/** * Lifecycle Observation Extension Schema * * Extension namespace: `org.peacprotocol/lifecycle-observation` * Record type URIs: 9 (one per event kind; see LIFECYCLE_OBSERVATION_TYPE_URIS) * * Records observations of lifecycle events emitted by external systems * (orchestrators, workflow engines, evaluation systems, approval systems, * agent runtimes). The caller observed the event; the CLI issues a record * using the caller-provided issuer key. The caller's issuer is the * signer-of-record. PEAC provides the record format, validation, and * signing path. PEAC does not capture, observe, decide, evaluate, score, * transition, or vouch for the truth of the lifecycle event. * * No-inline-value invariant (grammar-based, not heuristic-based): * - 20 forbidden top-level keys reject with `lifecycle.inline_value_blocked` * - All `*_ref` fields validated by `OpaqueRefSchema` grammar * - `approver_ref` priority chain: * non-string -> lifecycle.ref_must_be_string * contains @ -> lifecycle.approver_ref_pii_blocked (more specific; runs first) * else -> lifecycle.opaque_ref_grammar_violation * - Numeric strings like "0.92" reject through the opaque-reference grammar * (no recognized prefix) with `lifecycle.opaque_ref_grammar_violation`, * not `lifecycle.inline_value_blocked`. No language-specific or * numeric-specific heuristics. * * Forbidden top-level keys vs event_kind enum values: * The `event_kind` enum value `'lifecycle-approval-granted'` is REQUIRED * on the `event_kind` field. An extension top-level field literally named * `granted: true` is FORBIDDEN. The no-inline-value check inspects the * extension top level only, never the `event_kind` field. * * Validation returns the structured error contract: * `{ ok: true, value }` or `{ ok: false, errors: [{ code, path?, message }] }`. */ import { z } from 'zod'; export declare const LIFECYCLE_OBSERVATION_EXTENSION_KEY: "org.peacprotocol/lifecycle-observation"; /** All 9 lifecycle observation record type URIs (one per event kind). */ export declare const LIFECYCLE_OBSERVATION_TYPE_URIS: readonly ["org.peacprotocol/lifecycle-approval-requested", "org.peacprotocol/lifecycle-approval-granted", "org.peacprotocol/lifecycle-approval-denied", "org.peacprotocol/lifecycle-evaluation-started", "org.peacprotocol/lifecycle-evaluation-completed", "org.peacprotocol/lifecycle-experiment-assigned", "org.peacprotocol/lifecycle-experiment-result", "org.peacprotocol/lifecycle-workflow-transition", "org.peacprotocol/lifecycle-mode-observed"]; export type LifecycleObservationTypeUri = (typeof LIFECYCLE_OBSERVATION_TYPE_URIS)[number]; /** * Event-kind discriminator literal values. Each `event_kind` corresponds * 1:1 with a type URI in `LIFECYCLE_OBSERVATION_TYPE_URIS` (drop the * `org.peacprotocol/` prefix from the URI to get the event_kind). */ declare const EVENT_KINDS: readonly ["lifecycle-approval-requested", "lifecycle-approval-granted", "lifecycle-approval-denied", "lifecycle-evaluation-started", "lifecycle-evaluation-completed", "lifecycle-experiment-assigned", "lifecycle-experiment-result", "lifecycle-workflow-transition", "lifecycle-mode-observed"]; export type LifecycleEventKind = (typeof EVENT_KINDS)[number]; /** Stable error codes for `validateLifecycleObservation`. */ export declare const LIFECYCLE_OBSERVATION_ERROR_CODES: { readonly inlineValueBlocked: "lifecycle.inline_value_blocked"; readonly opaqueRefGrammarViolation: "lifecycle.opaque_ref_grammar_violation"; readonly approverRefPiiBlocked: "lifecycle.approver_ref_pii_blocked"; readonly refMustBeString: "lifecycle.ref_must_be_string"; readonly missingRequiredField: "lifecycle.missing_required_field"; readonly eventKindUnknown: "lifecycle.event_kind_unknown"; readonly invalidObservedAt: "lifecycle.invalid_observed_at"; readonly invalidState: "lifecycle.invalid_state"; readonly invalidObservedMode: "lifecycle.invalid_observed_mode"; }; /** * Closed-enum constant of forbidden