@kya-os/contracts 1.8.1 → 1.9.1

package/dist/agentshield-api/schemas.d.ts

@@ -83,6 +83,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             sessionId: z.ZodString;
             requestHash: z.ZodString;
             responseHash: z.ZodString;
+            outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
             scopeId: z.ZodOptional<z.ZodString>;
             delegationRef: z.ZodOptional<z.ZodString>;
             clientDid: z.ZodOptional<z.ZodString>;
@@ -97,6 +98,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         }, {
             did: string;
@@ -109,6 +111,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
@@ -124,6 +127,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }, {
@@ -139,6 +143,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }>, "many">;
@@ -286,6 +291,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }[];
@@ -332,6 +338,7 @@ export declare const proofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }[];

package/dist/compute.d.ts

@@ -335,19 +335,45 @@ export declare const ConfigBundleSchema: z.ZodObject<{
     aiProvider: z.ZodObject<{
         type: z.ZodEnum<["anthropic", "openai"]>;
         apiKey: z.ZodString;
+        /**
+         * Optional base URL override. When set, OpenClaw routes all provider
+         * traffic through this URL instead of the provider's default endpoint.
+         * Used by managed deployments where AgentShield issues a per-deployment
+         * gateway token and proxies to the upstream provider with budget tracking.
+         */
+        baseUrl: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         type: "anthropic" | "openai";
         apiKey: string;
+        baseUrl?: string | undefined;
     }, {
         type: "anthropic" | "openai";
         apiKey: string;
+        baseUrl?: string | undefined;
     }>;
+    /**
+     * Optional OpenClaw heartbeat interval (`agents.defaults.heartbeat.every`).
+     * Drives how often OpenClaw wakes the agent for HEARTBEAT.md processing —
+     * the primary token-cost lever. Examples: "30m" (active), "6h" (idle),
+     * "off" (dormant — heartbeat disabled entirely). When absent, the patcher
+     * preserves whatever value already lives in openclaw.json (OpenClaw's
+     * built-in default of "30m").
+     */
+    heartbeatEvery: z.ZodOptional<z.ZodString>;
+    /**
+     * Optional override for `agents.defaults.model.primary` (e.g.
+     * "anthropic/claude-haiku-4-5" for idle agents). When absent, the patcher
+     * derives the model from `aiProvider.type` as before. Format must be
+     * "<provider>/<model-id>".
+     */
+    modelOverride: z.ZodOptional<z.ZodString>;
     /** ISO timestamp of last config modification */
     updatedAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     aiProvider: {
         type: "anthropic" | "openai";
         apiKey: string;
+        baseUrl?: string | undefined;
     };
     version: number;
     channels: {
@@ -373,10 +399,13 @@ export declare const ConfigBundleSchema: z.ZodObject<{
     soulFile: string | null;
     gatewayToken: string;
     updatedAt: string;
+    heartbeatEvery?: string | undefined;
+    modelOverride?: string | undefined;
 }, {
     aiProvider: {
         type: "anthropic" | "openai";
         apiKey: string;
+        baseUrl?: string | undefined;
     };
     version: number;
     channels: {
@@ -402,6 +431,8 @@ export declare const ConfigBundleSchema: z.ZodObject<{
     soulFile: string | null;
     gatewayToken: string;
     updatedAt: string;
+    heartbeatEvery?: string | undefined;
+    modelOverride?: string | undefined;
 }>;
 export type ConfigBundle = z.infer<typeof ConfigBundleSchema>;
 /**

