@openagentid/arsenal-sdk

declare function addPolicyRule(doc: PolicyDocument, rule: PolicyRule): PolicyDocument;

declare class AgentCapabilityToken {
    readonly claims: TokenClaims;
    readonly signature: TokenSignature | undefined;
    static fromClaims(claims: TokenClaims): AgentCapabilityToken;
    static fromClaimsAndSignature(claims: TokenClaims, signature: TokenSignature): AgentCapabilityToken;
    get id(): string;
    get subject(): string;
    get audience(): string;
    get scopes(): ScopeSet;
    isExpired(now?: Date): boolean;
    isNotYetValid(now?: Date): boolean;
    isTimeValid(now?: Date): boolean;
    remainingTtlMs(now?: Date): number;
    isSigned(): boolean;
    validateStructure(now?: Date): void;
    toCbor(): Uint8Array;
    claimsToCbor(): Uint8Array;
    toBase64Url(): string;
    static fromCbor(bytes: Uint8Array): AgentCapabilityToken;
    static fromBase64Url(s: string): AgentCapabilityToken;
}

declare class AgentId {
    static fromUuid(uuid: string): AgentId;
    static generate(): AgentId;
    asUuid(): string;
    toString(): string;
    toJSON(): string;
    equals(other: AgentId): boolean;
}

declare class AgentIdentity {
    static create(tenantId: TenantId, name: string, publicKeyFingerprint: KeyFingerprint): AgentIdentity;
    get id(): AgentId;
    get publicKeyFingerprint(): KeyFingerprint;
    get tenantId(): TenantId;
    get name(): string;
    get isActive(): boolean;
    get tags(): readonly string[];
    isValid(now?: Date): boolean;
    deactivate(): AgentIdentity;
    withExpiresAt(expiresAt: Date): AgentIdentity;
    withTag(tag: string): AgentIdentity;
    toJSON(): {
        id: string;
        public_key_fingerprint: string;
        tenant_id: string;
        name: string;
        created_at: string;
        expires_at: string | null;
        is_active: boolean;
        tags: readonly string[];
    };
}

interface AgentIdentityData {
    id: AgentId;
    publicKeyFingerprint: KeyFingerprint;
    tenantId: TenantId;
    name: string;
    createdAt: string;
    expiresAt: string | null;
    isActive: boolean;
    tags: readonly string[];
}

declare function allowDelegation(depth: number): DelegationConstraints;

type ApiErrorResponse = z.infer<typeof ApiErrorResponseSchema>;

declare const ApiErrorResponseSchema: z.ZodObject<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    code: z.ZodNumber;
    message: z.ZodString;
    correlation_id: z.ZodOptional<z.ZodString>;
    retry_after: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">>;

declare class ArsenalClient {
    static create(opts: ArsenalClientConfig): ArsenalClient;
    get identity(): AgentIdentity;
    get broker(): BrokerClient | undefined;
    startSession(): Promise<string>;
    endSession(): Promise<void>;
    revokeSession(): Promise<void>;
    hasActiveSession(): boolean;
    sessionStats(): SessionStats;
    currentToken(): AgentCapabilityToken | undefined;
    requestCapability(request: CapabilityRequest): Promise<CapabilityHandle>;
    requestCapabilityForScopes(scopes: readonly string[], ttlSeconds: number): Promise<CapabilityHandle>;
    renewCurrentCapability(): Promise<CapabilityHandle>;
    proxyHttp(request: ProxyRequest): Promise<ProxyResponse>;
    callToolSimple(_toolId: string, _method: string, params: unknown, opts?: {
        scopes?: readonly string[];
        ttlSeconds?: number;
    }): Promise<unknown>;
    approveConsent(payload: ConsentApprovalPayload): Promise<ConsentRecordPayload>;
    denyConsent(payload: ConsentDenialPayload): Promise<void>;
    revokeConsent(payload: ConsentRevocationPayload): Promise<void>;
    listConsents(): Promise<readonly ConsentRecordPayload[]>;
    requestSecret(secretId: string, capabilityToken: string, version?: number): Promise<SecretResponsePayload>;
    verifyToken(tokenBase64: string): Promise<{
        valid: boolean;
        subject?: string;
        audience?: string;
        scopes?: string[];
    }>;
    revokeToken(tokenId: string, reason?: string): Promise<void>;
}

