@odingard/guardian-sdk 0.0.0-stage → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/LICENSE +201 -0
  2. package/README.md +302 -2
  3. package/dist/contracts.js +9865 -0
  4. package/dist/index.js +14437 -0
  5. package/dist/public-catalog.v1.json +6915 -0
  6. package/dist-dts/catalog.d.ts +14 -0
  7. package/dist-dts/client.d.ts +130 -0
  8. package/dist-dts/contracts/action-pack.d.ts +464 -0
  9. package/dist-dts/contracts/action-parameters.d.ts +34 -0
  10. package/dist-dts/contracts/action-registry.d.ts +287 -0
  11. package/dist-dts/contracts/action.d.ts +2358 -0
  12. package/dist-dts/contracts/agent-state.d.ts +386 -0
  13. package/dist-dts/contracts/api.d.ts +78 -0
  14. package/dist-dts/contracts/approval.d.ts +425 -0
  15. package/dist-dts/contracts/assurance.d.ts +60 -0
  16. package/dist-dts/contracts/authority-graph.d.ts +294 -0
  17. package/dist-dts/contracts/authority-state.d.ts +108 -0
  18. package/dist-dts/contracts/authority.d.ts +339 -0
  19. package/dist-dts/contracts/billing.d.ts +32 -0
  20. package/dist-dts/contracts/calendar.d.ts +146 -0
  21. package/dist-dts/contracts/canonical-json.d.ts +4 -0
  22. package/dist-dts/contracts/capability.d.ts +28 -0
  23. package/dist-dts/contracts/commerce.d.ts +133 -0
  24. package/dist-dts/contracts/denial.d.ts +648 -0
  25. package/dist-dts/contracts/digest.d.ts +2 -0
  26. package/dist-dts/contracts/email.d.ts +45 -0
  27. package/dist-dts/contracts/evidence.d.ts +1087 -0
  28. package/dist-dts/contracts/execution.d.ts +1732 -0
  29. package/dist-dts/contracts/files.d.ts +61 -0
  30. package/dist-dts/contracts/identifiers.d.ts +49 -0
  31. package/dist-dts/contracts/index.d.ts +41 -0
  32. package/dist-dts/contracts/intent.d.ts +335 -0
  33. package/dist-dts/contracts/lineage.d.ts +218 -0
  34. package/dist-dts/contracts/local.d.ts +101 -0
  35. package/dist-dts/contracts/multi-principal.d.ts +292 -0
  36. package/dist-dts/contracts/multiparty.d.ts +169 -0
  37. package/dist-dts/contracts/obligation.d.ts +196 -0
  38. package/dist-dts/contracts/plan.d.ts +67 -0
  39. package/dist-dts/contracts/policy-simulation.d.ts +681 -0
  40. package/dist-dts/contracts/prerequisite.d.ts +147 -0
  41. package/dist-dts/contracts/protected-data.d.ts +160 -0
  42. package/dist-dts/contracts/receipt.d.ts +3126 -0
  43. package/dist-dts/contracts/resource-claims.d.ts +146 -0
  44. package/dist-dts/contracts/runtime.d.ts +111 -0
  45. package/dist-dts/contracts/safety-envelope.d.ts +287 -0
  46. package/dist-dts/contracts/sequence.d.ts +132 -0
  47. package/dist-dts/contracts/sources.d.ts +191 -0
  48. package/dist-dts/contracts/tools.d.ts +232 -0
  49. package/dist-dts/contracts/transaction.d.ts +360 -0
  50. package/dist-dts/contracts-entry.d.ts +1 -0
  51. package/dist-dts/embedded.d.ts +58 -0
  52. package/dist-dts/evidence/evidence.d.ts +25 -0
  53. package/dist-dts/evidence/receipt.d.ts +61 -0
  54. package/dist-dts/index.d.ts +5 -0
  55. package/dist-dts/lifecycle.d.ts +25 -0
  56. package/dist-dts/proposal.d.ts +41 -0
  57. package/dist-dts/receipts.d.ts +37 -0
  58. package/package.json +56 -4
@@ -0,0 +1,294 @@
1
+ import { z } from "zod";
2
+ /**
3
+ * WO-010 — the authority graph: principal → agent → task → tool/resource
4
+ * nodes with bounded delegated edges. This is a read model over the same
5
+ * authority state the kernel evaluates; it never carries a second policy
6
+ * path (GUA-UNIVERSAL-001 K15).
