@vorionsys/platform-core 0.1.0

package/dist/car-extensions/types.d.ts

@@ -0,0 +1,2269 @@
+/**
+ * CAR Extension Protocol Types
+ *
+ * Provides comprehensive type definitions for the Layer 4 Runtime Assurance
+ * extension system. This module defines the core extension interface and all
+ * supporting types for capability, action, monitoring, trust, and policy hooks.
+ *
+ * @packageDocumentation
+ * @module @vorion/car-extensions/types
+ * @license Apache-2.0
+ */
+import { z } from 'zod';
+import type { TrustScore } from '../common/types.js';
+/**
+ * Trust tier values (T0-T7)
+ * Maps to 8-tier Vorion trust model
+ */
+export type TrustTier = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+/**
+ * Zod schema for TrustTier validation
+ */
+export declare const TrustTierSchema: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>, z.ZodLiteral<7>]>;
+/**
+ * Agent identity information for extension hooks.
+ *
+ * NOTE: Trust data (trustTier, trustScore) is optional runtime context injected
+ * by the Trust Engine. CAR identity is immutable and does NOT include trust.
+ * See packages/contracts/src/car/identity.ts for the canonical trust-free CAR identity.
+ */
+export interface AgentIdentity {
+    /** Agent's DID (Decentralized Identifier) */
+    did: string;
+    /** Agent's CAR string (with optional extensions) */
+    carId: string;
+    /** Publisher organization */
+    publisher: string;
+    /** Agent name */
+    name: string;
+    /** Runtime trust tier from Trust Engine (not part of CAR identity) */
+    trustTier?: TrustTier;
+    /** Runtime trust score 0-1000 from Trust Engine (not part of CAR identity) */
+    trustScore?: TrustScore;
+    /** Capability domains (bitmask) */
+    domains: number;
+    /** Capability level */
+    level: number;
+    /** Agent version */
+    version: string;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Zod schema for AgentIdentity validation
+ */
+export declare const AgentIdentitySchema: z.ZodObject<{
+    did: z.ZodString;
+    carId: z.ZodString;
+    publisher: z.ZodString;
+    name: z.ZodString;
+    trustTier: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>, z.ZodLiteral<7>]>>;
+    trustScore: z.ZodOptional<z.ZodNumber>;
+    domains: z.ZodNumber;
+    level: z.ZodNumber;
+    version: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    version?: string;
+    level?: number;
+    name?: string;
+    metadata?: Record<string, unknown>;
+    trustScore?: number;
+    carId?: string;
+    trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    did?: string;
+    domains?: number;
+    publisher?: string;
+}, {
+    version?: string;
+    level?: number;
+    name?: string;
+    metadata?: Record<string, unknown>;
+    trustScore?: number;
+    carId?: string;
+    trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    did?: string;
+    domains?: number;
+    publisher?: string;
+}>;
+/**
+ * Attestation record for verifying agent certification
+ */
+export interface Attestation {
+    /** Attestation ID */
+    id: string;
+    /** Agent DID this attestation is for */
+    agentDid: string;
+    /** Issuer DID */
+    issuerDid: string;
+    /** Attestation type */
+    type: 'certification' | 'capability' | 'trust' | 'compliance';
+    /** Claims in the attestation */
+    claims: Record<string, unknown>;
+    /** Issuance timestamp */
+    issuedAt: Date;
+    /** Expiry timestamp */
+    expiresAt: Date;
+    /** Cryptographic signature */
+    signature: string;
+    /** Signature algorithm */
+    signatureAlgorithm: string;
+    /** Whether attestation has been revoked */
+    revoked: boolean;
+    /** Revocation timestamp if revoked */
+    revokedAt?: Date;
+}
+/**
+ * Zod schema for Attestation validation
+ */
+export declare const AttestationSchema: z.ZodObject<{
+    id: z.ZodString;
+    agentDid: z.ZodString;
+    issuerDid: z.ZodString;
+    type: z.ZodEnum<["certification", "capability", "trust", "compliance"]>;
+    claims: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    issuedAt: z.ZodDate;
+    expiresAt: z.ZodDate;
+    signature: z.ZodString;
+    signatureAlgorithm: z.ZodString;
+    revoked: z.ZodBoolean;
+    revokedAt: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "trust" | "compliance" | "capability" | "certification";
+    expiresAt?: Date;
+    revokedAt?: Date;
+    revoked?: boolean;
+    signature?: string;
+    signatureAlgorithm?: string;
+    issuedAt?: Date;
+    agentDid?: string;
+    issuerDid?: string;
+    claims?: Record<string, unknown>;
+}, {
+    id?: string;
+    type?: "trust" | "compliance" | "capability" | "certification";
+    expiresAt?: Date;
+    revokedAt?: Date;
+    revoked?: boolean;
+    signature?: string;
+    signatureAlgorithm?: string;
+    issuedAt?: Date;
+    agentDid?: string;
+    issuerDid?: string;
+    claims?: Record<string, unknown>;
+}>;
+/**
+ * Request context for capability and action requests
+ */
+export interface RequestContext {
+    /** Request source identifier */
+    source: string;
+    /** Request purpose description */
+    purpose?: string;
+    /** Target resource identifier */
+    resource?: string;
+    /** Additional metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Zod schema for RequestContext validation
+ */
+export declare const RequestContextSchema: z.ZodObject<{
+    source: z.ZodString;
+    purpose: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    metadata?: Record<string, unknown>;
+    source?: string;
+    resource?: string;
+    purpose?: string;
+}, {
+    metadata?: Record<string, unknown>;
+    source?: string;
+    resource?: string;
+    purpose?: string;
+}>;
+/**
+ * Constraint that can be applied to capabilities or actions
+ */
+export interface Constraint {
+    /** Constraint type */
+    type: 'rate_limit' | 'time_window' | 'resource' | 'approval' | 'custom';
+    /** Constraint parameters */
+    params: Record<string, unknown>;
+}
+/**
+ * Zod schema for Constraint validation
+ */
+export declare const ConstraintSchema: z.ZodObject<{
+    type: z.ZodEnum<["rate_limit", "time_window", "resource", "approval", "custom"]>;
+    params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    params?: Record<string, unknown>;
+    type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+}, {
+    params?: Record<string, unknown>;
+    type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+}>;
+/**
+ * Capability request from an agent
+ */
+export interface CapabilityRequest {
+    /** Requested domains (string identifiers) */
+    domains: string[];
+    /** Requested capability level */
+    level: number;
+    /** Request context */
+    context: RequestContext;
+    /** Time-to-live in seconds */
+    ttl?: number;
+}
+/**
+ * Zod schema for CapabilityRequest validation
+ */
+export declare const CapabilityRequestSchema: z.ZodObject<{
+    domains: z.ZodArray<z.ZodString, "many">;
+    level: z.ZodNumber;
+    context: z.ZodObject<{
+        source: z.ZodString;
+        purpose: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }>;
+    ttl: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    level?: number;
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+    ttl?: number;
+    domains?: string[];
+}, {
+    level?: number;
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+    ttl?: number;
