@llm-dev-ops/agentics-cli 1.4.29 → 1.4.32

package/dist/bundled-agents/data-vault-agents/src/tests/contract-tests.ts

@@ -1,1234 +0,0 @@
-/**
- * Contract Validation Tests for LLM-Data-Vault Agents
- *
- * Validates all inputs and outputs against schemas:
- * - Input schema compliance
- * - Output schema compliance
- * - DecisionEvent schema compliance
- * - TelemetryEvent schema compliance
- * - Boundary enforcement
- *
- * @module tests/contract-tests
- */
-
-import { describe, it, expect } from 'vitest';
-import { v4 as uuidv4 } from 'uuid';
-import { z } from 'zod';
-import {
-  // Registration schemas
-  AgentCapabilitySchema,
-  AgentRegistrationSchema,
-  createAgentRegistration,
-  validateRegistration,
-  verifyBoundaryCompliance,
-  AuthorizeCapability,
-  AnonymizeCapability,
-  EncryptionCapability,
-
-  // Integration schemas
-  DecisionEventSchema,
-  TelemetryEventSchema,
-  PolicySchema,
-  DatasetRequestSchema,
-  DatasetResponseSchema,
-  ApprovedDatasetSchema,
-
-  // Types
-  type DecisionEvent,
-  type TelemetryEvent,
-  type Policy,
-  type DatasetRequest,
-  type DatasetResponse,
-  type ApprovedDataset
-} from '../platform/index.js';
-
-// =============================================================================
-// INPUT SCHEMA VALIDATION TESTS
-// =============================================================================
-
-describe('Input Schema Validation', () => {
-  describe('AuthorizeRequest Schema', () => {
-    // Define input schema for authorization requests
-    const AuthorizeRequestSchema = z.object({
-      requestId: z.string().uuid(),
-      userId: z.string().min(1),
-      datasetId: z.string().min(1),
-      operation: z.enum(['read', 'write', 'delete', 'admin']),
-      fields: z.array(z.string()).optional(),
-      purpose: z.enum(['training', 'inference', 'evaluation', 'analysis']).optional(),
-      metadata: z.record(z.unknown()).optional()
-    });
-
-    it('should validate complete authorization request', () => {
-      const validRequest = {
-        requestId: uuidv4(),
-        userId: 'user-123',
-        datasetId: 'dataset-456',
-        operation: 'read',
-        fields: ['name', 'email'],
-        purpose: 'training',
-        metadata: { source: 'api' }
-      };
-
-      const result = AuthorizeRequestSchema.safeParse(validRequest);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject request with invalid UUID', () => {
-      const invalidRequest = {
-        requestId: 'not-a-uuid',
-        userId: 'user-123',
-        datasetId: 'dataset-456',
-        operation: 'read'
-      };
-
-      const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject request with invalid operation', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        userId: 'user-123',
-        datasetId: 'dataset-456',
-        operation: 'execute' // Invalid
-      };
-
-      const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject request with empty userId', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        userId: '',
-        datasetId: 'dataset-456',
-        operation: 'read'
-      };
-
-      const result = AuthorizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should accept request without optional fields', () => {
-      const minimalRequest = {
-        requestId: uuidv4(),
-        userId: 'user-123',
-        datasetId: 'dataset-456',
-        operation: 'read'
-      };
-
-      const result = AuthorizeRequestSchema.safeParse(minimalRequest);
-      expect(result.success).toBe(true);
-    });
-  });
-
-  describe('AnonymizeRequest Schema', () => {
-    const AnonymizeRequestSchema = z.object({
-      requestId: z.string().uuid(),
-      datasetId: z.string().min(1),
-      data: z.array(z.record(z.unknown())),
-      strategy: z.enum(['redact', 'mask', 'hash', 'encrypt', 'generalize', 'pseudonymize']),
-      fields: z.array(z.string()).optional(),
-      options: z.object({
-        preserveFormat: z.boolean().optional(),
-        hashSalt: z.string().optional(),
-        maskChar: z.string().length(1).optional(),
-        generalizationLevel: z.number().int().min(1).max(10).optional()
-      }).optional(),
-      trackLineage: z.boolean().optional()
-    });
-
-    it('should validate complete anonymize request', () => {
-      const validRequest = {
-        requestId: uuidv4(),
-        datasetId: 'dataset-456',
-        data: [
-          { id: 1, email: 'john@example.com' },
