@tangle-network/agent-interface 5.2.1 → 5.3.1

package/dist/profile-schema.d.ts

@@ -239,34 +239,34 @@ export declare const agentProfileConfigValueSchema: z.ZodDiscriminatedUnion<[z.Z
     }>>;
 }, z.core.$strict>], "kind">;
 export declare const agentProfileEnvironmentSchema: z.ZodType<Record<string, {
-    kind: "public";
-    value: string;
-} | {
     kind: "secret-ref";
     key: string;
     format?: "bearer" | "raw" | undefined;
-}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+} | {
     kind: "public";
     value: string;
-} | {
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
     kind: "secret-ref";
     key: string;
     format?: "bearer" | "raw" | undefined;
-}>, unknown>>;
-export declare const agentProfileHeaderSchema: z.ZodType<Record<string, {
+} | {
     kind: "public";
     value: string;
-} | {
+}>, unknown>>;
+export declare const agentProfileHeaderSchema: z.ZodType<Record<string, {
     kind: "secret-ref";
     key: string;
     format?: "bearer" | "raw" | undefined;
-}>, unknown, z.core.$ZodTypeInternals<Record<string, {
+} | {
     kind: "public";
     value: string;
-} | {
+}>, unknown, z.core.$ZodTypeInternals<Record<string, {
     kind: "secret-ref";
     key: string;
     format?: "bearer" | "raw" | undefined;
+} | {
+    kind: "public";
+    value: string;
 }>, unknown>>;
 export declare const agentSubagentProfileSchema: z.ZodObject<{
     description: z.ZodOptional<z.ZodString>;
@@ -283,19 +283,19 @@ export declare const agentProfileHookCommandSchema: z.ZodObject<{
     blocking: z.ZodOptional<z.ZodBoolean>;
     matcher: z.ZodOptional<z.ZodString>;
     env: z.ZodOptional<z.ZodType<Record<string, {
-        kind: "public";
-        value: string;
-    } | {
         kind: "secret-ref";
         key: string;
         format?: "bearer" | "raw" | undefined;
-    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
+    } | {
         kind: "public";
         value: string;
-    } | {
+    }>, unknown, z.core.$ZodTypeInternals<Record<string, {
         kind: "secret-ref";
         key: string;
         format?: "bearer" | "raw" | undefined;
+    } | {
+        kind: "public";
+        value: string;
     }>, unknown>>>;
 }, z.core.$strict>;
 export declare const agentProfileModeSchema: z.ZodObject<{
@@ -344,6 +344,7 @@ export declare const agentProfileDiffRemovalSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
     harness: z.ZodOptional<z.ZodLiteral<true>>;
     seats: z.ZodOptional<z.ZodLiteral<true>>;
+    proxySecrets: z.ZodOptional<z.ZodLiteral<true>>;
     permissions: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
     tools: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
     mcp: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<true>, z.ZodArray<z.ZodString>]>>;
@@ -556,6 +557,33 @@ export declare const agentProfileSchema: z.ZodObject<{
         tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
         permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
     }, z.core.$strict>>>;
+    proxySecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        envName: z.ZodString;
+        secretRef: z.ZodObject<{
+            kind: z.ZodLiteral<"secret-ref">;
+            key: z.ZodString;
+        }, z.core.$strict>;
+        presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"bearer">;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"basic">;
+            username: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"header">;
+            name: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            type: z.ZodLiteral<"query">;
+            name: z.ZodString;
+        }, z.core.$strict>], "type">;
+        placeholderFormat: z.ZodOptional<z.ZodEnum<{
+            jwt: "jwt";
+            opaque: "opaque";
+        }>>;
+        ttlSeconds: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
     permissions: z.ZodOptional<z.ZodType<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown, z.core.$ZodTypeInternals<Record<string, "allow" | "ask" | "deny" | Record<string, "allow" | "ask" | "deny">>, unknown>>>;
     tools: z.ZodOptional<z.ZodType<Record<string, boolean>, unknown, z.core.$ZodTypeInternals<Record<string, boolean>, unknown>>>;
     mcp: z.ZodOptional<z.ZodType<Record<string, AgentProfileMcpServer>, unknown, z.core.$ZodTypeInternals<Record<string, AgentProfileMcpServer>, unknown>>>;
