tokens_pct_session\"?: Long,\n        \"budget_tokens_pct_daily\"?: Long,\n        \"budget_tokens_pct_monthly\"?: Long,\n        \"budget_cost_pct_daily\"?: Long,\n        \"budget_cost_pct_monthly\"?: Long,\n        \"budget_exceeded_session\"?: Bool,\n        \"budget_exceeded_daily\"?: Bool,\n        \"budget_exceeded_monthly\"?: Bool,\n\n        // Rate Limiting \u2014 gateway-metered, Shield-decided (ADR 0014)\n        \"rpm_remaining_pct\"?: Long,\n        \"rpm_exceeded\"?: Bool,\n        \"tpm_remaining_pct\"?: Long,\n        \"tpm_exceeded\"?: Bool,\n\n        // Agent Identity \u2014 authenticated agent principal metadata (optional)\n        \"agent_id\"?: String,\n        \"agent_type\"?: String,\n        \"agent_trust_level\"?: String,\n        \"agent_framework\"?: String,\n        \"agent_publisher\"?: String,\n\n    };\n}\n";
 /**
  * Overwatch Cedar schema
  *
  * Full Cedar schema for overwatch, embedded at codegen time.
  */
-export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Inspect the OUTPUT of a tool that has already run.\n// Threat focus: a credential or PII printed by a tool entering the agent's\n// context. The tool has run, so a permission verdict is meaningless here \u2014 the\n// only enforcement available is rewriting or withholding what the model sees,\n// which is why transform rules (@redaction_strategy) are the point of this\n// action. Context is deliberately narrower than call_tool: pre-execution\n// signals (tool risk, loop, sequence) belong to the call, not its result.\naction post_tool_call appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath, LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,\n    mcp_server?: String,\n    mcp_tool?: String,\n\n    // --- Result ---\n    exit_code?: Long,                 // Absent when the IDE does not propagate it\n\n    // --- File & Path ---\n    path?: String,\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Secrets --- the primary signal for this surface\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Indirect injection via tool output --- (OWASP ASI01)\n    indirect_injection_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_threat_turns?: Long,\n    session_max_secret_score?: Long,\n    session_max_pii_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
+export declare const OVERWATCH_SCHEMA = "// Overwatch Cedar Schema\n// ===================================\n// IDE Agent Security & Policy Enforcement\n//\n// Overwatch protects IDE agent operations (prompts, tool calls, file access, MCP connections)\n// by evaluating threats detected by the detection engine pipeline against Cedar policies.\n//\n// Architecture:\n//   User/Agent \u2192 IDE Hook \u2192 Detection Engine \u2192 Cedar Policy \u2192 Allow/Deny\n//\n// Supported IDEs:\n//   - Cursor (beforeSubmitPrompt, beforeShellExecution, beforeMCPExecution, etc.)\n//   - Claude Code (UserPromptSubmit, PreToolUse)\n//   - GitHub Copilot (userPromptSubmitted, preToolUse)\n//\n// Threat Coverage:\n//   - OWASP Top 10 for LLM Applications 2025 (LLM01-LLM10)\n//   - OWASP Top 10 for Agentic Applications (ASI01-ASI10)\n//   - OWASP MCP Top 10 (MCP01-MCP05)\n//   - MITRE ATLAS Agent Techniques (AML.T0051, AML.T0080-T0082)\n\nnamespace Overwatch {\n\n// =============================================================================\n// ENTITIES - Tenant Hierarchy (ReBAC)\n// =============================================================================\n// Aligned with Guardrails entity hierarchy (Account \u2192 Project).\n// Overwatch does not have app-specific policies, so App is omitted.\n//\n// Entity hierarchy enables Cedar's `in` operator for policy scoping:\n//   Account (org root)\n//     \u2514\u2500\u2500 Project in [Account]\n//           \u2514\u2500\u2500 Tool/Server/FilePath/LlmPrompt in [Project]\n//\n// Policy scoping examples:\n//   resource == Overwatch::Tool::\"shell\"               \u2192 specific tool\n//   resource in Overwatch::Project::\"<uuid>\"            \u2192 project-wide\n//   resource in Overwatch::Account::\"<uuid>\"            \u2192 org-wide\n\n/// Account represents an organization (top-level tenant)\nentity Account;\n\n/// Project represents a project within an account\nentity Project in [Account];\n\n// =============================================================================\n// ENTITIES - Principals\n// =============================================================================\n\n/// Human user or service account making requests to the IDE\nentity User;\n\n/// AI agent (Claude, GitHub Copilot, etc.)