@llm-dev-ops/agentics-cli 1.4.26 → 1.4.27

package/dist/bundled-agents/data-vault-agents/dist/tests/contract-tests.js

@@ -0,0 +1,1096 @@
+/**
+ * Contract Validation Tests for LLM-Data-Vault Agents
+ *
+ * Validates all inputs and outputs against schemas:
+ * - Input schema compliance
+ * - Output schema compliance
+ * - DecisionEvent schema compliance
+ * - TelemetryEvent schema compliance
+ * - Boundary enforcement
+ *
+ * @module tests/contract-tests
+ */
+import { describe, it, expect } from 'vitest';
+import { v4 as uuidv4 } from 'uuid';
+import { z } from 'zod';
+import { 
+// Registration schemas
+AgentCapabilitySchema, AgentRegistrationSchema, createAgentRegistration, validateRegistration, verifyBoundaryCompliance, AuthorizeCapability, AnonymizeCapability, EncryptionCapability, 
+// Integration schemas
+DecisionEventSchema, TelemetryEventSchema, PolicySchema, DatasetRequestSchema, DatasetResponseSchema, ApprovedDatasetSchema } from '../platform/index.js';
+// =============================================================================
+// INPUT SCHEMA VALIDATION TESTS
+// =============================================================================
+describe('Input Schema Validation', () => {
+    describe('AuthorizeRequest Schema', () => {
+        // Define input schema for authorization requests
+        const AuthorizeRequestSchema = z.object({
+            requestId: z.string().uuid(),
+            userId: z.string().min(1),
+            datasetId: z.string().min(1),
+            operation: z.enum(['read', 'write', 'delete', 'admin']),
+            fields: z.array(z.string()).optional(),
+            purpose: z.enum(['training', 'inference', 'evaluation', 'analysis']).optional(),
+            metadata: z.record(z.unknown()).optional()
+        });
+        it('should validate complete authorization request', () => {
+            const validRequest = {
+                requestId: uuidv4(),
+                userId: 'user-123',
+                datasetId: 'dataset-456',
+                operation: 'read',
+                fields: ['name', 'email'],
+                purpose: 'training',
+                metadata: { source: 'api' }
+            };
+            const result = AuthorizeRequestSchema.safeParse(validRequest);
+            expect(result.success).toBe(true);
+        });
+        it('should reject request with invalid UUID', () => {
+            const invalidRequest = {
+                requestId: 'not-a-uuid',
+                userId: 'user-123',
+                datasetId: 'dataset-456',
+                operation: 'read'
+            };
+            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should reject request with invalid operation', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                userId: 'user-123',
+                datasetId: 'dataset-456',
+                operation: 'execute' // Invalid
+            };
+            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should reject request with empty userId', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                userId: '',
+                datasetId: 'dataset-456',
+                operation: 'read'
+            };
+            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should accept request without optional fields', () => {
+            const minimalRequest = {
+                requestId: uuidv4(),
+                userId: 'user-123',
+                datasetId: 'dataset-456',
+                operation: 'read'
+            };
+            const result = AuthorizeRequestSchema.safeParse(minimalRequest);
+            expect(result.success).toBe(true);
+        });
+    });
+    describe('AnonymizeRequest Schema', () => {
+        const AnonymizeRequestSchema = z.object({
+            requestId: z.string().uuid(),
+            datasetId: z.string().min(1),
+            data: z.array(z.record(z.unknown())),
+            strategy: z.enum(['redact', 'mask', 'hash', 'encrypt', 'generalize', 'pseudonymize']),
+            fields: z.array(z.string()).optional(),
+            options: z.object({
+                preserveFormat: z.boolean().optional(),
+                hashSalt: z.string().optional(),
+                maskChar: z.string().length(1).optional(),
+                generalizationLevel: z.number().int().min(1).max(10).optional()
+            }).optional(),
+            trackLineage: z.boolean().optional()
+        });
+        it('should validate complete anonymize request', () => {
+            const validRequest = {
+                requestId: uuidv4(),
+                datasetId: 'dataset-456',
+                data: [
+                    { id: 1, email: 'john@example.com' },
+                    { id: 2, email: 'jane@example.com' }
+                ],
+                strategy: 'redact',
+                fields: ['email'],
+                options: { preserveFormat: true },
+                trackLineage: true
+            };
+            const result = AnonymizeRequestSchema.safeParse(validRequest);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid strategy', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                datasetId: 'dataset-456',