package/dist/compute.js

@@ -161,7 +161,30 @@ exports.ConfigBundleSchema = zod_1.z.object({
     aiProvider: zod_1.z.object({
         type: zod_1.z.enum(["anthropic", "openai"]),
         apiKey: zod_1.z.string().min(1).max(500),
+        /**
+         * Optional base URL override. When set, OpenClaw routes all provider
+         * traffic through this URL instead of the provider's default endpoint.
+         * Used by managed deployments where AgentShield issues a per-deployment
+         * gateway token and proxies to the upstream provider with budget tracking.
+         */
+        baseUrl: zod_1.z.string().url().optional(),
     }),
+    /**
+     * Optional OpenClaw heartbeat interval (`agents.defaults.heartbeat.every`).
+     * Drives how often OpenClaw wakes the agent for HEARTBEAT.md processing —
+     * the primary token-cost lever. Examples: "30m" (active), "6h" (idle),
+     * "off" (dormant — heartbeat disabled entirely). When absent, the patcher
+     * preserves whatever value already lives in openclaw.json (OpenClaw's
+     * built-in default of "30m").
+     */
+    heartbeatEvery: zod_1.z.string().min(1).max(20).optional(),
+    /**
+     * Optional override for `agents.defaults.model.primary` (e.g.
+     * "anthropic/claude-haiku-4-5" for idle agents). When absent, the patcher
+     * derives the model from `aiProvider.type` as before. Format must be
+     * "<provider>/<model-id>".
+     */
+    modelOverride: zod_1.z.string().min(1).max(100).optional(),
     /** ISO timestamp of last config modification */
     updatedAt: zod_1.z.string().datetime(),
 });

package/dist/handshake.d.ts

@@ -206,18 +206,19 @@ export declare const SessionContextSchema: z.ZodObject<{
     /**
      * Delegation VC credential ID for the active delegation.
      * Set after delegation verification succeeds for a protected tool call.
-     * Used by outbound fetch interceptors to inject KYA-Delegation-Id header.
+     * Used by outbound fetch interceptors as the delegation reference embedded
+     * in the KYA-OS-Delegation-Chain / KYA-OS-Delegation-Proof headers.
      */
     delegationRef: z.ZodOptional<z.ZodString>;
     /**
      * Reference chain string for the delegation hierarchy.
      * Format: "vc_id_1>del_id_1>vc_id_2>del_id_2"
-     * Used by outbound fetch interceptors to inject KYA-Delegation-Chain header.
+     * Used by outbound fetch interceptors to inject KYA-OS-Delegation-Chain header.
      */
     delegationChain: z.ZodOptional<z.ZodString>;
     /**
      * Scopes granted by the active delegation.
-     * Used by outbound fetch interceptors to inject KYA-Granted-Scopes header.
+     * Used by outbound fetch interceptors to inject KYA-OS-Granted-Scopes header.
      */
     delegationScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {

package/dist/handshake.js

@@ -78,18 +78,19 @@ exports.SessionContextSchema = zod_1.z.object({
     /**
      * Delegation VC credential ID for the active delegation.
      * Set after delegation verification succeeds for a protected tool call.
-     * Used by outbound fetch interceptors to inject KYA-Delegation-Id header.
+     * Used by outbound fetch interceptors as the delegation reference embedded
+     * in the KYA-OS-Delegation-Chain / KYA-OS-Delegation-Proof headers.
      */
     delegationRef: zod_1.z.string().optional(),
     /**
      * Reference chain string for the delegation hierarchy.
      * Format: "vc_id_1>del_id_1>vc_id_2>del_id_2"
-     * Used by outbound fetch interceptors to inject KYA-Delegation-Chain header.
+     * Used by outbound fetch interceptors to inject KYA-OS-Delegation-Chain header.
      */
     delegationChain: zod_1.z.string().optional(),
     /**
      * Scopes granted by the active delegation.
-     * Used by outbound fetch interceptors to inject KYA-Granted-Scopes header.
+     * Used by outbound fetch interceptors to inject KYA-OS-Granted-Scopes header.
      */
     delegationScopes: zod_1.z.array(zod_1.z.string()).optional(),
 });

