@intutic/shared-types 1.0.1

package/dist/api-contracts.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Zod schemas for API request/response validation.
+ *
+ * Each schema is exported alongside its inferred TypeScript type.
+ * Services use these schemas in route handlers to validate incoming
+ * payloads; the inferred types are used in service function signatures.
+ *
+ * HLD §3.1 (Proxy Gateway), §3.6 (FinOps), §3.3 (PCAS)
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * Zod schema for the `POST /api/v1/sessions` request body.
+ *
+ * Creates a new agent session in the control plane.
+ */
+export declare const CreateSessionSchema: z.ZodObject<{
+    /** Workspace to create the session in. */
+    workspaceId: z.ZodString;
+    /** User initiating the session. */
+    userId: z.ZodString;
+    /** Optional project to scope the session. */
+    projectId: z.ZodOptional<z.ZodString>;
+    /** Optional SOP to govern the session. */
+    activeSopId: z.ZodOptional<z.ZodString>;
+    /** Agent harness type. */
+    harnessType: z.ZodEnum<["cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot", ...("cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot")[]]>;
+    /** Budget tier — defaults to JUNIOR on the server. */
+    budgetTier: z.ZodOptional<z.ZodEnum<["JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL", ...("JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL")[]]>>;
+    /** Execution mode — defaults to STANDARD on the server. */
+    executionMode: z.ZodOptional<z.ZodEnum<["STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS", ...("STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS")[]]>>;
+}, "strip", z.ZodTypeAny, {
+    workspaceId: string;
+    userId: string;
+    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot";
+    projectId?: string | undefined;
+    activeSopId?: string | undefined;
+    budgetTier?: "JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL" | undefined;
+    executionMode?: "STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS" | undefined;
+}, {
+    workspaceId: string;
+    userId: string;
+    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot";
+    projectId?: string | undefined;
+    activeSopId?: string | undefined;
+    budgetTier?: "JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL" | undefined;
+    executionMode?: "STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS" | undefined;
+}>;
+/** Inferred type for a create-session request payload. */
+export type CreateSessionInput = z.infer<typeof CreateSessionSchema>;
+/**
+ * Zod schema for the `POST /api/v1/traces` request body.
+ *
+ * Appends a new row to the `execution_traces` ledger.
+ * Fields with server-side defaults (e.g., `timestamp`) are optional.
+ */
+export declare const CreateTraceSchema: z.ZodObject<{
+    /** Session that produced this trace. */
+    sessionId: z.ZodString;
+    /** Idempotency key — must be unique across all traces. */
+    requestId: z.ZodString;
+    /** Effective date of the governing SOP (ISO 8601). */
+    sopEffectiveDate: z.ZodString;
+    requestedModel: z.ZodString;
+    actualModelRouted: z.ZodString;
+    routingTier: z.ZodEnum<["frontier" | "economy" | "local", ...("frontier" | "economy" | "local")[]]>;
+    complexityScore: z.ZodNumber;
+    rawInputTokens: z.ZodNumber;
+    compressedInputTokens: z.ZodNumber;
+    outputTokens: z.ZodNumber;
+    rawCostUsd: z.ZodNumber;
+    actualCostUsd: z.ZodNumber;
+    tokenUtility: z.ZodOptional<z.ZodEnum<["USEFUL" | "WASTED", ...("USEFUL" | "WASTED")[]]>>;
+    tokenUtilityScore: z.ZodOptional<z.ZodNumber>;
+    complianceScore: z.ZodNumber;
+    enforcementAction: z.ZodEnum<["BYPASS" | "ENHANCE" | "HIJACK" | "KILL", ...("BYPASS" | "ENHANCE" | "HIJACK" | "KILL")[]]>;
+    anomalyDetected: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    anomalyConfidenceScore: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    taxonomyMetadata: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    rawPayloadJson: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    appId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    agentChainId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    agentChain: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    cacheHit: z.ZodOptional<z.ZodBoolean>;
+    cacheSavingsUsd: z.ZodOptional<z.ZodNumber>;
+    rootCauseAttribution: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    correctivePromptCard: z.ZodOptional<z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, "strip", z.ZodTypeAny, {
