@llm-dev-ops/agentics-cli 1.4.29 → 1.4.32

package/dist/bundled-agents/data-vault-agents/dist/tests/contract-tests.js

@@ -1,1096 +0,0 @@
-/**
- * Contract Validation Tests for LLM-Data-Vault Agents
- *
- * Validates all inputs and outputs against schemas:
- * - Input schema compliance
- * - Output schema compliance
- * - DecisionEvent schema compliance
- * - TelemetryEvent schema compliance
- * - Boundary enforcement
- *
- * @module tests/contract-tests
- */
-import { describe, it, expect } from 'vitest';
-import { v4 as uuidv4 } from 'uuid';
-import { z } from 'zod';
-import { 
-// Registration schemas
-AgentCapabilitySchema, AgentRegistrationSchema, createAgentRegistration, validateRegistration, verifyBoundaryCompliance, AuthorizeCapability, AnonymizeCapability, EncryptionCapability, 
-// Integration schemas
-DecisionEventSchema, TelemetryEventSchema, PolicySchema, DatasetRequestSchema, DatasetResponseSchema, ApprovedDatasetSchema } from '../platform/index.js';
-// =============================================================================
-// INPUT SCHEMA VALIDATION TESTS
-// =============================================================================
-describe('Input Schema Validation', () => {
-    describe('AuthorizeRequest Schema', () => {
-        // Define input schema for authorization requests
-        const AuthorizeRequestSchema = z.object({
-            requestId: z.string().uuid(),
-            userId: z.string().min(1),
-            datasetId: z.string().min(1),
-            operation: z.enum(['read', 'write', 'delete', 'admin']),
-            fields: z.array(z.string()).optional(),
-            purpose: z.enum(['training', 'inference', 'evaluation', 'analysis']).optional(),
-            metadata: z.record(z.unknown()).optional()
-        });
-        it('should validate complete authorization request', () => {
-            const validRequest = {
-                requestId: uuidv4(),
-                userId: 'user-123',
-                datasetId: 'dataset-456',
-                operation: 'read',
-                fields: ['name', 'email'],
-                purpose: 'training',
-                metadata: { source: 'api' }
-            };
-            const result = AuthorizeRequestSchema.safeParse(validRequest);
-            expect(result.success).toBe(true);
-        });
-        it('should reject request with invalid UUID', () => {
-            const invalidRequest = {
-                requestId: 'not-a-uuid',
-                userId: 'user-123',
-                datasetId: 'dataset-456',
-                operation: 'read'
-            };
-            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should reject request with invalid operation', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                userId: 'user-123',
-                datasetId: 'dataset-456',
-                operation: 'execute' // Invalid
-            };
-            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should reject request with empty userId', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                userId: '',
-                datasetId: 'dataset-456',
-                operation: 'read'
-            };
-            const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should accept request without optional fields', () => {
-            const minimalRequest = {
-                requestId: uuidv4(),
-                userId: 'user-123',
-                datasetId: 'dataset-456',
-                operation: 'read'
-            };
-            const result = AuthorizeRequestSchema.safeParse(minimalRequest);
-            expect(result.success).toBe(true);
-        });
-    });
-    describe('AnonymizeRequest Schema', () => {
-        const AnonymizeRequestSchema = z.object({
-            requestId: z.string().uuid(),
-            datasetId: z.string().min(1),
-            data: z.array(z.record(z.unknown())),
-            strategy: z.enum(['redact', 'mask', 'hash', 'encrypt', 'generalize', 'pseudonymize']),
-            fields: z.array(z.string()).optional(),
-            options: z.object({
-                preserveFormat: z.boolean().optional(),
-                hashSalt: z.string().optional(),
-                maskChar: z.string().length(1).optional(),
-                generalizationLevel: z.number().int().min(1).max(10).optional()
-            }).optional(),
-            trackLineage: z.boolean().optional()
-        });
-        it('should validate complete anonymize request', () => {
-            const validRequest = {
-                requestId: uuidv4(),
-                datasetId: 'dataset-456',
-                data: [
-                    { id: 1, email: 'john@example.com' },
-                    { id: 2, email: 'jane@example.com' }
-                ],
-                strategy: 'redact',
-                fields: ['email'],
-                options: { preserveFormat: true },
-                trackLineage: true
-            };
-            const result = AnonymizeRequestSchema.safeParse(validRequest);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid strategy', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                datasetId: 'dataset-456',
