@kya-os/contracts 1.3.2 → 1.3.4

package/dist/delegation/constraints.d.ts

@@ -1,992 +0,0 @@
-/**
- * CRISP Delegation Constraints
- *
- * Types and schemas for CRISP (Constrained Resource Intent Specification Protocol)
- * constraints on delegations. CRISP enables fine-grained authorization control.
- *
- * Related Spec: MCP-I §4.2
- * Python Reference: Delegation-Documentation.md
- */
-import { z } from 'zod';
-/**
- * Currency types for CRISP budgets
- */
-export declare const CurrencySchema: z.ZodEnum<["USD", "ops", "points"]>;
-export type Currency = z.infer<typeof CurrencySchema>;
-/**
- * Window kind for budget enforcement
- */
-export declare const WindowKindSchema: z.ZodEnum<["rolling", "fixed"]>;
-export type WindowKind = z.infer<typeof WindowKindSchema>;
-/**
- * Budget Window Schema
- *
- * Defines the time window for budget enforcement
- */
-export declare const BudgetWindowSchema: z.ZodObject<{
-    /** Type of window (rolling or fixed) */
-    kind: z.ZodEnum<["rolling", "fixed"]>;
-    /** Duration in seconds */
-    durationSec: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    kind: "rolling" | "fixed";
-    durationSec: number;
-}, {
-    kind: "rolling" | "fixed";
-    durationSec: number;
-}>;
-export type BudgetWindow = z.infer<typeof BudgetWindowSchema>;
-/**
- * CRISP Budget Schema
- *
- * Defines spending/usage limits for a delegation
- */
-export declare const CrispBudgetSchema: z.ZodObject<{
-    /** Unit of the budget */
-    unit: z.ZodEnum<["USD", "ops", "points"]>;
-    /** Cap/limit for the budget */
-    cap: z.ZodNumber;
-    /** Optional time window for the budget */
-    window: z.ZodOptional<z.ZodObject<{
-        /** Type of window (rolling or fixed) */
-        kind: z.ZodEnum<["rolling", "fixed"]>;
-        /** Duration in seconds */
-        durationSec: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        kind: "rolling" | "fixed";
-        durationSec: number;
-    }, {
-        kind: "rolling" | "fixed";
-        durationSec: number;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    unit: "USD" | "ops" | "points";
-    cap: number;
-    window?: {
-        kind: "rolling" | "fixed";
-        durationSec: number;
-    } | undefined;
-}, {
-    unit: "USD" | "ops" | "points";
-    cap: number;
-    window?: {
-        kind: "rolling" | "fixed";
-        durationSec: number;
-    } | undefined;
-}>;
-export type CrispBudget = z.infer<typeof CrispBudgetSchema>;
-/**
- * Scope matcher types
- */
-export declare const ScopeMatcherSchema: z.ZodEnum<["exact", "prefix", "regex"]>;
-export type ScopeMatcher = z.infer<typeof ScopeMatcherSchema>;
-/**
- * CRISP Scope Schema
- *
- * Defines what resources/actions are allowed in a delegation
- */
-export declare const CrispScopeSchema: z.ZodObject<{
-    /** Resource identifier (e.g., "api:users", "data:emails") */
-    resource: z.ZodString;
-    /** How to match the resource */
-    matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-    /** Optional additional constraints on this scope */
-    constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-}, "strip", z.ZodTypeAny, {
-    resource: string;
-    matcher: "exact" | "prefix" | "regex";
-    constraints?: Record<string, any> | undefined;
-}, {
-    resource: string;
-    matcher: "exact" | "prefix" | "regex";
-    constraints?: Record<string, any> | undefined;
-}>;
-export type CrispScope = z.infer<typeof CrispScopeSchema>;
-/**
- * Delegation Constraints Schema (CRISP)
- *
- * Complete constraint specification for a delegation
- */
-export declare const DelegationConstraintsSchema: z.ZodObject<{
-    /** Not valid before (Unix timestamp in seconds) */
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    /** Not valid after (Unix timestamp in seconds) */
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** CRISP-specific constraints (full model) */
-    crisp: z.ZodOptional<z.ZodObject<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">>>;
-}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    /** Not valid before (Unix timestamp in seconds) */
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    /** Not valid after (Unix timestamp in seconds) */
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** CRISP-specific constraints (full model) */
-    crisp: z.ZodOptional<z.ZodObject<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">>>;
-}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    /** Not valid before (Unix timestamp in seconds) */
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    /** Not valid after (Unix timestamp in seconds) */
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** CRISP-specific constraints (full model) */