+                data: [{ email: 'test@example.com' }],
+                strategy: 'delete' // Invalid
+            };
+            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should reject empty data array', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                datasetId: 'dataset-456',
+                data: [],
+                strategy: 'redact'
+            };
+            // Empty arrays are technically valid, but could be rejected by business logic
+            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(true); // Schema allows empty, business logic may not
+        });
+        it('should validate mask character length', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                datasetId: 'dataset-456',
+                data: [{ email: 'test@example.com' }],
+                strategy: 'mask',
+                options: { maskChar: '**' } // Should be single char
+            };
+            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should validate generalization level bounds', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                datasetId: 'dataset-456',
+                data: [{ age: 25 }],
+                strategy: 'generalize',
+                options: { generalizationLevel: 15 } // Max is 10
+            };
+            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('DatasetRequest Schema', () => {
+        it('should validate complete dataset request', () => {
+            const validRequest = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                requester: {
+                    serviceId: 'llm-orchestrator',
+                    userId: 'user-123',
+                    purpose: 'training'
+                },
+                dataset: {
+                    datasetId: 'dataset-456',
+                    version: '1.0.0',
+                    filters: { category: 'public' },
+                    fields: ['id', 'text'],
+                    limit: 1000
+                },
+                requirements: {
+                    anonymizationLevel: 'strict',
+                    encryptionRequired: true,
+                    auditRequired: true,
+                    lineageRequired: true
+                },
+                deadline: new Date(Date.now() + 3600000).toISOString()
+            };
+            const result = DatasetRequestSchema.safeParse(validRequest);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid purpose', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                requester: {
+                    serviceId: 'service-1',
+                    purpose: 'hacking' // Invalid
+                },
+                dataset: { datasetId: 'dataset-456' },
+                requirements: {
+                    anonymizationLevel: 'none',
+                    encryptionRequired: false,
+                    auditRequired: false,
+                    lineageRequired: false
+                }
+            };
+            const result = DatasetRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should reject invalid anonymization level', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                requester: {
+                    serviceId: 'service-1',
+                    purpose: 'training'
+                },
+                dataset: { datasetId: 'dataset-456' },
+                requirements: {
+                    anonymizationLevel: 'maximum', // Invalid
+                    encryptionRequired: false,
+                    auditRequired: false,
+                    lineageRequired: false
+                }
+            };
+            const result = DatasetRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+        it('should reject negative limit', () => {
+            const invalidRequest = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                requester: {
+                    serviceId: 'service-1',
+                    purpose: 'training'
+                },
+                dataset: {
+                    datasetId: 'dataset-456',
+                    limit: -100 // Invalid
+                },
+                requirements: {
+                    anonymizationLevel: 'none',
+                    encryptionRequired: false,
+                    auditRequired: false,
+                    lineageRequired: false
+                }
+            };
+            const result = DatasetRequestSchema.safeParse(invalidRequest);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('Policy Schema', () => {
+        it('should validate complete policy', () => {
+            const validPolicy = {
+                policyId: uuidv4(),
+                name: 'GDPR Compliance Policy',
+                version: '1.0.0',
+                rules: [
+                    {
+                        ruleId: 'rule-001',
+                        condition: {
+                            field: 'dataType',
+                            operator: 'eq',
+                            value: 'personal'
+                        },
+                        action: 'transform',
+                        transformations: [
+                            {
+                                type: 'redact',