-                data: [{ email: 'test@example.com' }],
-                strategy: 'delete' // Invalid
-            };
-            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should reject empty data array', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                datasetId: 'dataset-456',
-                data: [],
-                strategy: 'redact'
-            };
-            // Empty arrays are technically valid, but could be rejected by business logic
-            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(true); // Schema allows empty, business logic may not
-        });
-        it('should validate mask character length', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                datasetId: 'dataset-456',
-                data: [{ email: 'test@example.com' }],
-                strategy: 'mask',
-                options: { maskChar: '**' } // Should be single char
-            };
-            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should validate generalization level bounds', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                datasetId: 'dataset-456',
-                data: [{ age: 25 }],
-                strategy: 'generalize',
-                options: { generalizationLevel: 15 } // Max is 10
-            };
-            const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-    });
-    describe('DatasetRequest Schema', () => {
-        it('should validate complete dataset request', () => {
-            const validRequest = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                requester: {
-                    serviceId: 'llm-orchestrator',
-                    userId: 'user-123',
-                    purpose: 'training'
-                },
-                dataset: {
-                    datasetId: 'dataset-456',
-                    version: '1.0.0',
-                    filters: { category: 'public' },
-                    fields: ['id', 'text'],
-                    limit: 1000
-                },
-                requirements: {
-                    anonymizationLevel: 'strict',
-                    encryptionRequired: true,
-                    auditRequired: true,
-                    lineageRequired: true
-                },
-                deadline: new Date(Date.now() + 3600000).toISOString()
-            };
-            const result = DatasetRequestSchema.safeParse(validRequest);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid purpose', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                requester: {
-                    serviceId: 'service-1',
-                    purpose: 'hacking' // Invalid
-                },
-                dataset: { datasetId: 'dataset-456' },
-                requirements: {
-                    anonymizationLevel: 'none',
-                    encryptionRequired: false,
-                    auditRequired: false,
-                    lineageRequired: false
-                }
-            };
-            const result = DatasetRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should reject invalid anonymization level', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                requester: {
-                    serviceId: 'service-1',
-                    purpose: 'training'
-                },
-                dataset: { datasetId: 'dataset-456' },
-                requirements: {
-                    anonymizationLevel: 'maximum', // Invalid
-                    encryptionRequired: false,
-                    auditRequired: false,
-                    lineageRequired: false
-                }
-            };
-            const result = DatasetRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-        it('should reject negative limit', () => {
-            const invalidRequest = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                requester: {
-                    serviceId: 'service-1',
-                    purpose: 'training'
-                },
-                dataset: {
-                    datasetId: 'dataset-456',
-                    limit: -100 // Invalid
-                },
-                requirements: {
-                    anonymizationLevel: 'none',
-                    encryptionRequired: false,
-                    auditRequired: false,
-                    lineageRequired: false
-                }
-            };
-            const result = DatasetRequestSchema.safeParse(invalidRequest);
-            expect(result.success).toBe(false);
-        });
-    });
-    describe('Policy Schema', () => {
-        it('should validate complete policy', () => {
-            const validPolicy = {
-                policyId: uuidv4(),
-                name: 'GDPR Compliance Policy',
-                version: '1.0.0',
-                rules: [
-                    {
-                        ruleId: 'rule-001',
-                        condition: {
-                            field: 'dataType',
-                            operator: 'eq',
-                            value: 'personal'
-                        },
-                        action: 'transform',
-                        transformations: [
-                            {
-                                type: 'redact',