-          { id: 2, email: 'jane@example.com' }
-        ],
-        strategy: 'redact',
-        fields: ['email'],
-        options: { preserveFormat: true },
-        trackLineage: true
-      };
-
-      const result = AnonymizeRequestSchema.safeParse(validRequest);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid strategy', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        datasetId: 'dataset-456',
-        data: [{ email: 'test@example.com' }],
-        strategy: 'delete' // Invalid
-      };
-
-      const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject empty data array', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        datasetId: 'dataset-456',
-        data: [],
-        strategy: 'redact'
-      };
-
-      // Empty arrays are technically valid, but could be rejected by business logic
-      const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(true); // Schema allows empty, business logic may not
-    });
-
-    it('should validate mask character length', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        datasetId: 'dataset-456',
-        data: [{ email: 'test@example.com' }],
-        strategy: 'mask',
-        options: { maskChar: '**' } // Should be single char
-      };
-
-      const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should validate generalization level bounds', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        datasetId: 'dataset-456',
-        data: [{ age: 25 }],
-        strategy: 'generalize',
-        options: { generalizationLevel: 15 } // Max is 10
-      };
-
-      const result = AnonymizeRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-  });
-
-  describe('DatasetRequest Schema', () => {
-    it('should validate complete dataset request', () => {
-      const validRequest: DatasetRequest = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        requester: {
-          serviceId: 'llm-orchestrator',
-          userId: 'user-123',
-          purpose: 'training'
-        },
-        dataset: {
-          datasetId: 'dataset-456',
-          version: '1.0.0',
-          filters: { category: 'public' },
-          fields: ['id', 'text'],
-          limit: 1000
-        },
-        requirements: {
-          anonymizationLevel: 'strict',
-          encryptionRequired: true,
-          auditRequired: true,
-          lineageRequired: true
-        },
-        deadline: new Date(Date.now() + 3600000).toISOString()
-      };
-
-      const result = DatasetRequestSchema.safeParse(validRequest);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid purpose', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        requester: {
-          serviceId: 'service-1',
-          purpose: 'hacking' // Invalid
-        },
-        dataset: { datasetId: 'dataset-456' },
-        requirements: {
-          anonymizationLevel: 'none',
-          encryptionRequired: false,
-          auditRequired: false,
-          lineageRequired: false
-        }
-      };
-
-      const result = DatasetRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject invalid anonymization level', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        requester: {
-          serviceId: 'service-1',
-          purpose: 'training'
-        },
-        dataset: { datasetId: 'dataset-456' },
-        requirements: {
-          anonymizationLevel: 'maximum', // Invalid
-          encryptionRequired: false,
-          auditRequired: false,
-          lineageRequired: false
-        }
-      };
-
-      const result = DatasetRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject negative limit', () => {
-      const invalidRequest = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        requester: {
-          serviceId: 'service-1',
-          purpose: 'training'
-        },
-        dataset: {
-          datasetId: 'dataset-456',
-          limit: -100 // Invalid
-        },
-        requirements: {
-          anonymizationLevel: 'none',
-          encryptionRequired: false,
-          auditRequired: false,
-          lineageRequired: false
-        }
-      };
-
-      const result = DatasetRequestSchema.safeParse(invalidRequest);
-      expect(result.success).toBe(false);
-    });
-  });
-
-  describe('Policy Schema', () => {
-    it('should validate complete policy', () => {
-      const validPolicy: Policy = {
-        policyId: uuidv4(),
-        name: 'GDPR Compliance Policy',
-        version: '1.0.0',
-        rules: [
-          {