+    sessionId: string;
+    requestId: string;
+    sopEffectiveDate: string;
+    requestedModel: string;
+    actualModelRouted: string;
+    routingTier: "frontier" | "economy" | "local";
+    complexityScore: number;
+    rawInputTokens: number;
+    compressedInputTokens: number;
+    outputTokens: number;
+    rawCostUsd: number;
+    actualCostUsd: number;
+    complianceScore: number;
+    enforcementAction: "BYPASS" | "ENHANCE" | "HIJACK" | "KILL";
+    tokenUtility?: "USEFUL" | "WASTED" | undefined;
+    tokenUtilityScore?: number | undefined;
+    anomalyDetected?: string | null | undefined;
+    anomalyConfidenceScore?: number | null | undefined;
+    taxonomyMetadata?: Record<string, unknown> | null | undefined;
+    rawPayloadJson?: Record<string, unknown> | null | undefined;
+    appId?: string | null | undefined;
+    agentChainId?: string | null | undefined;
+    agentChain?: Record<string, unknown> | null | undefined;
+    cacheHit?: boolean | undefined;
+    cacheSavingsUsd?: number | undefined;
+    rootCauseAttribution?: Record<string, unknown> | null | undefined;
+    correctivePromptCard?: Record<string, unknown> | null | undefined;
+}, {
+    sessionId: string;
+    requestId: string;
+    sopEffectiveDate: string;
+    requestedModel: string;
+    actualModelRouted: string;
+    routingTier: "frontier" | "economy" | "local";
+    complexityScore: number;
+    rawInputTokens: number;
+    compressedInputTokens: number;
+    outputTokens: number;
+    rawCostUsd: number;
+    actualCostUsd: number;
+    complianceScore: number;
+    enforcementAction: "BYPASS" | "ENHANCE" | "HIJACK" | "KILL";
+    tokenUtility?: "USEFUL" | "WASTED" | undefined;
+    tokenUtilityScore?: number | undefined;
+    anomalyDetected?: string | null | undefined;
+    anomalyConfidenceScore?: number | null | undefined;
+    taxonomyMetadata?: Record<string, unknown> | null | undefined;
+    rawPayloadJson?: Record<string, unknown> | null | undefined;
+    appId?: string | null | undefined;
+    agentChainId?: string | null | undefined;
+    agentChain?: Record<string, unknown> | null | undefined;
+    cacheHit?: boolean | undefined;
+    cacheSavingsUsd?: number | undefined;
+    rootCauseAttribution?: Record<string, unknown> | null | undefined;
+    correctivePromptCard?: Record<string, unknown> | null | undefined;
+}>;
+/** Inferred type for a create-trace request payload. */
+export type CreateTraceInput = z.infer<typeof CreateTraceSchema>;
+/**
+ * Zod schema for a policy verdict (used in Circuit Breaker responses
+ * and inter-service communication).
+ *
+ * HLD §3.3 — PCAS enforcement
+ */
+export declare const PolicyVerdictSchema: z.ZodObject<{
+    /** Enforcement action to apply. */
+    action: z.ZodEnum<["BYPASS" | "ENHANCE" | "HIJACK" | "KILL", ...("BYPASS" | "ENHANCE" | "HIJACK" | "KILL")[]]>;
+    /** Confidence score (0.0–1.0). */
+    confidence: z.ZodNumber;
+    /** Human-readable reason. */
+    reason: z.ZodString;
+    /** Optional policy rule ID. */
+    policyId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    action: "BYPASS" | "ENHANCE" | "HIJACK" | "KILL";
+    confidence: number;
+    reason: string;
+    policyId?: string | undefined;
+}, {
+    action: "BYPASS" | "ENHANCE" | "HIJACK" | "KILL";
+    confidence: number;
+    reason: string;
+    policyId?: string | undefined;
+}>;
+/** Inferred type for a policy verdict. */
+export type PolicyVerdictInput = z.infer<typeof PolicyVerdictSchema>;
+//# sourceMappingURL=api-contracts.d.ts.map

package/dist/api-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contracts.d.ts","sourceRoot":"","sources":["../src/api-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAmBvB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC9B,0CAA0C;;IAG1C,mCAAmC;;IAGnC,6CAA6C;;IAG7C,0CAA0C;;IAG1C,0BAA0B;;IAG1B,sDAAsD;;IAGtD,2DAA2D;;;;;;;;;;;;;;;;;;EAE3D,CAAA;AAEF,0DAA0D;AAC1D,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAIpE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;IAC5B,wCAAwC;;IAGxC,0DAA0D;;IAG1D,sDAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8CtD,CAAA;AAEF,wDAAwD;AACxD,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;IAC9B,mCAAmC;;IAGnC,kCAAkC;;IAGlC,6BAA6B;;IAG7B,+BAA+B;;;;;;;;;;;;EAE/B,CAAA;AAEF,0CAA0C;AAC1C,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}

package/dist/api-contracts.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Zod schemas for API request/response validation.
