@odingard/guardian-sdk 0.1.0 → 0.2.0

package/dist-dts/contracts/approval.d.ts

@@ -46,9 +46,9 @@ export declare const ApprovalPresentationSchema: z.ZodObject<{
     resource: z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">;
     adapterId: z.core.$ZodBranded<z.ZodString, "AdapterId", "out">;
     interface: z.ZodEnum<{
-        internal: "internal";
         mcp: "mcp";
         rest: "rest";
+        internal: "internal";
     }>;
     initiatingContext: z.ZodEnum<{
         agent: "agent";
@@ -78,6 +78,89 @@ export declare const ApprovalPresentationSchema: z.ZodObject<{
             }, z.core.$strict>>;
         }, z.core.$strict>;
     }, z.core.$strict>;
+    providedObligations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            log: "log";
+            retain_receipt: "retain_receipt";
+            notify: "notify";
+            delay: "delay";
+            cooling_period: "cooling_period";
+            delete_after_use: "delete_after_use";
+            redact: "redact";
+            encrypt: "encrypt";
+            tokenize: "tokenize";
+            minimize: "minimize";
+            verify_counterparty: "verify_counterparty";
+            verify_resource: "verify_resource";
+            verify_effect: "verify_effect";
+            attest_runtime: "attest_runtime";
+            require_consent: "require_consent";
+            require_location: "require_location";
+            require_device: "require_device";
+            require_network: "require_network";
+            require_contract: "require_contract";
+            step_up: "step_up";
+            second_approver: "second_approver";
+            quorum: "quorum";
+            authenticate: "authenticate";
+        }>;
+        params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString>]>>>;
+    }, z.core.$strict>>>;
+    runtimeTrustLevel: z.ZodOptional<z.ZodEnum<{
+        T0_UNKNOWN: "T0_UNKNOWN";
+        T1_IDENTIFIED: "T1_IDENTIFIED";
+        T2_VERIFIED: "T2_VERIFIED";
+        T3_ATTESTED: "T3_ATTESTED";
+        T4_HARDWARE_BACKED: "T4_HARDWARE_BACKED";
+    }>>;
+    enforcementAssurance: z.ZodOptional<z.ZodEnum<{
+        G2_CREDENTIAL_MEDIATED: "G2_CREDENTIAL_MEDIATED";
+        G1_POLICY_MEDIATED: "G1_POLICY_MEDIATED";
+        G3_RUNTIME_CONTAINED: "G3_RUNTIME_CONTAINED";
+        G0_OBSERVED: "G0_OBSERVED";
+        G4_COUNTERPARTY_INTERLOCKED: "G4_COUNTERPARTY_INTERLOCKED";
+    }>>;
+    approvalStructures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        schema: z.ZodLiteral<"guardian.multiparty.v1">;
+        structureId: z.ZodString;
+        members: z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"single">;
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"nOfM">;
+            n: z.ZodNumber;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"unanimous">;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"roleQuorum">;
+            role: z.ZodString;
+            n: z.ZodNumber;
+            m: z.ZodNumber;
+        }, z.core.$strict>], "kind">;
+        specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        separationOfDuties: z.ZodOptional<z.ZodObject<{
+            mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            expiresAtEpochMs: z.ZodNumber;
+        }, z.core.$strict>>>;
+        delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>>>;
+        emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        coolingPeriod: z.ZodOptional<z.ZodObject<{
+            seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     actionDigest: z.ZodString;
     expiresAtEpochMs: z.ZodNumber;
 }, z.core.$strict>;
@@ -104,13 +187,64 @@ export declare const ApprovalBindingSchema: z.ZodObject<{
     presentationDigest: z.ZodString;
     requestedAtEpochMs: z.ZodNumber;
     expiresAtEpochMs: z.ZodNumber;
+    eligiblePrincipalIds: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+    requiredFactor: z.ZodOptional<z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+        "multi-approver": "multi-approver";
+    }>>;
+    requiredApprovals: z.ZodOptional<z.ZodNumber>;
+    scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+    structures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        schema: z.ZodLiteral<"guardian.multiparty.v1">;
+        structureId: z.ZodString;
+        members: z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"single">;
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"nOfM">;
+            n: z.ZodNumber;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"unanimous">;
+            members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"roleQuorum">;
+            role: z.ZodString;
+            n: z.ZodNumber;
+            m: z.ZodNumber;
+        }, z.core.$strict>], "kind">;
+        specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        separationOfDuties: z.ZodOptional<z.ZodObject<{
+            mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            expiresAtEpochMs: z.ZodNumber;
+        }, z.core.$strict>>>;
+        delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        }, z.core.$strict>>>;
+        emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        coolingPeriod: z.ZodOptional<z.ZodObject<{
+            seconds: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export declare const ApprovalStateSchema: z.ZodEnum<{
     revoked: "revoked";