-            ruleId: 'rule-001',
-            condition: {
-              field: 'dataType',
-              operator: 'eq',
-              value: 'personal'
-            },
-            action: 'transform',
-            transformations: [
-              {
-                type: 'redact',
-                field: 'email'
-              },
-              {
-                type: 'hash',
-                field: 'userId',
-                config: { algorithm: 'sha256' }
-              }
-            ]
-          }
-        ],
-        scope: {
-          datasets: ['public-*', 'training-*'],
-          users: ['analyst-*'],
-          operations: ['read']
-        },
-        effectiveFrom: new Date().toISOString(),
-        effectiveUntil: new Date(Date.now() + 365 * 24 * 3600000).toISOString(),
-        priority: 100
-      };
-
-      const result = PolicySchema.safeParse(validPolicy);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid rule operator', () => {
-      const invalidPolicy = {
-        policyId: uuidv4(),
-        name: 'Test Policy',
-        version: '1.0.0',
-        rules: [{
-          ruleId: 'rule-001',
-          condition: {
-            field: 'type',
-            operator: 'like', // Invalid
-            value: 'test'
-          },
-          action: 'allow'
-        }],
-        scope: {},
-        effectiveFrom: new Date().toISOString(),
-        priority: 50
-      };
-
-      const result = PolicySchema.safeParse(invalidPolicy);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject invalid transformation type', () => {
-      const invalidPolicy = {
-        policyId: uuidv4(),
-        name: 'Test Policy',
-        version: '1.0.0',
-        rules: [{
-          ruleId: 'rule-001',
-          condition: {
-            field: 'type',
-            operator: 'eq',
-            value: 'test'
-          },
-          action: 'transform',
-          transformations: [{
-            type: 'delete', // Invalid
-            field: 'email'
-          }]
-        }],
-        scope: {},
-        effectiveFrom: new Date().toISOString(),
-        priority: 50
-      };
-
-      const result = PolicySchema.safeParse(invalidPolicy);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject priority out of bounds', () => {
-      const invalidPolicy = {
-        policyId: uuidv4(),
-        name: 'Test Policy',
-        version: '1.0.0',
-        rules: [],
-        scope: {},
-        effectiveFrom: new Date().toISOString(),
-        priority: 1500 // Max is 1000
-      };
-
-      const result = PolicySchema.safeParse(invalidPolicy);
-      expect(result.success).toBe(false);
-    });
-  });
-});
-
-// =============================================================================
-// OUTPUT SCHEMA VALIDATION TESTS
-// =============================================================================
-
-describe('Output Schema Validation', () => {
-  describe('AuthorizeResponse Schema', () => {
-    const AuthorizeResponseSchema = z.object({
-      requestId: z.string().uuid(),
-      authorized: z.boolean(),
-      reason: z.string(),
-      decisionEventId: z.string().uuid(),
-      policyIds: z.array(z.string()),
-      expiresAt: z.string().datetime().optional(),
-      constraints: z.object({
-        allowedFields: z.array(z.string()).optional(),
-        maxRecords: z.number().int().positive().optional(),
-        rateLimit: z.number().int().positive().optional()
-      }).optional()
-    });
-
-    it('should validate complete authorization response', () => {
-      const validResponse = {
-        requestId: uuidv4(),
-        authorized: true,
-        reason: 'Access granted per policy-001',
-        decisionEventId: uuidv4(),
-        policyIds: ['policy-001', 'policy-002'],
-        expiresAt: new Date(Date.now() + 3600000).toISOString(),
-        constraints: {
-          allowedFields: ['id', 'name'],
-          maxRecords: 1000,
-          rateLimit: 100
-        }
-      };
-
-      const result = AuthorizeResponseSchema.safeParse(validResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate denial response', () => {
-      const denialResponse = {
-        requestId: uuidv4(),
-        authorized: false,
-        reason: 'User does not have permission for write operation',
-        decisionEventId: uuidv4(),
-        policyIds: ['security-policy-001']
-      };
-
-      const result = AuthorizeResponseSchema.safeParse(denialResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should require decision event ID', () => {