+    domains?: string[];
+}>;
+/**
+ * Capability grant issued to an agent
+ */
+export interface CapabilityGrant {
+    /** Grant ID */
+    id: string;
+    /** Granted CAR string */
+    carId: string;
+    /** Granted domains (bitmask) */
+    domains: number;
+    /** Granted level */
+    level: number;
+    /** Issuance timestamp */
+    issuedAt: Date;
+    /** Expiry timestamp */
+    expiresAt: Date;
+    /** Additional constraints */
+    constraints?: Constraint[];
+    /** JWT token representing the grant */
+    token?: string;
+}
+/**
+ * Zod schema for CapabilityGrant validation
+ */
+export declare const CapabilityGrantSchema: z.ZodObject<{
+    id: z.ZodString;
+    carId: z.ZodString;
+    domains: z.ZodNumber;
+    level: z.ZodNumber;
+    issuedAt: z.ZodDate;
+    expiresAt: z.ZodDate;
+    constraints: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["rate_limit", "time_window", "resource", "approval", "custom"]>;
+        params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }>, "many">>;
+    token: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    level?: number;
+    token?: string;
+    id?: string;
+    expiresAt?: Date;
+    constraints?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }[];
+    carId?: string;
+    domains?: number;
+    issuedAt?: Date;
+}, {
+    level?: number;
+    token?: string;
+    id?: string;
+    expiresAt?: Date;
+    constraints?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }[];
+    carId?: string;
+    domains?: number;
+    issuedAt?: Date;
+}>;
+/**
+ * Target of an action
+ */
+export interface ActionTarget {
+    /** Target type (e.g., 'resource', 'agent', 'service') */
+    type: string;
+    /** Target identifier */
+    id: string;
+    /** Target metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Zod schema for ActionTarget validation
+ */
+export declare const ActionTargetSchema: z.ZodObject<{
+    type: z.ZodString;
+    id: z.ZodString;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: string;
+    metadata?: Record<string, unknown>;
+}, {
+    id?: string;
+    type?: string;
+    metadata?: Record<string, unknown>;
+}>;
+/**
+ * Action request from an agent
+ */
+export interface ActionRequest {
+    /** Action type identifier */
+    type: string;
+    /** Action target */
+    target: ActionTarget;
+    /** Action parameters */
+    params: Record<string, unknown>;
+    /** Request context */
+    context: RequestContext;
+}
+/**
+ * Zod schema for ActionRequest validation
+ */
+export declare const ActionRequestSchema: z.ZodObject<{
+    type: z.ZodString;
+    target: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    }, {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    }>;
+    params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    context: z.ZodObject<{
+        source: z.ZodString;
+        purpose: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    target?: {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    };
+    params?: Record<string, unknown>;
+    type?: string;
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+}, {
+    target?: {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    };
+    params?: Record<string, unknown>;
+    type?: string;
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+}>;
+/**
+ * Side effect of an action
+ */
+export interface SideEffect {
+    /** Effect type */
+    type: string;
+    /** Effect target */
+    target: string;
+    /** Effect description */
+    description: string;
+}
+/**
+ * Zod schema for SideEffect validation
+ */
+export declare const SideEffectSchema: z.ZodObject<{
+    type: z.ZodString;
+    target: z.ZodString;
+    description: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    target?: string;
+    description?: string;
+    type?: string;
+}, {
+    target?: string;
+    description?: string;
+    type?: string;
+}>;
+/**
+ * Result of an action execution
+ */
+export interface ActionResult {
+    /** Whether action succeeded */
+    success: boolean;
+    /** Result data */
+    data?: unknown;
+    /** Side effects produced */
+    sideEffects?: SideEffect[];
+}
+/**
+ * Zod schema for ActionResult validation
+ */
+export declare const ActionResultSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodUnknown>;
+    sideEffects: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodString;
+        target: z.ZodString;
+        description: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        target?: string;
+        description?: string;
+        type?: string;
+    }, {
+        target?: string;
+        description?: string;
+        type?: string;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    success?: boolean;
+    data?: unknown;
+    sideEffects?: {
+        target?: string;
+        description?: string;
+        type?: string;
+    }[];
+}, {
+    success?: boolean;
+    data?: unknown;
+    sideEffects?: {
+        target?: string;
+        description?: string;
+        type?: string;
+    }[];
+}>;
+/**
+ * Record of an executed action
+ */
+export interface ActionRecord extends ActionRequest {
+    /** Action record ID */
+    id: string;
+    /** Execution start timestamp */
+    startedAt: Date;
+    /** Execution completion timestamp */
+    completedAt?: Date;
+    /** Action result */
+    result?: ActionResult;
+    /** Error if action failed */
+    error?: Error;
+}
+/**
+ * Zod schema for ActionRecord validation
+ */
+export declare const ActionRecordSchema: z.ZodObject<{
+    type: z.ZodString;
+    target: z.ZodObject<{
+        type: z.ZodString;
+        id: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    }, {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    }>;
+    params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    context: z.ZodObject<{
+        source: z.ZodString;
+        purpose: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }, {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    }>;
+} & {
+    id: z.ZodString;
+    startedAt: z.ZodDate;
+    completedAt: z.ZodOptional<z.ZodDate>;
+    result: z.ZodOptional<z.ZodObject<{
+        success: z.ZodBoolean;
+        data: z.ZodOptional<z.ZodUnknown>;
+        sideEffects: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodString;
+            target: z.ZodString;
+            description: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            target?: string;
+            description?: string;
+            type?: string;
+        }, {
+            target?: string;
+            description?: string;
+            type?: string;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        success?: boolean;
+        data?: unknown;
+        sideEffects?: {
+            target?: string;
+            description?: string;
+            type?: string;
+        }[];
+    }, {
+        success?: boolean;
+        data?: unknown;
+        sideEffects?: {
+            target?: string;
+            description?: string;
+            type?: string;
+        }[];
+    }>>;
+    error: z.ZodOptional<z.ZodType<Error, z.ZodTypeDef, Error>>;
+}, "strip", z.ZodTypeAny, {
+    error?: Error;
+    target?: {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    };
+    id?: string;
+    params?: Record<string, unknown>;