package/dist/proof/index.d.ts

@@ -4,6 +4,6 @@
  * This module exports all proof-related types including DetachedProof,
  * proof records, and signing specs.
  */
-export { DetachedProofSchema, ProofMetaSchema, CanonicalHashesSchema, AuditRecordSchema, ToolCallContextSchema, ProofSubmissionContextSchema, ProofSubmissionRequestSchema, JWS_ALGORITHM, HASH_ALGORITHM, AUDIT_VERSION, type DetachedProof, type ProofMeta, type CanonicalHashes, type AuditRecord, type ToolCallContext, type ProofSubmissionContext, type ProofSubmissionRequest, } from '../proof.js';
-export * from './signing-spec.js';
-export * from './proof-record.js';
+export { DetachedProofSchema, ProofMetaSchema, ProofOutcomeSchema, CanonicalHashesSchema, AuditRecordSchema, ToolCallContextSchema, ProofSubmissionContextSchema, ProofSubmissionRequestSchema, JWS_ALGORITHM, HASH_ALGORITHM, AUDIT_VERSION, type DetachedProof, type ProofMeta, type ProofOutcome, type CanonicalHashes, type AuditRecord, type ToolCallContext, type ProofSubmissionContext, type ProofSubmissionRequest, } from "../proof.js";
+export * from "./signing-spec.js";
+export * from "./proof-record.js";

package/dist/proof/index.js

@@ -20,11 +20,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUDIT_VERSION = exports.HASH_ALGORITHM = exports.JWS_ALGORITHM = exports.ProofSubmissionRequestSchema = exports.ProofSubmissionContextSchema = exports.ToolCallContextSchema = exports.AuditRecordSchema = exports.CanonicalHashesSchema = exports.ProofMetaSchema = exports.DetachedProofSchema = void 0;
+exports.AUDIT_VERSION = exports.HASH_ALGORITHM = exports.JWS_ALGORITHM = exports.ProofSubmissionRequestSchema = exports.ProofSubmissionContextSchema = exports.ToolCallContextSchema = exports.AuditRecordSchema = exports.CanonicalHashesSchema = exports.ProofOutcomeSchema = exports.ProofMetaSchema = exports.DetachedProofSchema = void 0;
 // Export DetachedProof and related schemas from root proof.ts
 var proof_js_1 = require("../proof.js");
 Object.defineProperty(exports, "DetachedProofSchema", { enumerable: true, get: function () { return proof_js_1.DetachedProofSchema; } });
 Object.defineProperty(exports, "ProofMetaSchema", { enumerable: true, get: function () { return proof_js_1.ProofMetaSchema; } });
+Object.defineProperty(exports, "ProofOutcomeSchema", { enumerable: true, get: function () { return proof_js_1.ProofOutcomeSchema; } });
 Object.defineProperty(exports, "CanonicalHashesSchema", { enumerable: true, get: function () { return proof_js_1.CanonicalHashesSchema; } });
 Object.defineProperty(exports, "AuditRecordSchema", { enumerable: true, get: function () { return proof_js_1.AuditRecordSchema; } });
 Object.defineProperty(exports, "ToolCallContextSchema", { enumerable: true, get: function () { return proof_js_1.ToolCallContextSchema; } });