+                                field: 'email'
+                            },
+                            {
+                                type: 'hash',
+                                field: 'userId',
+                                config: { algorithm: 'sha256' }
+                            }
+                        ]
+                    }
+                ],
+                scope: {
+                    datasets: ['public-*', 'training-*'],
+                    users: ['analyst-*'],
+                    operations: ['read']
+                },
+                effectiveFrom: new Date().toISOString(),
+                effectiveUntil: new Date(Date.now() + 365 * 24 * 3600000).toISOString(),
+                priority: 100
+            };
+            const result = PolicySchema.safeParse(validPolicy);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid rule operator', () => {
+            const invalidPolicy = {
+                policyId: uuidv4(),
+                name: 'Test Policy',
+                version: '1.0.0',
+                rules: [{
+                        ruleId: 'rule-001',
+                        condition: {
+                            field: 'type',
+                            operator: 'like', // Invalid
+                            value: 'test'
+                        },
+                        action: 'allow'
+                    }],
+                scope: {},
+                effectiveFrom: new Date().toISOString(),
+                priority: 50
+            };
+            const result = PolicySchema.safeParse(invalidPolicy);
+            expect(result.success).toBe(false);
+        });
+        it('should reject invalid transformation type', () => {
+            const invalidPolicy = {
+                policyId: uuidv4(),
+                name: 'Test Policy',
+                version: '1.0.0',
+                rules: [{
+                        ruleId: 'rule-001',
+                        condition: {
+                            field: 'type',
+                            operator: 'eq',
+                            value: 'test'
+                        },
+                        action: 'transform',
+                        transformations: [{
+                                type: 'delete', // Invalid
+                                field: 'email'
+                            }]
+                    }],
+                scope: {},
+                effectiveFrom: new Date().toISOString(),
+                priority: 50
+            };
+            const result = PolicySchema.safeParse(invalidPolicy);
+            expect(result.success).toBe(false);
+        });
+        it('should reject priority out of bounds', () => {
+            const invalidPolicy = {
+                policyId: uuidv4(),
+                name: 'Test Policy',
+                version: '1.0.0',
+                rules: [],
+                scope: {},
+                effectiveFrom: new Date().toISOString(),
+                priority: 1500 // Max is 1000
+            };
+            const result = PolicySchema.safeParse(invalidPolicy);
+            expect(result.success).toBe(false);
+        });
+    });
+});
+// =============================================================================
+// OUTPUT SCHEMA VALIDATION TESTS
+// =============================================================================
+describe('Output Schema Validation', () => {
+    describe('AuthorizeResponse Schema', () => {
+        const AuthorizeResponseSchema = z.object({
+            requestId: z.string().uuid(),
+            authorized: z.boolean(),
+            reason: z.string(),
+            decisionEventId: z.string().uuid(),
+            policyIds: z.array(z.string()),
+            expiresAt: z.string().datetime().optional(),
+            constraints: z.object({
+                allowedFields: z.array(z.string()).optional(),
+                maxRecords: z.number().int().positive().optional(),
+                rateLimit: z.number().int().positive().optional()
+            }).optional()
+        });
+        it('should validate complete authorization response', () => {
+            const validResponse = {
+                requestId: uuidv4(),
+                authorized: true,
+                reason: 'Access granted per policy-001',
+                decisionEventId: uuidv4(),
+                policyIds: ['policy-001', 'policy-002'],
+                expiresAt: new Date(Date.now() + 3600000).toISOString(),
+                constraints: {
+                    allowedFields: ['id', 'name'],
+                    maxRecords: 1000,
+                    rateLimit: 100
+                }
+            };
+            const result = AuthorizeResponseSchema.safeParse(validResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate denial response', () => {
+            const denialResponse = {
+                requestId: uuidv4(),
+                authorized: false,
+                reason: 'User does not have permission for write operation',
+                decisionEventId: uuidv4(),
+                policyIds: ['security-policy-001']
+            };
+            const result = AuthorizeResponseSchema.safeParse(denialResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should require decision event ID', () => {
