@odingard/guardian-sdk 0.1.0 → 0.2.0

package/dist-dts/contracts/local.d.ts

@@ -0,0 +1,101 @@
+import { z } from "zod";
+export declare const LOCAL_EXEC_PARAMETERS_SCHEMA_ID = "odingard.guardian.local.exec.v1";
+export declare const LOCAL_EGRESS_PARAMETERS_SCHEMA_ID = "odingard.guardian.local.egress.v1";
+export declare const LOCAL_BROWSE_PARAMETERS_SCHEMA_ID = "odingard.guardian.local.browse.v1";
+export declare const LocalExecParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.local.exec.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    command: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type LocalExecParametersV1 = z.infer<typeof LocalExecParametersV1Schema>;
+export declare const LocalEgressParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.local.egress.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    url: z.ZodString;
+    method: z.ZodDefault<z.ZodEnum<{
+        GET: "GET";
+        HEAD: "HEAD";
+        POST: "POST";
+        PUT: "PUT";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+        OPTIONS: "OPTIONS";
+    }>>;
+}, z.core.$strict>;
+export type LocalEgressParametersV1 = z.infer<typeof LocalEgressParametersV1Schema>;
+export declare const LocalBrowseParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.local.browse.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    url: z.ZodString;
+}, z.core.$strict>;
+export type LocalBrowseParametersV1 = z.infer<typeof LocalBrowseParametersV1Schema>;
+export declare const LocalCommandClassSchema: z.ZodEnum<{
+    routine: "routine";
+    publish: "publish";
+    destructive: "destructive";
+}>;
+export type LocalCommandClass = z.infer<typeof LocalCommandClassSchema>;
+/**
+ * Deterministic shell command classifier for local.exec mediation.
+ *
+ * The mediator routes each intercepted command to the class-scoped action
+ * (local.exec / local.exec.publish / local.exec.destroy); the definition's
+ * validateBinding re-derives the class from the same function, so an agent
+ * cannot smuggle a destructive command through a lower-class action.
+ *
+ * Semantics (kept deliberately small and auditable):
+ *  - The command is split on `&&`, `||`, `;`, `|`, and newlines; the result is
+ *    the MOST restrictive class of any segment.
+ *  - Leading `NAME=value` assignments and `sudo`/`doas`/`env`/`nice`/`ionice`/
+ *    `nohup`/`timeout`/`time` wrappers (plus their flag arguments) are stripped
+ *    so `sudo rm -rf /` still classifies on `rm`.
+ *  - Anything the classifier cannot fully inspect fails conservative:
+ *    a nested shell (`bash`, `sh -c`, `zsh`), `eval`, `exec`, `source`, inline
+ *    interpreters (`python -c`, `node -e`, …) and `xargs` are destructive;
+ *    command substitution `$(...)` / backticks and output redirections raise
+ *    the floor to publish; unknown programs are publish.
+ *  - `destructive` programs (rm, dd, mkfs, shred, kill*, shutdown, iptables,
+ *    `terraform destroy|apply`, `kubectl delete`, `docker rm|prune`, …) and
+ *    destructive git forms (`git reset`, `git clean`, `git push --force`,
+ *    `git branch -D`) are destructive.
+ *  - `publish` programs are outbound mutations: network tools (curl, wget,
+ *    ssh, scp, rsync, gh, browsers), package installs (`npm install`), and
+ *    git subcommands that mutate or reach a remote (push, commit, merge, …).
+ *  - `routine` is a closed list of dev-toolchain and read-only utilities
+ *    (build/test/lint commands, ls/cat/grep/find/ps, `npm test`, read-only
+ *    git subcommands like status/log/diff).
+ */
+export declare function classifyLocalCommand(command: string): LocalCommandClass;
+type BindingResult = Readonly<{
+    ok: true;
+}> | Readonly<{
+    ok: false;
+    reasonCode: string;
+}>;
+type LocalConnectionFacts = Readonly<{
+    provider: string;
+    endpointAllowlist?: readonly string[];
+}>;
+/**
+ * The class-scoped binding for local.exec*: the classified command must equal
+ * the action's declared class. Re-derived here so a misrouted action id (e.g.