+ *
+ * Each schema is exported alongside its inferred TypeScript type.
+ * Services use these schemas in route handlers to validate incoming
+ * payloads; the inferred types are used in service function signatures.
+ *
+ * HLD §3.1 (Proxy Gateway), §3.6 (FinOps), §3.3 (PCAS)
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PolicyVerdictSchema = exports.CreateTraceSchema = exports.CreateSessionSchema = void 0;
+const zod_1 = require("zod");
+const enums_js_1 = require("./enums.js");
+// ─── Helpers ─────────────────────────────────────────────────────────
+/** Extract the values array from a const object for use in `z.enum()`. */
+function constValues(obj) {
+    return Object.values(obj);
+}
+// ─── CreateSession ───────────────────────────────────────────────────
+/**
+ * Zod schema for the `POST /api/v1/sessions` request body.
+ *
+ * Creates a new agent session in the control plane.
+ */
+exports.CreateSessionSchema = zod_1.z.object({
+    /** Workspace to create the session in. */
+    workspaceId: zod_1.z.string().min(1),
+    /** User initiating the session. */
+    userId: zod_1.z.string().min(1),
+    /** Optional project to scope the session. */
+    projectId: zod_1.z.string().min(1).optional(),
+    /** Optional SOP to govern the session. */
+    activeSopId: zod_1.z.string().min(1).optional(),
+    /** Agent harness type. */
+    harnessType: zod_1.z.enum(constValues(enums_js_1.HarnessType)),
+    /** Budget tier — defaults to JUNIOR on the server. */
+    budgetTier: zod_1.z.enum(constValues(enums_js_1.BudgetTier)).optional(),
+    /** Execution mode — defaults to STANDARD on the server. */
+    executionMode: zod_1.z.enum(constValues(enums_js_1.ExecutionMode)).optional(),
+});
+// ─── CreateTrace ─────────────────────────────────────────────────────
+/**
+ * Zod schema for the `POST /api/v1/traces` request body.
+ *
+ * Appends a new row to the `execution_traces` ledger.
+ * Fields with server-side defaults (e.g., `timestamp`) are optional.
+ */
+exports.CreateTraceSchema = zod_1.z.object({
+    /** Session that produced this trace. */
+    sessionId: zod_1.z.string().min(1),
+    /** Idempotency key — must be unique across all traces. */
+    requestId: zod_1.z.string().min(1),
+    /** Effective date of the governing SOP (ISO 8601). */
+    sopEffectiveDate: zod_1.z.string().datetime(),
+    // ── Model routing ──
+    requestedModel: zod_1.z.string().min(1),
+    actualModelRouted: zod_1.z.string().min(1),
+    routingTier: zod_1.z.enum(constValues(enums_js_1.RoutingTier)),
+    complexityScore: zod_1.z.number().min(0).max(1),
+    // ── Token accounting ──
+    rawInputTokens: zod_1.z.number().int().nonnegative(),
+    compressedInputTokens: zod_1.z.number().int().nonnegative(),
+    outputTokens: zod_1.z.number().int().nonnegative(),
+    // ── Cost accounting ──
+    rawCostUsd: zod_1.z.number().nonnegative(),
+    actualCostUsd: zod_1.z.number().nonnegative(),
+    // ── Token utility ──
+    tokenUtility: zod_1.z.enum(constValues(enums_js_1.TokenUtility)).optional(),
+    tokenUtilityScore: zod_1.z.number().min(0).max(1).optional(),
+    // ── Enforcement ──
+    complianceScore: zod_1.z.number().min(0).max(1),
+    enforcementAction: zod_1.z.enum(constValues(enums_js_1.EnforcementAction)),
+    // ── Anomaly ──
+    anomalyDetected: zod_1.z.string().nullable().optional(),
+    anomalyConfidenceScore: zod_1.z.number().min(0).max(1).nullable().optional(),
+    taxonomyMetadata: zod_1.z.record(zod_1.z.unknown()).nullable().optional(),
+    // ── Forensics ──
+    rawPayloadJson: zod_1.z.record(zod_1.z.unknown()).nullable().optional(),
+    // ── 4D Attribution ──
+    appId: zod_1.z.string().nullable().optional(),
+    agentChainId: zod_1.z.string().nullable().optional(),
+    agentChain: zod_1.z.record(zod_1.z.unknown()).nullable().optional(),
+    // ── Cache ──
+    cacheHit: zod_1.z.boolean().optional(),
+    cacheSavingsUsd: zod_1.z.number().nonnegative().optional(),
+    // ── Root cause ──
+    rootCauseAttribution: zod_1.z.record(zod_1.z.unknown()).nullable().optional(),
+    correctivePromptCard: zod_1.z.record(zod_1.z.unknown()).nullable().optional(),
+});
+// ─── PolicyVerdict ───────────────────────────────────────────────────
+/**
+ * Zod schema for a policy verdict (used in Circuit Breaker responses
+ * and inter-service communication).