+    type?: string;
+    result?: {
+        success?: boolean;
+        data?: unknown;
+        sideEffects?: {
+            target?: string;
+            description?: string;
+            type?: string;
+        }[];
+    };
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+    startedAt?: Date;
+    completedAt?: Date;
+}, {
+    error?: Error;
+    target?: {
+        id?: string;
+        type?: string;
+        metadata?: Record<string, unknown>;
+    };
+    id?: string;
+    params?: Record<string, unknown>;
+    type?: string;
+    result?: {
+        success?: boolean;
+        data?: unknown;
+        sideEffects?: {
+            target?: string;
+            description?: string;
+            type?: string;
+        }[];
+    };
+    context?: {
+        metadata?: Record<string, unknown>;
+        source?: string;
+        resource?: string;
+        purpose?: string;
+    };
+    startedAt?: Date;
+    completedAt?: Date;
+}>;
+/**
+ * Result of a capability pre-check hook
+ */
+export interface PreCheckResult {
+    /** Whether to allow the capability request */
+    allow: boolean;
+    /** Reason for decision */
+    reason?: string;
+    /** Additional constraints to apply if allowed */
+    constraints?: Constraint[];
+}
+/**
+ * Zod schema for PreCheckResult validation
+ */
+export declare const PreCheckResultSchema: z.ZodObject<{
+    allow: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+    constraints: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["rate_limit", "time_window", "resource", "approval", "custom"]>;
+        params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    allow?: boolean;
+    reason?: string;
+    constraints?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }[];
+}, {
+    allow?: boolean;
+    reason?: string;
+    constraints?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "resource" | "approval" | "rate_limit" | "time_window";
+    }[];
+}>;
+/**
+ * Modification to apply to an action
+ */
+export interface ActionModification {
+    /** Field being modified */
+    field: string;
+    /** Original value */
+    original: unknown;
+    /** Modified value */
+    modified: unknown;
+    /** Reason for modification */
+    reason: string;
+}
+/**
+ * Zod schema for ActionModification validation
+ */
+export declare const ActionModificationSchema: z.ZodObject<{
+    field: z.ZodString;
+    original: z.ZodUnknown;
+    modified: z.ZodUnknown;
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    field?: string;
+    modified?: unknown;
+    original?: unknown;
+}, {
+    reason?: string;
+    field?: string;
+    modified?: unknown;
+    original?: unknown;
+}>;
+/**
+ * Approval requirement for an action
+ */
+export interface ApprovalRequirement {
+    /** Type of approver needed */
+    type: 'human' | 'system' | 'manager';
+    /** Specific approver identifier */
+    approver?: string;
+    /** Timeout in milliseconds */
+    timeout?: number;
+}
+/**
+ * Zod schema for ApprovalRequirement validation
+ */
+export declare const ApprovalRequirementSchema: z.ZodObject<{
+    type: z.ZodEnum<["human", "system", "manager"]>;
+    approver: z.ZodOptional<z.ZodString>;
+    timeout: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    timeout?: number;
+    type?: "system" | "human" | "manager";
+    approver?: string;
+}, {
+    timeout?: number;
+    type?: "system" | "human" | "manager";
+    approver?: string;
+}>;
+/**
+ * Result of a pre-action hook
+ */
+export interface PreActionResult {
+    /** Whether to proceed with the action */
+    proceed: boolean;
+    /** Reason for decision */
+    reason?: string;
+    /** Modifications to apply to the action */
+    modifications?: ActionModification[];
+    /** Required approvals before proceeding */
+    requiredApprovals?: ApprovalRequirement[];
+}
+/**
+ * Zod schema for PreActionResult validation
+ */
+export declare const PreActionResultSchema: z.ZodObject<{
+    proceed: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodString>;
+    modifications: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        field: z.ZodString;
+        original: z.ZodUnknown;
+        modified: z.ZodUnknown;
+        reason: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        reason?: string;
+        field?: string;
+        modified?: unknown;
+        original?: unknown;
+    }, {
+        reason?: string;
+        field?: string;
+        modified?: unknown;
+        original?: unknown;
+    }>, "many">>;
+    requiredApprovals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["human", "system", "manager"]>;
+        approver: z.ZodOptional<z.ZodString>;
+        timeout: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        timeout?: number;
+        type?: "system" | "human" | "manager";
+        approver?: string;
+    }, {
+        timeout?: number;
+        type?: "system" | "human" | "manager";
+        approver?: string;
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    requiredApprovals?: {
+        timeout?: number;
+        type?: "system" | "human" | "manager";
+        approver?: string;
+    }[];
+    proceed?: boolean;
+    modifications?: {
+        reason?: string;
+        field?: string;
+        modified?: unknown;
+        original?: unknown;
+    }[];
+}, {
+    reason?: string;
+    requiredApprovals?: {
+        timeout?: number;
+        type?: "system" | "human" | "manager";
+        approver?: string;
+    }[];
+    proceed?: boolean;
+    modifications?: {
+        reason?: string;
+        field?: string;
+        modified?: unknown;
+        original?: unknown;
+    }[];
+}>;
+/**
+ * Decision on capability expiry
+ */
+export interface ExpiryDecision {
+    /** Action to take on expiry */
+    action: 'renew' | 'expire' | 'revoke';
+    /** New TTL in seconds if renewing */
+    newTtl?: number;
+    /** Reason for decision */
+    reason?: string;
+}
+/**
+ * Zod schema for ExpiryDecision validation
+ */
+export declare const ExpiryDecisionSchema: z.ZodObject<{
+    action: z.ZodEnum<["renew", "expire", "revoke"]>;
+    newTtl: z.ZodOptional<z.ZodNumber>;
+    reason: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    action?: "revoke" | "expire" | "renew";
+    reason?: string;
+    newTtl?: number;
+}, {
+    action?: "revoke" | "expire" | "renew";
+    reason?: string;
+    newTtl?: number;
+}>;
+/**
+ * Response to an action failure
+ */
+export interface FailureResponse {
+    /** Whether to retry the action */
+    retry: boolean;
+    /** Delay before retry in milliseconds */
+    retryDelay?: number;
+    /** Maximum number of retries */
+    maxRetries?: number;
+    /** Fallback action to execute instead */
+    fallback?: ActionRequest;
+}
+/**
+ * Zod schema for FailureResponse validation
+ */
+export declare const FailureResponseSchema: z.ZodObject<{
+    retry: z.ZodBoolean;
+    retryDelay: z.ZodOptional<z.ZodNumber>;
+    maxRetries: z.ZodOptional<z.ZodNumber>;
+    fallback: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        target: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        }, {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        }>;
+        params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        context: z.ZodObject<{
+            source: z.ZodString;