-                                field: 'email'
-                            },
-                            {
-                                type: 'hash',
-                                field: 'userId',
-                                config: { algorithm: 'sha256' }
-                            }
-                        ]
-                    }
-                ],
-                scope: {
-                    datasets: ['public-*', 'training-*'],
-                    users: ['analyst-*'],
-                    operations: ['read']
-                },
-                effectiveFrom: new Date().toISOString(),
-                effectiveUntil: new Date(Date.now() + 365 * 24 * 3600000).toISOString(),
-                priority: 100
-            };
-            const result = PolicySchema.safeParse(validPolicy);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid rule operator', () => {
-            const invalidPolicy = {
-                policyId: uuidv4(),
-                name: 'Test Policy',
-                version: '1.0.0',
-                rules: [{
-                        ruleId: 'rule-001',
-                        condition: {
-                            field: 'type',
-                            operator: 'like', // Invalid
-                            value: 'test'
-                        },
-                        action: 'allow'
-                    }],
-                scope: {},
-                effectiveFrom: new Date().toISOString(),
-                priority: 50
-            };
-            const result = PolicySchema.safeParse(invalidPolicy);
-            expect(result.success).toBe(false);
-        });
-        it('should reject invalid transformation type', () => {
-            const invalidPolicy = {
-                policyId: uuidv4(),
-                name: 'Test Policy',
-                version: '1.0.0',
-                rules: [{
-                        ruleId: 'rule-001',
-                        condition: {
-                            field: 'type',
-                            operator: 'eq',
-                            value: 'test'
-                        },
-                        action: 'transform',
-                        transformations: [{
-                                type: 'delete', // Invalid
-                                field: 'email'
-                            }]
-                    }],
-                scope: {},
-                effectiveFrom: new Date().toISOString(),
-                priority: 50
-            };
-            const result = PolicySchema.safeParse(invalidPolicy);
-            expect(result.success).toBe(false);
-        });
-        it('should reject priority out of bounds', () => {
-            const invalidPolicy = {
-                policyId: uuidv4(),
-                name: 'Test Policy',
-                version: '1.0.0',
-                rules: [],
-                scope: {},
-                effectiveFrom: new Date().toISOString(),
-                priority: 1500 // Max is 1000
-            };
-            const result = PolicySchema.safeParse(invalidPolicy);
-            expect(result.success).toBe(false);
-        });
-    });
-});
-// =============================================================================
-// OUTPUT SCHEMA VALIDATION TESTS
-// =============================================================================
-describe('Output Schema Validation', () => {
-    describe('AuthorizeResponse Schema', () => {
-        const AuthorizeResponseSchema = z.object({
-            requestId: z.string().uuid(),
-            authorized: z.boolean(),
-            reason: z.string(),
-            decisionEventId: z.string().uuid(),
-            policyIds: z.array(z.string()),
-            expiresAt: z.string().datetime().optional(),
-            constraints: z.object({
-                allowedFields: z.array(z.string()).optional(),
-                maxRecords: z.number().int().positive().optional(),
-                rateLimit: z.number().int().positive().optional()
-            }).optional()
-        });
-        it('should validate complete authorization response', () => {
-            const validResponse = {
-                requestId: uuidv4(),
-                authorized: true,
-                reason: 'Access granted per policy-001',
-                decisionEventId: uuidv4(),
-                policyIds: ['policy-001', 'policy-002'],
-                expiresAt: new Date(Date.now() + 3600000).toISOString(),
-                constraints: {
-                    allowedFields: ['id', 'name'],
-                    maxRecords: 1000,
-                    rateLimit: 100
-                }
-            };
-            const result = AuthorizeResponseSchema.safeParse(validResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate denial response', () => {
-            const denialResponse = {
-                requestId: uuidv4(),
-                authorized: false,
-                reason: 'User does not have permission for write operation',
-                decisionEventId: uuidv4(),
-                policyIds: ['security-policy-001']
-            };