top-level keys. Each key here * represents a class of inline-value smuggling that the observational * invariant must reject. Changes to this list require an explicit * schema and conformance update. * * NOTE: enum LITERAL values like 'lifecycle-approval-granted' live in the * `event_kind` FIELD, not at the extension top level. A top-level field * literally named `granted: true` is FORBIDDEN; the enum value 'granted' * inside event_kind is REQUIRED. */ export declare const FORBIDDEN_TOP_LEVEL_KEYS: readonly ["decision", "verdict", "score", "result", "passed", "failed", "policy_result", "approval_result", "outcome", "judgment", "rating", "grade", "pass", "fail", "allow", "deny", "authorized", "denied", "granted", "rejected_reason"]; /** * The full lifecycle observation record (discriminated by `event_kind`). * * Forbidden-top-level-key checks run as a pre-flight inside * `validateLifecycleObservation` so callers see `lifecycle.inline_value_blocked` * with the offending key name rather than Zod's generic `unrecognized_keys`. */ export declare const LifecycleObservationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{ approval_ref: z.ZodString; approver_ref: z.ZodPipe; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-approval-requested">; }, z.core.$strict>, z.ZodObject<{ approval_ref: z.ZodString; approver_ref: z.ZodPipe; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-approval-granted">; }, z.core.$strict>, z.ZodObject<{ approval_ref: z.ZodString; approver_ref: z.ZodPipe; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-approval-denied">; }, z.core.$strict>, z.ZodObject<{ observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-evaluation-started">; }, z.core.$strict>, z.ZodObject<{ result_ref: z.ZodString; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-evaluation-completed">; }, z.core.$strict>, z.ZodObject<{ experiment_ref: z.ZodString; cohort_ref: z.ZodOptional; variant_ref: z.ZodOptional; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-experiment-assigned">; }, z.core.$strict>, z.ZodObject<{ experiment_ref: z.ZodString; cohort_ref: z.ZodOptional; variant_ref: z.ZodOptional; result_ref: z.ZodString; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-experiment-result">; }, z.core.$strict>, z.ZodObject<{ from_state: z.ZodString; to_state: z.ZodString; observed_mode: z.ZodOptional>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-workflow-transition">; }, z.core.$strict>, z.ZodObject<{ observed_mode: z.ZodEnum<{ deterministic_script: "deterministic_script"; templated_flow: "templated_flow"; agent_loop: "agent_loop"; human_step: "human_step"; hybrid: "hybrid"; }>; parent_ref: z.ZodOptional; upstream_artifact_ref: z.ZodOptional; upstream_artifact_digest: z.ZodOptional; policy_ref: z.ZodOptional; policy_digest: z.ZodOptional; rubric_ref: z.ZodOptional; score_ref: z.ZodOptional; result_digest: z.ZodOptional; subject_ref: z.ZodString; observed_at: z.ZodString; event_kind: z.ZodLiteral<"lifecycle-mode-observed">; }, z.core.$strict>], "event_kind">; export type LifecycleObservation = z.infer; export interface LifecycleValidationError { code: string; path?: string; message: string; } export type LifecycleValidationResult = { ok: true; value: LifecycleObservation; } | { ok: false; errors: LifecycleValidationError[]; }; /** * Validate a lifecycle observation payload. Mirrors the * `validateCliExecution` structured-error contract. * * Pre-flight order: * 1. forbidden top-level keys -> lifecycle.inline_value_blocked * 2. event_kind presence/value -> missing_required_field / event_kind_unknown * 3. observed_at presence -> missing_required_field * 4. Zod schema parse with priority-mapped stable codes * * Generic Zod string-error messages are NEVER surfaced as public diagnostics. */ export declare function validateLifecycleObservation(data: unknown): LifecycleValidationResult; export {}; //# sourceMappingURL=lifecycle-observation.d.ts.map