@@ -664,12 +692,12 @@ export declare const agentProfileSchema: z.ZodObject<{
         blocking?: boolean | undefined;
         matcher?: string | undefined;
         env?: Record<string, {
-            kind: "public";
-            value: string;
-        } | {
             kind: "secret-ref";
             key: string;
             format?: "bearer" | "raw" | undefined;
+        } | {
+            kind: "public";
+            value: string;
         }> | undefined;
     }[]>, unknown, z.core.$ZodTypeInternals<Record<string, {
         command: string;
@@ -677,12 +705,12 @@ export declare const agentProfileSchema: z.ZodObject<{
         blocking?: boolean | undefined;
         matcher?: string | undefined;
         env?: Record<string, {
-            kind: "public";
-            value: string;
-        } | {
             kind: "secret-ref";
             key: string;
             format?: "bearer" | "raw" | undefined;
+        } | {
+            kind: "public";
+            value: string;
         }> | undefined;
     }[]>, unknown>>>;
     modes: z.ZodOptional<z.ZodType<Record<string, {
@@ -743,3 +771,4 @@ export interface Capability {
     recommendedSize?: SandboxSizePreset;
 }
 export declare const capabilitySchema: z.ZodType<Capability>;
+export * from "./proxy-secrets.js";

package/dist/profile-schema.js

@@ -1,4 +1,6 @@
+import { agentCandidateSecretRefSchema } from "./agent-candidate-schema-common.js";
 import { z } from "zod";
+import { ProxySecretsSchema } from "./proxy-secrets.js";
 import { agentProfileKnowledgeRefsSchema } from "./profile-knowledge.js";
 export { agentProfileKnowledgeRefSchema, agentProfileKnowledgeRefsSchema, } from "./profile-knowledge.js";
 import { REASONING_EFFORTS, TRAINED_MODEL_PREFIX, trainedModelIdForArtifact, } from "./agent-profile.js";
@@ -169,23 +171,11 @@ const publicProfileConfigStringSchema = z
     .refine((value) => isWellFormedUnicode(value) &&
     !controlCharacterPattern.test(value) &&
     !looksLikeCredential(value), "public profile config cannot carry credential-like material");
-const secretReferenceKeySchema = z
-    .string()
-    .min(1)
-    .max(500)
-    .refine((value) => value.trim().length > 0 &&
-    isWellFormedUnicode(value) &&
-    !controlCharacterPattern.test(value) &&
-    !looksLikeCredential(value), "secret reference key must be a public non-credential identity");
 export const agentProfilePublicConfigValueSchema = z.strictObject({
     kind: z.literal("public"),
     value: publicProfileConfigStringSchema,
 });
-export const agentProfileSecretRefSchema = z.strictObject({
-    kind: z.literal("secret-ref"),
-    key: secretReferenceKeySchema,
-    format: z.enum(["raw", "bearer"]).optional(),
-});
+export const agentProfileSecretRefSchema = agentCandidateSecretRefSchema;
 export const agentProfileConfigValueSchema = z.discriminatedUnion("kind", [
     agentProfilePublicConfigValueSchema,
     agentProfileSecretRefSchema,
@@ -327,6 +317,7 @@ export const agentProfileDiffRemovalSchema = z.strictObject({
     model: removeListSchema.optional(),
     harness: z.literal(true).optional(),
     seats: z.literal(true).optional(),
+    proxySecrets: z.literal(true).optional(),
     permissions: removeListSchema.optional(),
     tools: removeListSchema.optional(),
     mcp: removeListSchema.optional(),
@@ -438,6 +429,7 @@ export const agentProfileSchema = z
     model: agentProfileModelHintsSchema.optional(),
     harness: harnessTypeSchema.optional(),
     seats: z.array(agentProfileSeatSchema).nonempty().optional(),
+    proxySecrets: ProxySecretsSchema.optional(),
     permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
     tools: ownPropertyRecordSchema(z.boolean()).optional(),
     mcp: ownPropertyRecordSchema(agentProfileMcpServerSchema).optional(),
@@ -609,3 +601,4 @@ export const capabilitySchema = z.strictObject({
     definition: agentProfileSchema,
     recommendedSize: z.enum(SANDBOX_SIZE_PRESET_NAMES).optional(),
 });
+export * from "./proxy-secrets.js";

package/dist/proxy-secrets.d.ts

@@ -0,0 +1,329 @@
+import { z } from "zod";
+/** Match complete components only. Selected header names are case-insensitive; duplicate fields
+ * are refused before coalescing. Query names are case-sensitive after one strict UTF-8 percent
+ * decode (+ means space); malformed encoding and duplicate decoded selector names are refused.