package/dist/proof.d.ts

@@ -9,6 +9,23 @@ import { z } from "zod";
  * The JWS payload contains JWT standard claims (aud, sub, iss) plus custom
  * proof claims (requestHash, responseHash, nonce, etc.).
  */
+/**
+ * Outcome of the policy decision a proof attests to (ratified DIF decision).
+ *
+ * - `allowed`             — the call was authorized and produced a response; the
+ *                           proof carries a `responseHash` over that response.
+ * - `denied`              — the call was refused; no response was produced.
+ * - `step_up_required`    — a step-up (re-auth / higher assurance) is required
+ *                           before the call may proceed; no response yet.
+ * - `needs_authorization` — explicit user authorization is required first; no
+ *                           response yet.
+ *
+ * Denial and step-up outcomes authorize no response, so their proofs omit
+ * `responseHash`. The field is optional on {@link ProofMetaSchema}: proofs minted
+ * before it existed carry no `outcome` and are treated as `allowed`.
+ */
+export declare const ProofOutcomeSchema: z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>;
+export type ProofOutcome = z.infer<typeof ProofOutcomeSchema>;
 export declare const ProofMetaSchema: z.ZodObject<{
     did: z.ZodString;
     kid: z.ZodString;
@@ -18,6 +35,7 @@ export declare const ProofMetaSchema: z.ZodObject<{
     sessionId: z.ZodString;
     requestHash: z.ZodString;
     responseHash: z.ZodString;
+    outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
     scopeId: z.ZodOptional<z.ZodString>;
     delegationRef: z.ZodOptional<z.ZodString>;
     clientDid: z.ZodOptional<z.ZodString>;
@@ -32,6 +50,7 @@ export declare const ProofMetaSchema: z.ZodObject<{
     responseHash: string;
     clientDid?: string | undefined;
     delegationRef?: string | undefined;
+    outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
     scopeId?: string | undefined;
 }, {
     did: string;
@@ -44,6 +63,7 @@ export declare const ProofMetaSchema: z.ZodObject<{
     responseHash: string;
     clientDid?: string | undefined;
     delegationRef?: string | undefined;
+    outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
     scopeId?: string | undefined;
 }>;
 export declare const DetachedProofSchema: z.ZodObject<{
@@ -57,6 +77,7 @@ export declare const DetachedProofSchema: z.ZodObject<{
         sessionId: z.ZodString;
         requestHash: z.ZodString;
         responseHash: z.ZodString;
+        outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
         scopeId: z.ZodOptional<z.ZodString>;
         delegationRef: z.ZodOptional<z.ZodString>;
         clientDid: z.ZodOptional<z.ZodString>;
@@ -71,6 +92,7 @@ export declare const DetachedProofSchema: z.ZodObject<{
         responseHash: string;
         clientDid?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopeId?: string | undefined;
     }, {
         did: string;
@@ -83,6 +105,7 @@ export declare const DetachedProofSchema: z.ZodObject<{
         responseHash: string;
         clientDid?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopeId?: string | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
@@ -98,6 +121,7 @@ export declare const DetachedProofSchema: z.ZodObject<{
         responseHash: string;
         clientDid?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopeId?: string | undefined;
     };
 }, {
@@ -113,6 +137,7 @@ export declare const DetachedProofSchema: z.ZodObject<{
         responseHash: string;
         clientDid?: string | undefined;
         delegationRef?: string | undefined;
+        outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
         scopeId?: string | undefined;
     };
 }>;
@@ -251,6 +276,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             sessionId: z.ZodString;
             requestHash: z.ZodString;
             responseHash: z.ZodString;
+            outcome: z.ZodOptional<z.ZodEnum<["allowed", "denied", "step_up_required", "needs_authorization"]>>;
             scopeId: z.ZodOptional<z.ZodString>;
             delegationRef: z.ZodOptional<z.ZodString>;
             clientDid: z.ZodOptional<z.ZodString>;
@@ -265,6 +291,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         }, {
             did: string;
@@ -277,6 +304,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
@@ -292,6 +320,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }, {
@@ -307,6 +336,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }>, "many">;
@@ -365,6 +395,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }[];
@@ -394,6 +425,7 @@ export declare const ProofSubmissionRequestSchema: z.ZodObject<{
             responseHash: string;
             clientDid?: string | undefined;
             delegationRef?: string | undefined;
+            outcome?: "allowed" | "denied" | "step_up_required" | "needs_authorization" | undefined;
             scopeId?: string | undefined;
         };
     }[];