-            const result = AuthorizeResponseSchema.safeParse(denialResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should require decision event ID', () => {
-            const invalidResponse = {
-                requestId: uuidv4(),
-                authorized: true,
-                reason: 'Granted',
-                policyIds: []
-                // Missing decisionEventId
-            };
-            const result = AuthorizeResponseSchema.safeParse(invalidResponse);
-            expect(result.success).toBe(false);
-        });
-    });
-    describe('AnonymizeResponse Schema', () => {
-        const AnonymizeResponseSchema = z.object({
-            requestId: z.string().uuid(),
-            success: z.boolean(),
-            data: z.array(z.record(z.unknown())).optional(),
-            transformations: z.array(z.object({
-                field: z.string(),
-                type: z.string(),
-                count: z.number().int().nonnegative()
-            })).optional(),
-            detectedPii: z.array(z.object({
-                field: z.string(),
-                type: z.string(),
-                confidence: z.number().min(0).max(1)
-            })).optional(),
-            lineage: z.object({
-                sourceDatasetId: z.string(),
-                targetDatasetId: z.string(),
-                transformationId: z.string().uuid(),
-                timestamp: z.string().datetime()
-            }).optional(),
-            decisionEventId: z.string().uuid(),
-            error: z.object({
-                code: z.string(),
-                message: z.string()
-            }).optional()
-        });
-        it('should validate successful anonymize response', () => {
-            const validResponse = {
-                requestId: uuidv4(),
-                success: true,
-                data: [
-                    { id: 1, email: '[REDACTED]' },
-                    { id: 2, email: '[REDACTED]' }
-                ],
-                transformations: [
-                    { field: 'email', type: 'redact', count: 2 }
-                ],
-                decisionEventId: uuidv4()
-            };
-            const result = AnonymizeResponseSchema.safeParse(validResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate response with detected PII', () => {
-            const validResponse = {
-                requestId: uuidv4(),
-                success: true,
-                detectedPii: [
-                    { field: 'email', type: 'EMAIL', confidence: 0.99 },
-                    { field: 'ssn', type: 'SSN', confidence: 0.95 },
-                    { field: 'phone', type: 'PHONE', confidence: 0.87 }
-                ],
-                decisionEventId: uuidv4()
-            };
-            const result = AnonymizeResponseSchema.safeParse(validResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate response with lineage', () => {
-            const validResponse = {
-                requestId: uuidv4(),
-                success: true,
-                lineage: {
-                    sourceDatasetId: 'dataset-456',
-                    targetDatasetId: 'dataset-456-anonymized',
-                    transformationId: uuidv4(),
-                    timestamp: new Date().toISOString()
-                },
-                decisionEventId: uuidv4()
-            };
-            const result = AnonymizeResponseSchema.safeParse(validResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate error response', () => {
-            const errorResponse = {
-                requestId: uuidv4(),
-                success: false,
-                decisionEventId: uuidv4(),
-                error: {
-                    code: 'VALIDATION_ERROR',
-                    message: 'Invalid data format'
-                }
-            };
-            const result = AnonymizeResponseSchema.safeParse(errorResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid confidence score', () => {
-            const invalidResponse = {
-                requestId: uuidv4(),
-                success: true,
-                detectedPii: [
-                    { field: 'email', type: 'EMAIL', confidence: 1.5 } // Invalid
-                ],
-                decisionEventId: uuidv4()
-            };
-            const result = AnonymizeResponseSchema.safeParse(invalidResponse);
-            expect(result.success).toBe(false);
-        });
-    });
-    describe('DatasetResponse Schema', () => {
-        it('should validate approved response', () => {
-            const validResponse = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                status: 'approved',
-                dataset: {
-                    datasetId: 'dataset-456',
-                    version: '1.0.0',
-                    recordCount: 1000,
-                    sizeBytes: 1024000,
-                    checksum: 'sha256:abc123def456',
-                    location: 'https://storage.example.com/datasets/456',
-                    expiresAt: new Date(Date.now() + 3600000).toISOString()
-                },
-                transformations: [
-                    { type: 'anonymize', fieldsAffected: ['email', 'phone'], recordsAffected: 1000 }
-                ],
-                decision: {
-                    decisionEventId: uuidv4(),