+            purpose: z.ZodOptional<z.ZodString>;
+            resource: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    }, {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    maxRetries?: number;
+    retry?: boolean;
+    retryDelay?: number;
+    fallback?: {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    };
+}, {
+    maxRetries?: number;
+    retry?: boolean;
+    retryDelay?: number;
+    fallback?: {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    };
+}>;
+/**
+ * Behavioral metrics collected for an agent
+ */
+export interface BehaviorMetrics {
+    /** Observation window start */
+    windowStart: Date;
+    /** Observation window end */
+    windowEnd: Date;
+    /** Total request count in window */
+    requestCount: number;
+    /** Error count in window */
+    errorCount: number;
+    /** Average response time in milliseconds */
+    avgResponseTime: number;
+    /** P99 response time in milliseconds */
+    p99ResponseTime: number;
+    /** Actions grouped by type */
+    actionsByType: Record<string, number>;
+    /** Domains accessed (bitmask values) */
+    domainsAccessed: number[];
+    /** Maximum capability level used */
+    maxLevelUsed: number;
+    /** Custom metrics */
+    custom?: Record<string, number>;
+}
+/**
+ * Zod schema for BehaviorMetrics validation
+ */
+export declare const BehaviorMetricsSchema: z.ZodObject<{
+    windowStart: z.ZodDate;
+    windowEnd: z.ZodDate;
+    requestCount: z.ZodNumber;
+    errorCount: z.ZodNumber;
+    avgResponseTime: z.ZodNumber;
+    p99ResponseTime: z.ZodNumber;
+    actionsByType: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    domainsAccessed: z.ZodArray<z.ZodNumber, "many">;
+    maxLevelUsed: z.ZodNumber;
+    custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+}, "strip", z.ZodTypeAny, {
+    custom?: Record<string, number>;
+    errorCount?: number;
+    windowStart?: Date;
+    windowEnd?: Date;
+    requestCount?: number;
+    avgResponseTime?: number;
+    p99ResponseTime?: number;
+    actionsByType?: Record<string, number>;
+    domainsAccessed?: number[];
+    maxLevelUsed?: number;
+}, {
+    custom?: Record<string, number>;
+    errorCount?: number;
+    windowStart?: Date;
+    windowEnd?: Date;
+    requestCount?: number;
+    avgResponseTime?: number;
+    p99ResponseTime?: number;
+    actionsByType?: Record<string, number>;
+    domainsAccessed?: number[];
+    maxLevelUsed?: number;
+}>;
+/**
+ * Result of behavioral verification
+ */
+export interface BehaviorVerificationResult {
+    /** Whether behavior is within certified bounds */
+    inBounds: boolean;
+    /** Drift score (0-100, higher means more drift) */
+    driftScore: number;
+    /** Categories of detected drift */
+    driftCategories: string[];
+    /** Recommended action */
+    recommendation: 'continue' | 'warn' | 'suspend' | 'revoke';
+    /** Additional details */
+    details?: string;
+}
+/**
+ * Zod schema for BehaviorVerificationResult validation
+ */
+export declare const BehaviorVerificationResultSchema: z.ZodObject<{
+    inBounds: z.ZodBoolean;
+    driftScore: z.ZodNumber;
+    driftCategories: z.ZodArray<z.ZodString, "many">;
+    recommendation: z.ZodEnum<["continue", "warn", "suspend", "revoke"]>;
+    details: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    details?: string;
+    recommendation?: "warn" | "revoke" | "suspend" | "continue";
+    inBounds?: boolean;
+    driftScore?: number;
+    driftCategories?: string[];
+}, {
+    details?: string;
+    recommendation?: "warn" | "revoke" | "suspend" | "continue";
+    inBounds?: boolean;
+    driftScore?: number;
+    driftCategories?: string[];
+}>;
+/**
+ * Metrics report from an agent
+ */
+export interface MetricsReport {
+    /** Report timestamp */
+    timestamp: Date;
+    /** Agent CAR string */
+    carId: string;
+    /** Collected metrics */
+    metrics: BehaviorMetrics;
+    /** Overall health status */
+    health: 'healthy' | 'degraded' | 'unhealthy';
+}
+/**
+ * Zod schema for MetricsReport validation
+ */
+export declare const MetricsReportSchema: z.ZodObject<{
+    timestamp: z.ZodDate;
+    carId: z.ZodString;
+    metrics: z.ZodObject<{
+        windowStart: z.ZodDate;
+        windowEnd: z.ZodDate;
+        requestCount: z.ZodNumber;
+        errorCount: z.ZodNumber;
+        avgResponseTime: z.ZodNumber;
+        p99ResponseTime: z.ZodNumber;
+        actionsByType: z.ZodRecord<z.ZodString, z.ZodNumber>;
+        domainsAccessed: z.ZodArray<z.ZodNumber, "many">;
+        maxLevelUsed: z.ZodNumber;
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: Record<string, number>;
+        errorCount?: number;
+        windowStart?: Date;
+        windowEnd?: Date;
+        requestCount?: number;
+        avgResponseTime?: number;
+        p99ResponseTime?: number;
+        actionsByType?: Record<string, number>;
+        domainsAccessed?: number[];
+        maxLevelUsed?: number;
+    }, {
+        custom?: Record<string, number>;
+        errorCount?: number;
+        windowStart?: Date;
+        windowEnd?: Date;
+        requestCount?: number;
+        avgResponseTime?: number;
+        p99ResponseTime?: number;
+        actionsByType?: Record<string, number>;
+        domainsAccessed?: number[];
+        maxLevelUsed?: number;
+    }>;
+    health: z.ZodEnum<["healthy", "degraded", "unhealthy"]>;
+}, "strip", z.ZodTypeAny, {
+    health?: "healthy" | "unhealthy" | "degraded";
+    timestamp?: Date;
+    carId?: string;
+    metrics?: {
+        custom?: Record<string, number>;
+        errorCount?: number;
+        windowStart?: Date;
+        windowEnd?: Date;
+        requestCount?: number;
+        avgResponseTime?: number;
+        p99ResponseTime?: number;
+        actionsByType?: Record<string, number>;
+        domainsAccessed?: number[];
+        maxLevelUsed?: number;
+    };
+}, {
+    health?: "healthy" | "unhealthy" | "degraded";
+    timestamp?: Date;
+    carId?: string;
+    metrics?: {
+        custom?: Record<string, number>;
+        errorCount?: number;
+        windowStart?: Date;
+        windowEnd?: Date;
+        requestCount?: number;
+        avgResponseTime?: number;
+        p99ResponseTime?: number;
+        actionsByType?: Record<string, number>;
+        domainsAccessed?: number[];
+        maxLevelUsed?: number;
+    };
+}>;
+/**
+ * Report of an anomaly detected in agent behavior
+ */
+export interface AnomalyReport {
+    /** Anomaly ID */
+    id: string;
+    /** Detection timestamp */
+    detectedAt: Date;
+    /** Anomaly type */
+    type: 'behavior' | 'security' | 'performance' | 'compliance';
+    /** Severity level */
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    /** Human-readable description */
+    description: string;
+    /** Evidence supporting the anomaly detection */
+    evidence: Record<string, unknown>;
+}
+/**
+ * Zod schema for AnomalyReport validation
+ */
+export declare const AnomalyReportSchema: z.ZodObject<{
+    id: z.ZodString;
+    detectedAt: z.ZodDate;
+    type: z.ZodEnum<["behavior", "security", "performance", "compliance"]>;
+    severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    description: z.ZodString;
+    evidence: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    description?: string;
