@kya-os/contracts 1.5.2-canary.4 → 1.5.2-canary.6

package/dist/delegation/constraints.d.ts

@@ -0,0 +1,1021 @@
+/**
+ * CRISP Delegation Constraints
+ *
+ * Types and schemas for CRISP (Constrained Resource Intent Specification Protocol)
+ * constraints on delegations. CRISP enables fine-grained authorization control.
+ *
+ * Related Spec: MCP-I §4.2
+ * Python Reference: Delegation-Documentation.md
+ */
+import { z } from 'zod';
+/**
+ * Currency types for CRISP budgets
+ */
+export declare const CurrencySchema: z.ZodEnum<["USD", "ops", "points"]>;
+export type Currency = z.infer<typeof CurrencySchema>;
+/**
+ * Window kind for budget enforcement
+ */
+export declare const WindowKindSchema: z.ZodEnum<["rolling", "fixed"]>;
+export type WindowKind = z.infer<typeof WindowKindSchema>;
+/**
+ * Budget Window Schema
+ *
+ * Defines the time window for budget enforcement
+ */
+export declare const BudgetWindowSchema: z.ZodObject<{
+    /** Type of window (rolling or fixed) */
+    kind: z.ZodEnum<["rolling", "fixed"]>;
+    /** Duration in seconds */
+    durationSec: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    kind: "rolling" | "fixed";
+    durationSec: number;
+}, {
+    kind: "rolling" | "fixed";
+    durationSec: number;
+}>;
+export type BudgetWindow = z.infer<typeof BudgetWindowSchema>;
+/**
+ * CRISP Budget Schema
+ *
+ * Defines spending/usage limits for a delegation
+ */
+export declare const CrispBudgetSchema: z.ZodObject<{
+    /** Unit of the budget */
+    unit: z.ZodEnum<["USD", "ops", "points"]>;
+    /** Cap/limit for the budget */
+    cap: z.ZodNumber;
+    /** Optional time window for the budget */
+    window: z.ZodOptional<z.ZodObject<{
+        /** Type of window (rolling or fixed) */
+        kind: z.ZodEnum<["rolling", "fixed"]>;
+        /** Duration in seconds */
+        durationSec: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        kind: "rolling" | "fixed";
+        durationSec: number;
+    }, {
+        kind: "rolling" | "fixed";
+        durationSec: number;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    unit: "USD" | "ops" | "points";
+    cap: number;
+    window?: {
+        kind: "rolling" | "fixed";
+        durationSec: number;
+    } | undefined;
+}, {
+    unit: "USD" | "ops" | "points";
+    cap: number;
+    window?: {
+        kind: "rolling" | "fixed";
+        durationSec: number;
+    } | undefined;
+}>;
+export type CrispBudget = z.infer<typeof CrispBudgetSchema>;
+/**
+ * Scope matcher types
+ */
+export declare const ScopeMatcherSchema: z.ZodEnum<["exact", "prefix", "regex"]>;
+export type ScopeMatcher = z.infer<typeof ScopeMatcherSchema>;
+/**
+ * CRISP Scope Schema
+ *
+ * Defines what resources/actions are allowed in a delegation
+ */
+export declare const CrispScopeSchema: z.ZodObject<{
+    /** Resource identifier (e.g., "api:users", "data:emails") */
+    resource: z.ZodString;
+    /** How to match the resource */
+    matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+    /** Optional additional constraints on this scope */
+    constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    resource: string;
+    matcher: "exact" | "prefix" | "regex";
+    constraints?: Record<string, any> | undefined;
+}, {
+    resource: string;
+    matcher: "exact" | "prefix" | "regex";
+    constraints?: Record<string, any> | undefined;
+}>;
+export type CrispScope = z.infer<typeof CrispScopeSchema>;
+/**
+ * Delegation Constraints Schema (CRISP)
+ *
+ * Complete constraint specification for a delegation
+ */
+export declare const DelegationConstraintsSchema: z.ZodObject<{
+    /** Not valid before (Unix timestamp in seconds) */
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    /** Not valid after (Unix timestamp in seconds) */
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional target server DID(s) for this delegation
+     * If omitted, delegation is valid on any server accepting the scopes
+     * If specified, delegation is only valid on the specified server(s)
+     */
+    audience: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /** CRISP-specific constraints (full model) */
+    crisp: z.ZodOptional<z.ZodObject<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Not valid before (Unix timestamp in seconds) */
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    /** Not valid after (Unix timestamp in seconds) */
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional target server DID(s) for this delegation
+     * If omitted, delegation is valid on any server accepting the scopes
+     * If specified, delegation is only valid on the specified server(s)
+     */
+    audience: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /** CRISP-specific constraints (full model) */
+    crisp: z.ZodOptional<z.ZodObject<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Not valid before (Unix timestamp in seconds) */
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    /** Not valid after (Unix timestamp in seconds) */
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional target server DID(s) for this delegation
+     * If omitted, delegation is valid on any server accepting the scopes