-                    policyIds: ['policy-001'],
-                    reason: 'Access granted and data anonymized'
-                }
-            };
-            const result = DatasetResponseSchema.safeParse(validResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate denied response', () => {
-            const deniedResponse = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                status: 'denied',
-                decision: {
-                    decisionEventId: uuidv4(),
-                    policyIds: ['security-policy-001'],
-                    reason: 'Dataset contains restricted data'
-                },
-                error: {
-                    code: 'ACCESS_DENIED',
-                    message: 'User lacks required clearance'
-                }
-            };
-            const result = DatasetResponseSchema.safeParse(deniedResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should validate partial response', () => {
-            const partialResponse = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                status: 'partial',
-                dataset: {
-                    datasetId: 'dataset-456',
-                    version: '1.0.0',
-                    recordCount: 500, // Partial records
-                    sizeBytes: 512000,
-                    checksum: 'sha256:partial123'
-                },
-                decision: {
-                    decisionEventId: uuidv4(),
-                    policyIds: ['policy-001'],
-                    reason: 'Partial access granted - some records filtered'
-                }
-            };
-            const result = DatasetResponseSchema.safeParse(partialResponse);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid status', () => {
-            const invalidResponse = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                status: 'rejected', // Invalid - should be denied
-                decision: {
-                    decisionEventId: uuidv4(),
-                    policyIds: [],
-                    reason: 'Test'
-                }
-            };
-            const result = DatasetResponseSchema.safeParse(invalidResponse);
-            expect(result.success).toBe(false);
-        });
-        it('should reject negative record count', () => {
-            const invalidResponse = {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                status: 'approved',
-                dataset: {
-                    datasetId: 'dataset-456',
-                    version: '1.0.0',
-                    recordCount: -10, // Invalid
-                    sizeBytes: 1024,
-                    checksum: 'sha256:test'
-                },
-                decision: {
-                    decisionEventId: uuidv4(),
-                    policyIds: [],
-                    reason: 'Test'
-                }
-            };
-            const result = DatasetResponseSchema.safeParse(invalidResponse);
-            expect(result.success).toBe(false);
-        });
-    });
-    describe('ApprovedDataset Schema', () => {
-        it('should validate complete approved dataset', () => {
-            const validDataset = {
-                datasetId: 'dataset-456',
-                version: '1.0.0',
-                approvalId: uuidv4(),
-                approvedAt: new Date().toISOString(),
-                expiresAt: new Date(Date.now() + 3600000).toISOString(),
-                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-                constraints: {
-                    maxRecords: 10000,
-                    allowedFields: ['id', 'text', 'category'],
-                    rateLimit: {
-                        requestsPerMinute: 100,
-                        bytesPerMinute: 10485760
-                    }
-                },
-                endpoint: 'https://gateway.example.com/api/v1/datasets/456'
-            };
-            const result = ApprovedDatasetSchema.safeParse(validDataset);
-            expect(result.success).toBe(true);
-        });
-        it('should reject invalid endpoint URL', () => {
-            const invalidDataset = {
-                datasetId: 'dataset-456',
-                version: '1.0.0',
-                approvalId: uuidv4(),
-                approvedAt: new Date().toISOString(),
-                expiresAt: new Date(Date.now() + 3600000).toISOString(),
-                accessToken: 'token123',
-                constraints: {},
-                endpoint: 'not-a-valid-url' // Invalid
-            };
-            const result = ApprovedDatasetSchema.safeParse(invalidDataset);
-            expect(result.success).toBe(false);
-        });
-    });
-});
-// =============================================================================
-// DECISION EVENT SCHEMA COMPLIANCE TESTS
-// =============================================================================
-describe('DecisionEvent Schema Compliance', () => {
-    it('should validate complete DecisionEvent', () => {
-        const validEvent = {
-            eventId: uuidv4(),
-            eventType: 'DecisionEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                agentId: 'agent-001',
-                agentName: 'llm-data-vault',
