/**
 * @vorionsys/contracts — DecisionRecord v1
 * Single source of truth for the BASIS proof-chain record format.
 *
 * Shape only. Canonicalization (RFC 8785), hashing, and Ed25519 signing live in
 * @vorionsys/verify — never re-implement them here. See SPEC-basis-verify §2–§3.
 *
 * Exported via the "@vorionsys/contracts/basis" subpath (see ./index.ts).
 */
import { z } from "zod";
export declare const Ulid: z.ZodString;
export declare const Sha256Ref: z.ZodString;
/** RFC 3339 UTC with exactly millisecond precision, e.g. 2026-07-02T14:03:22.481Z */
export declare const Rfc3339UtcMs: z.ZodString;
export declare const DottedPath: z.ZodString;
export declare const DECISIONS: readonly ["allow", "deny", "escalate"];
export declare const DecisionSchema: z.ZodEnum<["allow", "deny", "escalate"]>;
export type Decision = z.infer<typeof DecisionSchema>;
export declare const REASON_CODES: readonly ["WITHIN_AUTHORITY", "TIER_CAP_EXCEEDED", "DOMAIN_NOT_ALLOWLISTED", "CAPABILITY_NOT_GRANTED", "PARAM_NOT_ALLOWLISTED", "RATE_LIMIT_EXCEEDED", "VERIFICATION_REQUIRED", "CIRCUIT_BREAKER_OPEN", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "HUMAN_APPROVED", "HUMAN_DENIED", "APPROVAL_CEILING_EXCEEDED"];
export declare const ReasonCodeSchema: z.ZodEnum<["WITHIN_AUTHORITY", "TIER_CAP_EXCEEDED", "DOMAIN_NOT_ALLOWLISTED", "CAPABILITY_NOT_GRANTED", "PARAM_NOT_ALLOWLISTED", "RATE_LIMIT_EXCEEDED", "VERIFICATION_REQUIRED", "CIRCUIT_BREAKER_OPEN", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "HUMAN_APPROVED", "HUMAN_DENIED", "APPROVAL_CEILING_EXCEEDED"]>;
export type ReasonCode = z.infer<typeof ReasonCodeSchema>;
export declare const CREDENTIAL_STATUSES: readonly ["active", "expired", "revoked", "none"];
export declare const CredentialStatusSchema: z.ZodEnum<["active", "expired", "revoked", "none"]>;
export declare const CredentialSchema: z.ZodObject<{
    id: z.ZodString;
    status: z.ZodEnum<["active", "expired", "revoked", "none"]>;
    /** null iff status === "none" (enforced in superRefine below) */
    expiresAt: z.ZodNullable<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    id: string;
    status: "active" | "none" | "revoked" | "expired";
    expiresAt: string | null;
}, {
    id: string;
    status: "active" | "none" | "revoked" | "expired";
    expiresAt: string | null;
}>;
export declare const AgentRefSchema: z.ZodObject<{
    id: z.ZodString;
    /** Tier ceilings/caps are defined in @vorionsys/shared-constants. */
    tier: z.ZodNumber;
    credential: z.ZodObject<{
        id: z.ZodString;
        status: z.ZodEnum<["active", "expired", "revoked", "none"]>;
        /** null iff status === "none" (enforced in superRefine below) */
        expiresAt: z.ZodNullable<z.ZodString>;
    }, "strict", z.ZodTypeAny, {
        id: string;
        status: "active" | "none" | "revoked" | "expired";
        expiresAt: string | null;
    }, {
        id: string;
        status: "active" | "none" | "revoked" | "expired";
        expiresAt: string | null;
    }>;
}, "strict", z.ZodTypeAny, {
    id: string;
    tier: number;
    credential: {
        id: string;
        status: "active" | "none" | "revoked" | "expired";
        expiresAt: string | null;
    };
}, {
    id: string;
    tier: number;
    credential: {
        id: string;
        status: "active" | "none" | "revoked" | "expired";
        expiresAt: string | null;
    };
}>;
export declare const ActionSchema: z.ZodObject<{
    domain: z.ZodString;
    capability: z.ZodString;
    /** sha256 of the JCS-canonicalized params. Raw params NEVER enter a record. */
    paramsHash: z.ZodString;
}, "strict", z.ZodTypeAny, {
    domain: string;
    capability: string;
    paramsHash: string;
}, {
    domain: string;
    capability: string;
    paramsHash: string;
}>;
export declare const PolicyRefSchema: z.ZodObject<{
    id: z.ZodString;
    version: z.ZodString;
    /** Hash of the exact policy document evaluated. */
    hash: z.ZodString;
}, "strict", z.ZodTypeAny, {
    id: string;
    version: string;
    hash: string;