\nentity Agent;\n\n// =============================================================================\n// ENTITIES - Resources (scoped under Project)\n// =============================================================================\n\n/// LLM prompt or session \u2014 resource for process_prompt action\nentity LlmPrompt in [Project];\n\n/// MCP tool or native IDE tool \u2014 resource for call_tool action\nentity Tool in [Project];\n\n/// MCP server \u2014 resource for connect_server action\nentity Server in [Project];\n\n/// File system path \u2014 resource for read_file/write_file/call_tool actions\nentity FilePath in [Project];\n\n// =============================================================================\n// ACTIONS\n// =============================================================================\n\n// User submits a prompt or receives AI response\n// Threat focus: injection, jailbreak, secrets, PII, content safety, invisible chars\naction process_prompt appliesTo {\n  principal: [User, Agent],\n  resource: [LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned\n    source: String,                   // IDE source: \"cursor\", \"claudecode\", \"github_copilot\"\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Workspace ---\n    cwd?: String,                     // Current working directory\n    workspace_root?: String,          // Workspace/repository root\n\n    // --- Threat Detection (from detection engine pipeline) ---\n    threat_count: Long,               // Total threats detected\n    highest_severity: String,         // \"critical\", \"high\", \"medium\", \"low\", \"none\"\n    threat_categories: Set<String>,   // Threat category names\n    detected_threats: Set<String>,    // Detection rule names that matched\n    max_threat_severity: Long,        // Numeric severity (0=none, 1=low, 2=medium, 3=high, 4=critical)\n    secrets_detected: Bool,           // Whether secrets/credentials detected\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,       // Types: \"aws_access_key\", \"github_token\", \"ssh_private_key\", etc.\n    secret_count?: Long,              // Number of distinct secrets found\n\n    // --- PII Detection ---\n    pii_detected?: Bool,              // Whether any PII patterns matched\n    pii_types?: Set<String>,          // Types: \"ssn\", \"credit_card\", \"email\", \"phone\", etc.\n    pii_count?: Long,                 // Number of PII matches\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,  // Zero-width chars, bidi overrides, tag chars detected\n    invisible_chars_score?: Long,     // Unicode attack severity (0-100)\n\n    // --- Content Safety Scores (0-100, from ML classifiers) ---\n    violence_score: Long,\n    weapons_score: Long,\n    hate_speech_score: Long,\n    crime_score: Long,\n    sexual_score: Long,\n    profanity_score: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score: Long,             // PII detection classifier confidence\n    injection_score: Long,       // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score: Long,       // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) ---\n    indirect_injection_score: Long,   // Indirect prompt injection risk (OWASP LLM01, ASI01)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    prompt_text?: String,             // Same as content (backward compatibility)\n    response_content?: String,        // Response content (if available)\n  },\n};\n\n// User calls a tool (native IDE tool or MCP tool)\n// Threat focus: command injection, tool poisoning, rug pull, data exfiltration, loops\naction call_tool appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // Raw content being scanned (e.g., shell command, tool args)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,               // Normalized tool name (\"shell\", \"read_file\", etc.)