     pending: "pending";
+    expired: "expired";
     approved: "approved";
     denied: "denied";
-    expired: "expired";
     superseded: "superseded";
     consumed: "consumed";
 }>;
@@ -139,29 +273,114 @@ export declare const ApprovalRecordSchema: z.ZodObject<{
         presentationDigest: z.ZodString;
         requestedAtEpochMs: z.ZodNumber;
         expiresAtEpochMs: z.ZodNumber;
+        eligiblePrincipalIds: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+        requiredFactor: z.ZodOptional<z.ZodEnum<{
+            tap: "tap";
+            passkey: "passkey";
+            biometric: "biometric";
+            "second-device": "second-device";
+            "multi-approver": "multi-approver";
+        }>>;
+        requiredApprovals: z.ZodOptional<z.ZodNumber>;
+        scopeId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ScopeId", "out">>;
+        structures: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            schema: z.ZodLiteral<"guardian.multiparty.v1">;
+            structureId: z.ZodString;
+            members: z.ZodArray<z.ZodObject<{
+                memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+                roles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            requirement: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"single">;
+                memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"nOfM">;
+                n: z.ZodNumber;
+                members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"unanimous">;
+                members: z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"roleQuorum">;
+                role: z.ZodString;
+                n: z.ZodNumber;
+                m: z.ZodNumber;
+            }, z.core.$strict>], "kind">;
+            specificRequired: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+            veto: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+            separationOfDuties: z.ZodOptional<z.ZodObject<{
+                mutuallyExclusive: z.ZodArray<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            temporaryApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+                expiresAtEpochMs: z.ZodNumber;
+            }, z.core.$strict>>>;
+            delegatedApprovers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+                delegatedBy: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+            }, z.core.$strict>>>;
+            emergencyApprovers: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>>;
+            coolingPeriod: z.ZodOptional<z.ZodObject<{
+                seconds: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
     state: z.ZodEnum<{
         revoked: "revoked";
         pending: "pending";
+        expired: "expired";
         approved: "approved";
         denied: "denied";
-        expired: "expired";
         superseded: "superseded";
         consumed: "consumed";
     }>;
     version: z.ZodNumber;
     updatedAtEpochMs: z.ZodNumber;
     decidedByPrincipalId: z.ZodNullable<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    endorsements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        factor: z.ZodEnum<{
+            tap: "tap";
+            passkey: "passkey";
+            biometric: "biometric";
+            "second-device": "second-device";
+        }>;
+        atEpochMs: z.ZodNumber;
+    }, z.core.$strict>>>;
+    structureApprovals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        memberId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+        decision: z.ZodEnum<{
+            veto: "veto";
+            approve: "approve";
+            deny: "deny";
+        }>;
+        atEpochMs: z.ZodNumber;
+        via: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+        emergency: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>>>;
+    cooling: z.ZodOptional<z.ZodObject<{
+        startedAtEpochMs: z.ZodNumber;
+        endsAtEpochMs: z.ZodNumber;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 /** Human-facing REST body for an explicit approve or deny decision. */
 export declare const ApprovalDecisionRequestSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
     decision: z.ZodEnum<{
-        deny: "deny";
+        veto: "veto";
         approve: "approve";
+        deny: "deny";
     }>;
     expectedVersion: z.ZodNumber;
     presentationDigest: z.ZodString;
+    via: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">>;
+    emergency: z.ZodOptional<z.ZodLiteral<true>>;
+    factor: z.ZodOptional<z.ZodEnum<{
+        tap: "tap";
+        passkey: "passkey";
+        biometric: "biometric";
+        "second-device": "second-device";
+    }>>;
 }, z.core.$strict>;
 /** Human-facing REST body for revoking a pending or approved decision. */
 export declare const ApprovalRevocationRequestSchema: z.ZodObject<{
@@ -181,9 +400,9 @@ export declare const ApprovalReceiptSchema: z.ZodObject<{
     state: z.ZodEnum<{
         revoked: "revoked";
         pending: "pending";
+        expired: "expired";
         approved: "approved";
         denied: "denied";
-        expired: "expired";
         superseded: "superseded";
         consumed: "consumed";
     }>;

package/dist-dts/contracts/assurance.d.ts

@@ -0,0 +1,60 @@
+import { z } from "zod";
+/**
+ * WO-026: guardian.assurance.v1 — enforcement assurance level contract
+ * (GUA-AUTHORITY-OS-001 §26–27).