+            const invalidResponse = {
+                requestId: uuidv4(),
+                authorized: true,
+                reason: 'Granted',
+                policyIds: []
+                // Missing decisionEventId
+            };
+            const result = AuthorizeResponseSchema.safeParse(invalidResponse);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('AnonymizeResponse Schema', () => {
+        const AnonymizeResponseSchema = z.object({
+            requestId: z.string().uuid(),
+            success: z.boolean(),
+            data: z.array(z.record(z.unknown())).optional(),
+            transformations: z.array(z.object({
+                field: z.string(),
+                type: z.string(),
+                count: z.number().int().nonnegative()
+            })).optional(),
+            detectedPii: z.array(z.object({
+                field: z.string(),
+                type: z.string(),
+                confidence: z.number().min(0).max(1)
+            })).optional(),
+            lineage: z.object({
+                sourceDatasetId: z.string(),
+                targetDatasetId: z.string(),
+                transformationId: z.string().uuid(),
+                timestamp: z.string().datetime()
+            }).optional(),
+            decisionEventId: z.string().uuid(),
+            error: z.object({
+                code: z.string(),
+                message: z.string()
+            }).optional()
+        });
+        it('should validate successful anonymize response', () => {
+            const validResponse = {
+                requestId: uuidv4(),
+                success: true,
+                data: [
+                    { id: 1, email: '[REDACTED]' },
+                    { id: 2, email: '[REDACTED]' }
+                ],
+                transformations: [
+                    { field: 'email', type: 'redact', count: 2 }
+                ],
+                decisionEventId: uuidv4()
+            };
+            const result = AnonymizeResponseSchema.safeParse(validResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate response with detected PII', () => {
+            const validResponse = {
+                requestId: uuidv4(),
+                success: true,
+                detectedPii: [
+                    { field: 'email', type: 'EMAIL', confidence: 0.99 },
+                    { field: 'ssn', type: 'SSN', confidence: 0.95 },
+                    { field: 'phone', type: 'PHONE', confidence: 0.87 }
+                ],
+                decisionEventId: uuidv4()
+            };
+            const result = AnonymizeResponseSchema.safeParse(validResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate response with lineage', () => {
+            const validResponse = {
+                requestId: uuidv4(),
+                success: true,
+                lineage: {
+                    sourceDatasetId: 'dataset-456',
+                    targetDatasetId: 'dataset-456-anonymized',
+                    transformationId: uuidv4(),
+                    timestamp: new Date().toISOString()
+                },
+                decisionEventId: uuidv4()
+            };
+            const result = AnonymizeResponseSchema.safeParse(validResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate error response', () => {
+            const errorResponse = {
+                requestId: uuidv4(),
+                success: false,
+                decisionEventId: uuidv4(),
+                error: {
+                    code: 'VALIDATION_ERROR',
+                    message: 'Invalid data format'
+                }
+            };
+            const result = AnonymizeResponseSchema.safeParse(errorResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid confidence score', () => {
+            const invalidResponse = {
+                requestId: uuidv4(),
+                success: true,
+                detectedPii: [
+                    { field: 'email', type: 'EMAIL', confidence: 1.5 } // Invalid
+                ],
+                decisionEventId: uuidv4()
+            };
+            const result = AnonymizeResponseSchema.safeParse(invalidResponse);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('DatasetResponse Schema', () => {
+        it('should validate approved response', () => {
+            const validResponse = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                status: 'approved',
+                dataset: {
+                    datasetId: 'dataset-456',
+                    version: '1.0.0',
+                    recordCount: 1000,
+                    sizeBytes: 1024000,
+                    checksum: 'sha256:abc123def456',
+                    location: 'https://storage.example.com/datasets/456',
+                    expiresAt: new Date(Date.now() + 3600000).toISOString()
+                },
+                transformations: [
+                    { type: 'anonymize', fieldsAffected: ['email', 'phone'], recordsAffected: 1000 }
+                ],
+                decision: {
+                    decisionEventId: uuidv4(),
+                    policyIds: ['policy-001'],