7
+ */
8
+ export declare const AuthorityGraphNodeKindSchema: z.ZodEnum<{
9
+ tool: "tool";
10
+ agent: "agent";
11
+ task: "task";
12
+ principal: "principal";
13
+ resource: "resource";
14
+ connection: "connection";
15
+ }>;
16
+ export declare const AuthorityGraphNodeSchema: z.ZodObject<{
17
+ id: z.ZodString;
18
+ kind: z.ZodEnum<{
19
+ tool: "tool";
20
+ agent: "agent";
21
+ task: "task";
22
+ principal: "principal";
23
+ resource: "resource";
24
+ connection: "connection";
25
+ }>;
26
+ label: z.ZodString;
27
+ status: z.ZodOptional<z.ZodEnum<{
28
+ active: "active";
29
+ revoked: "revoked";
30
+ expired: "expired";
31
+ paused: "paused";
32
+ }>>;
33
+ }, z.core.$strict>;
34
+ /**
35
+ * A writ edge: one emitted version of a grant, dated and bounded. The edge's
36
+ * ceiling is the grant's constraints at that version — a delegated edge may
37
+ * only carry a ceiling equal to or narrower than its parent edge's.
38
+ */
39
+ export declare const AuthorityWritSchema: z.ZodObject<{
40
+ grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
41
+ version: z.ZodNumber;
42
+ issuedAtEpochMs: z.ZodNumber;
43
+ change: z.ZodEnum<{
44
+ revoked: "revoked";
45
+ issued: "issued";
46
+ paused: "paused";
47
+ amended: "amended";
48
+ resumed: "resumed";
49
+ }>;
50
+ ceiling: z.ZodObject<{
51
+ actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
52
+ resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
53
+ adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
54
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
55
+ maxUsesPerRequest: z.ZodNumber;
56
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
57
+ expiresAtEpochMs: z.ZodNumber;
58
+ approvalRequired: z.ZodBoolean;
59
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
60
+ merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
61
+ categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
62
+ recurrence: z.ZodOptional<z.ZodEnum<{
63
+ never: "never";
64
+ allowed: "allowed";
65
+ }>>;
66
+ budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
67
+ }, z.core.$strict>;
68
+ }, z.core.$strict>;
69
+ export declare const AuthorityGraphEdgeSchema: z.ZodObject<{
70
+ id: z.ZodString;
71
+ kind: z.ZodEnum<{
72
+ contains: "contains";
73
+ writ: "writ";
74
+ coverage: "coverage";
75
+ }>;
76
+ from: z.ZodString;
77
+ to: z.ZodString;
78
+ writ: z.ZodOptional<z.ZodObject<{
79
+ grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
80
+ version: z.ZodNumber;
81
+ issuedAtEpochMs: z.ZodNumber;
82
+ change: z.ZodEnum<{
83
+ revoked: "revoked";
84
+ issued: "issued";
85
+ paused: "paused";
86
+ amended: "amended";
87
+ resumed: "resumed";
88
+ }>;
89
+ ceiling: z.ZodObject<{
90
+ actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
91
+ resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
92
+ adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
93
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
94
+ maxUsesPerRequest: z.ZodNumber;
95
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
96
+ expiresAtEpochMs: z.ZodNumber;
97
+ approvalRequired: z.ZodBoolean;
98
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
99
+ merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
100
+ categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
101
+ recurrence: z.ZodOptional<z.ZodEnum<{
102
+ never: "never";
103
+ allowed: "allowed";
104
+ }>>;
105
+ budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
106
+ }, z.core.$strict>;
107
+ }, z.core.$strict>>;
108
+ parentEdgeId: z.ZodOptional<z.ZodString>;
109
+ status: z.ZodOptional<z.ZodEnum<{
110
+ active: "active";
111
+ revoked: "revoked";
112
+ paused: "paused";
113
+ }>>;
114
+ }, z.core.$strict>;
115
+ /**
116
+ * The kernel's effective constraints: the restrictive intersection of a
117
+ * chain's ceilings. Unlike the issuance schema, computed intersections may
118
+ * leave a set empty — an empty actions/resources/adapterIds set means the
119
+ * chain can satisfy nothing, which is itself a truthful answer.