-      const invalidResponse = {
-        requestId: uuidv4(),
-        authorized: true,
-        reason: 'Granted',
-        policyIds: []
-        // Missing decisionEventId
-      };
-
-      const result = AuthorizeResponseSchema.safeParse(invalidResponse);
-      expect(result.success).toBe(false);
-    });
-  });
-
-  describe('AnonymizeResponse Schema', () => {
-    const AnonymizeResponseSchema = z.object({
-      requestId: z.string().uuid(),
-      success: z.boolean(),
-      data: z.array(z.record(z.unknown())).optional(),
-      transformations: z.array(z.object({
-        field: z.string(),
-        type: z.string(),
-        count: z.number().int().nonnegative()
-      })).optional(),
-      detectedPii: z.array(z.object({
-        field: z.string(),
-        type: z.string(),
-        confidence: z.number().min(0).max(1)
-      })).optional(),
-      lineage: z.object({
-        sourceDatasetId: z.string(),
-        targetDatasetId: z.string(),
-        transformationId: z.string().uuid(),
-        timestamp: z.string().datetime()
-      }).optional(),
-      decisionEventId: z.string().uuid(),
-      error: z.object({
-        code: z.string(),
-        message: z.string()
-      }).optional()
-    });
-
-    it('should validate successful anonymize response', () => {
-      const validResponse = {
-        requestId: uuidv4(),
-        success: true,
-        data: [
-          { id: 1, email: '[REDACTED]' },
-          { id: 2, email: '[REDACTED]' }
-        ],
-        transformations: [
-          { field: 'email', type: 'redact', count: 2 }
-        ],
-        decisionEventId: uuidv4()
-      };
-
-      const result = AnonymizeResponseSchema.safeParse(validResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate response with detected PII', () => {
-      const validResponse = {
-        requestId: uuidv4(),
-        success: true,
-        detectedPii: [
-          { field: 'email', type: 'EMAIL', confidence: 0.99 },
-          { field: 'ssn', type: 'SSN', confidence: 0.95 },
-          { field: 'phone', type: 'PHONE', confidence: 0.87 }
-        ],
-        decisionEventId: uuidv4()
-      };
-
-      const result = AnonymizeResponseSchema.safeParse(validResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate response with lineage', () => {
-      const validResponse = {
-        requestId: uuidv4(),
-        success: true,
-        lineage: {
-          sourceDatasetId: 'dataset-456',
-          targetDatasetId: 'dataset-456-anonymized',
-          transformationId: uuidv4(),
-          timestamp: new Date().toISOString()
-        },
-        decisionEventId: uuidv4()
-      };
-
-      const result = AnonymizeResponseSchema.safeParse(validResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate error response', () => {
-      const errorResponse = {
-        requestId: uuidv4(),
-        success: false,
-        decisionEventId: uuidv4(),
-        error: {
-          code: 'VALIDATION_ERROR',
-          message: 'Invalid data format'
-        }
-      };
-
-      const result = AnonymizeResponseSchema.safeParse(errorResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid confidence score', () => {
-      const invalidResponse = {
-        requestId: uuidv4(),
-        success: true,
-        detectedPii: [
-          { field: 'email', type: 'EMAIL', confidence: 1.5 } // Invalid
-        ],
-        decisionEventId: uuidv4()
-      };
-
-      const result = AnonymizeResponseSchema.safeParse(invalidResponse);
-      expect(result.success).toBe(false);
-    });
-  });
-
-  describe('DatasetResponse Schema', () => {
-    it('should validate approved response', () => {
-      const validResponse: DatasetResponse = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        status: 'approved',
-        dataset: {
-          datasetId: 'dataset-456',
-          version: '1.0.0',
-          recordCount: 1000,
-          sizeBytes: 1024000,
-          checksum: 'sha256:abc123def456',
-          location: 'https://storage.example.com/datasets/456',
-          expiresAt: new Date(Date.now() + 3600000).toISOString()
-        },
-        transformations: [
-          { type: 'anonymize', fieldsAffected: ['email', 'phone'], recordsAffected: 1000 }
-        ],
-        decision: {
-          decisionEventId: uuidv4(),
-          policyIds: ['policy-001'],
-          reason: 'Access granted and data anonymized'