+     * If specified, delegation is only valid on the specified server(s)
+     */
+    audience: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /** CRISP-specific constraints (full model) */
+    crisp: z.ZodOptional<z.ZodObject<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">>;
+export type DelegationConstraints = z.infer<typeof DelegationConstraintsSchema>;
+/**
+ * Validation Helpers
+ */
+/**
+ * Validate delegation constraints
+ *
+ * @param constraints - The constraints to validate
+ * @returns Validation result
+ */
+export declare function validateDelegationConstraints(constraints: unknown): z.SafeParseReturnType<z.objectInputType<{
+    /** Not valid before (Unix timestamp in seconds) */
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    /** Not valid after (Unix timestamp in seconds) */
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional target server DID(s) for this delegation
+     * If omitted, delegation is valid on any server accepting the scopes
+     * If specified, delegation is only valid on the specified server(s)
+     */
+    audience: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /** CRISP-specific constraints (full model) */
+    crisp: z.ZodOptional<z.ZodObject<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectOutputType<{
+    /** Not valid before (Unix timestamp in seconds) */
+    notBefore: z.ZodOptional<z.ZodNumber>;
+    /** Not valid after (Unix timestamp in seconds) */
+    notAfter: z.ZodOptional<z.ZodNumber>;
+    /** Simple scopes array (for Phase 1 bouncer - simplified model) */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Optional target server DID(s) for this delegation
+     * If omitted, delegation is valid on any server accepting the scopes
+     * If specified, delegation is only valid on the specified server(s)
+     */
+    audience: z.ZodOptional<z.ZodUnion<[z.ZodString, z.ZodArray<z.ZodString, "many">]>>;
+    /** CRISP-specific constraints (full model) */
+    crisp: z.ZodOptional<z.ZodObject<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /** Optional budget constraint */
+        budget: z.ZodOptional<z.ZodObject<{
+            /** Unit of the budget */
+            unit: z.ZodEnum<["USD", "ops", "points"]>;
+            /** Cap/limit for the budget */
+            cap: z.ZodNumber;
+            /** Optional time window for the budget */
+            window: z.ZodOptional<z.ZodObject<{
+                /** Type of window (rolling or fixed) */
+                kind: z.ZodEnum<["rolling", "fixed"]>;
+                /** Duration in seconds */
+                durationSec: z.ZodNumber;
+            }, "strip", z.ZodTypeAny, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }, {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }, {
+            unit: "USD" | "ops" | "points";
+            cap: number;
+            window?: {
+                kind: "rolling" | "fixed";
+                durationSec: number;
+            } | undefined;
+        }>>;
+        /** Required: at least one scope */
+        scopes: z.ZodArray<z.ZodObject<{
+            /** Resource identifier (e.g., "api:users", "data:emails") */
+            resource: z.ZodString;
+            /** How to match the resource */
+            matcher: z.ZodEnum<["exact", "prefix", "regex"]>;
+            /** Optional additional constraints on this scope */
+            constraints: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }, {
+            resource: string;
+            matcher: "exact" | "prefix" | "regex";
+            constraints?: Record<string, any> | undefined;
+        }>, "many">;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">>;
+/**
+ * Check if constraints have a valid time range
+ *
+ * @param constraints - The constraints to check
+ * @returns true if time range is valid or no time range specified
+ */
+export declare function hasValidTimeRange(constraints: DelegationConstraints): boolean;
+/**
+ * Check if child constraints are within parent constraints
+ *
+ * This performs basic structural checks. Full chain validation
+ * requires runtime implementation.
+ *
+ * @param parent - Parent delegation constraints
+ * @param child - Child delegation constraints
+ * @returns true if child is within parent bounds
+ */
+export declare function areChildConstraintsValid(parent: DelegationConstraints, child: DelegationConstraints): boolean;
+/**
+ * Check if a resource matches a scope
+ *
+ * @param resource - The resource to check
+ * @param scope - The scope to match against
+ * @returns true if resource matches scope
+ */
+export declare function doesResourceMatchScope(resource: string, scope: CrispScope): boolean;
+/**
+ * Constants
+ */
+/**
+ * Supported currency types
+ */
+export declare const SUPPORTED_CURRENCIES: Currency[];
+/**
+ * Supported scope matchers
+ */
+export declare const SUPPORTED_MATCHERS: ScopeMatcher[];
+/**
+ * Maximum reasonable budget cap (for validation)
+ */
+export declare const MAX_BUDGET_CAP: number;
+/**
+ * Maximum reasonable window duration (10 years in seconds)
+ */
+export declare const MAX_WINDOW_DURATION_SEC: number;