interface ArsenalClientConfig {
    identity: AgentIdentity;
    broker?: BrokerClientOptions;
    sessionConfig?: SessionConfig;
    autoRenew?: boolean;
    issuer?: string;
    defaultAudience?: string;
}

declare class ArsenalError extends Error {
    readonly name = "ArsenalError";
    readonly code: number;
    readonly correlationId: string | undefined;
    readonly context: ErrorContext | undefined;
    constructor(code: number, message: string, options?: {
        correlationId?: string;
        context?: ErrorContext;
        cause?: unknown;
    });
    toString(): string;
    toJSON(): {
        code: number;
        message: string;
        correlation_id?: string;
        context?: ErrorContext;
    };
    withCorrelationId(id: string): ArsenalError;
    withContext(context: ErrorContext): ArsenalError;
    static authenticationFailed(): ArsenalError;
    static tokenExpired(): ArsenalError;
    static tokenSignatureInvalid(): ArsenalError;
    static tokenRevoked(): ArsenalError;
    static scopeExceeded(): ArsenalError;
    static insufficientPermissions(requiredScope: string): ArsenalError;
    static policyDenied(policyId: string): ArsenalError;
    static rateLimitExceeded(retryAfterSecs?: number): ArsenalError;
    static secretNotFound(): ArsenalError;
    static validationFailed(field: string, reason: string): ArsenalError;
    static internal(): ArsenalError;
    static sessionExpired(): ArsenalError;
    static proxyDestinationViolation(domain: string): ArsenalError;
    static ssrfBlocked(): ArsenalError;
    static templateVariableNotFound(variable: string): ArsenalError;
    static invalidTemplateVariable(name: string): ArsenalError;
    static consentRequired(): ArsenalError;
    static consentDenied(): ArsenalError;
    static fingerprintMismatch(): ArsenalError;
    static configurationError(component: string): ArsenalError;
    static cryptoOperationFailed(): ArsenalError;
}

interface AuditEvent {
    id: string;
    timestamp: string;
    kind: AuditEventKindValue;
    severity: AuditSeverityValue;
    tenant_id: string;
    agent_id?: string;
    session_id?: string;
    token_id?: string;
    outcome: AuditOutcomeValue;
    description: string;
    metadata: Readonly<Record<string, unknown>>;
    client_ip?: string;
    user_agent?: string;
    request_id?: string;
    previous_hash?: Uint8Array;
    event_hash?: Uint8Array;
}

declare const AuditEventKind: {
    readonly AgentAuthenticated: "agent_authenticated";
    readonly AuthenticationFailed: "authentication_failed";
    readonly SessionStarted: "session_started";
    readonly SessionEnded: "session_ended";
    readonly CapabilityRequested: "capability_requested";
    readonly CapabilityGranted: "capability_granted";
    readonly CapabilityDenied: "capability_denied";
    readonly TokenRevoked: "token_revoked";
    readonly SecretRead: "secret_read";
    readonly SecretRotated: "secret_rotated";
    readonly ProxyRequest: "proxy_request";
    readonly ProxyDenied: "proxy_denied";
    readonly ConsentRequested: "consent_requested";
    readonly ConsentApproved: "consent_approved";
    readonly ConsentDenied: "consent_denied";
    readonly ConsentRevoked: "consent_revoked";
    readonly PolicyEvaluated: "policy_evaluated";
    readonly PolicyViolation: "policy_violation";
    readonly ConfigChanged: "config_changed";
    readonly KeyRotated: "key_rotated";
};

type AuditEventKindValue = (typeof AuditEventKind)[keyof typeof AuditEventKind];

declare const AuditOutcome: {
    readonly Success: "success";
    readonly Failure: "failure";
    readonly Partial: "partial";
    readonly Pending: "pending";
};

type AuditOutcomeValue = (typeof AuditOutcome)[keyof typeof AuditOutcome];

declare const AuditSeverity: {
    readonly Info: "info";
    readonly Warning: "warning";
    readonly Error: "error";
    readonly Critical: "critical";
};