+                    reason: 'Access granted and data anonymized'
+                }
+            };
+            const result = DatasetResponseSchema.safeParse(validResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate denied response', () => {
+            const deniedResponse = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                status: 'denied',
+                decision: {
+                    decisionEventId: uuidv4(),
+                    policyIds: ['security-policy-001'],
+                    reason: 'Dataset contains restricted data'
+                },
+                error: {
+                    code: 'ACCESS_DENIED',
+                    message: 'User lacks required clearance'
+                }
+            };
+            const result = DatasetResponseSchema.safeParse(deniedResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should validate partial response', () => {
+            const partialResponse = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                status: 'partial',
+                dataset: {
+                    datasetId: 'dataset-456',
+                    version: '1.0.0',
+                    recordCount: 500, // Partial records
+                    sizeBytes: 512000,
+                    checksum: 'sha256:partial123'
+                },
+                decision: {
+                    decisionEventId: uuidv4(),
+                    policyIds: ['policy-001'],
+                    reason: 'Partial access granted - some records filtered'
+                }
+            };
+            const result = DatasetResponseSchema.safeParse(partialResponse);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid status', () => {
+            const invalidResponse = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                status: 'rejected', // Invalid - should be denied
+                decision: {
+                    decisionEventId: uuidv4(),
+                    policyIds: [],
+                    reason: 'Test'
+                }
+            };
+            const result = DatasetResponseSchema.safeParse(invalidResponse);
+            expect(result.success).toBe(false);
+        });
+        it('should reject negative record count', () => {
+            const invalidResponse = {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                status: 'approved',
+                dataset: {
+                    datasetId: 'dataset-456',
+                    version: '1.0.0',
+                    recordCount: -10, // Invalid
+                    sizeBytes: 1024,
+                    checksum: 'sha256:test'
+                },
+                decision: {
+                    decisionEventId: uuidv4(),
+                    policyIds: [],
+                    reason: 'Test'
+                }
+            };
+            const result = DatasetResponseSchema.safeParse(invalidResponse);
+            expect(result.success).toBe(false);
+        });
+    });
+    describe('ApprovedDataset Schema', () => {
+        it('should validate complete approved dataset', () => {
+            const validDataset = {
+                datasetId: 'dataset-456',
+                version: '1.0.0',
+                approvalId: uuidv4(),
+                approvedAt: new Date().toISOString(),
+                expiresAt: new Date(Date.now() + 3600000).toISOString(),
+                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+                constraints: {
+                    maxRecords: 10000,
+                    allowedFields: ['id', 'text', 'category'],
+                    rateLimit: {
+                        requestsPerMinute: 100,
+                        bytesPerMinute: 10485760
+                    }
+                },
+                endpoint: 'https://gateway.example.com/api/v1/datasets/456'
+            };
+            const result = ApprovedDatasetSchema.safeParse(validDataset);
+            expect(result.success).toBe(true);
+        });
+        it('should reject invalid endpoint URL', () => {
+            const invalidDataset = {
+                datasetId: 'dataset-456',
+                version: '1.0.0',
+                approvalId: uuidv4(),
+                approvedAt: new Date().toISOString(),
+                expiresAt: new Date(Date.now() + 3600000).toISOString(),
+                accessToken: 'token123',
+                constraints: {},
+                endpoint: 'not-a-valid-url' // Invalid
+            };
+            const result = ApprovedDatasetSchema.safeParse(invalidDataset);
+            expect(result.success).toBe(false);
+        });
+    });
+});
+// =============================================================================
+// DECISION EVENT SCHEMA COMPLIANCE TESTS
+// =============================================================================
+describe('DecisionEvent Schema Compliance', () => {
+    it('should validate complete DecisionEvent', () => {
+        const validEvent = {
+            eventId: uuidv4(),
+            eventType: 'DecisionEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                agentId: 'agent-001',
+                agentName: 'llm-data-vault',
+                agentVersion: '0.1.0'