120
+ */
121
+ export declare const EffectiveConstraintsSchema: z.ZodObject<{
122
+ actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
123
+ resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
124
+ adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
125
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
126
+ maxUsesPerRequest: z.ZodNumber;
127
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
128
+ expiresAtEpochMs: z.ZodNumber;
129
+ approvalRequired: z.ZodBoolean;
130
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
131
+ merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
132
+ categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
133
+ recurrence: z.ZodOptional<z.ZodEnum<{
134
+ never: "never";
135
+ allowed: "allowed";
136
+ }>>;
137
+ budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
138
+ }, z.core.$strict>;
139
+ /**
140
+ * Effective authority for one agent: the per-chain result of the kernel's
141
+ * own chain evaluation — the same computation the decision path runs, so the
142
+ * Authority Map can never drift from what the kernel enforces.
143
+ */
144
+ export declare const EffectiveAuthoritySchema: z.ZodObject<{
145
+ agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
146
+ suspended: z.ZodBoolean;
147
+ chains: z.ZodArray<z.ZodObject<{
148
+ grantIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
149
+ outcome: z.ZodEnum<{
150
+ denied: "denied";
151
+ effective: "effective";
152
+ }>;
153
+ reasonCode: z.ZodOptional<z.ZodString>;
154
+ effective: z.ZodOptional<z.ZodObject<{
155
+ actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
156
+ resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
157
+ adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
158
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
159
+ maxUsesPerRequest: z.ZodNumber;
160
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
161
+ expiresAtEpochMs: z.ZodNumber;
162
+ approvalRequired: z.ZodBoolean;
163
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
164
+ merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
165
+ categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
166
+ recurrence: z.ZodOptional<z.ZodEnum<{
167
+ never: "never";
168
+ allowed: "allowed";
169
+ }>>;
170
+ budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
171
+ }, z.core.$strict>>;
172
+ }, z.core.$strict>>;
173
+ }, z.core.$strict>;
174
+ export declare const AuthorityGraphSchema: z.ZodObject<{
175
+ tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
176
+ principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
177
+ computedAtEpochMs: z.ZodNumber;
178
+ nodes: z.ZodArray<z.ZodObject<{
179
+ id: z.ZodString;
180
+ kind: z.ZodEnum<{
181
+ tool: "tool";
182
+ agent: "agent";
183
+ task: "task";
184
+ principal: "principal";
185
+ resource: "resource";
186
+ connection: "connection";
187
+ }>;
188
+ label: z.ZodString;
189
+ status: z.ZodOptional<z.ZodEnum<{
190
+ active: "active";
191
+ revoked: "revoked";
192
+ expired: "expired";
193
+ paused: "paused";
194
+ }>>;
195
+ }, z.core.$strict>>;
196
+ edges: z.ZodArray<z.ZodObject<{
197
+ id: z.ZodString;
198
+ kind: z.ZodEnum<{
199
+ contains: "contains";
200
+ writ: "writ";
201
+ coverage: "coverage";
202
+ }>;
203
+ from: z.ZodString;
204
+ to: z.ZodString;
205
+ writ: z.ZodOptional<z.ZodObject<{
206
+ grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
207
+ version: z.ZodNumber;
208
+ issuedAtEpochMs: z.ZodNumber;
209
+ change: z.ZodEnum<{
210
+ revoked: "revoked";
211
+ issued: "issued";
212
+ paused: "paused";
213
+ amended: "amended";
214
+ resumed: "resumed";
215
+ }>;
216
+ ceiling: z.ZodObject<{
217
+ actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
218
+ resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
219
+ adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
220
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
221