}, {
    id: string;
    version: string;
    hash: string;
}>;
export declare const VerdictSchema: z.ZodObject<{
    decision: z.ZodEnum<["allow", "deny", "escalate"]>;
    reason: z.ZodEnum<["WITHIN_AUTHORITY", "TIER_CAP_EXCEEDED", "DOMAIN_NOT_ALLOWLISTED", "CAPABILITY_NOT_GRANTED", "PARAM_NOT_ALLOWLISTED", "RATE_LIMIT_EXCEEDED", "VERIFICATION_REQUIRED", "CIRCUIT_BREAKER_OPEN", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "HUMAN_APPROVED", "HUMAN_DENIED", "APPROVAL_CEILING_EXCEEDED"]>;
    latencyMs: z.ZodNumber;
    /** Resolution records (HUMAN_APPROVED / HUMAN_DENIED) point at the
     *  escalation record they resolve; null otherwise. */
    linksTo: z.ZodNullable<z.ZodString>;
}, "strict", z.ZodTypeAny, {
    reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
    decision: "deny" | "allow" | "escalate";
    latencyMs: number;
    linksTo: string | null;
}, {
    reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
    decision: "deny" | "allow" | "escalate";
    latencyMs: number;
    linksTo: string | null;
}>;
export declare const SigSchema: z.ZodObject<{
    alg: z.ZodLiteral<"ed25519">;
    kid: z.ZodString;
    /** Ed25519 signature over the JCS-canonical record WITHOUT `sig`. */
    value: z.ZodString;
}, "strict", z.ZodTypeAny, {
    value: string;
    alg: "ed25519";
    kid: string;
}, {
    value: string;
    alg: "ed25519";
    kid: string;
}>;
export declare const DecisionRecordSchema: z.ZodEffects<z.ZodObject<{
    v: z.ZodLiteral<"1">;
    id: z.ZodString;
    ts: z.ZodString;
    agent: z.ZodObject<{
        id: z.ZodString;
        /** Tier ceilings/caps are defined in @vorionsys/shared-constants. */
        tier: z.ZodNumber;
        credential: z.ZodObject<{
            id: z.ZodString;
            status: z.ZodEnum<["active", "expired", "revoked", "none"]>;
            /** null iff status === "none" (enforced in superRefine below) */
            expiresAt: z.ZodNullable<z.ZodString>;
        }, "strict", z.ZodTypeAny, {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        }, {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        }>;
    }, "strict", z.ZodTypeAny, {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    }, {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    }>;
    action: z.ZodObject<{
        domain: z.ZodString;
        capability: z.ZodString;
        /** sha256 of the JCS-canonicalized params. Raw params NEVER enter a record. */
        paramsHash: z.ZodString;
    }, "strict", z.ZodTypeAny, {
        domain: string;
        capability: string;
        paramsHash: string;
    }, {
        domain: string;
        capability: string;
        paramsHash: string;
    }>;
    policy: z.ZodObject<{
        id: z.ZodString;
        version: z.ZodString;
        /** Hash of the exact policy document evaluated. */
        hash: z.ZodString;
    }, "strict", z.ZodTypeAny, {
        id: string;
        version: string;
        hash: string;
    }, {
        id: string;
        version: string;
        hash: string;
    }>;
    verdict: z.ZodObject<{
        decision: z.ZodEnum<["allow", "deny", "escalate"]>;
        reason: z.ZodEnum<["WITHIN_AUTHORITY", "TIER_CAP_EXCEEDED", "DOMAIN_NOT_ALLOWLISTED", "CAPABILITY_NOT_GRANTED", "PARAM_NOT_ALLOWLISTED", "RATE_LIMIT_EXCEEDED", "VERIFICATION_REQUIRED", "CIRCUIT_BREAKER_OPEN", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "HUMAN_APPROVED", "HUMAN_DENIED", "APPROVAL_CEILING_EXCEEDED"]>;
        latencyMs: z.ZodNumber;
        /** Resolution records (HUMAN_APPROVED / HUMAN_DENIED) point at the
         *  escalation record they resolve; null otherwise. */
        linksTo: z.ZodNullable<z.ZodString>;
    }, "strict", z.ZodTypeAny, {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    }, {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    }>;
    /** Hash of the previous FULL record (incl. sig) — "GENESIS" for record 0. */
    prev: z.ZodUnion<[z.ZodString, z.ZodLiteral<"GENESIS">]>;
    sig: z.ZodObject<{
        alg: z.ZodLiteral<"ed25519">;