+ * a destructive command proposed as `local.exec`) fails closed.
+ */
+export declare function localExecBinding(expected: LocalCommandClass): (input: {
+    params: LocalExecParametersV1;
+    connection: LocalConnectionFacts;
+}) => BindingResult;
+export declare function localEndpointBinding(input: {
+    params: {
+        url: string;
+    };
+    connection: LocalConnectionFacts;
+}): BindingResult;
+export declare function localExecVerificationProjection(input: LocalExecParametersV1): unknown;
+export declare function localExecEnvelopeProjection(input: LocalExecParametersV1): unknown;
+export declare function localEgressVerificationProjection(input: LocalEgressParametersV1): unknown;
+export declare function localEgressEnvelopeProjection(input: LocalEgressParametersV1): unknown;
+export declare function localBrowseVerificationProjection(input: LocalBrowseParametersV1): unknown;
+export declare function localBrowseEnvelopeProjection(input: LocalBrowseParametersV1): unknown;
+export {};

package/dist-dts/contracts/multi-principal.d.ts

@@ -0,0 +1,292 @@
+import { z } from "zod";
+/**
+ * WO-019 — multi-principal authority relationships.
+ *
+ * A shared scope groups principals into a household or team. Memberships carry
+ * three independent axes, never blended:
+ *   - principalClass: what authority the principal may hold (a child never
+ *     holds adult-scope authority);
+ *   - role: what the member may DO inside the scope (approve vs only view);
+ *   - relationshipKind: descriptive family/workspace label carried for display
+ *     and audit; it never confers authority by itself.
+ *
+ * Scope kinds are deliberately limited to household/team: organization-level
+ * directory management is enterprise IAM and out of scope (WO-019 stop
+ * condition).
+ */
+export declare const PrincipalClassSchema: z.ZodEnum<{
+    adult: "adult";
+    child: "child";
+}>;
+export declare const ScopeKindSchema: z.ZodEnum<{
+    household: "household";
+    team: "team";
+}>;
+export declare const RelationshipKindSchema: z.ZodEnum<{
+    child: "child";
+    spouse: "spouse";
+    parent: "parent";
+    caregiver: "caregiver";
+    workspace: "workspace";
+}>;
+export declare const ScopeMemberRoleSchema: z.ZodEnum<{
+    owner: "owner";
+    approver: "approver";
+    viewer: "viewer";
+}>;
+/**
+ * Step-up levels a single human can present. "multi-approver" is a required
+ * level only — no single human can present it; it is satisfied by a quorum of
+ * distinct approvers (WO-019 step-up ladder).
+ */
+export declare const StepUpLevelSchema: z.ZodEnum<{
+    tap: "tap";
+    passkey: "passkey";
+    biometric: "biometric";
+    "second-device": "second-device";
+    "multi-approver": "multi-approver";
+}>;
+/** The factor one human actually presents with a decision. */
+export declare const ApprovalFactorSchema: z.ZodEnum<{
+    tap: "tap";
+    passkey: "passkey";
+    biometric: "biometric";
+    "second-device": "second-device";
+}>;
+/** Ordering of the single-human step-up levels, lowest first. */
+export declare const APPROVAL_FACTOR_RANK: Record<z.infer<typeof ApprovalFactorSchema>, number>;
+/**
+ * Ordering of the step-up levels an approval may require, lowest first;
+ * "multi-approver" sits above every single-human factor.
+ */
+export declare const STEP_UP_LEVEL_RANK: Record<z.infer<typeof StepUpLevelSchema>, number>;
+/** The stricter of two required step-up levels. */
+export declare function strictestStepUpLevel(current: z.infer<typeof StepUpLevelSchema>, candidate: z.infer<typeof StepUpLevelSchema>): z.infer<typeof StepUpLevelSchema>;
+/**
+ * True when the presented factor meets the required step-up level.
+ * "multi-approver" can never be met by one presented factor — it is satisfied
+ * by the endorsement quorum the approval service enforces.