-        }
-      };
-
-      const result = DatasetResponseSchema.safeParse(validResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate denied response', () => {
-      const deniedResponse: DatasetResponse = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        status: 'denied',
-        decision: {
-          decisionEventId: uuidv4(),
-          policyIds: ['security-policy-001'],
-          reason: 'Dataset contains restricted data'
-        },
-        error: {
-          code: 'ACCESS_DENIED',
-          message: 'User lacks required clearance'
-        }
-      };
-
-      const result = DatasetResponseSchema.safeParse(deniedResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should validate partial response', () => {
-      const partialResponse: DatasetResponse = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        status: 'partial',
-        dataset: {
-          datasetId: 'dataset-456',
-          version: '1.0.0',
-          recordCount: 500, // Partial records
-          sizeBytes: 512000,
-          checksum: 'sha256:partial123'
-        },
-        decision: {
-          decisionEventId: uuidv4(),
-          policyIds: ['policy-001'],
-          reason: 'Partial access granted - some records filtered'
-        }
-      };
-
-      const result = DatasetResponseSchema.safeParse(partialResponse);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid status', () => {
-      const invalidResponse = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        status: 'rejected', // Invalid - should be denied
-        decision: {
-          decisionEventId: uuidv4(),
-          policyIds: [],
-          reason: 'Test'
-        }
-      };
-
-      const result = DatasetResponseSchema.safeParse(invalidResponse);
-      expect(result.success).toBe(false);
-    });
-
-    it('should reject negative record count', () => {
-      const invalidResponse = {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        status: 'approved',
-        dataset: {
-          datasetId: 'dataset-456',
-          version: '1.0.0',
-          recordCount: -10, // Invalid
-          sizeBytes: 1024,
-          checksum: 'sha256:test'
-        },
-        decision: {
-          decisionEventId: uuidv4(),
-          policyIds: [],
-          reason: 'Test'
-        }
-      };
-
-      const result = DatasetResponseSchema.safeParse(invalidResponse);
-      expect(result.success).toBe(false);
-    });
-  });
-
-  describe('ApprovedDataset Schema', () => {
-    it('should validate complete approved dataset', () => {
-      const validDataset: ApprovedDataset = {
-        datasetId: 'dataset-456',
-        version: '1.0.0',
-        approvalId: uuidv4(),
-        approvedAt: new Date().toISOString(),
-        expiresAt: new Date(Date.now() + 3600000).toISOString(),
-        accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-        constraints: {
-          maxRecords: 10000,
-          allowedFields: ['id', 'text', 'category'],
-          rateLimit: {
-            requestsPerMinute: 100,
-            bytesPerMinute: 10485760
-          }
-        },
-        endpoint: 'https://gateway.example.com/api/v1/datasets/456'
-      };
-
-      const result = ApprovedDatasetSchema.safeParse(validDataset);
-      expect(result.success).toBe(true);
-    });
-
-    it('should reject invalid endpoint URL', () => {
-      const invalidDataset = {
-        datasetId: 'dataset-456',
-        version: '1.0.0',
-        approvalId: uuidv4(),
-        approvedAt: new Date().toISOString(),
-        expiresAt: new Date(Date.now() + 3600000).toISOString(),
-        accessToken: 'token123',
-        constraints: {},
-        endpoint: 'not-a-valid-url' // Invalid
-      };
-
-      const result = ApprovedDatasetSchema.safeParse(invalidDataset);
-      expect(result.success).toBe(false);
-    });
-  });
-});
-
-// =============================================================================
-// DECISION EVENT SCHEMA COMPLIANCE TESTS
-// =============================================================================
-
-describe('DecisionEvent Schema Compliance', () => {
-  it('should validate complete DecisionEvent', () => {
-    const validEvent: DecisionEvent = {
-      eventId: uuidv4(),
-      eventType: 'DecisionEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        agentId: 'agent-001',
-        agentName: 'llm-data-vault',
-        agentVersion: '0.1.0'
-      },
-      decision: {