+ * Never scan other query fields. Basic is one strict base64 value decoding to exactly public
+ * username:placeholder; the username is printable ASCII without colon. Bearer is exactly
+ * "Bearer SP placeholder". Embedded placeholders never match. Authority, TLS SNI and validated
+ * destination must agree on the declared FQDN over HTTPS/443; explicit :443 is equivalent.
+ */
+export declare const ProxySecretPresentationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"bearer">;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"basic">;
+    username: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"header">;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"query">;
+    name: z.ZodString;
+}, z.core.$strict>], "type">;
+export type ProxySecretPresentation = z.infer<typeof ProxySecretPresentationSchema>;
+export declare const ProxySecretScopeSchema: z.ZodObject<{
+    hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>;
+export type ProxySecretScope = z.infer<typeof ProxySecretScopeSchema>;
+export declare const ProxySecretBindingSchema: z.ZodObject<{
+    hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    envName: z.ZodString;
+    secretRef: z.ZodObject<{
+        kind: z.ZodLiteral<"secret-ref">;
+        key: z.ZodString;
+    }, z.core.$strict>;
+    presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        username: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"header">;
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"query">;
+        name: z.ZodString;
+    }, z.core.$strict>], "type">;
+    placeholderFormat: z.ZodOptional<z.ZodEnum<{
+        jwt: "jwt";
+        opaque: "opaque";
+    }>>;
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type ProxySecretBinding = z.infer<typeof ProxySecretBindingSchema>;
+export declare const ProxySecretsSchema: z.ZodArray<z.ZodObject<{
+    hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    envName: z.ZodString;
+    secretRef: z.ZodObject<{
+        kind: z.ZodLiteral<"secret-ref">;
+        key: z.ZodString;
+    }, z.core.$strict>;
+    presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        username: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"header">;
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"query">;
+        name: z.ZodString;
+    }, z.core.$strict>], "type">;
+    placeholderFormat: z.ZodOptional<z.ZodEnum<{
+        jwt: "jwt";
+        opaque: "opaque";
+    }>>;
+    ttlSeconds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>>;
+export declare const ProxySecretResolvedIdentitySchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    issuerId: z.ZodString;
+    secretId: z.ZodString;
+    revision: z.ZodString;
+}, z.core.$strict>;
+export type ProxySecretResolvedIdentity = z.infer<typeof ProxySecretResolvedIdentitySchema>;
+export declare const ProxySecretGrantSchema: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<1>;
+    grantId: z.ZodString;
+    sandboxId: z.ZodString;
+    epoch: z.ZodString;
+    identity: z.ZodObject<{
+        tenantId: z.ZodString;
+        issuerId: z.ZodString;
+        secretId: z.ZodString;
+        revision: z.ZodString;
+    }, z.core.$strict>;
+    scope: z.ZodObject<{
+        hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    }, z.core.$strict>;
+    presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        username: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"header">;
+        name: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"query">;
+        name: z.ZodString;
+    }, z.core.$strict>], "type">;
+    placeholderFormat: z.ZodEnum<{
+        jwt: "jwt";
+        opaque: "opaque";
+    }>;
+    issuedAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    sourceExpiresAt: z.ZodOptional<z.ZodISODateTime>;
+    parentGrantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProxySecretGrant = z.infer<typeof ProxySecretGrantSchema>;
+/** proxy-installed is a phase-two input, never dispatch authority. Only installed acknowledges
+ * proxy and placeholder-only materialization. Revoked confirms binding revocation, not upstream
+ * credential revocation. Receipts contain metadata only, never secret or placeholder bytes.