+ */
+export declare function approvalFactorSatisfies(presented: z.infer<typeof ApprovalFactorSchema>, required: z.infer<typeof StepUpLevelSchema>): boolean;
+export declare const SharedScopeSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    kind: z.ZodEnum<{
+        household: "household";
+        team: "team";
+    }>;
+    label: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        dissolved: "dissolved";
+    }>;
+    version: z.ZodNumber;
+    createdAtEpochMs: z.ZodNumber;
+    createdByPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strict>;
+export declare const ScopeMembershipSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    membershipId: z.core.$ZodBranded<z.ZodString, "MembershipId", "out">;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    principalClass: z.ZodEnum<{
+        adult: "adult";
+        child: "child";
+    }>;
+    role: z.ZodEnum<{
+        owner: "owner";
+        approver: "approver";
+        viewer: "viewer";
+    }>;
+    relationshipKind: z.ZodEnum<{
+        child: "child";
+        spouse: "spouse";
+        parent: "parent";
+        caregiver: "caregiver";
+        workspace: "workspace";
+    }>;
+    status: z.ZodEnum<{
+        active: "active";
+        removed: "removed";
+    }>;
+    version: z.ZodNumber;
+    addedAtEpochMs: z.ZodNumber;
+    addedByPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strict>;
+/** Links one member's agent into the scope so co-principals can see/decide. */
+export declare const ScopeAgentLinkSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    ownerPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    status: z.ZodEnum<{
+        active: "active";
+        unlinked: "unlinked";
+    }>;
+    version: z.ZodNumber;
+    linkedAtEpochMs: z.ZodNumber;
+    linkedByPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strict>;
+/**
+ * Per-scope approval policy: the step-up level and approver quorum every new
+ * approval on a linked agent must satisfy. factorByRiskClass can raise (never
+ * lower) the level for higher-risk actions.
+ */
+export declare const ScopeApprovalPolicySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    scopeId: z.core.$ZodBranded<z.ZodString, "ScopeId", "out">;
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    requiredFactor: z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+        "multi-approver": "multi-approver";
+    }>;
+    requiredApprovals: z.ZodNumber;
+    factorByRiskClass: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
+        R0: "R0";
+        R1: "R1";
+        R2: "R2";
+        R3: "R3";
+        R4: "R4";
+        R5: "R5";
+    }>, z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+        "multi-approver": "multi-approver";
+    }>>>;
+    status: z.ZodEnum<{
+        active: "active";
+    }>;
+    version: z.ZodNumber;
+    updatedAtEpochMs: z.ZodNumber;
+    updatedByPrincipalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    approvalStructure: z.ZodOptional<z.ZodObject<{
+        schema: z.ZodLiteral<"guardian.multiparty.v1">;
+        structureId: z.ZodString;
+        members: z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"single">;
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"nOfM">;
+            n: z.ZodNumber;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"unanimous">;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"roleQuorum">;
+            role: z.ZodString;
+            n: z.ZodNumber;
+            m: z.ZodNumber;
+        }, z.core.$strict>], "kind">;
+        specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        separationOfDuties: z.ZodOptional<z.ZodObject<{
+            mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            expiresAtEpochMs: z.ZodNumber;
+        }, z.core.$strict>>>;
+        delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>>>;
+        emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        coolingPeriod: z.ZodOptional<z.ZodObject<{
+            seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * The requirement resolved when an approval is opened on a scope-linked agent:
+ * the bound approver set, the required step-up level, and the quorum. It is
+ * frozen into the approval binding at creation so consent cannot widen later.