-        type: 'ALLOW',
-        reason: 'Access granted per data access policy',
-        confidence: 0.99,
-        policyIds: ['policy-001', 'policy-002'],
-        appliedRules: [
-          {
-            ruleId: 'rule-001',
-            ruleName: 'AllowAnalystRead',
-            action: 'allow',
-            matched: true
-          }
-        ]
-      },
-      context: {
-        requestId: uuidv4(),
-        correlationId: uuidv4(),
-        userId: 'user-123',
-        datasetId: 'dataset-456',
-        operation: 'read',
-        resourceType: 'dataset'
-      },
-      audit: {
-        inputHash: 'sha256:input123',
-        outputHash: 'sha256:output456',
-        processingTimeMs: 150,
-        bytesProcessed: 5120
-      },
-      metadata: {
-        clientIp: '192.168.1.1',
-        userAgent: 'SDK/1.0.0'
-      }
-    };
-
-    const result = DecisionEventSchema.safeParse(validEvent);
-    expect(result.success).toBe(true);
-  });
-
-  it('should validate all decision types', () => {
-    const decisionTypes: Array<DecisionEvent['decision']['type']> = ['ALLOW', 'DENY', 'TRANSFORM', 'AUDIT'];
-
-    for (const type of decisionTypes) {
-      const event: DecisionEvent = {
-        eventId: uuidv4(),
-        eventType: 'DecisionEvent',
-        version: '1.0.0',
-        timestamp: new Date().toISOString(),
-        source: {
-          agentId: 'agent-001',
-          agentName: 'llm-data-vault',
-          agentVersion: '0.1.0'
-        },
-        decision: {
-          type,
-          reason: `Decision type: ${type}`,
-          confidence: 1.0,
-          policyIds: [],
-          appliedRules: []
-        },
-        context: {
-          requestId: uuidv4(),
-          operation: 'test',
-          resourceType: 'test'
-        },
-        audit: {
-          inputHash: 'sha256:test',
-          processingTimeMs: 10,
-          bytesProcessed: 100
-        }
-      };
-
-      const result = DecisionEventSchema.safeParse(event);
-      expect(result.success).toBe(true);
-    }
-  });
-
-  it('should reject invalid decision type', () => {
-    const invalidEvent = {
-      eventId: uuidv4(),
-      eventType: 'DecisionEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        agentId: 'agent-001',
-        agentName: 'llm-data-vault',
-        agentVersion: '0.1.0'
-      },
-      decision: {
-        type: 'APPROVE', // Invalid - should be ALLOW
-        reason: 'Test',
-        confidence: 1.0,
-        policyIds: [],
-        appliedRules: []
-      },
-      context: {
-        requestId: uuidv4(),
-        operation: 'test',
-        resourceType: 'test'
-      },
-      audit: {
-        inputHash: 'sha256:test',
-        processingTimeMs: 10,
-        bytesProcessed: 100
-      }
-    };
-
-    const result = DecisionEventSchema.safeParse(invalidEvent);
-    expect(result.success).toBe(false);
-  });
-
-  it('should reject confidence out of bounds', () => {
-    const invalidEvent = {
-      eventId: uuidv4(),
-      eventType: 'DecisionEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        agentId: 'agent-001',
-        agentName: 'llm-data-vault',
-        agentVersion: '0.1.0'
-      },
-      decision: {
-        type: 'ALLOW',
-        reason: 'Test',
-        confidence: 1.5, // Invalid - max is 1.0
-        policyIds: [],
-        appliedRules: []
-      },
-      context: {
-        requestId: uuidv4(),
-        operation: 'test',
-        resourceType: 'test'
-      },
-      audit: {
-        inputHash: 'sha256:test',
-        processingTimeMs: 10,
-        bytesProcessed: 100
-      }
-    };
-
-    const result = DecisionEventSchema.safeParse(invalidEvent);
-    expect(result.success).toBe(false);
-  });
-
-  it('should require audit fields', () => {
-    const invalidEvent = {
-      eventId: uuidv4(),
-      eventType: 'DecisionEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        agentId: 'agent-001',
-        agentName: 'llm-data-vault',
-        agentVersion: '0.1.0'
-      },
-      decision: {
-        type: 'ALLOW',
-        reason: 'Test',
-        confidence: 1.0,
-        policyIds: [],
-        appliedRules: []
-      },
-      context: {
-        requestId: uuidv4(),
-        operation: 'test',
-        resourceType: 'test'
-      }
-      // Missing audit field
-    };
-
-    const result = DecisionEventSchema.safeParse(invalidEvent);
-    expect(result.success).toBe(false);
-  });
-
-  it('should validate applied rules structure', () => {