+    type?: "security" | "compliance" | "behavior" | "performance";
+    severity?: "critical" | "low" | "medium" | "high";
+    evidence?: Record<string, unknown>;
+    detectedAt?: Date;
+}, {
+    id?: string;
+    description?: string;
+    type?: "security" | "compliance" | "behavior" | "performance";
+    severity?: "critical" | "low" | "medium" | "high";
+    evidence?: Record<string, unknown>;
+    detectedAt?: Date;
+}>;
+/**
+ * Response to an anomaly
+ */
+export interface AnomalyResponse {
+    /** Action taken in response to anomaly */
+    action: 'ignore' | 'log' | 'alert' | 'suspend' | 'revoke';
+    /** Parties notified */
+    notified?: string[];
+    /** Whether the anomaly was escalated */
+    escalated?: boolean;
+}
+/**
+ * Zod schema for AnomalyResponse validation
+ */
+export declare const AnomalyResponseSchema: z.ZodObject<{
+    action: z.ZodEnum<["ignore", "log", "alert", "suspend", "revoke"]>;
+    notified: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    escalated: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    escalated?: boolean;
+    action?: "ignore" | "revoke" | "suspend" | "log" | "alert";
+    notified?: string[];
+}, {
+    escalated?: boolean;
+    action?: "ignore" | "revoke" | "suspend" | "log" | "alert";
+    notified?: string[];
+}>;
+/**
+ * Revocation event for an agent or capability
+ */
+export interface RevocationEvent {
+    /** Revocation ID */
+    id: string;
+    /** Revoked agent DID */
+    agentDid: string;
+    /** Revoked CAR string */
+    carId: string;
+    /** Revocation timestamp */
+    revokedAt: Date;
+    /** Reason for revocation */
+    reason: string;
+    /** Scope of revocation */
+    scope: 'full' | 'attestation' | 'capability';
+    /** Affected attestation IDs */
+    attestationIds?: string[];
+}
+/**
+ * Zod schema for RevocationEvent validation
+ */
+export declare const RevocationEventSchema: z.ZodObject<{
+    id: z.ZodString;
+    agentDid: z.ZodString;
+    carId: z.ZodString;
+    revokedAt: z.ZodDate;
+    reason: z.ZodString;
+    scope: z.ZodEnum<["full", "attestation", "capability"]>;
+    attestationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    reason?: string;
+    id?: string;
+    revokedAt?: Date;
+    carId?: string;
+    agentDid?: string;
+    scope?: "full" | "capability" | "attestation";
+    attestationIds?: string[];
+}, {
+    reason?: string;
+    id?: string;
+    revokedAt?: Date;
+    carId?: string;
+    agentDid?: string;
+    scope?: "full" | "capability" | "attestation";
+    attestationIds?: string[];
+}>;
+/**
+ * Trust adjustment request
+ */
+export interface TrustAdjustment {
+    /** Type of adjustment */
+    type: 'increment' | 'decrement' | 'set';
+    /** Amount for increment/decrement */
+    amount?: number;
+    /** Target value for set */
+    value?: number;
+    /** Reason for adjustment */
+    reason: string;
+    /** Evidence supporting adjustment */
+    evidence?: string;
+}
+/**
+ * Zod schema for TrustAdjustment validation
+ */
+export declare const TrustAdjustmentSchema: z.ZodObject<{
+    type: z.ZodEnum<["increment", "decrement", "set"]>;
+    amount: z.ZodOptional<z.ZodNumber>;
+    value: z.ZodOptional<z.ZodNumber>;
+    reason: z.ZodString;
+    evidence: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    value?: number;
+    reason?: string;
+    type?: "set" | "increment" | "decrement";
+    evidence?: string;
+    amount?: number;
+}, {
+    value?: number;
+    reason?: string;
+    type?: "set" | "increment" | "decrement";
+    evidence?: string;
+    amount?: number;
+}>;
+/**
+ * Result of a trust adjustment
+ */
+export interface TrustAdjustmentResult {
+    /** Previous trust score */
+    previousScore: number;
+    /** New trust score */
+    newScore: number;
+    /** Previous trust tier */
+    previousTier: TrustTier;
+    /** New trust tier */
+    newTier: TrustTier;
+    /** Whether tier changed */
+    tierChanged: boolean;
+}
+/**
+ * Zod schema for TrustAdjustmentResult validation
+ */
+export declare const TrustAdjustmentResultSchema: z.ZodObject<{
+    previousScore: z.ZodNumber;
+    newScore: z.ZodNumber;
+    previousTier: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>, z.ZodLiteral<7>]>;
+    newTier: z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>, z.ZodLiteral<7>]>;
+    tierChanged: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    previousScore?: number;
+    newScore?: number;
+    previousTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    newTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    tierChanged?: boolean;
+}, {
+    previousScore?: number;
+    newScore?: number;
+    previousTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    newTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    tierChanged?: boolean;
+}>;
+/**
+ * Result of attestation verification
+ */
+export interface AttestationVerificationResult {
+    /** Whether attestation is valid */
+    valid: boolean;
+    /** Verification errors */
+    errors: string[];
+    /** Verification warnings */
+    warnings: string[];
+    /** Whether issuer was verified */
+    issuerVerified: boolean;
+    /** Whether signature was verified */
+    signatureVerified: boolean;
+    /** Whether attestation is not expired */
+    notExpired: boolean;
+    /** Whether attestation is not revoked */
+    notRevoked: boolean;
+}
+/**
+ * Zod schema for AttestationVerificationResult validation
+ */
+export declare const AttestationVerificationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodString, "many">;
+    warnings: z.ZodArray<z.ZodString, "many">;
+    issuerVerified: z.ZodBoolean;
+    signatureVerified: z.ZodBoolean;
+    notExpired: z.ZodBoolean;
+    notRevoked: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    errors?: string[];
+    warnings?: string[];
+    signatureVerified?: boolean;
+    issuerVerified?: boolean;
+    notExpired?: boolean;
+    notRevoked?: boolean;
+}, {
+    valid?: boolean;
+    errors?: string[];
+    warnings?: string[];
+    signatureVerified?: boolean;
+    issuerVerified?: boolean;
+    notExpired?: boolean;
+    notRevoked?: boolean;
+}>;
+/**
+ * Environment context for policy evaluation
+ */
+export interface EnvironmentContext {
+    /** Source IP address */
+    sourceIp?: string;
+    /** Geographic location */
+    geoLocation?: string;
+    /** Time of day (HH:MM format) */
+    timeOfDay: string;
+    /** Day of week */
+    dayOfWeek: string;
+    /** Whether request is during business hours */
+    isBusinessHours: boolean;
+    /** Custom context values */
+    custom?: Record<string, unknown>;
+}
+/**
+ * Zod schema for EnvironmentContext validation
+ */
+export declare const EnvironmentContextSchema: z.ZodObject<{
+    sourceIp: z.ZodOptional<z.ZodString>;
+    geoLocation: z.ZodOptional<z.ZodString>;
+    timeOfDay: z.ZodString;
+    dayOfWeek: z.ZodString;
+    isBusinessHours: z.ZodBoolean;
+    custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    custom?: Record<string, unknown>;
+    dayOfWeek?: string;
+    sourceIp?: string;
+    geoLocation?: string;
+    timeOfDay?: string;
+    isBusinessHours?: boolean;
+}, {
+    custom?: Record<string, unknown>;
+    dayOfWeek?: string;
+    sourceIp?: string;
+    geoLocation?: string;
+    timeOfDay?: string;