type AuditSeverityValue = (typeof AuditSeverity)[keyof typeof AuditSeverity];

declare function base64Decode(s: string): Uint8Array;

declare function base64Encode(bytes: Uint8Array): string;

declare function base64UrlDecode(s: string): Uint8Array;

declare function base64UrlEncode(bytes: Uint8Array): string;

declare const BindingType: {
    readonly Required: "required";
    readonly Preferred: "preferred";
};

type BindingTypeValue = (typeof BindingType)[keyof typeof BindingType];

declare class BrokerClient {
    constructor(opts: BrokerClientOptions);
    health(): Promise<HealthResponse>;
    requestCapability(payload: CapabilityRequestPayload): Promise<CapabilityResponsePayload>;
    requestSecret(payload: SecretRequestPayload): Promise<SecretResponsePayload>;
    revokeToken(tokenId: string, reason?: string): Promise<RevokeTokenResponse>;
    verifyToken(token: string): Promise<VerifyTokenResponse>;
    proxyRequest(req: ProxyRequest, opts?: {
        fingerprintHex?: string;
    }): Promise<ProxyResponse>;
    approveConsent(payload: ConsentApprovalPayload): Promise<ConsentRecordPayload>;
    denyConsent(payload: ConsentDenialPayload): Promise<void>;
    revokeConsent(payload: ConsentRevocationPayload): Promise<void>;
    listConsents(agentDid: string): Promise<readonly ConsentRecordPayload[]>;
    static decodeCapabilityToken(response: CapabilityResponsePayload): AgentCapabilityToken;
}

interface BrokerClientOptions {
    baseUrl: string;
    timeoutMs?: number;
    defaultHeaders?: Record<string, string>;
    fetch?: typeof globalThis.fetch;
}

declare function buildTokenClaims(opts: TokenClaimsBuildOptions): TokenClaims;

declare function canDelegateTo(constraints: DelegationConstraints, agentId: string): boolean;

declare function canTransitionTo(from: SessionStateValue, to: SessionStateValue): boolean;

declare class CapabilityHandle {
    readonly token: AgentCapabilityToken;
    constructor(token: AgentCapabilityToken);
    get tokenId(): string;
    get audience(): string;
    scopes(): ScopeSet;
    isExpired(now?: Date): boolean;
    remainingTtlMs(now?: Date): number;
    encode(): string;
}

declare class CapabilityRequest {
    static create(): CapabilityRequest;
    scope(scope: string): CapabilityRequest;
    scopes(scopes: readonly string[]): CapabilityRequest;
    ttlSeconds(ttl: number): CapabilityRequest;
    audience(audience: string): CapabilityRequest;
    constraints(constraints: Constraints): CapabilityRequest;
    getScopes(): ScopeSet;
    getTtl(): number;
    getAudience(): string;
    getConstraints(): Constraints | undefined;
}

type CapabilityRequestPayload = z.infer<typeof CapabilityRequestPayloadSchema>;

declare const CapabilityRequestPayloadSchema: z.ZodObject<{
    scopes: z.ZodArray<z.ZodString, "many">;
    ttl_seconds: z.ZodOptional<z.ZodNumber>;
    audience: z.ZodString;
    constraints: z.ZodOptional<z.ZodObject<{
        require_pop: z.ZodBoolean;
        allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
        device_id: z.ZodOptional<z.ZodString>;
    }, "strict", z.ZodTypeAny, {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    }, {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    }>>;
    pop_key_fingerprint: z.ZodOptional<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    scopes: string[];
    audience: string;
    ttl_seconds?: number | undefined;
    constraints?: {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    } | undefined;
    pop_key_fingerprint?: string | undefined;
}, {
    scopes: string[];
    audience: string;
    ttl_seconds?: number | undefined;
    constraints?: {
        require_pop: boolean;
        device_id?: string | undefined;
        allowed_origins?: string[] | undefined;
    } | undefined;
    pop_key_fingerprint?: string | undefined;
}>;

type CapabilityResponsePayload = z.infer<typeof CapabilityResponsePayloadSchema>;