\n    mcp_server?: String,              // MCP server name\n    mcp_tool?: String,                // MCP tool name\n\n    // --- File & Path ---\n    path?: String,                    // File path (if file operation)\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Content Safety Scores (0-100) ---\n    violence_score?: Long,\n    weapons_score?: Long,\n    hate_speech_score?: Long,\n    crime_score?: Long,\n    sexual_score?: Long,\n    profanity_score?: Long,\n\n    // --- ML Detector Confidence Scores (0-100) ---\n    pii_score?: Long,\n    injection_score?: Long,      // Combined injection confidence: MAX(pulse, deep_context)\n    jailbreak_score?: Long,      // Combined jailbreak confidence: MAX(pulse, deep_context)\n    injection_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    injection_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n    jailbreak_pulse_score?: Long,     // 0-100 Pulse single-turn classifier\n    jailbreak_deep_context_score?: Long, // 0-100 DeepContext multi-turn\n\n    // --- Agent Security (0-100) --- (OWASP ASI01, ASI02, ASI04; MITRE AML.T0051)\n    tool_poisoning_score?: Long,      // Hidden instructions in tool description/args\n    tool_poisoning_detected?: Bool,   // Boolean flag for tool poisoning\n    rug_pull_score?: Long,            // Tool behavior drift after trust establishment\n    rug_pull_detected?: Bool,         // Boolean flag for rug pull\n    indirect_injection_score?: Long,  // Indirect injection via tool output\n\n    // --- Tool Risk Assessment ---\n    tool_risk_score?: Long,           // Computed tool risk (0-100)\n    tool_category?: String,           // \"safe\", \"sensitive\", \"dangerous\"\n    tool_is_sensitive?: Bool,         // Sensitivity classification\n    tool_is_builtin?: Bool,           // Built-in IDE tool vs MCP tool\n\n    // --- Behavioral Analysis --- (OWASP LLM10, ASI02, ASI08)\n    loop_detected?: Bool,             // Consecutive same-tool call loop\n    loop_count?: Long,                // Number of consecutive repeat calls\n    loop_tool?: String,               // Tool name in loop\n    suspicious_pattern?: Bool,        // Data exfiltration or attack sequence detected\n    pattern_type?: String,            // \"data_exfiltration\", \"secret_exfiltration\", \"credential_theft\", \"destructive_sequence\"\n    sequence_risk?: Long,             // Sequence risk score (0-100)\n\n    // --- MCP Trust ---\n    mcp_server_verified?: Bool,       // Whether server is from verified registry\n\n    // --- Tool Operation Classifier ---\n    tool_operation_classes?: Set<String>,  // subset of {\"readonly\", \"write_enabling\", \"execute_enabling\", \"network_access\", \"unknown\"}\n\n    // --- Bash AST resolved target paths (#411 / CAP-DET-007) \u2014 newline-delimited (leading+trailing \\n); Cedar `like` is anchored so patterns start with \"*\": sub-tree \"*\\n/etc/*\", bare dir \"*\\n/etc\\n*\", exact \"*\\n/etc/passwd\\n*\" ---\n    resolved_target_paths?: String,  // union of resolved absolute target paths, any capability\n    read_target_paths?: String,      // paths the command reads or enumerates\n    write_target_paths?: String,     // paths the command writes, creates, or destroys\n    exec_target_paths?: String,      // paths executed as a script\n    unresolved_target?: Bool,        // a target hid behind a variable/glob/$()/inline code\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Legacy ---\n    response_content?: String,\n  },\n};\n\n// Inspect the OUTPUT of a tool that has already run.\n// Threat focus: a credential or PII printed by a tool entering the agent's\n// context. The tool has run, so a permission verdict is meaningless here \u2014 the\n// only enforcement available is rewriting or withholding what the model sees,\n// which is why transform rules (@redaction_strategy) are the point of this\n// action. Context is deliberately narrower than call_tool: pre-execution\n// signals (tool risk, loop, sequence) belong to the call, not its result.