-                agentVersion: '0.1.0'
-            },
-            decision: {
-                type: 'ALLOW',
-                reason: 'Access granted per data access policy',
-                confidence: 0.99,
-                policyIds: ['policy-001', 'policy-002'],
-                appliedRules: [
-                    {
-                        ruleId: 'rule-001',
-                        ruleName: 'AllowAnalystRead',
-                        action: 'allow',
-                        matched: true
-                    }
-                ]
-            },
-            context: {
-                requestId: uuidv4(),
-                correlationId: uuidv4(),
-                userId: 'user-123',
-                datasetId: 'dataset-456',
-                operation: 'read',
-                resourceType: 'dataset'
-            },
-            audit: {
-                inputHash: 'sha256:input123',
-                outputHash: 'sha256:output456',
-                processingTimeMs: 150,
-                bytesProcessed: 5120
-            },
-            metadata: {
-                clientIp: '192.168.1.1',
-                userAgent: 'SDK/1.0.0'
-            }
-        };
-        const result = DecisionEventSchema.safeParse(validEvent);
-        expect(result.success).toBe(true);
-    });
-    it('should validate all decision types', () => {
-        const decisionTypes = ['ALLOW', 'DENY', 'TRANSFORM', 'AUDIT'];
-        for (const type of decisionTypes) {
-            const event = {
-                eventId: uuidv4(),
-                eventType: 'DecisionEvent',
-                version: '1.0.0',
-                timestamp: new Date().toISOString(),
-                source: {
-                    agentId: 'agent-001',
-                    agentName: 'llm-data-vault',
-                    agentVersion: '0.1.0'
-                },
-                decision: {
-                    type,
-                    reason: `Decision type: ${type}`,
-                    confidence: 1.0,
-                    policyIds: [],
-                    appliedRules: []
-                },
-                context: {
-                    requestId: uuidv4(),
-                    operation: 'test',
-                    resourceType: 'test'
-                },
-                audit: {
-                    inputHash: 'sha256:test',
-                    processingTimeMs: 10,
-                    bytesProcessed: 100
-                }
-            };
-            const result = DecisionEventSchema.safeParse(event);
-            expect(result.success).toBe(true);
-        }
-    });
-    it('should reject invalid decision type', () => {
-        const invalidEvent = {
-            eventId: uuidv4(),
-            eventType: 'DecisionEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                agentId: 'agent-001',
-                agentName: 'llm-data-vault',
-                agentVersion: '0.1.0'
-            },
-            decision: {
-                type: 'APPROVE', // Invalid - should be ALLOW
-                reason: 'Test',
-                confidence: 1.0,
-                policyIds: [],
-                appliedRules: []
-            },
-            context: {
-                requestId: uuidv4(),
-                operation: 'test',
-                resourceType: 'test'
-            },
-            audit: {
-                inputHash: 'sha256:test',
-                processingTimeMs: 10,
-                bytesProcessed: 100
-            }
-        };
-        const result = DecisionEventSchema.safeParse(invalidEvent);
-        expect(result.success).toBe(false);
-    });
-    it('should reject confidence out of bounds', () => {
-        const invalidEvent = {
-            eventId: uuidv4(),
-            eventType: 'DecisionEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                agentId: 'agent-001',
-                agentName: 'llm-data-vault',
-                agentVersion: '0.1.0'
-            },
-            decision: {
-                type: 'ALLOW',
-                reason: 'Test',
-                confidence: 1.5, // Invalid - max is 1.0
-                policyIds: [],
-                appliedRules: []
-            },
-            context: {
-                requestId: uuidv4(),
-                operation: 'test',
-                resourceType: 'test'
-            },
-            audit: {
-                inputHash: 'sha256:test',
-                processingTimeMs: 10,
-                bytesProcessed: 100
-            }
-        };
-        const result = DecisionEventSchema.safeParse(invalidEvent);
-        expect(result.success).toBe(false);
-    });
-    it('should require audit fields', () => {
-        const invalidEvent = {
-            eventId: uuidv4(),
-            eventType: 'DecisionEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                agentId: 'agent-001',
-                agentName: 'llm-data-vault',
-                agentVersion: '0.1.0'
-            },
-            decision: {
-                type: 'ALLOW',
-                reason: 'Test',
-                confidence: 1.0,
-                policyIds: [],
-                appliedRules: []
-            },
-            context: {