declare const CapabilityResponsePayloadSchema: z.ZodObject<{
    token_id: z.ZodString;
    token: z.ZodString;
    expires_at: z.ZodString;
    granted_scopes: z.ZodArray<z.ZodString, "many">;
}, "strict", z.ZodTypeAny, {
    token: string;
    token_id: string;
    expires_at: string;
    granted_scopes: string[];
}, {
    token: string;
    token_id: string;
    expires_at: string;
    granted_scopes: string[];
}>;

declare function compareOperator(operator: ConditionOperatorValue, actual: string, expected: string): boolean;

declare class CompositeRateLimiter {
    constructor(limits: RateLimits);
    acquire(): () => void;
}

declare const ConditionOperator: {
    readonly Equals: "equals";
    readonly NotEquals: "not_equals";
    readonly Contains: "contains";
    readonly StartsWith: "starts_with";
    readonly EndsWith: "ends_with";
    readonly Matches: "matches";
    readonly In: "in";
    readonly NotIn: "not_in";
};

type ConditionOperatorValue = (typeof ConditionOperator)[keyof typeof ConditionOperator];

type ConsentApprovalPayload = z.infer<typeof ConsentApprovalPayloadSchema>;

declare const ConsentApprovalPayloadSchema: z.ZodObject<{
    agent_did: z.ZodString;
    human_root_did: z.ZodString;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodArray<z.ZodString, "many">;
    scopes: z.ZodArray<z.ZodString, "many">;
    granted_by: z.ZodString;
    expires_in_seconds: z.ZodOptional<z.ZodNumber>;
    signature: z.ZodString;
}, "strict", z.ZodTypeAny, {
    signature: string;
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
    granted_by: string;
    expires_in_seconds?: number | undefined;
}, {
    signature: string;
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
    granted_by: string;
    expires_in_seconds?: number | undefined;
}>;

type ConsentDenialPayload = z.infer<typeof ConsentDenialPayloadSchema>;

declare const ConsentDenialPayloadSchema: z.ZodObject<{
    agent_did: z.ZodString;
    human_root_did: z.ZodString;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodArray<z.ZodString, "many">;
    scopes: z.ZodArray<z.ZodString, "many">;
}, "strict", z.ZodTypeAny, {
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
}, {
    variables: string[];
    destination_domains: string[];
    scopes: string[];
    agent_did: string;
    human_root_did: string;
}>;

declare const ConsentPolicy: {
    readonly PerVariable: "per_variable";
    readonly PerProvider: "per_provider";
    readonly PerAgent: "per_agent";
};

type ConsentPolicyValue = (typeof ConsentPolicy)[keyof typeof ConsentPolicy];

interface ConsentRecord {
    consent_id: string;
    tenant_id: string;
    agent_did: string;
    human_root_did: string;
    variables: readonly string[];
    destination_domains: readonly string[];
    scopes: readonly string[];
    granted_by: string;
    granted_at: string;
    expires_at: string;
    signature: Uint8Array;
    revocable: boolean;
    revoked: boolean;
    revoked_at?: string;
}

declare function consentRecordCoversDomain(record: ConsentRecord, domain: string): boolean;

declare function consentRecordCoversVariable(record: ConsentRecord, variable: string): boolean;

declare function consentRecordIsValid(record: ConsentRecord, now?: Date): boolean;

type ConsentRecordPayload = z.infer<typeof ConsentRecordPayloadSchema>;

declare const ConsentRecordPayloadSchema: z.ZodObject<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    consent_id: z.ZodString;
    agent_did: z.ZodString;
    human_root_did: z.ZodOptional<z.ZodString>;
    variables: z.ZodArray<z.ZodString, "many">;
    destination_domains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    granted_by: z.ZodOptional<z.ZodString>;
    granted_at: z.ZodString;
    expires_at: z.ZodString;
    revoked: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">>;

declare function consentRecordSigningBytes(record: ConsentRecord): Uint8Array;

interface ConsentRequest {
    request_id: string;
    agent_did: string;
    human_root_did: string;
    variables: readonly string[];
    destination_domains: readonly string[];
    scopes: readonly string[];
    created_at: string;
    expires_at: string;
}

declare function consentRequestIsExpired(req: ConsentRequest, now?: Date): boolean;

type ConsentRevocationPayload = z.infer<typeof ConsentRevocationPayloadSchema>;