package/dist/proof.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProofSubmissionRequestSchema = exports.ProofSubmissionContextSchema = exports.ToolCallContextSchema = exports.AUDIT_VERSION = exports.HASH_ALGORITHM = exports.JWS_ALGORITHM = exports.AuditRecordSchema = exports.CanonicalHashesSchema = exports.DetachedProofSchema = exports.ProofMetaSchema = void 0;
+exports.ProofSubmissionRequestSchema = exports.ProofSubmissionContextSchema = exports.ToolCallContextSchema = exports.AUDIT_VERSION = exports.HASH_ALGORITHM = exports.JWS_ALGORITHM = exports.AuditRecordSchema = exports.CanonicalHashesSchema = exports.DetachedProofSchema = exports.ProofMetaSchema = exports.ProofOutcomeSchema = void 0;
 const zod_1 = require("zod");
 /**
  * Proof and signature schemas for MCP-I
@@ -12,6 +12,27 @@ const zod_1 = require("zod");
  * The JWS payload contains JWT standard claims (aud, sub, iss) plus custom
  * proof claims (requestHash, responseHash, nonce, etc.).
  */
+/**
+ * Outcome of the policy decision a proof attests to (ratified DIF decision).
+ *
+ * - `allowed`             — the call was authorized and produced a response; the
+ *                           proof carries a `responseHash` over that response.
+ * - `denied`              — the call was refused; no response was produced.
+ * - `step_up_required`    — a step-up (re-auth / higher assurance) is required
+ *                           before the call may proceed; no response yet.
+ * - `needs_authorization` — explicit user authorization is required first; no
+ *                           response yet.
+ *
+ * Denial and step-up outcomes authorize no response, so their proofs omit
+ * `responseHash`. The field is optional on {@link ProofMetaSchema}: proofs minted
+ * before it existed carry no `outcome` and are treated as `allowed`.
+ */
+exports.ProofOutcomeSchema = zod_1.z.enum([
+    "allowed",
+    "denied",
+    "step_up_required",
+    "needs_authorization",
+]);
 exports.ProofMetaSchema = zod_1.z.object({
     did: zod_1.z.string().min(1),
     kid: zod_1.z.string().min(1),
@@ -21,6 +42,13 @@ exports.ProofMetaSchema = zod_1.z.object({
     sessionId: zod_1.z.string().min(1),
     requestHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
     responseHash: zod_1.z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    // Policy outcome this proof attests to (ratified DIF decision); absent on
+    // legacy proofs, which consumers treat as "allowed". Per the ratified schema
+    // `responseHash` is present only for the "allowed" outcome — the verifier
+    // enforces that outcome-conditionally. `responseHash` stays required-typed
+    // here to avoid a repo-wide `string | undefined` ripple; making it
+    // conditionally optional is a deferred schema refinement.
+    outcome: exports.ProofOutcomeSchema.optional(),
     scopeId: zod_1.z.string().optional(),
     delegationRef: zod_1.z.string().optional(),
     clientDid: zod_1.z.string().optional(), // Optional for backward compatibility

package/dist/reputation/index.d.ts

@@ -16,5 +16,6 @@
  */
 export * from "./schemas.js";
 export * from "./api.js";
+export * from "./interactions.js";
 export * from "./credentials.js";
 export * from "./constants.js";

package/dist/reputation/index.js

@@ -34,6 +34,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./schemas.js"), exports);
 // API schemas
 __exportStar(require("./api.js"), exports);
+// Per-tool-call interaction attestation request (xmcp-i#413)
+__exportStar(require("./interactions.js"), exports);
 // Credential schemas (W3C VC)
 __exportStar(require("./credentials.js"), exports);
 // Constants and configuration