+            },
+            decision: {
+                type: 'ALLOW',
+                reason: 'Access granted per data access policy',
+                confidence: 0.99,
+                policyIds: ['policy-001', 'policy-002'],
+                appliedRules: [
+                    {
+                        ruleId: 'rule-001',
+                        ruleName: 'AllowAnalystRead',
+                        action: 'allow',
+                        matched: true
+                    }
+                ]
+            },
+            context: {
+                requestId: uuidv4(),
+                correlationId: uuidv4(),
+                userId: 'user-123',
+                datasetId: 'dataset-456',
+                operation: 'read',
+                resourceType: 'dataset'
+            },
+            audit: {
+                inputHash: 'sha256:input123',
+                outputHash: 'sha256:output456',
+                processingTimeMs: 150,
+                bytesProcessed: 5120
+            },
+            metadata: {
+                clientIp: '192.168.1.1',
+                userAgent: 'SDK/1.0.0'
+            }
+        };
+        const result = DecisionEventSchema.safeParse(validEvent);
+        expect(result.success).toBe(true);
+    });
+    it('should validate all decision types', () => {
+        const decisionTypes = ['ALLOW', 'DENY', 'TRANSFORM', 'AUDIT'];
+        for (const type of decisionTypes) {
+            const event = {
+                eventId: uuidv4(),
+                eventType: 'DecisionEvent',
+                version: '1.0.0',
+                timestamp: new Date().toISOString(),
+                source: {
+                    agentId: 'agent-001',
+                    agentName: 'llm-data-vault',
+                    agentVersion: '0.1.0'
+                },
+                decision: {
+                    type,
+                    reason: `Decision type: ${type}`,
+                    confidence: 1.0,
+                    policyIds: [],
+                    appliedRules: []
+                },
+                context: {
+                    requestId: uuidv4(),
+                    operation: 'test',
+                    resourceType: 'test'
+                },
+                audit: {
+                    inputHash: 'sha256:test',
+                    processingTimeMs: 10,
+                    bytesProcessed: 100
+                }
+            };
+            const result = DecisionEventSchema.safeParse(event);
+            expect(result.success).toBe(true);
+        }
+    });
+    it('should reject invalid decision type', () => {
+        const invalidEvent = {
+            eventId: uuidv4(),
+            eventType: 'DecisionEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                agentId: 'agent-001',
+                agentName: 'llm-data-vault',
+                agentVersion: '0.1.0'
+            },
+            decision: {
+                type: 'APPROVE', // Invalid - should be ALLOW
+                reason: 'Test',
+                confidence: 1.0,
+                policyIds: [],
+                appliedRules: []
+            },
+            context: {
+                requestId: uuidv4(),
+                operation: 'test',
+                resourceType: 'test'
+            },
+            audit: {
+                inputHash: 'sha256:test',
+                processingTimeMs: 10,
+                bytesProcessed: 100
+            }
+        };
+        const result = DecisionEventSchema.safeParse(invalidEvent);
+        expect(result.success).toBe(false);
+    });
+    it('should reject confidence out of bounds', () => {
+        const invalidEvent = {
+            eventId: uuidv4(),
+            eventType: 'DecisionEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                agentId: 'agent-001',
+                agentName: 'llm-data-vault',
+                agentVersion: '0.1.0'
+            },
+            decision: {
+                type: 'ALLOW',
+                reason: 'Test',
+                confidence: 1.5, // Invalid - max is 1.0
+                policyIds: [],
+                appliedRules: []
+            },
+            context: {
+                requestId: uuidv4(),
+                operation: 'test',
+                resourceType: 'test'
+            },
+            audit: {
+                inputHash: 'sha256:test',
+                processingTimeMs: 10,
+                bytesProcessed: 100
+            }
+        };
+        const result = DecisionEventSchema.safeParse(invalidEvent);
+        expect(result.success).toBe(false);
+    });
+    it('should require audit fields', () => {
+        const invalidEvent = {
+            eventId: uuidv4(),
+            eventType: 'DecisionEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                agentId: 'agent-001',
+                agentName: 'llm-data-vault',
+                agentVersion: '0.1.0'
+            },
+            decision: {
+                type: 'ALLOW',
+                reason: 'Test',
+                confidence: 1.0,
+                policyIds: [],
+                appliedRules: []
+            },
+            context: {
+                requestId: uuidv4(),