-    const validEvent: DecisionEvent = {
-      eventId: uuidv4(),
-      eventType: 'DecisionEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        agentId: 'agent-001',
-        agentName: 'llm-data-vault',
-        agentVersion: '0.1.0'
-      },
-      decision: {
-        type: 'TRANSFORM',
-        reason: 'Data anonymized',
-        confidence: 1.0,
-        policyIds: ['gdpr-001'],
-        appliedRules: [
-          { ruleId: 'r1', ruleName: 'RedactEmail', action: 'redact', matched: true },
-          { ruleId: 'r2', ruleName: 'MaskPhone', action: 'mask', matched: true },
-          { ruleId: 'r3', ruleName: 'HashSSN', action: 'hash', matched: false }
-        ]
-      },
-      context: {
-        requestId: uuidv4(),
-        operation: 'anonymize',
-        resourceType: 'dataset'
-      },
-      audit: {
-        inputHash: 'sha256:input',
-        outputHash: 'sha256:output',
-        processingTimeMs: 250,
-        bytesProcessed: 10240
-      }
-    };
-
-    const result = DecisionEventSchema.safeParse(validEvent);
-    expect(result.success).toBe(true);
-
-    expect(validEvent.decision.appliedRules.filter(r => r.matched).length).toBe(2);
-  });
-});
-
-// =============================================================================
-// TELEMETRY EVENT SCHEMA COMPLIANCE TESTS
-// =============================================================================
-
-describe('TelemetryEvent Schema Compliance', () => {
-  it('should validate complete TelemetryEvent', () => {
-    const validEvent: TelemetryEvent = {
-      eventId: uuidv4(),
-      eventType: 'TelemetryEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        service: 'llm-data-vault',
-        instance: 'instance-001',
-        version: '0.1.0'
-      },
-      metrics: {
-        name: 'request_latency',
-        value: 150,
-        unit: 'ms',
-        tags: {
-          endpoint: '/api/v1/authorize',
-          status: '200',
-          method: 'POST'
-        }
-      },
-      trace: {
-        traceId: uuidv4(),
-        spanId: uuidv4(),
-        parentSpanId: uuidv4()
-      }
-    };
-
-    const result = TelemetryEventSchema.safeParse(validEvent);
-    expect(result.success).toBe(true);
-  });
-
-  it('should validate all metric units', () => {
-    const units: Array<TelemetryEvent['metrics']['unit']> = ['count', 'ms', 'bytes', 'percent'];
-
-    for (const unit of units) {
-      const event: TelemetryEvent = {
-        eventId: uuidv4(),
-        eventType: 'TelemetryEvent',
-        version: '1.0.0',
-        timestamp: new Date().toISOString(),
-        source: {
-          service: 'llm-data-vault',
-          instance: 'instance-001',
-          version: '0.1.0'
-        },
-        metrics: {
-          name: `test_metric_${unit}`,
-          value: 100,
-          unit,
-          tags: { test: 'true' }
-        }
-      };
-
-      const result = TelemetryEventSchema.safeParse(event);
-      expect(result.success).toBe(true);
-    }
-  });
-
-  it('should reject invalid metric unit', () => {
-    const invalidEvent = {
-      eventId: uuidv4(),
-      eventType: 'TelemetryEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        service: 'llm-data-vault',
-        instance: 'instance-001',
-        version: '0.1.0'
-      },
-      metrics: {
-        name: 'test_metric',
-        value: 100,
-        unit: 'seconds', // Invalid - should be ms
-        tags: {}
-      }
-    };
-
-    const result = TelemetryEventSchema.safeParse(invalidEvent);
-    expect(result.success).toBe(false);
-  });
-
-  it('should allow event without trace context', () => {
-    const eventWithoutTrace: TelemetryEvent = {
-      eventId: uuidv4(),
-      eventType: 'TelemetryEvent',
-      version: '1.0.0',
-      timestamp: new Date().toISOString(),
-      source: {
-        service: 'llm-data-vault',
-        instance: 'instance-001',
-        version: '0.1.0'
-      },
-      metrics: {
-        name: 'requests_total',
-        value: 1,
-        unit: 'count',
-        tags: { endpoint: '/health' }
-      }
-      // No trace field
-    };
-
-    const result = TelemetryEventSchema.safeParse(eventWithoutTrace);
-    expect(result.success).toBe(true);
-  });
-});
-
-// =============================================================================
-// AGENT REGISTRATION SCHEMA COMPLIANCE TESTS
-// =============================================================================
-