+ *
+ * HLD §3.3 — PCAS enforcement
+ */
+exports.PolicyVerdictSchema = zod_1.z.object({
+    /** Enforcement action to apply. */
+    action: zod_1.z.enum(constValues(enums_js_1.EnforcementAction)),
+    /** Confidence score (0.0–1.0). */
+    confidence: zod_1.z.number().min(0).max(1),
+    /** Human-readable reason. */
+    reason: zod_1.z.string().min(1),
+    /** Optional policy rule ID. */
+    policyId: zod_1.z.string().optional(),
+});
+//# sourceMappingURL=api-contracts.js.map

package/dist/api-contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-contracts.js","sourceRoot":"","sources":["../src/api-contracts.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,6BAAuB;AACvB,yCAOmB;AAEnB,wEAAwE;AAExE,0EAA0E;AAC1E,SAAS,WAAW,CAAmC,GAAM;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAkC,CAAA;AAC5D,CAAC;AAED,wEAAwE;AAExE;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,0CAA0C;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE9B,mCAAmC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzB,6CAA6C;IAC7C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvC,0CAA0C;IAC1C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEzC,0BAA0B;IAC1B,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAW,CAAC,CAAC;IAE7C,sDAAsD;IACtD,UAAU,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,qBAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEtD,2DAA2D;IAC3D,aAAa,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,wBAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAA;AAKF,wEAAwE;AAExE;;;;;GAKG;AACU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,wCAAwC;IACxC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,0DAA0D;IAC1D,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5B,sDAAsD;IACtD,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,sBAAsB;IACtB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,sBAAW,CAAC,CAAC;IAC7C,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzC,yBAAyB;IACzB,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,qBAAqB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAE5C,wBAAwB;IACxB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IACpC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAEvC,sBAAsB;IACtB,YAAY,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,uBAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEtD,oBAAoB;IACpB,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,iBAAiB,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,4BAAiB,CAAC,CAAC;IAEzD,gBAAgB;IAChB,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,sBAAsB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtE,gBAAgB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE7D,kBAAkB;IAClB,cAAc,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAE3D,uBAAuB;IACvB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAEvD,cAAc;IACd,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAEpD,mBAAmB;IACnB,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjE,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClE,CAAC,CAAA;AAKF,wEAAwE;AAExE;;;;;GAKG;AACU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,mCAAmC;IACnC,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,WAAW,CAAC,4BAAiB,CAAC,CAAC;IAE9C,kCAAkC;IAClC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpC,6BAA6B;IAC7B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzB,+BAA+B;IAC/B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAA"}

package/dist/attenuation.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ *
+ * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
+ * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.
+ *
+ * HLD §5.1, §5.6 — Zero-Trust Identity Broker
+ *
+ * @module
+ */
+import { z } from 'zod';
+/**
+ * OBO (On-Behalf-Of) token grant — short-lived, employee-scoped
+ * JWT issued per harness session.
+ *
+ * HLD §5.6 — per-employee ephemeral scoping.
+ */
+export interface OboTokenGrant {
+    /** Unique grant identifier — `newId('obo')` */
+    grantId: string;
+    /** Issuing workspace member ID */
+    memberId: string;
+    /** Workspace scope */
+    workspaceId: string;
+    /** Optional agent session binding */
+    sessionId: string | null;
+    /** Allow-list of tool names this token grants access to */
+    scopedTools: string[];
+    /** Plaintext short-lived JWT — returned ONCE on issuance */
+    oboToken: string;
+    /** Grant expiry (ISO-8601, 15 min from issuance) */
+    expiresAt: string;
+}
+/** Request schema for OBO token issuance. */
+export declare const IssueOboTokenInputSchema: z.ZodObject<{
+    sessionId: z.ZodOptional<z.ZodString>;
+    scopedTools: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    scopedTools: string[];
+    sessionId?: string | undefined;
+}, {
+    scopedTools: string[];
+    sessionId?: string | undefined;
+}>;
+export type IssueOboTokenInput = z.infer<typeof IssueOboTokenInputSchema>;
+/**
+ * Result returned from a successful token attenuation handshake.