+                operation: 'test',
+                resourceType: 'test'
+            }
+            // Missing audit field
+        };
+        const result = DecisionEventSchema.safeParse(invalidEvent);
+        expect(result.success).toBe(false);
+    });
+    it('should validate applied rules structure', () => {
+        const validEvent = {
+            eventId: uuidv4(),
+            eventType: 'DecisionEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                agentId: 'agent-001',
+                agentName: 'llm-data-vault',
+                agentVersion: '0.1.0'
+            },
+            decision: {
+                type: 'TRANSFORM',
+                reason: 'Data anonymized',
+                confidence: 1.0,
+                policyIds: ['gdpr-001'],
+                appliedRules: [
+                    { ruleId: 'r1', ruleName: 'RedactEmail', action: 'redact', matched: true },
+                    { ruleId: 'r2', ruleName: 'MaskPhone', action: 'mask', matched: true },
+                    { ruleId: 'r3', ruleName: 'HashSSN', action: 'hash', matched: false }
+                ]
+            },
+            context: {
+                requestId: uuidv4(),
+                operation: 'anonymize',
+                resourceType: 'dataset'
+            },
+            audit: {
+                inputHash: 'sha256:input',
+                outputHash: 'sha256:output',
+                processingTimeMs: 250,
+                bytesProcessed: 10240
+            }
+        };
+        const result = DecisionEventSchema.safeParse(validEvent);
+        expect(result.success).toBe(true);
+        expect(validEvent.decision.appliedRules.filter(r => r.matched).length).toBe(2);
+    });
+});
+// =============================================================================
+// TELEMETRY EVENT SCHEMA COMPLIANCE TESTS
+// =============================================================================
+describe('TelemetryEvent Schema Compliance', () => {
+    it('should validate complete TelemetryEvent', () => {
+        const validEvent = {
+            eventId: uuidv4(),
+            eventType: 'TelemetryEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                service: 'llm-data-vault',
+                instance: 'instance-001',
+                version: '0.1.0'
+            },
+            metrics: {
+                name: 'request_latency',
+                value: 150,
+                unit: 'ms',
+                tags: {
+                    endpoint: '/api/v1/authorize',
+                    status: '200',
+                    method: 'POST'
+                }
+            },
+            trace: {
+                traceId: uuidv4(),
+                spanId: uuidv4(),
+                parentSpanId: uuidv4()
+            }
+        };
+        const result = TelemetryEventSchema.safeParse(validEvent);
+        expect(result.success).toBe(true);
+    });
+    it('should validate all metric units', () => {
+        const units = ['count', 'ms', 'bytes', 'percent'];
+        for (const unit of units) {
+            const event = {
+                eventId: uuidv4(),
+                eventType: 'TelemetryEvent',
+                version: '1.0.0',
+                timestamp: new Date().toISOString(),
+                source: {
+                    service: 'llm-data-vault',
+                    instance: 'instance-001',
+                    version: '0.1.0'
+                },
+                metrics: {
+                    name: `test_metric_${unit}`,
+                    value: 100,
+                    unit,
+                    tags: { test: 'true' }
+                }
+            };
+            const result = TelemetryEventSchema.safeParse(event);
+            expect(result.success).toBe(true);
+        }
+    });
+    it('should reject invalid metric unit', () => {
+        const invalidEvent = {
+            eventId: uuidv4(),
+            eventType: 'TelemetryEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                service: 'llm-data-vault',
+                instance: 'instance-001',
+                version: '0.1.0'
+            },
+            metrics: {
+                name: 'test_metric',
+                value: 100,
+                unit: 'seconds', // Invalid - should be ms
+                tags: {}
+            }
+        };
+        const result = TelemetryEventSchema.safeParse(invalidEvent);
+        expect(result.success).toBe(false);
+    });
+    it('should allow event without trace context', () => {
+        const eventWithoutTrace = {
+            eventId: uuidv4(),
+            eventType: 'TelemetryEvent',
+            version: '1.0.0',
+            timestamp: new Date().toISOString(),
+            source: {
+                service: 'llm-data-vault',
+                instance: 'instance-001',
+                version: '0.1.0'
+            },
+            metrics: {
+                name: 'requests_total',
+                value: 1,
+                unit: 'count',
+                tags: { endpoint: '/health' }
+            }
+            // No trace field
+        };
+        const result = TelemetryEventSchema.safeParse(eventWithoutTrace);