+ maxUsesPerRequest: z.ZodNumber;
222
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
223
+ expiresAtEpochMs: z.ZodNumber;
224
+ approvalRequired: z.ZodBoolean;
225
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
226
+ merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
227
+ categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
228
+ recurrence: z.ZodOptional<z.ZodEnum<{
229
+ never: "never";
230
+ allowed: "allowed";
231
+ }>>;
232
+ budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
233
+ }, z.core.$strict>;
234
+ }, z.core.$strict>>;
235
+ parentEdgeId: z.ZodOptional<z.ZodString>;
236
+ status: z.ZodOptional<z.ZodEnum<{
237
+ active: "active";
238
+ revoked: "revoked";
239
+ paused: "paused";
240
+ }>>;
241
+ }, z.core.$strict>>;
242
+ effectiveAuthority: z.ZodArray<z.ZodObject<{
243
+ agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
244
+ suspended: z.ZodBoolean;
245
+ chains: z.ZodArray<z.ZodObject<{
246
+ grantIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
247
+ outcome: z.ZodEnum<{
248
+ denied: "denied";
249
+ effective: "effective";
250
+ }>;
251
+ reasonCode: z.ZodOptional<z.ZodString>;
252
+ effective: z.ZodOptional<z.ZodObject<{
253
+ actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
254
+ resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
255
+ adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
256
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
257
+ maxUsesPerRequest: z.ZodNumber;
258
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
259
+ expiresAtEpochMs: z.ZodNumber;
260
+ approvalRequired: z.ZodBoolean;
261
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
262
+ merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
263
+ categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
264
+ recurrence: z.ZodOptional<z.ZodEnum<{
265
+ never: "never";
266
+ allowed: "allowed";
267
+ }>>;
268
+ budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
269
+ }, z.core.$strict>>;
270
+ }, z.core.$strict>>;
271
+ }, z.core.$strict>>;
272
+ activePauses: z.ZodArray<z.ZodObject<{
273
+ id: z.core.$ZodBranded<z.ZodString, "PauseId", "out">;
274
+ scope: z.ZodEnum<{
275
+ agent: "agent";
276
+ principal: "principal";
277
+ grant: "grant";
278
+ connection: "connection";
279
+ }>;
280
+ agentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
281
+ grantId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
282
+ connectionId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">>;
283
+ adapterId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
284
+ taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
285
+ createdAtEpochMs: z.ZodNumber;
286
+ }, z.core.$strict>>;
287
+ }, z.core.$strict>;
288
+ export type EffectiveConstraints = z.infer<typeof EffectiveConstraintsSchema>;
289
+ export type AuthorityGraphNodeKind = z.infer<typeof AuthorityGraphNodeKindSchema>;
290
+ export type AuthorityGraphNode = z.infer<typeof AuthorityGraphNodeSchema>;
291
+ export type AuthorityWrit = z.infer<typeof AuthorityWritSchema>;
292
+ export type AuthorityGraphEdge = z.infer<typeof AuthorityGraphEdgeSchema>;
293
+ export type EffectiveAuthority = z.infer<typeof EffectiveAuthoritySchema>;
294
+ export type AuthorityGraph = z.infer<typeof AuthorityGraphSchema>;
@@ -0,0 +1,108 @@
1
+ import { z } from "zod";
2
+ import { type CanonicalAction, type RecordedAuthorityEvaluationInput } from "./action.js";
3
+ export declare const AuthorityStateSnapshotSchema: z.ZodObject<{
4
+ principal: z.ZodObject<{
5
+ id: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
6
+ tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
7
+ status: z.ZodEnum<{
8
+ active: "active";
9
+ disabled: "disabled";
10
+ }>;
11
+ }, z.core.$strict>;
12
+ agent: z.ZodObject<{
13
+ id: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
14
+ tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
15
+ ownerPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
16
+ status: z.ZodEnum<{
17
+ active: "active";
18
+ disabled: "disabled";
19
+ revoked: "revoked";
20
+ }>;
21
+ allowedInterfaces: z.ZodPipe<z.ZodArray<z.ZodEnum<{
22
+ mcp: "mcp";
23
+ rest: "rest";
24
+ internal: "internal";
25
+ }>>, z.ZodTransform<("mcp" | "rest" | "internal")[], ("mcp" | "rest" | "internal")[]>>;
26
+ boundRuntime: z.ZodOptional<z.ZodString>;
27
+ boundModel: z.ZodOptional<z.ZodString>;
28
+ parentAgentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
29
+ }, z.core.$strict>;
30
+ policy: z.ZodObject<{
31
+ id: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
32
+ version: z.ZodNumber;
33
+ }, z.core.$strict>;
34
+ authorityChain: z.ZodArray<z.ZodObject<{
35
+ id: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
36
+ tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
37
+ principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
38
+ agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
39
+ parentGrantId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
40
+ issuedBy: z.ZodObject<{
41
+ type: z.ZodLiteral<"principal">;
42
+ principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
43
+ }, z.core.$strict>;
44
+ status: z.ZodEnum<{
45
+ active: "active";
46
+ disabled: "disabled";
47
+ revoked: "revoked";
48
+ }>;
49
+ version: z.ZodNumber;
50
+ delegable: z.ZodDefault<z.ZodBoolean>;
51
+ constraints: z.ZodObject<{
52
+ actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
53
+ resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
54
+ adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
55
+ maxValueCents: z.ZodOptional<z.ZodNumber>;
56
+ maxUsesPerRequest: z.ZodNumber;
57
+ notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
58
+ expiresAtEpochMs: z.ZodNumber;
59
+ approvalRequired: z.ZodBoolean;
60
+ askAboveValueCents: z.ZodOptional<z.ZodNumber>;
61
+ merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
62
+ categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
63
+ recurrence: z.ZodOptional<z.ZodEnum<{
64
+ never: "never";
65
+ allowed: "allowed";
66
+ }>>;
67
+ budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
68
+ }, z.core.$strict>;
69
+ }, z.core.$strict>>;
70
+ revocations: z.ZodArray<z.ZodObject<{
71
+ grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
72
+ revokedAtEpochMs: z.ZodNumber;
73
+ reasonCode: z.ZodString;
74
+ }, z.core.$strict>>;
75
+ pauses: z.ZodDefault<z.ZodArray<z.ZodObject<{
76
+ id: z.core.$ZodBranded<z.ZodString, "PauseId", "out">;
77
+ scope: z.ZodEnum<{
78
+ agent: "agent";
79
+ principal: "principal";
80
+ grant: "grant";
81
+ connection: "connection";
82
+ }>;
83
+ agentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
84
+ grantIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>, z.ZodTransform<(string & z.core.$brand<"GrantId">)[], (string & z.core.$brand<"GrantId">)[]>>>;
85
+ adapterIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>>;
86
+ }, z.core.$strict>>>;
87
+ allowedAdapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
88
+ budgets: z.ZodDefault<z.ZodArray<z.ZodObject<{
89
+ id: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
90
+ scope: z.ZodEnum<{
91
+ agent: "agent";
92
+ task: "task";
93
+ }>;
94
+ taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
95
+ limitCents: z.ZodNumber;
96
+ consumedCents: z.ZodNumber;
97
+ transactionLimit: z.ZodNumber;
98
+ consumedTransactions: z.ZodNumber;
99
+ expiresAtEpochMs: z.ZodOptional<z.ZodNumber>;
100
+ status: z.ZodEnum<{
101
+ active: "active";
102
+ exhausted: "exhausted";
103
+ revoked: "revoked";
104
+ }>;
105
+ }, z.core.$strict>>>;
106
+ }, z.core.$strict>;
107
+ export type AuthorityStateSnapshot = z.infer<typeof AuthorityStateSnapshotSchema>;
108
+ export declare function buildRecordedEvaluationInput(actionInput: CanonicalAction, stateInput: AuthorityStateSnapshot, nowEpochMs: number): RecordedAuthorityEvaluationInput;