+    isBusinessHours?: boolean;
+}>;
+/**
+ * Context for policy evaluation
+ */
+export interface PolicyContext {
+    /** Agent identity */
+    agent: AgentIdentity;
+    /** Action being evaluated (if action-based) */
+    action?: ActionRequest;
+    /** Capability being requested (if capability-based) */
+    capability?: CapabilityRequest;
+    /** Environment context */
+    environment: EnvironmentContext;
+    /** Request timestamp */
+    timestamp: Date;
+}
+/**
+ * Zod schema for PolicyContext validation
+ */
+export declare const PolicyContextSchema: z.ZodObject<{
+    agent: z.ZodObject<{
+        did: z.ZodString;
+        carId: z.ZodString;
+        publisher: z.ZodString;
+        name: z.ZodString;
+        trustTier: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<0>, z.ZodLiteral<1>, z.ZodLiteral<2>, z.ZodLiteral<3>, z.ZodLiteral<4>, z.ZodLiteral<5>, z.ZodLiteral<6>, z.ZodLiteral<7>]>>;
+        trustScore: z.ZodOptional<z.ZodNumber>;
+        domains: z.ZodNumber;
+        level: z.ZodNumber;
+        version: z.ZodString;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        version?: string;
+        level?: number;
+        name?: string;
+        metadata?: Record<string, unknown>;
+        trustScore?: number;
+        carId?: string;
+        trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+        did?: string;
+        domains?: number;
+        publisher?: string;
+    }, {
+        version?: string;
+        level?: number;
+        name?: string;
+        metadata?: Record<string, unknown>;
+        trustScore?: number;
+        carId?: string;
+        trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+        did?: string;
+        domains?: number;
+        publisher?: string;
+    }>;
+    action: z.ZodOptional<z.ZodObject<{
+        type: z.ZodString;
+        target: z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        }, {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        }>;
+        params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        context: z.ZodObject<{
+            source: z.ZodString;
+            purpose: z.ZodOptional<z.ZodString>;
+            resource: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    }, {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    }>>;
+    capability: z.ZodOptional<z.ZodObject<{
+        domains: z.ZodArray<z.ZodString, "many">;
+        level: z.ZodNumber;
+        context: z.ZodObject<{
+            source: z.ZodString;
+            purpose: z.ZodOptional<z.ZodString>;
+            resource: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strip", z.ZodTypeAny, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }, {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        }>;
+        ttl: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        level?: number;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+        ttl?: number;
+        domains?: string[];
+    }, {
+        level?: number;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+        ttl?: number;
+        domains?: string[];
+    }>>;
+    environment: z.ZodObject<{
+        sourceIp: z.ZodOptional<z.ZodString>;
+        geoLocation: z.ZodOptional<z.ZodString>;
+        timeOfDay: z.ZodString;
+        dayOfWeek: z.ZodString;
+        isBusinessHours: z.ZodBoolean;
+        custom: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, "strip", z.ZodTypeAny, {
+        custom?: Record<string, unknown>;
+        dayOfWeek?: string;
+        sourceIp?: string;
+        geoLocation?: string;
+        timeOfDay?: string;
+        isBusinessHours?: boolean;
+    }, {
+        custom?: Record<string, unknown>;
+        dayOfWeek?: string;
+        sourceIp?: string;
+        geoLocation?: string;
+        timeOfDay?: string;
+        isBusinessHours?: boolean;
+    }>;
+    timestamp: z.ZodDate;
+}, "strip", z.ZodTypeAny, {
+    agent?: {
+        version?: string;
+        level?: number;
+        name?: string;
+        metadata?: Record<string, unknown>;
+        trustScore?: number;
+        carId?: string;
+        trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+        did?: string;
+        domains?: number;
+        publisher?: string;
+    };
+    action?: {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    };
+    environment?: {
+        custom?: Record<string, unknown>;
+        dayOfWeek?: string;
+        sourceIp?: string;
+        geoLocation?: string;
+        timeOfDay?: string;
+        isBusinessHours?: boolean;
+    };
+    timestamp?: Date;
+    capability?: {
+        level?: number;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+        ttl?: number;
+        domains?: string[];
+    };
+}, {
+    agent?: {
+        version?: string;
+        level?: number;
+        name?: string;
+        metadata?: Record<string, unknown>;
+        trustScore?: number;
+        carId?: string;
+        trustTier?: 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7;
+        did?: string;
+        domains?: number;
+        publisher?: string;
+    };
+    action?: {
+        target?: {
+            id?: string;
+            type?: string;
+            metadata?: Record<string, unknown>;
+        };
+        params?: Record<string, unknown>;
+        type?: string;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+    };
+    environment?: {
+        custom?: Record<string, unknown>;
+        dayOfWeek?: string;
+        sourceIp?: string;
+        geoLocation?: string;
+        timeOfDay?: string;
+        isBusinessHours?: boolean;
+    };
+    timestamp?: Date;
+    capability?: {
+        level?: number;
+        context?: {
+            metadata?: Record<string, unknown>;
+            source?: string;
+            resource?: string;
+            purpose?: string;
+        };
+        ttl?: number;
+        domains?: string[];
+    };
+}>;
+/**
+ * Evidence from a policy match
+ */
+export interface PolicyEvidence {
+    /** ID of the policy that matched */
+    policyId: string;
+    /** ID of the rule that matched */
+    ruleId: string;
+    /** Match details */
+    details: string;
+}
+/**
+ * Zod schema for PolicyEvidence validation
+ */
+export declare const PolicyEvidenceSchema: z.ZodObject<{
+    policyId: z.ZodString;
+    ruleId: z.ZodString;
+    details: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    ruleId?: string;
+    details?: string;
+    policyId?: string;
+}, {
+    ruleId?: string;
+    details?: string;
+    policyId?: string;
+}>;
+/**
+ * Obligation that must be fulfilled as part of policy decision
+ */
+export interface PolicyObligation {
+    /** Obligation type */
+    type: 'log' | 'notify' | 'audit' | 'custom';
+    /** Obligation parameters */
+    params: Record<string, unknown>;
+}
+/**
+ * Zod schema for PolicyObligation validation
+ */
+export declare const PolicyObligationSchema: z.ZodObject<{
+    type: z.ZodEnum<["log", "notify", "audit", "custom"]>;
+    params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    params?: Record<string, unknown>;
+    type?: "custom" | "audit" | "log" | "notify";
+}, {
+    params?: Record<string, unknown>;
+    type?: "custom" | "audit" | "log" | "notify";
+}>;
+/**
+ * Decision from policy evaluation
+ */
+export interface PolicyDecision {