+ *
+ * The assurance level states how strongly Guardian can enforce a decision
+ * for one action, computed deterministically from recorded surface
+ * evidence. It is honest by construction: G0/G1 describe mediation that
+ * does not physically prevent bypass, and the level never rises on
+ * evidence that was not recorded.
+ *
+ * The ladder (§26), precedence strongest-evidence G4 > G3 > G2 > G1 > G0:
+ *
+ *   G4 COUNTERPARTY_INTERLOCKED — the destination/provider itself
+ *      requires valid Guardian authority proof (recorded tool-server
+ *      catalog bound on the connection).
+ *   G3 RUNTIME_CONTAINED        — execution is constrained inside a
+ *      Guardian-controlled or Guardian-recognized environment (recorded
+ *      attestation marks the execution environment recognized).
+ *   G2 CREDENTIAL_MEDIATED      — the underlying reusable credential is
+ *      Guardian-mediated (a bound connection record backed the action).
+ *   G1 POLICY_MEDIATED          — the agent voluntarily called Guardian;
+ *      alternate execution may exist.
+ *   G0 OBSERVED                 — Guardian saw the action but could not
+ *      prevent bypass.
+ */
+export declare const ASSURANCE_CONTRACT_SCHEMA = "guardian.assurance.v1";
+/** Ordered enforcement-assurance ladder (lowest → highest). */
+export declare const EnforcementAssuranceLevelSchema: z.ZodEnum<{
+    G2_CREDENTIAL_MEDIATED: "G2_CREDENTIAL_MEDIATED";
+    G1_POLICY_MEDIATED: "G1_POLICY_MEDIATED";
+    G3_RUNTIME_CONTAINED: "G3_RUNTIME_CONTAINED";
+    G0_OBSERVED: "G0_OBSERVED";
+    G4_COUNTERPARTY_INTERLOCKED: "G4_COUNTERPARTY_INTERLOCKED";
+}>;
+export type EnforcementAssuranceLevel = z.infer<typeof EnforcementAssuranceLevelSchema>;
+export declare const ENFORCEMENT_ASSURANCE_RANK: Record<EnforcementAssuranceLevel, number>;
+/** Human-readable level names for display surfaces (§27). */
+export declare const ENFORCEMENT_ASSURANCE_LABEL: Record<EnforcementAssuranceLevel, string>;
+/**
+ * Recorded surface evidence the gateway derived for one action. Absent or
+ * false entries never raise the level.
+ */
+export declare const EnforcementAssuranceFactsSchema: z.ZodObject<{
+    voluntaryCall: z.ZodBoolean;
+    guardianMediatedCredential: z.ZodOptional<z.ZodBoolean>;
+    guardianContainedEnvironment: z.ZodOptional<z.ZodBoolean>;
+    counterpartyRequiresAuthorityProof: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type EnforcementAssuranceFacts = z.infer<typeof EnforcementAssuranceFactsSchema>;
+export interface EnforcementAssuranceComputation {
+    level: EnforcementAssuranceLevel;
+    /** The recorded evidence names the level was computed from. */
+    evidence: readonly string[];
+}
+/**
+ * Pure, deterministic level computation over recorded evidence. Strongest
+ * evidence wins; missing evidence never raises the level.
+ */
+export declare function computeEnforcementAssurance(facts: EnforcementAssuranceFacts | null | undefined): EnforcementAssuranceComputation;

package/dist-dts/contracts/authority-graph.d.ts

@@ -0,0 +1,294 @@
+import { z } from "zod";
+/**
+ * WO-010 — the authority graph: principal → agent → task → tool/resource
+ * nodes with bounded delegated edges. This is a read model over the same
+ * authority state the kernel evaluates; it never carries a second policy
+ * path (GUA-UNIVERSAL-001 K15).
+ */
+export declare const AuthorityGraphNodeKindSchema: z.ZodEnum<{
+    tool: "tool";
+    agent: "agent";
+    task: "task";
+    principal: "principal";
+    resource: "resource";
+    connection: "connection";
+}>;
+export declare const AuthorityGraphNodeSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        tool: "tool";
+        agent: "agent";
+        task: "task";
+        principal: "principal";
+        resource: "resource";
+        connection: "connection";
+    }>;
+    label: z.ZodString;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+        expired: "expired";
+        paused: "paused";
+    }>>;
+}, z.core.$strict>;
+/**
+ * A writ edge: one emitted version of a grant, dated and bounded. The edge's
+ * ceiling is the grant's constraints at that version — a delegated edge may
+ * only carry a ceiling equal to or narrower than its parent edge's.