package/dist/reputation/interactions.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Interaction Report Request Contract
+ *
+ * The per-tool-call attestation body that identity-aware runtimes POST to
+ * KTA's `POST /api/v1/agents/{did}/interactions` endpoint (xmcp-i#413). KTA
+ * verifies the embedded JWS against the agent's registered public key and
+ * folds the outcome into the Bayesian reputation engine.
+ *
+ * WHY this lives in @kya-os/contracts: per the repo's API-parity rule, the
+ * wire shape of any cross-service POST must be a shared, Zod-validated
+ * contract — never inlined at the call site. The producer here is
+ * `@kya-os/compute`'s attestation reporter; the consumer is the KTA route.
+ *
+ * PARITY CAVEAT: KTA's receiving schema lives in a different repository
+ * (Know-That-Ai/know-that-ai → `src/app/api/v1/agents/[did]/interactions/`)
+ * and cannot be imported or validated from here. This schema mirrors the body
+ * shape already accepted in production (the existing attestation flow), and
+ * MUST be kept in lock-step with that route when either side changes.
+ *
+ * Related Spec: MCP-I §5 (Reputation)
+ */
+import { z } from "zod";
+/**
+ * Interaction classification. Open-ended on the wire (KTA may accept more
+ * types over time), but the per-tool-call attestation path emits exactly
+ * `"scope_executed"`. Modeled as a string with that documented default rather
+ * than a closed enum so adding a new KTA-side type does not require a
+ * contracts bump on the producer before the receiver is ready.
+ */
+export declare const INTERACTION_TYPE_SCOPE_EXECUTED: "scope_executed";
+/**
+ * Coarse success/failure outcome KTA folds into the reputation score. The
+ * compute reporter collapses its finer 4-value status (success/error/denied/
+ * timeout) onto this two-value axis — anything that is not an unambiguous
+ * success counts as a failure for reputation purposes.
+ */
+export declare const InteractionOutcomeSchema: z.ZodEnum<["success", "failure"]>;
+export type InteractionOutcome = z.infer<typeof InteractionOutcomeSchema>;
+/**
+ * Evidentiary context carried alongside the signed attestation. `client_did`
+ * is optional because the agent may receive calls from un-attested clients
+ * during the rollout window; the attestation still has value without it.
+ */
+export declare const InteractionContextSchema: z.ZodObject<{
+    /** MCP session id from the originating tools/call. May be empty for headless flows. */
+    session_id: z.ZodString;
+    /** Calling client's DID, when known. Omitted (not null) when un-attested. */
+    client_did: z.ZodOptional<z.ZodString>;
+    /** Compact JWS attestation of the tool call, signed by the agent's key. */
+    attestation_jws: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    session_id: string;
+    attestation_jws: string;
+    client_did?: string | undefined;
+}, {
+    session_id: string;
+    attestation_jws: string;
+    client_did?: string | undefined;
+}>;
+export type InteractionContext = z.infer<typeof InteractionContextSchema>;
+/**
+ * Interaction Report Request Schema
+ *
+ * Fire-and-forget body POSTed per tool call. Authenticated by the
+ * `x-api-key` header (not part of the body); idempotency is the caller's
+ * responsibility via `idempotency_key`.
+ */
+export declare const InteractionReportRequestSchema: z.ZodObject<{
+    /** Interaction classification — `"scope_executed"` for tool-call attestations. */
+    interaction_type: z.ZodString;
+    /** Reputation-facing outcome. */
+    outcome: z.ZodEnum<["success", "failure"]>;
+    /** Authorized scopes for the call, when a delegation context supplies them. */
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** ISO 8601 timestamp of the call, set when the attestation is signed. */
+    timestamp: z.ZodString;
+    /** Evidentiary context including the signed attestation. */
+    context: z.ZodObject<{
+        /** MCP session id from the originating tools/call. May be empty for headless flows. */
+        session_id: z.ZodString;
+        /** Calling client's DID, when known. Omitted (not null) when un-attested. */
+        client_did: z.ZodOptional<z.ZodString>;
+        /** Compact JWS attestation of the tool call, signed by the agent's key. */
+        attestation_jws: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    }, {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    }>;
+    /** Per-call key so a retried POST of the same call is deduped by KTA. */
+    idempotency_key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    timestamp: string;
+    outcome: "success" | "failure";
+    context: {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    };
+    interaction_type: string;
+    idempotency_key: string;
+    scopes?: string[] | undefined;
+}, {
+    timestamp: string;
+    outcome: "success" | "failure";
+    context: {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    };
+    interaction_type: string;
+    idempotency_key: string;
+    scopes?: string[] | undefined;
+}>;
+export type InteractionReportRequest = z.infer<typeof InteractionReportRequestSchema>;
+/**
+ * Validate an interaction report request. Mirrors the `validate*` helpers in
+ * `./api.ts` so call sites can branch on `.success` without importing zod.
+ */
+export declare function validateInteractionReportRequest(data: unknown): z.SafeParseReturnType<{
+    timestamp: string;
+    outcome: "success" | "failure";
+    context: {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    };
+    interaction_type: string;
+    idempotency_key: string;
+    scopes?: string[] | undefined;
+}, {
+    timestamp: string;
+    outcome: "success" | "failure";
+    context: {
+        session_id: string;
+        attestation_jws: string;
+        client_did?: string | undefined;
+    };
+    interaction_type: string;
+    idempotency_key: string;
+    scopes?: string[] | undefined;
+}>;