+ */
+export declare const ApprovalRequirementSchema: z.ZodObject<{
+    scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    eligiblePrincipalIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    requiredFactor: z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+        "multi-approver": "multi-approver";
+    }>;
+    requiredApprovals: z.ZodNumber;
+    structure: z.ZodOptional<z.ZodObject<{
+        schema: z.ZodLiteral<"guardian.multiparty.v1">;
+        structureId: z.ZodString;
+        members: z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"single">;
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"nOfM">;
+            n: z.ZodNumber;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"unanimous">;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"roleQuorum">;
+            role: z.ZodString;
+            n: z.ZodNumber;
+            m: z.ZodNumber;
+        }, z.core.$strict>], "kind">;
+        specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        separationOfDuties: z.ZodOptional<z.ZodObject<{
+            mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            expiresAtEpochMs: z.ZodNumber;
+        }, z.core.$strict>>>;
+        delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>>>;
+        emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        coolingPeriod: z.ZodOptional<z.ZodObject<{
+            seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** One approver's recorded assent toward a multi-approver quorum. */
+export declare const ApprovalEndorsementSchema: z.ZodObject<{
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    factor: z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+    }>;
+    atEpochMs: z.ZodNumber;
+}, z.core.$strict>;
+export type PrincipalClass = z.infer<typeof PrincipalClassSchema>;
+export type ScopeKind = z.infer<typeof ScopeKindSchema>;
+export type RelationshipKind = z.infer<typeof RelationshipKindSchema>;
+export type ScopeMemberRole = z.infer<typeof ScopeMemberRoleSchema>;
+export type StepUpLevel = z.infer<typeof StepUpLevelSchema>;
+export type ApprovalFactor = z.infer<typeof ApprovalFactorSchema>;
+export type SharedScope = z.infer<typeof SharedScopeSchema>;
+export type ScopeMembership = z.infer<typeof ScopeMembershipSchema>;
+export type ScopeAgentLink = z.infer<typeof ScopeAgentLinkSchema>;
+export type ScopeApprovalPolicy = z.infer<typeof ScopeApprovalPolicySchema>;
+export type ApprovalRequirement = z.infer<typeof ApprovalRequirementSchema>;
+export type ApprovalEndorsement = z.infer<typeof ApprovalEndorsementSchema>;

package/dist-dts/contracts/multiparty.d.ts

@@ -0,0 +1,169 @@
+import { z } from "zod";
+/**
+ * WO-027: guardian.multiparty.v1 — declarative multi-party approval
+ * structures (GUA-AUTHORITY-OS-001 §28–30).
+ *
+ * An approval structure declares WHICH human approvals must be recorded
+ * before consent can resolve: a single approver, an n-of-m quorum, a
+ * unanimous set, a role quorum, composable required members, vetoes,
+ * separation of duties, and temporary / delegated / emergency approvers.
+ * It is a pure declarative input: the approval service freezes the
+ * resolved structure into the approval binding at creation (consent can
+ * never widen), records each member's decision, and evaluates the
+ * structure deterministically. Nothing here enlarges authority — an
+ * unsatisfiable structure fails closed, a veto terminates as denied, and
+ * a declared cooling period keeps authority pending for its window.
+ */
+export declare const MULTIPARTY_CONTRACT_SCHEMA = "guardian.multiparty.v1";
+/** One roster entry: a member plus the role labels they hold under this structure. */
+export declare const StructureMemberSchema: z.ZodObject<{
+    memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type StructureMember = z.infer<typeof StructureMemberSchema>;
+/** The primary approval requirement — exactly one of four shapes. */
+export declare const StructureRequirementSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"single">;
+    memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"nOfM">;
+    n: z.ZodNumber;
+    members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"unanimous">;
+    members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"roleQuorum">;
+    role: z.ZodString;
+    n: z.ZodNumber;
+    m: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export type StructureRequirement = z.infer<typeof StructureRequirementSchema>;
+/** §30 — a declared delay between satisfaction and resolved consent. */
+export declare const CoolingPeriodSchema: z.ZodObject<{
+    seconds: z.ZodNumber;
+}, z.core.$strict>;
+export type CoolingPeriod = z.infer<typeof CoolingPeriodSchema>;
+/** A member whose recorded approvals count only while unexpired. */
+export declare const TemporaryApproverSchema: z.ZodObject<{
+    memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    expiresAtEpochMs: z.ZodNumber;
+}, z.core.$strict>;
+export type TemporaryApprover = z.infer<typeof TemporaryApproverSchema>;
+/**
+ * A member who may act on behalf of a delegator. The delegate's authority can
+ * only narrow the delegator's — the delegator must itself be a structure
+ * member, so a delegate can never act for an authority the delegator lacks.