        kid: z.ZodString;
        /** Ed25519 signature over the JCS-canonical record WITHOUT `sig`. */
        value: z.ZodString;
    }, "strict", z.ZodTypeAny, {
        value: string;
        alg: "ed25519";
        kid: string;
    }, {
        value: string;
        alg: "ed25519";
        kid: string;
    }>;
}, "strict", z.ZodTypeAny, {
    agent: {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    };
    id: string;
    action: {
        domain: string;
        capability: string;
        paramsHash: string;
    };
    v: "1";
    ts: string;
    policy: {
        id: string;
        version: string;
        hash: string;
    };
    verdict: {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    };
    prev: string;
    sig: {
        value: string;
        alg: "ed25519";
        kid: string;
    };
}, {
    agent: {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    };
    id: string;
    action: {
        domain: string;
        capability: string;
        paramsHash: string;
    };
    v: "1";
    ts: string;
    policy: {
        id: string;
        version: string;
        hash: string;
    };
    verdict: {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    };
    prev: string;
    sig: {
        value: string;
        alg: "ed25519";
        kid: string;
    };
}>, {
    agent: {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    };
    id: string;
    action: {
        domain: string;
        capability: string;
        paramsHash: string;
    };
    v: "1";
    ts: string;
    policy: {
        id: string;
        version: string;
        hash: string;
    };
    verdict: {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    };
    prev: string;
    sig: {
        value: string;
        alg: "ed25519";
        kid: string;
    };
}, {
    agent: {
        id: string;
        tier: number;
        credential: {
            id: string;
            status: "active" | "none" | "revoked" | "expired";
            expiresAt: string | null;
        };
    };
    id: string;
    action: {
        domain: string;
        capability: string;
        paramsHash: string;
    };
    v: "1";
    ts: string;
    policy: {
        id: string;
        version: string;
        hash: string;
    };
    verdict: {
        reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
        decision: "deny" | "allow" | "escalate";
        latencyMs: number;
        linksTo: string | null;
    };
    prev: string;
    sig: {
        value: string;
        alg: "ed25519";
        kid: string;
    };
}>;
export type DecisionRecord = z.infer<typeof DecisionRecordSchema>;
export type UnsignedDecisionRecord = Omit<DecisionRecord, "sig">;
/** Strip `sig` to produce the signable form. Canonicalization itself lives in
 *  @vorionsys/verify; this helper only guarantees field omission is uniform. */
export declare function toSignable(record: DecisionRecord): UnsignedDecisionRecord;
export declare const ChainFileSchema: z.ZodObject<{
    basisVerify: z.ZodLiteral<"1">;
    records: z.ZodArray<z.ZodEffects<z.ZodObject<{
        v: z.ZodLiteral<"1">;
        id: z.ZodString;
        ts: z.ZodString;
        agent: z.ZodObject<{
            id: z.ZodString;
            /** Tier ceilings/caps are defined in @vorionsys/shared-constants. */
            tier: z.ZodNumber;
            credential: z.ZodObject<{
                id: z.ZodString;
                status: z.ZodEnum<["active", "expired", "revoked", "none"]>;
                /** null iff status === "none" (enforced in superRefine below) */
                expiresAt: z.ZodNullable<z.ZodString>;
            }, "strict", z.ZodTypeAny, {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            }, {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            }>;
        }, "strict", z.ZodTypeAny, {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        }, {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        }>;
        action: z.ZodObject<{
            domain: z.ZodString;