+ */
+export declare const ProxySecretReceiptSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocolVersion: z.ZodLiteral<1>;
+    sandboxId: z.ZodString;
+    generation: z.ZodNumber;
+    bindings: z.ZodArray<z.ZodObject<{
+        envName: z.ZodString;
+        secretRef: z.ZodObject<{
+            kind: z.ZodLiteral<"secret-ref">;
+            key: z.ZodString;
+        }, z.core.$strict>;
+        grant: z.ZodObject<{
+            protocolVersion: z.ZodLiteral<1>;
+            grantId: z.ZodString;
+            sandboxId: z.ZodString;
+            epoch: z.ZodString;
+            identity: z.ZodObject<{
+                tenantId: z.ZodString;
+                issuerId: z.ZodString;
+                secretId: z.ZodString;
+                revision: z.ZodString;
+            }, z.core.$strict>;
+            scope: z.ZodObject<{
+                hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+                methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+                paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            }, z.core.$strict>;
+            presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"bearer">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"basic">;
+                username: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"header">;
+                name: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"query">;
+                name: z.ZodString;
+            }, z.core.$strict>], "type">;
+            placeholderFormat: z.ZodEnum<{
+                jwt: "jwt";
+                opaque: "opaque";
+            }>;
+            issuedAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            sourceExpiresAt: z.ZodOptional<z.ZodISODateTime>;
+            parentGrantId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    proxyAcknowledged: z.ZodLiteral<true>;
+    status: z.ZodLiteral<"proxy-installed">;
+    materializationAcknowledged: z.ZodLiteral<false>;
+}, z.core.$strict>, z.ZodObject<{
+    protocolVersion: z.ZodLiteral<1>;
+    sandboxId: z.ZodString;
+    generation: z.ZodNumber;
+    bindings: z.ZodArray<z.ZodObject<{
+        envName: z.ZodString;
+        secretRef: z.ZodObject<{
+            kind: z.ZodLiteral<"secret-ref">;
+            key: z.ZodString;
+        }, z.core.$strict>;
+        grant: z.ZodObject<{
+            protocolVersion: z.ZodLiteral<1>;
+            grantId: z.ZodString;
+            sandboxId: z.ZodString;
+            epoch: z.ZodString;
+            identity: z.ZodObject<{
+                tenantId: z.ZodString;
+                issuerId: z.ZodString;
+                secretId: z.ZodString;
+                revision: z.ZodString;
+            }, z.core.$strict>;
+            scope: z.ZodObject<{
+                hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+                methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+                paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            }, z.core.$strict>;
+            presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"bearer">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"basic">;
+                username: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"header">;
+                name: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"query">;
+                name: z.ZodString;
+            }, z.core.$strict>], "type">;
+            placeholderFormat: z.ZodEnum<{
+                jwt: "jwt";
+                opaque: "opaque";
+            }>;
+            issuedAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            sourceExpiresAt: z.ZodOptional<z.ZodISODateTime>;
+            parentGrantId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    proxyAcknowledged: z.ZodLiteral<true>;
+    status: z.ZodLiteral<"installed">;
+    materializationAcknowledged: z.ZodLiteral<true>;
+}, z.core.$strict>, z.ZodObject<{
+    protocolVersion: z.ZodLiteral<1>;
+    sandboxId: z.ZodString;
+    generation: z.ZodNumber;
+    bindings: z.ZodArray<z.ZodObject<{
+        envName: z.ZodString;
+        secretRef: z.ZodObject<{
+            kind: z.ZodLiteral<"secret-ref">;
+            key: z.ZodString;
+        }, z.core.$strict>;
+        grant: z.ZodObject<{