-    crisp: z.ZodOptional<z.ZodObject<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">>>;
-}, z.ZodTypeAny, "passthrough">>;
-export type DelegationConstraints = z.infer<typeof DelegationConstraintsSchema>;
-/**
- * Validation Helpers
- */
-/**
- * Validate delegation constraints
- *
- * @param constraints - The constraints to validate
- * @returns Validation result
- */
-export declare function validateDelegationConstraints(constraints: unknown): z.SafeParseReturnType<z.objectInputType<{
-    /** Not valid before (Unix timestamp in seconds) */
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    /** Not valid after (Unix timestamp in seconds) */
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** CRISP-specific constraints (full model) */
-    crisp: z.ZodOptional<z.ZodObject<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">>>;
-}, z.ZodTypeAny, "passthrough">, z.objectOutputType<{
-    /** Not valid before (Unix timestamp in seconds) */
-    notBefore: z.ZodOptional<z.ZodNumber>;
-    /** Not valid after (Unix timestamp in seconds) */
-    notAfter: z.ZodOptional<z.ZodNumber>;
-    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
-    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    /** CRISP-specific constraints (full model) */
-    crisp: z.ZodOptional<z.ZodObject<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        /** Optional budget constraint */
-        budget: z.ZodOptional<z.ZodObject<{
-            /** Unit of the budget */
-            unit: z.ZodEnum<["USD", "ops", "points"]>;
-            /** Cap/limit for the budget */
-            cap: z.ZodNumber;
-            /** Optional time window for the budget */
-            window: z.ZodOptional<z.ZodObject<{
-                /** Type of window (rolling or fixed) */
-                kind: z.ZodEnum<["rolling", "fixed"]>;
-                /** Duration in seconds */
-                durationSec: z.ZodNumber;
-            }, "strip", z.ZodTypeAny, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }, {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            }>>;
-        }, "strip", z.ZodTypeAny, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }, {
-            unit: "USD" | "ops" | "points";
-            cap: number;
-            window?: {
-                kind: "rolling" | "fixed";
-                durationSec: number;
-            } | undefined;
-        }>>;
-        /** Required: at least one scope */
-        scopes: z.ZodArray<z.ZodObject<{
-            /** Resource identifier (e.g., "api:users", "data:emails") */
-            resource: z.ZodString;
-            /** How to match the resource */
-            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
-            /** Optional additional constraints on this scope */
-            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-        }, "strip", z.ZodTypeAny, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }, {
-            resource: string;
-            matcher: "exact" | "prefix" | "regex";
-            constraints?: Record<string, any> | undefined;
-        }>, "many">;
-    }, z.ZodTypeAny, "passthrough">>>;
-}, z.ZodTypeAny, "passthrough">>;
-/**
- * Check if constraints have a valid time range
- *
- * @param constraints - The constraints to check
- * @returns true if time range is valid or no time range specified
- */
-export declare function hasValidTimeRange(constraints: DelegationConstraints): boolean;
-/**
- * Check if child constraints are within parent constraints
- *
- * This performs basic structural checks. Full chain validation
- * requires runtime implementation.
- *
- * @param parent - Parent delegation constraints
- * @param child - Child delegation constraints
- * @returns true if child is within parent bounds
- */
-export declare function areChildConstraintsValid(parent: DelegationConstraints, child: DelegationConstraints): boolean;
-/**
- * Check if a resource matches a scope
- *
- * @param resource - The resource to check
- * @param scope - The scope to match against
- * @returns true if resource matches scope
- */
-export declare function doesResourceMatchScope(resource: string, scope: CrispScope): boolean;
-/**
- * Constants
- */
-/**
- * Supported currency types
- */
-export declare const SUPPORTED_CURRENCIES: Currency[];
-/**
- * Supported scope matchers
- */
-export declare const SUPPORTED_MATCHERS: ScopeMatcher[];
-/**
- * Maximum reasonable budget cap (for validation)
- */
-export declare const MAX_BUDGET_CAP: number;
-/**
- * Maximum reasonable window duration (10 years in seconds)
- */
-export declare const MAX_WINDOW_DURATION_SEC: number;
-//# sourceMappingURL=constraints.d.ts.map