-describe('Agent Registration Schema Compliance', () => {
-  it('should validate complete agent registration', () => {
-    const registration = createAgentRegistration({
-      agentId: uuidv4(),
-      baseUrl: 'https://api.example.com',
-      maintainerEmail: 'team@example.com'
-    });
-
-    const result = AgentRegistrationSchema.safeParse(registration);
-    expect(result.success).toBe(true);
-  });
-
-  it('should validate using validateRegistration function', () => {
-    const registration = createAgentRegistration({
-      agentId: uuidv4(),
-      baseUrl: 'https://api.example.com',
-      maintainerEmail: 'team@example.com'
-    });
-
-    const result = validateRegistration(registration);
-    expect(result.valid).toBe(true);
-    expect(result.errors).toHaveLength(0);
-  });
-
-  it('should reject invalid registration', () => {
-    const invalidRegistration = {
-      agentId: 'not-a-uuid',
-      name: '',
-      namespace: 'wrong-namespace'
-    };
-
-    const result = validateRegistration(invalidRegistration);
-    expect(result.valid).toBe(false);
-    expect(result.errors.length).toBeGreaterThan(0);
-  });
-
-  it('should enforce boundary constraints', () => {
-    const registration = createAgentRegistration({
-      agentId: uuidv4(),
-      baseUrl: 'https://api.example.com',
-      maintainerEmail: 'team@example.com'
-    });
-
-    // Verify boundaries are set correctly
-    expect(registration.boundaries.executesInference).toBe(false);
-    expect(registration.boundaries.modifiesPrompts).toBe(false);
-    expect(registration.boundaries.routesRequests).toBe(false);
-    expect(registration.boundaries.triggersOrchestration).toBe(false);
-  });
-
-  it('should validate capability constraints', () => {
-    const capabilities = [AuthorizeCapability, AnonymizeCapability, EncryptionCapability];
-
-    for (const cap of capabilities) {
-      const result = AgentCapabilitySchema.safeParse(cap);
-      expect(result.success).toBe(true);
-
-      // Verify constraints are reasonable
-      expect(cap.constraints.maxPayloadSizeBytes).toBeGreaterThan(0);
-      expect(cap.constraints.maxConcurrentRequests).toBeGreaterThan(0);
-      expect(cap.constraints.timeoutMs).toBeGreaterThan(0);
-    }
-  });
-});
-
-// =============================================================================
-// BOUNDARY ENFORCEMENT TESTS
-// =============================================================================
-
-describe('Boundary Enforcement', () => {
-  const forbiddenOperations = [
-    'inference',
-    'llm-call',
-    'llm-inference',
-    'execute-inference',
-    'prompt-modify',
-    'modify-prompt',
-    'prompt-inject',
-    'inject-prompt',
-    'route-request',
-    'request-routing',
-    'trigger-orchestration',
-    'orchestration-trigger',
-    'spawn-agent',
-    'agent-spawn',
-    'execute-code',
-    'code-execution'
-  ];
-
-  const allowedOperations = [
-    'authorize',
-    'authorization-check',
-    'anonymize',
-    'data-anonymize',
-    'detect-pii',
-    'pii-detection',
-    'encrypt',
-    'data-encrypt',
-    'decrypt',
-    'data-decrypt',
-    'audit',
-    'audit-log',
-    'lineage-track',
-    'track-lineage',
-    'health-check',
-    'check-health',
-    'emit-event',
-    'event-emit',
-    'emit-telemetry',
-    'telemetry-emit'
-  ];
-
-  it('should block all forbidden operations', () => {
-    for (const op of forbiddenOperations) {
-      const result = verifyBoundaryCompliance(op);
-      expect(result.allowed).toBe(false);
-      expect(result.reason).toBeDefined();
-    }
-  });
-
-  it('should allow all permitted operations', () => {
-    for (const op of allowedOperations) {
-      const result = verifyBoundaryCompliance(op);
-      expect(result.allowed).toBe(true);
-    }
-  });
-
-  it('should be case-insensitive', () => {
-    expect(verifyBoundaryCompliance('INFERENCE').allowed).toBe(false);
-    expect(verifyBoundaryCompliance('Inference').allowed).toBe(false);
-    expect(verifyBoundaryCompliance('AUTHORIZE').allowed).toBe(true);
-    expect(verifyBoundaryCompliance('Authorize').allowed).toBe(true);
-  });
-
-  it('should detect forbidden keywords in compound operations', () => {
-    expect(verifyBoundaryCompliance('pre-inference-validation').allowed).toBe(false);
-    expect(verifyBoundaryCompliance('data-prompt-modify').allowed).toBe(false);
-    expect(verifyBoundaryCompliance('async-route-request').allowed).toBe(false);
-  });
-});