declare const ConsentRevocationPayloadSchema: z.ZodObject<{
    consent_id: z.ZodString;
}, "strict", z.ZodTypeAny, {
    consent_id: string;
}, {
    consent_id: string;
}>;

declare const ConsentStatus: {
    readonly PreApproved: "pre_approved";
    readonly Approved: "approved";
    readonly Pending: "pending";
    readonly Denied: "denied";
    readonly Revoked: "revoked";
    readonly NotRequired: "not_required";
};

declare function consentStatusAllowsOperation(status: ConsentStatusValue): boolean;

type ConsentStatusValue = (typeof ConsentStatus)[keyof typeof ConsentStatus];

interface ConstraintContext {
    current_time: Date;
    device_id?: string;
    session_id?: string;
    session_key_hash?: Uint8Array;
    origin?: string;
    client_ip?: string;
    environment?: string;
    tags: ReadonlySet<string>;
}

interface Constraints {
    device_binding?: DeviceBinding;
    session_binding?: SessionBinding;
    origin_binding?: OriginBinding;
    network_constraints?: NetworkConstraints;
    time_constraints?: TimeConstraints;
    environment_constraints?: EnvironmentConstraint;
    require_pop: boolean;
}

type ConstraintsPayload = z.infer<typeof ConstraintsPayloadSchema>;

declare const ConstraintsPayloadSchema: z.ZodObject<{
    require_pop: z.ZodBoolean;
    allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    device_id: z.ZodOptional<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    require_pop: boolean;
    device_id?: string | undefined;
    allowed_origins?: string[] | undefined;
}, {
    require_pop: boolean;
    device_id?: string | undefined;
    allowed_origins?: string[] | undefined;
}>;

declare function contextNow(): ConstraintContext;

declare function createAuditEvent(opts: {
    kind: AuditEventKindValue;
    tenant_id: string;
    severity?: AuditSeverityValue;
    outcome?: AuditOutcomeValue;
    description?: string;
    metadata?: Record<string, unknown>;
    agent_id?: string;
    session_id?: string;
    token_id?: string;
    client_ip?: string;
    user_agent?: string;
    request_id?: string;
}): AuditEvent;

declare function createConsentRequest(opts: {
    agent_did: string;
    human_root_did: string;
    variables: readonly string[];
    destination_domains: readonly string[];
    scopes: readonly string[];
    ttl_seconds?: number;
}): ConsentRequest;

declare function createDestinationBinding(allowedDomains: readonly string[], opts?: Partial<Omit<DestinationBinding, "allowed_domains">>): DestinationBinding;

declare function createPolicyDocument(tenantId: string, name: string): PolicyDocument;

declare function createPolicyRequest(agentId: string, tenantId: string, requestedScope: string): PolicyRequest;

declare function createPolicyRule(id: string, effect: PolicyEffectValue, conditions?: readonly PolicyCondition[]): PolicyRule;

declare function createSecretMetadata(tenantId: string, name: string, secretType: SecretTypeValue): SecretMetadata;

declare function createTemplateVariable(name: string): TemplateVariable;

declare function decisionIsAllowed(d: PolicyDecision): boolean;

declare function decisionIsDenied(d: PolicyDecision): boolean;

declare function decodeCbor(bytes: Uint8Array): unknown;

declare function defaultRateLimits(): RateLimits;

declare function defaultSessionConfig(): SessionConfig;

declare function defaultUsageBudget(): UsageBudget;

interface DelegationConstraints {
    allow_delegation: boolean;
    max_depth: number;
    delegatable_scopes?: ScopeSet;
    allowed_delegates: readonly string[];
    allow_any_delegate: boolean;
    min_ttl_reduction: number;
    require_approval: boolean;
}

declare function denyDelegation(): DelegationConstraints;

declare function denyWith(reason: string): PolicyDecision;

interface DestinationBinding {
    allowed_domains: readonly string[];
    allowed_paths?: readonly string[];
    allowed_methods?: readonly string[];
    allowed_ports?: readonly number[];
    require_tls: boolean;
    allow_subdomains: boolean;
}

interface DeviceBinding {
    device_id: string;
    binding_type: BindingTypeValue;
}