+            protocolVersion: z.ZodLiteral<1>;
+            grantId: z.ZodString;
+            sandboxId: z.ZodString;
+            epoch: z.ZodString;
+            identity: z.ZodObject<{
+                tenantId: z.ZodString;
+                issuerId: z.ZodString;
+                secretId: z.ZodString;
+                revision: z.ZodString;
+            }, z.core.$strict>;
+            scope: z.ZodObject<{
+                hosts: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+                methods: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+                paths: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            }, z.core.$strict>;
+            presentation: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"bearer">;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"basic">;
+                username: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"header">;
+                name: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"query">;
+                name: z.ZodString;
+            }, z.core.$strict>], "type">;
+            placeholderFormat: z.ZodEnum<{
+                jwt: "jwt";
+                opaque: "opaque";
+            }>;
+            issuedAt: z.ZodISODateTime;
+            expiresAt: z.ZodISODateTime;
+            sourceExpiresAt: z.ZodOptional<z.ZodISODateTime>;
+            parentGrantId: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    proxyAcknowledged: z.ZodLiteral<true>;
+    status: z.ZodLiteral<"revoked">;
+    materializationAcknowledged: z.ZodLiteral<true>;
+}, z.core.$strict>], "status">;
+export type ProxySecretReceipt = z.infer<typeof ProxySecretReceiptSchema>;
+/** Advertise only when served API, driver, host, proxy and materializer agree. Absence,
+ * protocol skew, or unsupported driver/presentation/format refuses before resolution or launch.
+ */
+export declare const ProxySecretCapabilitiesSchema: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<1>;
+    supportedDrivers: z.ZodArray<z.ZodString>;
+    presentations: z.ZodArray<z.ZodEnum<{
+        basic: "basic";
+        bearer: "bearer";
+        header: "header";
+        query: "query";
+    }>>;
+    placeholderFormats: z.ZodArray<z.ZodEnum<{
+        jwt: "jwt";
+        opaque: "opaque";
+    }>>;
+    enforcement: z.ZodLiteral<"exact">;
+    transports: z.ZodTuple<[z.ZodLiteral<"https:443">], null>;
+    lifecycle: z.ZodLiteral<true>;
+    placementReceiptRequired: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ProxySecretCapabilities = z.infer<typeof ProxySecretCapabilitiesSchema>;
+export declare const ProxySecretUpdateControlsSchema: z.ZodObject<{
+    expectedProxySecretGeneration: z.ZodOptional<z.ZodNumber>;
+    requireInPlace: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type ProxySecretUpdateControls = z.infer<typeof ProxySecretUpdateControlsSchema>;
+/** Bounded delegation comparison, not proof of issuer authorization, installation, freshness
+ * or authenticated lineage. The trusted lifecycle owner must cascade parent revocation.
+ */
+export declare function isProxySecretGrantAttenuation(parent: ProxySecretGrant, child: ProxySecretGrant): boolean;
+/** Early declaration guard only: matching public refs do not establish resolved authority. */
+export declare function isProxySecretBindingAttenuation(parent: ProxySecretBinding, child: ProxySecretBinding): boolean;
+/** Omitted methods/paths mean all; a bounded parent cannot be widened by omission. */
+export declare function isProxySecretScopeAttenuation(parent: ProxySecretScope, child: ProxySecretScope): boolean;
+/** Header selectors compare case-insensitively; query selectors and Basic usernames are exact. */
+export declare function proxySecretPresentationsEqual(left: ProxySecretPresentation, right: ProxySecretPresentation): boolean;
+/** Merge independent declaration sources. Identical names deduplicate only when the full
+ * schema-parsed declaration agrees; callers preserve omission versus explicit empty selection.
+ * The result is detached public metadata. Conflicts fail without exposing declaration contents.
+ */
+export declare function mergeProxySecretBindings(...collections: readonly (readonly ProxySecretBinding[] | undefined)[]): ProxySecretBinding[];