+ */
+export declare const DelegatedApproverSchema: z.ZodObject<{
+    memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+}, z.core.$strict>;
+export type DelegatedApprover = z.infer<typeof DelegatedApproverSchema>;
+/**
+ * §28–29 — one declarative approval structure. `members` is the roster of
+ * principals the structure recognizes and the roles each holds (frozen into
+ * the binding, so a later roster edit cannot retroactively alter consent).
+ */
+export declare const ApprovalStructureSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"guardian.multiparty.v1">;
+    structureId: z.ZodString;
+    members: z.ZodArray<z.ZodObject<{
+        memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"single">;
+        memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"nOfM">;
+        n: z.ZodNumber;
+        members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"unanimous">;
+        members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"roleQuorum">;
+        role: z.ZodString;
+        n: z.ZodNumber;
+        m: z.ZodNumber;
+    }, z.core.$strict>], "kind">;
+    specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+    veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+    separationOfDuties: z.ZodOptional<z.ZodObject<{
+        mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        expiresAtEpochMs: z.ZodNumber;
+    }, z.core.$strict>>>;
+    delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    }, z.core.$strict>>>;
+    emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+    coolingPeriod: z.ZodOptional<z.ZodObject<{
+        seconds: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ApprovalStructure = z.infer<typeof ApprovalStructureSchema>;
+/** Every principal a structure recognizes as a potential decision actor. */
+export declare function structureMemberIds(structure: ApprovalStructure): readonly string[];
+/** The approvals a structure's primary requirement calls for (for display). */
+export declare function structureRequiredCount(structure: ApprovalStructure): number;
+/** One member's recorded decision under a structure (append-only). */
+export declare const RecordedStructureApprovalSchema: z.ZodObject<{
+    memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    decision: z.ZodEnum<{
+        veto: "veto";
+        approve: "approve";
+        deny: "deny";
+    }>;
+    atEpochMs: z.ZodNumber;
+    via: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    emergency: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type RecordedStructureApproval = z.infer<typeof RecordedStructureApprovalSchema>;
+export declare const CoolingWindowSchema: z.ZodObject<{
+    startedAtEpochMs: z.ZodNumber;
+    endsAtEpochMs: z.ZodNumber;
+}, z.core.$strict>;
+export type CoolingWindow = z.infer<typeof CoolingWindowSchema>;
+export type ApprovalStructureEvaluation = Readonly<{
+    status: "satisfied";
+    approvedBy: readonly string[];
+}> | Readonly<{
+    status: "pending";
+    recordedCount: number;
+    requiredCount: number;
+    missing: readonly string[];
+    cooling?: Readonly<{
+        startedAtEpochMs: number;
+        endsAtEpochMs: number;
+        remainingMs: number;
+    }>;
+}> | Readonly<{
+    status: "vetoed";
+    by: string;
+}> | Readonly<{
+    status: "impossible";
+    reason: string;
+}>;
+/**
+ * Pure evaluator (§29): every recorded decision is replayed against the
+ * declared structure. First-recorded decision per member wins (append-only);
+ * a recorded veto by a veto-listed member terminates as vetoed; a recorded
+ * deny removes that member's ability to approve and can make the structure
+ * impossible; temporary approvals void once expired; delegated approvals count
+ * only under a declared delegation whose delegator is a roster member; a
+ * separation-of-duties violation is impossible; an emergency approval
+ * satisfies the requirement only when the context declares the emergency.
+ * The result only ever holds authority pending or closes it — never widens it.
+ */
+export declare function evaluateApprovalStructure(structure: ApprovalStructure, recorded: readonly RecordedStructureApproval[], ctx: {
+    nowEpochMs: number;
+    emergency?: boolean;
+    /** When the requirements were first satisfied (recorded by the caller). */
+    satisfiedAtEpochMs?: number;
+}): ApprovalStructureEvaluation;
+export declare function approvalStructureDigest(structure: ApprovalStructure): string;