declare class DeviceId {
    static parse(id: string): DeviceId;
    asString(): string;
    toString(): string;
    toJSON(): string;
}

declare function effectiveTimeoutMs(req: ProxyRequest): number;

declare function encodeCbor(value: unknown): Uint8Array;

interface EnvironmentConstraint {
    required_environment?: string;
    required_tags?: ReadonlySet<string>;
    forbidden_tags?: ReadonlySet<string>;
}

declare const ErrorCode: {
    readonly AuthenticationFailed: 1001;
    readonly TokenExpired: 1002;
    readonly TokenSignatureInvalid: 1003;
    readonly PopVerificationFailed: 1004;
    readonly IdentityInvalid: 1005;
    readonly SessionExpired: 1006;
    readonly InsufficientPermissions: 2001;
    readonly ScopeExceeded: 2002;
    readonly PolicyDenied: 2003;
    readonly DelegationInvalid: 2004;
    readonly RateLimitExceeded: 2005;
    readonly BudgetExhausted: 2006;
    readonly TimeConstraintViolation: 3001;
    readonly EnvironmentBindingViolation: 3002;
    readonly NetworkConstraintViolation: 3003;
    readonly DeviceBindingViolation: 3004;
    readonly OriginBindingViolation: 3005;
    readonly SecretNotFound: 4001;
    readonly SecretVersionNotFound: 4002;
    readonly SecretRevoked: 4003;
    readonly SecretRotationInProgress: 4004;
    readonly SecretUnwrapLimitExceeded: 4005;
    readonly CryptoOperationFailed: 4006;
    readonly ValidationFailed: 5001;
    readonly MalformedRequest: 5002;
    readonly InvalidTokenFormat: 5003;
    readonly InvalidScopeFormat: 5004;
    readonly InvalidConstraint: 5005;
    readonly InternalError: 6001;
    readonly StorageError: 6002;
    readonly ConfigurationError: 6003;
    readonly CryptoSubsystemError: 6004;
    readonly AuditError: 6005;
    readonly SerializationFailed: 6006;
    readonly TokenRevoked: 7001;
    readonly AgentDeactivated: 7002;
    readonly TenantSuspended: 7003;
    readonly RevocationStatusUnknown: 7004;
    readonly ProxyDestinationViolation: 8001;
    readonly ProxyRequestFailed: 8002;
    readonly ProxyTimeout: 8003;
    readonly SsrfBlocked: 8004;
    readonly TemplateVariableNotFound: 8005;
    readonly TemplateVariableAccessDenied: 8006;
    readonly InvalidTemplateVariable: 8007;
    readonly OAuthReauthRequired: 8008;
    readonly ConsentRequired: 9001;
    readonly ConsentDenied: 9002;
    readonly ConsentExpired: 9003;
    readonly ConsentRevoked: 9004;
    readonly FingerprintMismatch: 10001;
    readonly FingerprintStateNotFound: 10002;
    readonly DctScopeAmplification: 11001;
    readonly DctDepthExceeded: 11002;
};

type ErrorCodeValue = (typeof ErrorCode)[keyof typeof ErrorCode];

interface ErrorContext {
    operation?: string;
    resource?: string;
    constraint?: string;
    timestamp?: string;
}

declare function evaluatePolicy(policy: PolicyDocument, request: PolicyRequest): PolicyDecision;

declare function extractProxyRequestVariables(req: ProxyRequest): readonly TemplateVariable[];

declare function hashAuditEvent(event: AuditEvent): Promise<Uint8Array>;

type HealthResponse = z.infer<typeof HealthResponseSchema>;

declare const HealthResponseSchema: z.ZodObject<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    status: z.ZodString;
    version: z.ZodString;
    registered_agents: z.ZodOptional<z.ZodNumber>;
    revoked_tokens: z.ZodOptional<z.ZodNumber>;
}, z.ZodTypeAny, "passthrough">>;

declare function hexDecode(s: string): Uint8Array;

declare function hexEncode(bytes: Uint8Array): string;

declare function inferVariablePrefix(name: string): VariablePrefixValue;

declare function ipInCidrRange(ip: string, cidr: string): boolean;

declare function isClientError(code: number): boolean;