+        expect(result.success).toBe(true);
+    });
+});
+// =============================================================================
+// AGENT REGISTRATION SCHEMA COMPLIANCE TESTS
+// =============================================================================
+describe('Agent Registration Schema Compliance', () => {
+    it('should validate complete agent registration', () => {
+        const registration = createAgentRegistration({
+            agentId: uuidv4(),
+            baseUrl: 'https://api.example.com',
+            maintainerEmail: 'team@example.com'
+        });
+        const result = AgentRegistrationSchema.safeParse(registration);
+        expect(result.success).toBe(true);
+    });
+    it('should validate using validateRegistration function', () => {
+        const registration = createAgentRegistration({
+            agentId: uuidv4(),
+            baseUrl: 'https://api.example.com',
+            maintainerEmail: 'team@example.com'
+        });
+        const result = validateRegistration(registration);
+        expect(result.valid).toBe(true);
+        expect(result.errors).toHaveLength(0);
+    });
+    it('should reject invalid registration', () => {
+        const invalidRegistration = {
+            agentId: 'not-a-uuid',
+            name: '',
+            namespace: 'wrong-namespace'
+        };
+        const result = validateRegistration(invalidRegistration);
+        expect(result.valid).toBe(false);
+        expect(result.errors.length).toBeGreaterThan(0);
+    });
+    it('should enforce boundary constraints', () => {
+        const registration = createAgentRegistration({
+            agentId: uuidv4(),
+            baseUrl: 'https://api.example.com',
+            maintainerEmail: 'team@example.com'
+        });
+        // Verify boundaries are set correctly
+        expect(registration.boundaries.executesInference).toBe(false);
+        expect(registration.boundaries.modifiesPrompts).toBe(false);
+        expect(registration.boundaries.routesRequests).toBe(false);
+        expect(registration.boundaries.triggersOrchestration).toBe(false);
+    });
+    it('should validate capability constraints', () => {
+        const capabilities = [AuthorizeCapability, AnonymizeCapability, EncryptionCapability];
+        for (const cap of capabilities) {
+            const result = AgentCapabilitySchema.safeParse(cap);
+            expect(result.success).toBe(true);
+            // Verify constraints are reasonable
+            expect(cap.constraints.maxPayloadSizeBytes).toBeGreaterThan(0);
+            expect(cap.constraints.maxConcurrentRequests).toBeGreaterThan(0);
+            expect(cap.constraints.timeoutMs).toBeGreaterThan(0);
+        }
+    });
+});
+// =============================================================================
+// BOUNDARY ENFORCEMENT TESTS
+// =============================================================================
+describe('Boundary Enforcement', () => {
+    const forbiddenOperations = [
+        'inference',
+        'llm-call',
+        'llm-inference',
+        'execute-inference',
+        'prompt-modify',
+        'modify-prompt',
+        'prompt-inject',
+        'inject-prompt',
+        'route-request',
+        'request-routing',
+        'trigger-orchestration',
+        'orchestration-trigger',
+        'spawn-agent',
+        'agent-spawn',
+        'execute-code',
+        'code-execution'
+    ];
+    const allowedOperations = [
+        'authorize',
+        'authorization-check',
+        'anonymize',
+        'data-anonymize',
+        'detect-pii',
+        'pii-detection',
+        'encrypt',
+        'data-encrypt',
+        'decrypt',
+        'data-decrypt',
+        'audit',
+        'audit-log',
+        'lineage-track',
+        'track-lineage',
+        'health-check',
+        'check-health',
+        'emit-event',
+        'event-emit',
+        'emit-telemetry',
+        'telemetry-emit'
+    ];
+    it('should block all forbidden operations', () => {
+        for (const op of forbiddenOperations) {
+            const result = verifyBoundaryCompliance(op);
+            expect(result.allowed).toBe(false);
+            expect(result.reason).toBeDefined();
+        }
+    });
+    it('should allow all permitted operations', () => {
+        for (const op of allowedOperations) {
+            const result = verifyBoundaryCompliance(op);
+            expect(result.allowed).toBe(true);
+        }
+    });
+    it('should be case-insensitive', () => {
+        expect(verifyBoundaryCompliance('INFERENCE').allowed).toBe(false);
+        expect(verifyBoundaryCompliance('Inference').allowed).toBe(false);
+        expect(verifyBoundaryCompliance('AUTHORIZE').allowed).toBe(true);
+        expect(verifyBoundaryCompliance('Authorize').allowed).toBe(true);
+    });
+    it('should detect forbidden keywords in compound operations', () => {
+        expect(verifyBoundaryCompliance('pre-inference-validation').allowed).toBe(false);
+        expect(verifyBoundaryCompliance('data-prompt-modify').allowed).toBe(false);
+        expect(verifyBoundaryCompliance('async-route-request').allowed).toBe(false);
+    });
+});
+//# sourceMappingURL=contract-tests.js.map