+    /** Decision outcome */
+    decision: 'allow' | 'deny' | 'require_approval';
+    /** Reasons for the decision */
+    reasons: string[];
+    /** Evidence supporting the decision */
+    evidence?: PolicyEvidence[];
+    /** Obligations that must be fulfilled */
+    obligations?: PolicyObligation[];
+}
+/**
+ * Zod schema for PolicyDecision validation
+ */
+export declare const PolicyDecisionSchema: z.ZodObject<{
+    decision: z.ZodEnum<["allow", "deny", "require_approval"]>;
+    reasons: z.ZodArray<z.ZodString, "many">;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        policyId: z.ZodString;
+        ruleId: z.ZodString;
+        details: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        ruleId?: string;
+        details?: string;
+        policyId?: string;
+    }, {
+        ruleId?: string;
+        details?: string;
+        policyId?: string;
+    }>, "many">>;
+    obligations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["log", "notify", "audit", "custom"]>;
+        params: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, "strip", z.ZodTypeAny, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "audit" | "log" | "notify";
+    }, {
+        params?: Record<string, unknown>;
+        type?: "custom" | "audit" | "log" | "notify";
+    }>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    decision?: "allow" | "deny" | "require_approval";
+    evidence?: {
+        ruleId?: string;
+        details?: string;
+        policyId?: string;
+    }[];
+    reasons?: string[];
+    obligations?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "audit" | "log" | "notify";
+    }[];
+}, {
+    decision?: "allow" | "deny" | "require_approval";
+    evidence?: {
+        ruleId?: string;
+        details?: string;
+        policyId?: string;
+    }[];
+    reasons?: string[];
+    obligations?: {
+        params?: Record<string, unknown>;
+        type?: "custom" | "audit" | "log" | "notify";
+    }[];
+}>;
+/**
+ * Source for loading policy definitions
+ */
+export interface PolicySource {
+    /** Source type */
+    type: 'file' | 'url' | 'inline';
+    /** Source location or content */
+    location: string;
+    /** Policy format */
+    format: 'rego' | 'json' | 'yaml';
+}
+/**
+ * Zod schema for PolicySource validation
+ */
+export declare const PolicySourceSchema: z.ZodObject<{
+    type: z.ZodEnum<["file", "url", "inline"]>;
+    location: z.ZodString;
+    format: z.ZodEnum<["rego", "json", "yaml"]>;
+}, "strip", z.ZodTypeAny, {
+    type?: "url" | "file" | "inline";
+    location?: string;
+    format?: "json" | "rego" | "yaml";
+}, {
+    type?: "url" | "file" | "inline";
+    location?: string;
+    format?: "json" | "rego" | "yaml";
+}>;
+/**
+ * Lifecycle hooks for extension load/unload
+ */
+export interface LifecycleHooks {
+    /** Called when extension is loaded */
+    onLoad?: () => Promise<void>;
+    /** Called when extension is unloaded */
+    onUnload?: () => Promise<void>;
+}
+/**
+ * Capability-related hooks
+ */
+export interface CapabilityHooks {
+    /** Called before capability check */
+    preCheck?: (agent: AgentIdentity, request: CapabilityRequest) => Promise<PreCheckResult>;
+    /** Called after capability is granted */
+    postGrant?: (agent: AgentIdentity, grant: CapabilityGrant) => Promise<CapabilityGrant>;
+    /** Called when capability is about to expire */
+    onExpiry?: (agent: AgentIdentity, grant: CapabilityGrant) => Promise<ExpiryDecision>;
+}
+/**
+ * Action-related hooks
+ */
+export interface ActionHooks {
+    /** Called before action execution */
+    preAction?: (agent: AgentIdentity, action: ActionRequest) => Promise<PreActionResult>;
+    /** Called after action execution */
+    postAction?: (agent: AgentIdentity, action: ActionRecord) => Promise<void>;
+    /** Called on action failure */
+    onFailure?: (agent: AgentIdentity, action: ActionRecord, error: Error) => Promise<FailureResponse>;
+}
+/**
+ * Monitoring-related hooks
+ */
+export interface MonitoringHooks {
+    /** Verify agent behavior against baseline */
+    verifyBehavior?: (agent: AgentIdentity, metrics: BehaviorMetrics) => Promise<BehaviorVerificationResult>;
+    /** Collect metrics from agent */
+    collectMetrics?: (agent: AgentIdentity) => Promise<MetricsReport>;
+    /** Handle detected anomaly */
+    onAnomaly?: (agent: AgentIdentity, anomaly: AnomalyReport) => Promise<AnomalyResponse>;
+}
+/**
+ * Trust-related hooks
+ */
+export interface TrustHooks {
+    /** Handle revocation event */
+    onRevocation?: (revocation: RevocationEvent) => Promise<void>;
+    /** Adjust trust score */
+    adjustTrust?: (agent: AgentIdentity, adjustment: TrustAdjustment) => Promise<TrustAdjustmentResult>;
+    /** Verify attestation */
+    verifyAttestation?: (attestation: Attestation) => Promise<AttestationVerificationResult>;
+}
+/**
+ * Policy engine interface
+ */
+export interface PolicyEngine {
+    /** Evaluate policy for context */
+    evaluate: (context: PolicyContext) => Promise<PolicyDecision>;
+    /** Load policy from source */
+    loadPolicy?: (source: PolicySource) => Promise<void>;
+}
+/**
+ * CAR Extension Protocol Interface
+ *
+ * Implement this interface to create a Layer 4 extension that provides
+ * runtime assurance capabilities such as governance, monitoring, and
+ * policy enforcement.
+ */
+export interface CARExtension {
+    /** Unique extension identifier (format: car-ext-{name}-v{version}) */
+    extensionId: string;
+    /** Human-readable name */
+    name: string;
+    /** Semantic version */
+    version: string;
+    /** Short code for CAR strings (e.g., "gov", "audit") */
+    shortcode: string;
+    /** Publisher DID */
+    publisher: string;
+    /** Extension description */
+    description: string;
+    /** Required CAR core version (semver range) */
+    requiredCARVersion: string;
+    /** Lifecycle hooks */
+    hooks?: LifecycleHooks;
+    /** Capability hooks */
+    capability?: CapabilityHooks;
+    /** Action hooks */
+    action?: ActionHooks;
+    /** Monitoring hooks */
+    monitoring?: MonitoringHooks;
+    /** Trust hooks */
+    trust?: TrustHooks;
+    /** Policy engine (optional) */
+    policy?: PolicyEngine;
+}
+/**
+ * Zod schema for CARExtension validation (metadata only)
+ */
+export declare const CARExtensionMetadataSchema: z.ZodObject<{
+    extensionId: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    shortcode: z.ZodString;
+    publisher: z.ZodString;
+    description: z.ZodString;
+    requiredCARVersion: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    version?: string;
+    name?: string;
+    description?: string;
+    publisher?: string;
+    extensionId?: string;
+    shortcode?: string;
+    requiredCARVersion?: string;
+}, {
+    version?: string;
+    name?: string;
+    description?: string;
+    publisher?: string;
+    extensionId?: string;
+    shortcode?: string;
+    requiredCARVersion?: string;
+}>;
+/**
+ * Aggregated result from multiple pre-check hooks
+ */
+export interface AggregatedPreCheckResult {
+    /** Whether all extensions allowed the request */
+    allow: boolean;
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: PreCheckResult;
+    }>;
+    /** Combined constraints from all extensions */
+    constraints: Constraint[];