\naction post_tool_call appliesTo {\n  principal: [User, Agent],\n  resource: [Tool, FilePath, LlmPrompt],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    // --- Event & Source ---\n    content: String,                  // The tool's OUTPUT (stdout+stderr, or serialized response)\n    source: String,                   // IDE source\n    event: String,                    // Hook event name\n    user_email: String,               // User identifier\n\n    // --- Tool & MCP ---\n    tool_name?: String,\n    mcp_server?: String,\n    mcp_tool?: String,\n\n    // --- Result ---\n    exit_code?: Long,                 // Absent when the IDE does not propagate it\n\n    // --- File & Path ---\n    path?: String,\n\n    // --- Workspace ---\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Secrets --- the primary signal for this surface\n    secrets_detected?: Bool,\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n    pii_score?: Long,\n\n    // --- Indirect injection via tool output --- (OWASP ASI01)\n    indirect_injection_score?: Long,\n\n    // --- Encoding & Unicode Attacks ---\n    invisible_chars_detected?: Bool,\n    invisible_chars_score?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_threat_turns?: Long,\n    session_max_secret_score?: Long,\n    session_max_pii_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Connect to an MCP server\n// Threat focus: supply chain, tool poisoning, rug pull, config risk\naction connect_server appliesTo {\n  principal: [User, Agent],\n  resource: [Server],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content?: String,                 // Server config content (if available)\n    source: String,\n    event: String,\n    user_email: String,\n    mcp_server?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    max_threat_severity?: Long,\n\n    // --- Agent Security (0-100) --- (OWASP ASI04, MCP01-MCP05)\n    tool_poisoning_score?: Long,      // Poisoned tool descriptions in server\n    tool_poisoning_detected?: Bool,\n    rug_pull_score?: Long,            // Server behavior change after approval\n    rug_pull_detected?: Bool,\n    indirect_injection_score?: Long,  // Injection payloads in server responses\n\n    // --- MCP Trust & Config Risk ---\n    mcp_server_verified?: Bool,       // Verified registry status\n    mcp_config_risk?: Bool,           // Risky server config detected (inline code exec, etc.)\n    mcp_risk_score?: Long,            // Config risk severity (0-100)\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n  },\n};\n\n// Read a file from disk\n// Threat focus: secrets exposure, PII exposure, path traversal, sensitive paths\naction read_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n// Write a file to disk\n// Threat focus: secrets in output, PII in output, sensitive paths, malicious code\naction write_file appliesTo {\n  principal: [User, Agent],\n  resource: [FilePath],\n  context: {\n    // Identity (AARM R6 / CAP-IDN-011) \u2014 projected from the principal's token; optional.\n    role?: String,\n    privilege_scope?: Set<String>,\n    content: String,\n    source: String,\n    event: String,\n    user_email: String,\n    path?: String,\n    cwd?: String,\n    workspace_root?: String,\n\n    // --- Threat Detection ---\n    threat_count?: Long,\n    highest_severity?: String,\n    threat_categories?: Set<String>,\n    detected_threats?: Set<String>,\n    max_threat_severity?: Long,\n    secrets_detected?: Bool,\n\n    // --- Secrets (granular) ---\n    secret_types?: Set<String>,\n    secret_count?: Long,\n\n    // --- PII Detection ---\n    pii_detected?: Bool,\n    pii_types?: Set<String>,\n    pii_count?: Long,\n\n    // --- Session Detection History (cross-turn sticky flags) ---\n    session_pii_detected?: Bool,\n    session_pii_types?: Set<String>,\n    session_secrets_detected?: Bool,\n    session_secret_types?: Set<String>,\n    session_injection_detected?: Bool,\n    session_command_injection?: Bool,\n    session_threat_turns?: Long,\n    session_max_injection_score?: Long,\n    session_max_jailbreak_score?: Long,\n    session_max_command_injection_score?: Long,\n    session_max_pii_score?: Long,\n    session_max_secret_score?: Long,\n    session_cumulative_risk_score?: Long,\n\n    // --- Agent Security ---\n    indirect_injection_score?: Long,  // Indirect injection via file content\n  },\n};\n\n}\n";
 /**
  * Palisade Cedar schema
  *