+ */
+export declare const AuthorityWritSchema: z.ZodObject<{
+    grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+    version: z.ZodNumber;
+    issuedAtEpochMs: z.ZodNumber;
+    change: z.ZodEnum<{
+        revoked: "revoked";
+        issued: "issued";
+        paused: "paused";
+        amended: "amended";
+        resumed: "resumed";
+    }>;
+    ceiling: z.ZodObject<{
+        actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
+        resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
+        adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
+        maxValueCents: z.ZodOptional<z.ZodNumber>;
+        maxUsesPerRequest: z.ZodNumber;
+        notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+        expiresAtEpochMs: z.ZodNumber;
+        approvalRequired: z.ZodBoolean;
+        askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+        merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+        categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+        recurrence: z.ZodOptional<z.ZodEnum<{
+            never: "never";
+            allowed: "allowed";
+        }>>;
+        budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const AuthorityGraphEdgeSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        contains: "contains";
+        writ: "writ";
+        coverage: "coverage";
+    }>;
+    from: z.ZodString;
+    to: z.ZodString;
+    writ: z.ZodOptional<z.ZodObject<{
+        grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+        version: z.ZodNumber;
+        issuedAtEpochMs: z.ZodNumber;
+        change: z.ZodEnum<{
+            revoked: "revoked";
+            issued: "issued";
+            paused: "paused";
+            amended: "amended";
+            resumed: "resumed";
+        }>;
+        ceiling: z.ZodObject<{
+            actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
+            resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
+            adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
+            maxValueCents: z.ZodOptional<z.ZodNumber>;
+            maxUsesPerRequest: z.ZodNumber;
+            notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+            expiresAtEpochMs: z.ZodNumber;
+            approvalRequired: z.ZodBoolean;
+            askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+            merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+            categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+            recurrence: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                allowed: "allowed";
+            }>>;
+            budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    parentEdgeId: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+        paused: "paused";
+    }>>;
+}, z.core.$strict>;
+/**
+ * The kernel's effective constraints: the restrictive intersection of a
+ * chain's ceilings. Unlike the issuance schema, computed intersections may
+ * leave a set empty — an empty actions/resources/adapterIds set means the
+ * chain can satisfy nothing, which is itself a truthful answer.
+ */
+export declare const EffectiveConstraintsSchema: z.ZodObject<{
+    actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
+    resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
+    adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
+    maxValueCents: z.ZodOptional<z.ZodNumber>;
+    maxUsesPerRequest: z.ZodNumber;
+    notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+    expiresAtEpochMs: z.ZodNumber;
+    approvalRequired: z.ZodBoolean;
+    askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+    merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    recurrence: z.ZodOptional<z.ZodEnum<{
+        never: "never";
+        allowed: "allowed";
+    }>>;
+    budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/**
+ * Effective authority for one agent: the per-chain result of the kernel's
+ * own chain evaluation — the same computation the decision path runs, so the
+ * Authority Map can never drift from what the kernel enforces.