+    /** First denial reason if denied */
+    denialReason?: string;
+    /** Extension that denied if denied */
+    deniedBy?: string;
+}
+/**
+ * Aggregated result from multiple pre-action hooks
+ */
+export interface AggregatedPreActionResult {
+    /** Whether all extensions allow proceeding */
+    proceed: boolean;
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: PreActionResult;
+    }>;
+    /** Combined modifications from all extensions */
+    modifications: ActionModification[];
+    /** Combined approval requirements */
+    requiredApprovals: ApprovalRequirement[];
+    /** First blocking reason if blocked */
+    blockingReason?: string;
+    /** Extension that blocked if blocked */
+    blockedBy?: string;
+}
+/**
+ * Aggregated result from multiple failure handlers
+ */
+export interface AggregatedFailureResponse {
+    /** Whether any extension suggests retry */
+    retry: boolean;
+    /** Shortest suggested retry delay */
+    retryDelay?: number;
+    /** Minimum of max retries suggestions */
+    maxRetries?: number;
+    /** First suggested fallback */
+    fallback?: ActionRequest;
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: FailureResponse;
+    }>;
+}
+/**
+ * Aggregated result from multiple behavior verification hooks
+ */
+export interface AggregatedBehaviorResult {
+    /** Whether any extension found behavior out of bounds */
+    inBounds: boolean;
+    /** Maximum drift score across extensions */
+    maxDriftScore: number;
+    /** Combined drift categories */
+    driftCategories: string[];
+    /** Most severe recommendation */
+    recommendation: 'continue' | 'warn' | 'suspend' | 'revoke';
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: BehaviorVerificationResult;
+    }>;
+}
+/**
+ * Aggregated metrics from multiple extensions
+ */
+export interface AggregatedMetricsReport {
+    /** Collection timestamp */
+    timestamp: Date;
+    /** Reports from each extension */
+    reports: Array<{
+        extensionId: string;
+        report: MetricsReport;
+    }>;
+    /** Overall health (worst of all extensions) */
+    overallHealth: 'healthy' | 'degraded' | 'unhealthy';
+}
+/**
+ * Aggregated anomaly response from multiple extensions
+ */
+export interface AggregatedAnomalyResponse {
+    /** Most severe action taken */
+    action: 'ignore' | 'log' | 'alert' | 'suspend' | 'revoke';
+    /** All parties notified */
+    notified: string[];
+    /** Whether any extension escalated */
+    escalated: boolean;
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: AnomalyResponse;
+    }>;
+}
+/**
+ * Aggregated trust adjustment result
+ */
+export interface AggregatedTrustResult {
+    /** Final trust score after all adjustments */
+    finalScore: number;
+    /** Final trust tier */
+    finalTier: TrustTier;
+    /** Whether tier changed from any adjustment */
+    tierChanged: boolean;
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: TrustAdjustmentResult;
+    }>;
+}
+/**
+ * Aggregated policy decision from multiple extensions
+ */
+export interface AggregatedPolicyDecision {
+    /** Final decision (deny wins, then require_approval, then allow) */
+    decision: 'allow' | 'deny' | 'require_approval';
+    /** Combined reasons from all extensions */
+    reasons: string[];
+    /** Combined evidence from all extensions */
+    evidence: PolicyEvidence[];
+    /** Combined obligations from all extensions */
+    obligations: PolicyObligation[];
+    /** Results from each extension */
+    results: Array<{
+        extensionId: string;
+        result: PolicyDecision;
+    }>;
+}
+/**
+ * Information about a registered extension
+ */
+export interface ExtensionInfo {
+    /** Extension ID */
+    extensionId: string;
+    /** Extension name */
+    name: string;
+    /** Extension version */
+    version: string;
+    /** Extension shortcode */
+    shortcode: string;
+    /** Publisher DID */
+    publisher: string;
+    /** Extension description */
+    description: string;
+    /** When the extension was registered */
+    registeredAt: Date;
+    /** Whether the extension is currently loaded */
+    loaded: boolean;
+    /** Available hooks */
+    hooks: string[];
+}
+/**
+ * Result of extension validation
+ */
+export interface ValidationResult {
+    /** Whether extension is valid */
+    valid: boolean;
+    /** Validation errors */
+    errors: string[];
+    /** Validation warnings */
+    warnings: string[];
+}
+/**
+ * Zod schema for ValidationResult
+ */
+export declare const ValidationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    errors: z.ZodArray<z.ZodString, "many">;
+    warnings: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    valid?: boolean;
+    errors?: string[];
+    warnings?: string[];
+}, {
+    valid?: boolean;
+    errors?: string[];
+    warnings?: string[];
+}>;
+/**
+ * Configuration for the extension service
+ */
+export interface ExtensionServiceConfig {
+    /** Default timeout for hook execution (ms) */
+    defaultTimeout?: number;
+    /** Whether to fail fast on first hook error */
+    failFast?: boolean;
+    /** Whether to log hook execution */
+    logExecution?: boolean;
+    /** Maximum concurrent hook executions */
+    maxConcurrency?: number;
+}
+/**
+ * Zod schema for ExtensionServiceConfig
+ */
+export declare const ExtensionServiceConfigSchema: z.ZodObject<{
+    defaultTimeout: z.ZodOptional<z.ZodNumber>;
+    failFast: z.ZodOptional<z.ZodBoolean>;
+    logExecution: z.ZodOptional<z.ZodBoolean>;
+    maxConcurrency: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    defaultTimeout?: number;
+    failFast?: boolean;
+    logExecution?: boolean;
+    maxConcurrency?: number;
+}, {
+    defaultTimeout?: number;
+    failFast?: boolean;
+    logExecution?: boolean;
+    maxConcurrency?: number;
+}>;
+/**
+ * Default timeouts for different hook types (in milliseconds)
+ */
+export declare const HOOK_TIMEOUTS: {
+    readonly preCheck: {
+        readonly default: 100;
+        readonly max: 500;
+    };
+    readonly postGrant: {
+        readonly default: 100;
+        readonly max: 500;
+    };
+    readonly onExpiry: {
+        readonly default: 100;
+        readonly max: 500;
+    };
+    readonly preAction: {
+        readonly default: 200;
+        readonly max: 1000;
+    };
+    readonly postAction: {
+        readonly default: 500;
+        readonly max: 2000;
+    };
+    readonly onFailure: {
+        readonly default: 200;
+        readonly max: 1000;
+    };
+    readonly verifyBehavior: {
+        readonly default: 5000;
+        readonly max: 30000;
+    };
+    readonly collectMetrics: {
+        readonly default: 5000;
+        readonly max: 30000;
+    };
+    readonly onAnomaly: {
+        readonly default: 1000;
+        readonly max: 5000;
+    };
+    readonly onRevocation: {
+        readonly default: 500;
+        readonly max: 2000;
+    };
+    readonly adjustTrust: {
+        readonly default: 200;
+        readonly max: 1000;
+    };
+    readonly verifyAttestation: {
+        readonly default: 500;
+        readonly max: 2000;
+    };
+    readonly evaluate: {
+        readonly default: 500;
+        readonly max: 2000;
+    };
+};
+/**
+ * Hook timeout type
+ */
+export type HookTimeout = keyof typeof HOOK_TIMEOUTS;
+//# sourceMappingURL=types.d.ts.map