-                requestId: uuidv4(),
-                operation: 'test',
-                resourceType: 'test'
-            }
-            // Missing audit field
-        };
-        const result = DecisionEventSchema.safeParse(invalidEvent);
-        expect(result.success).toBe(false);
-    });
-    it('should validate applied rules structure', () => {
-        const validEvent = {
-            eventId: uuidv4(),
-            eventType: 'DecisionEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                agentId: 'agent-001',
-                agentName: 'llm-data-vault',
-                agentVersion: '0.1.0'
-            },
-            decision: {
-                type: 'TRANSFORM',
-                reason: 'Data anonymized',
-                confidence: 1.0,
-                policyIds: ['gdpr-001'],
-                appliedRules: [
-                    { ruleId: 'r1', ruleName: 'RedactEmail', action: 'redact', matched: true },
-                    { ruleId: 'r2', ruleName: 'MaskPhone', action: 'mask', matched: true },
-                    { ruleId: 'r3', ruleName: 'HashSSN', action: 'hash', matched: false }
-                ]
-            },
-            context: {
-                requestId: uuidv4(),
-                operation: 'anonymize',
-                resourceType: 'dataset'
-            },
-            audit: {
-                inputHash: 'sha256:input',
-                outputHash: 'sha256:output',
-                processingTimeMs: 250,
-                bytesProcessed: 10240
-            }
-        };
-        const result = DecisionEventSchema.safeParse(validEvent);
-        expect(result.success).toBe(true);
-        expect(validEvent.decision.appliedRules.filter(r => r.matched).length).toBe(2);
-    });
-});
-// =============================================================================
-// TELEMETRY EVENT SCHEMA COMPLIANCE TESTS
-// =============================================================================
-describe('TelemetryEvent Schema Compliance', () => {
-    it('should validate complete TelemetryEvent', () => {
-        const validEvent = {
-            eventId: uuidv4(),
-            eventType: 'TelemetryEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                service: 'llm-data-vault',
-                instance: 'instance-001',
-                version: '0.1.0'
-            },
-            metrics: {
-                name: 'request_latency',
-                value: 150,
-                unit: 'ms',
-                tags: {
-                    endpoint: '/api/v1/authorize',
-                    status: '200',
-                    method: 'POST'
-                }
-            },
-            trace: {
-                traceId: uuidv4(),
-                spanId: uuidv4(),
-                parentSpanId: uuidv4()
-            }
-        };
-        const result = TelemetryEventSchema.safeParse(validEvent);
-        expect(result.success).toBe(true);
-    });
-    it('should validate all metric units', () => {
-        const units = ['count', 'ms', 'bytes', 'percent'];
-        for (const unit of units) {
-            const event = {
-                eventId: uuidv4(),
-                eventType: 'TelemetryEvent',
-                version: '1.0.0',
-                timestamp: new Date().toISOString(),
-                source: {
-                    service: 'llm-data-vault',
-                    instance: 'instance-001',
-                    version: '0.1.0'
-                },
-                metrics: {
-                    name: `test_metric_${unit}`,
-                    value: 100,
-                    unit,
-                    tags: { test: 'true' }
-                }
-            };
-            const result = TelemetryEventSchema.safeParse(event);
-            expect(result.success).toBe(true);
-        }
-    });
-    it('should reject invalid metric unit', () => {
-        const invalidEvent = {
-            eventId: uuidv4(),
-            eventType: 'TelemetryEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                service: 'llm-data-vault',
-                instance: 'instance-001',
-                version: '0.1.0'
-            },
-            metrics: {
-                name: 'test_metric',
-                value: 100,
-                unit: 'seconds', // Invalid - should be ms
-                tags: {}
-            }
-        };
-        const result = TelemetryEventSchema.safeParse(invalidEvent);
-        expect(result.success).toBe(false);
-    });
-    it('should allow event without trace context', () => {
-        const eventWithoutTrace = {
-            eventId: uuidv4(),
-            eventType: 'TelemetryEvent',
-            version: '1.0.0',
-            timestamp: new Date().toISOString(),
-            source: {
-                service: 'llm-data-vault',
-                instance: 'instance-001',
-                version: '0.1.0'
-            },
-            metrics: {
-                name: 'requests_total',
-                value: 1,
-                unit: 'count',
-                tags: { endpoint: '/health' }
-            }
-            // No trace field
-        };
-        const result = TelemetryEventSchema.safeParse(eventWithoutTrace);