+ */
+export declare const EffectiveAuthoritySchema: z.ZodObject<{
+    agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+    suspended: z.ZodBoolean;
+    chains: z.ZodArray<z.ZodObject<{
+        grantIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
+        outcome: z.ZodEnum<{
+            denied: "denied";
+            effective: "effective";
+        }>;
+        reasonCode: z.ZodOptional<z.ZodString>;
+        effective: z.ZodOptional<z.ZodObject<{
+            actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
+            resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
+            adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
+            maxValueCents: z.ZodOptional<z.ZodNumber>;
+            maxUsesPerRequest: z.ZodNumber;
+            notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+            expiresAtEpochMs: z.ZodNumber;
+            approvalRequired: z.ZodBoolean;
+            askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+            merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            recurrence: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                allowed: "allowed";
+            }>>;
+            budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AuthorityGraphSchema: z.ZodObject<{
+    tenantId: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+    principalId: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+    computedAtEpochMs: z.ZodNumber;
+    nodes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            tool: "tool";
+            agent: "agent";
+            task: "task";
+            principal: "principal";
+            resource: "resource";
+            connection: "connection";
+        }>;
+        label: z.ZodString;
+        status: z.ZodOptional<z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+            expired: "expired";
+            paused: "paused";
+        }>>;
+    }, z.core.$strict>>;
+    edges: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            contains: "contains";
+            writ: "writ";
+            coverage: "coverage";
+        }>;
+        from: z.ZodString;
+        to: z.ZodString;
+        writ: z.ZodOptional<z.ZodObject<{
+            grantId: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+            version: z.ZodNumber;
+            issuedAtEpochMs: z.ZodNumber;
+            change: z.ZodEnum<{
+                revoked: "revoked";
+                issued: "issued";
+                paused: "paused";
+                amended: "amended";
+                resumed: "resumed";
+            }>;
+            ceiling: z.ZodObject<{
+                actions: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>, z.ZodTransform<(string & z.core.$brand<"ActionType">)[], (string & z.core.$brand<"ActionType">)[]>>;
+                resources: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>, z.ZodTransform<(string & z.core.$brand<"ResourceRef">)[], (string & z.core.$brand<"ResourceRef">)[]>>;
+                adapterIds: z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>, z.ZodTransform<(string & z.core.$brand<"AdapterId">)[], (string & z.core.$brand<"AdapterId">)[]>>;
+                maxValueCents: z.ZodOptional<z.ZodNumber>;
+                maxUsesPerRequest: z.ZodNumber;
+                notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+                expiresAtEpochMs: z.ZodNumber;
+                approvalRequired: z.ZodBoolean;
+                askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+                merchantAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+                categoryAllowlist: z.ZodOptional<z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>>;
+                recurrence: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
+                    allowed: "allowed";
+                }>>;
+                budgetIds: z.ZodOptional<z.ZodPipe<z.ZodArray<z.core.$ZodBranded<z.ZodString, "BudgetId", "out">>, z.ZodTransform<(string & z.core.$brand<"BudgetId">)[], (string & z.core.$brand<"BudgetId">)[]>>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+        parentEdgeId: z.ZodOptional<z.ZodString>;
+        status: z.ZodOptional<z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+            paused: "paused";
+        }>>;
+    }, z.core.$strict>>;
+    effectiveAuthority: z.ZodArray<z.ZodObject<{
+        agentId: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+        suspended: z.ZodBoolean;
+        chains: z.ZodArray<z.ZodObject<{
+            grantIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
+            outcome: z.ZodEnum<{
+                denied: "denied";
+                effective: "effective";
+            }>;
+            reasonCode: z.ZodOptional<z.ZodString>;
+            effective: z.ZodOptional<z.ZodObject<{
+                actions: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ActionType", "out">>;
+                resources: z.ZodArray<z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">>;
+                adapterIds: z.ZodArray<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
+                maxValueCents: z.ZodOptional<z.ZodNumber>;
+                maxUsesPerRequest: z.ZodNumber;
+                notBeforeEpochMs: z.ZodOptional<z.ZodNumber>;
+                expiresAtEpochMs: z.ZodNumber;
+                approvalRequired: z.ZodBoolean;
+                askAboveValueCents: z.ZodOptional<z.ZodNumber>;
+                merchantAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                categoryAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                recurrence: z.ZodOptional<z.ZodEnum<{
+                    never: "never";
+                    allowed: "allowed";
+                }>>;
+                budgetIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    activePauses: z.ZodArray<z.ZodObject<{
+        id: z.core.$ZodBranded<z.ZodString, "PauseId", "out">;
+        scope: z.ZodEnum<{
+            agent: "agent";
+            principal: "principal";
+            grant: "grant";
+            connection: "connection";
+        }>;
+        agentId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AgentId", "out">>;
+        grantId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "GrantId", "out">>;
+        connectionId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">>;
+        adapterId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "AdapterId", "out">>;
+        taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
+        createdAtEpochMs: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type EffectiveConstraints = z.infer<typeof EffectiveConstraintsSchema>;
+export type AuthorityGraphNodeKind = z.infer<typeof AuthorityGraphNodeKindSchema>;
+export type AuthorityGraphNode = z.infer<typeof AuthorityGraphNodeSchema>;
+export type AuthorityWrit = z.infer<typeof AuthorityWritSchema>;
+export type AuthorityGraphEdge = z.infer<typeof AuthorityGraphEdgeSchema>;
+export type EffectiveAuthority = z.infer<typeof EffectiveAuthoritySchema>;
+export type AuthorityGraph = z.infer<typeof AuthorityGraphSchema>;