+ * The plaintext child key is returned ONCE and never stored.
+ */
+export interface AttenuationResult {
+    /** Plaintext `vk_*` child key — returned ONCE */
+    childKey: string;
+    /** child api_keys.key_id */
+    childKeyId: string;
+    /** attenuation_chains.chain_id */
+    attenuationChainId: string;
+    /** Verified subset of parent capabilities granted to child */
+    grantedCaps: string[];
+    /** Child key expiry (ISO-8601) */
+    expiresAt: string;
+}
+/**
+ * A single link in the attenuation delegation lineage chain.
+ */
+export interface AttenuationChainLink {
+    /** attenuation_chains.chain_id */
+    chainId: string;
+    /** Parent api_keys.key_id */
+    parentKeyId: string;
+    /** Child api_keys.key_id */
+    childKeyId: string;
+    /** Workspace scope */
+    workspaceId: string;
+    /** Capabilities granted to the child key */
+    grantedCaps: string[];
+    /** Chain expiry (ISO-8601) */
+    expiresAt: string;
+    /** Creation timestamp (ISO-8601) */
+    createdAt: string;
+}
+/** Request schema for token attenuation. */
+export declare const AttenuateTokenInputSchema: z.ZodObject<{
+    parentKeyId: z.ZodString;
+    requestedCaps: z.ZodArray<z.ZodString, "many">;
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    parentKeyId: string;
+    requestedCaps: string[];
+    ttlSeconds?: number | undefined;
+}, {
+    parentKeyId: string;
+    requestedCaps: string[];
+    ttlSeconds?: number | undefined;
+}>;
+export type AttenuateTokenInput = z.infer<typeof AttenuateTokenInputSchema>;
+/**
+ * Result of SSO group → tool clearance resolution.
+ * - GRANTED: member has required SSO group; tool execution allowed
+ * - DENIED: member lacks required SSO group; tool blocked
+ * - REQUIRES_OBO: tool requires an active OBO token with this tool in scopedTools
+ */
+export type SsoGroupClearance = 'GRANTED' | 'DENIED' | 'REQUIRES_OBO';
+/**
+ * Workspace SSO group policy configuration.
+ * Stored in workspaces.settings->>'sso_group_policy' as JSONB.
+ */
+export interface SsoGroupPolicy {
+    /** Tools gated by SSO group membership (e.g. ['bash', 'file_write', 'database_write']) */
+    highRiskTools: string[];
+    /** IdP group names that grant clearance for high-risk tools */
+    requiredGroups: string[];
+    /** Tools that always require an OBO token regardless of group membership */
+    requireOboFor: string[];
+}
+//# sourceMappingURL=attenuation.d.ts.map

package/dist/attenuation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attenuation.d.ts","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,6CAA6C;AAC7C,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAIzE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAChB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,4CAA4C;AAC5C,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB"}

package/dist/attenuation.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ *
+ * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
+ * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.
+ *
+ * HLD §5.1, §5.6 — Zero-Trust Identity Broker
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttenuateTokenInputSchema = exports.IssueOboTokenInputSchema = void 0;
+const zod_1 = require("zod");
+/** Request schema for OBO token issuance. */
+exports.IssueOboTokenInputSchema = zod_1.z.object({
+    sessionId: zod_1.z.string().min(1).optional(),
+    scopedTools: zod_1.z.array(zod_1.z.string().min(1)).min(1, 'At least one tool must be specified'),
+});
+/** Request schema for token attenuation. */
+exports.AttenuateTokenInputSchema = zod_1.z.object({
+    parentKeyId: zod_1.z.string().min(1),
+    requestedCaps: zod_1.z.array(zod_1.z.string().min(1)).min(1, 'At least one capability must be requested'),
+    ttlSeconds: zod_1.z.number().int().min(60).max(86400).optional(),
+});
+//# sourceMappingURL=attenuation.js.map

package/dist/attenuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attenuation.js","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,6BAAuB;AA2BvB,6CAA6C;AAChC,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;CACtF,CAAC,CAAA;AA0CF,4CAA4C;AAC/B,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,2CAA2C,CAAC;IAC7F,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAA"}