-        expect(result.success).toBe(true);
-    });
-});
-// =============================================================================
-// AGENT REGISTRATION SCHEMA COMPLIANCE TESTS
-// =============================================================================
-describe('Agent Registration Schema Compliance', () => {
-    it('should validate complete agent registration', () => {
-        const registration = createAgentRegistration({
-            agentId: uuidv4(),
-            baseUrl: 'https://api.example.com',
-            maintainerEmail: 'team@example.com'
-        });
-        const result = AgentRegistrationSchema.safeParse(registration);
-        expect(result.success).toBe(true);
-    });
-    it('should validate using validateRegistration function', () => {
-        const registration = createAgentRegistration({
-            agentId: uuidv4(),
-            baseUrl: 'https://api.example.com',
-            maintainerEmail: 'team@example.com'
-        });
-        const result = validateRegistration(registration);
-        expect(result.valid).toBe(true);
-        expect(result.errors).toHaveLength(0);
-    });
-    it('should reject invalid registration', () => {
-        const invalidRegistration = {
-            agentId: 'not-a-uuid',
-            name: '',
-            namespace: 'wrong-namespace'
-        };
-        const result = validateRegistration(invalidRegistration);
-        expect(result.valid).toBe(false);
-        expect(result.errors.length).toBeGreaterThan(0);
-    });
-    it('should enforce boundary constraints', () => {
-        const registration = createAgentRegistration({
-            agentId: uuidv4(),
-            baseUrl: 'https://api.example.com',
-            maintainerEmail: 'team@example.com'
-        });
-        // Verify boundaries are set correctly
-        expect(registration.boundaries.executesInference).toBe(false);
-        expect(registration.boundaries.modifiesPrompts).toBe(false);
-        expect(registration.boundaries.routesRequests).toBe(false);
-        expect(registration.boundaries.triggersOrchestration).toBe(false);
-    });
-    it('should validate capability constraints', () => {
-        const capabilities = [AuthorizeCapability, AnonymizeCapability, EncryptionCapability];
-        for (const cap of capabilities) {
-            const result = AgentCapabilitySchema.safeParse(cap);
-            expect(result.success).toBe(true);
-            // Verify constraints are reasonable
-            expect(cap.constraints.maxPayloadSizeBytes).toBeGreaterThan(0);
-            expect(cap.constraints.maxConcurrentRequests).toBeGreaterThan(0);
-            expect(cap.constraints.timeoutMs).toBeGreaterThan(0);
-        }
-    });
-});
-// =============================================================================
-// BOUNDARY ENFORCEMENT TESTS
-// =============================================================================
-describe('Boundary Enforcement', () => {
-    const forbiddenOperations = [
-        'inference',
-        'llm-call',
-        'llm-inference',
-        'execute-inference',
-        'prompt-modify',
-        'modify-prompt',
-        'prompt-inject',
-        'inject-prompt',
-        'route-request',
-        'request-routing',
-        'trigger-orchestration',
-        'orchestration-trigger',
-        'spawn-agent',
-        'agent-spawn',
-        'execute-code',
-        'code-execution'
-    ];
-    const allowedOperations = [
-        'authorize',
-        'authorization-check',
-        'anonymize',
-        'data-anonymize',
-        'detect-pii',
-        'pii-detection',
-        'encrypt',
-        'data-encrypt',
-        'decrypt',
-        'data-decrypt',
-        'audit',
-        'audit-log',
-        'lineage-track',
-        'track-lineage',
-        'health-check',
-        'check-health',
-        'emit-event',
-        'event-emit',
-        'emit-telemetry',
-        'telemetry-emit'
-    ];
-    it('should block all forbidden operations', () => {
-        for (const op of forbiddenOperations) {
-            const result = verifyBoundaryCompliance(op);
-            expect(result.allowed).toBe(false);
-            expect(result.reason).toBeDefined();
-        }
-    });
-    it('should allow all permitted operations', () => {
-        for (const op of allowedOperations) {
-            const result = verifyBoundaryCompliance(op);
-            expect(result.allowed).toBe(true);
-        }
-    });
-    it('should be case-insensitive', () => {
-        expect(verifyBoundaryCompliance('INFERENCE').allowed).toBe(false);
-        expect(verifyBoundaryCompliance('Inference').allowed).toBe(false);
-        expect(verifyBoundaryCompliance('AUTHORIZE').allowed).toBe(true);
-        expect(verifyBoundaryCompliance('Authorize').allowed).toBe(true);
-    });
-    it('should detect forbidden keywords in compound operations', () => {
-        expect(verifyBoundaryCompliance('pre-inference-validation').allowed).toBe(false);
-        expect(verifyBoundaryCompliance('data-prompt-modify').allowed).toBe(false);
-        expect(verifyBoundaryCompliance('async-route-request').allowed).toBe(false);
-    });
-});
-//# sourceMappingURL=contract-tests.js.map