            capability: z.ZodString;
            /** sha256 of the JCS-canonicalized params. Raw params NEVER enter a record. */
            paramsHash: z.ZodString;
        }, "strict", z.ZodTypeAny, {
            domain: string;
            capability: string;
            paramsHash: string;
        }, {
            domain: string;
            capability: string;
            paramsHash: string;
        }>;
        policy: z.ZodObject<{
            id: z.ZodString;
            version: z.ZodString;
            /** Hash of the exact policy document evaluated. */
            hash: z.ZodString;
        }, "strict", z.ZodTypeAny, {
            id: string;
            version: string;
            hash: string;
        }, {
            id: string;
            version: string;
            hash: string;
        }>;
        verdict: z.ZodObject<{
            decision: z.ZodEnum<["allow", "deny", "escalate"]>;
            reason: z.ZodEnum<["WITHIN_AUTHORITY", "TIER_CAP_EXCEEDED", "DOMAIN_NOT_ALLOWLISTED", "CAPABILITY_NOT_GRANTED", "PARAM_NOT_ALLOWLISTED", "RATE_LIMIT_EXCEEDED", "VERIFICATION_REQUIRED", "CIRCUIT_BREAKER_OPEN", "CREDENTIAL_EXPIRED", "CREDENTIAL_REVOKED", "HUMAN_APPROVED", "HUMAN_DENIED", "APPROVAL_CEILING_EXCEEDED"]>;
            latencyMs: z.ZodNumber;
            /** Resolution records (HUMAN_APPROVED / HUMAN_DENIED) point at the
             *  escalation record they resolve; null otherwise. */
            linksTo: z.ZodNullable<z.ZodString>;
        }, "strict", z.ZodTypeAny, {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        }, {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        }>;
        /** Hash of the previous FULL record (incl. sig) — "GENESIS" for record 0. */
        prev: z.ZodUnion<[z.ZodString, z.ZodLiteral<"GENESIS">]>;
        sig: z.ZodObject<{
            alg: z.ZodLiteral<"ed25519">;
            kid: z.ZodString;
            /** Ed25519 signature over the JCS-canonical record WITHOUT `sig`. */
            value: z.ZodString;
        }, "strict", z.ZodTypeAny, {
            value: string;
            alg: "ed25519";
            kid: string;
        }, {
            value: string;
            alg: "ed25519";
            kid: string;
        }>;
    }, "strict", z.ZodTypeAny, {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }, {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }>, {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }, {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }>, "many">;
}, "strict", z.ZodTypeAny, {
    basisVerify: "1";
    records: {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }[];
}, {
    basisVerify: "1";
    records: {
        agent: {
            id: string;
            tier: number;
            credential: {
                id: string;
                status: "active" | "none" | "revoked" | "expired";
                expiresAt: string | null;
            };
        };
        id: string;
        action: {
            domain: string;
            capability: string;
            paramsHash: string;
        };
        v: "1";
        ts: string;
        policy: {
            id: string;
            version: string;
            hash: string;
        };
        verdict: {
            reason: "CREDENTIAL_EXPIRED" | "RATE_LIMIT_EXCEEDED" | "WITHIN_AUTHORITY" | "TIER_CAP_EXCEEDED" | "DOMAIN_NOT_ALLOWLISTED" | "CAPABILITY_NOT_GRANTED" | "PARAM_NOT_ALLOWLISTED" | "VERIFICATION_REQUIRED" | "CIRCUIT_BREAKER_OPEN" | "CREDENTIAL_REVOKED" | "HUMAN_APPROVED" | "HUMAN_DENIED" | "APPROVAL_CEILING_EXCEEDED";
            decision: "deny" | "allow" | "escalate";
            latencyMs: number;
            linksTo: string | null;
        };
        prev: string;
        sig: {
            value: string;
            alg: "ed25519";
            kid: string;
        };
    }[];
}>;
export type ChainFile = z.infer<typeof ChainFileSchema>;
/** { <kid>: <base64 raw Ed25519 public key> } */
export declare const KeysFileSchema: z.ZodRecord<z.ZodString, z.ZodString>;
export type KeysFile = z.infer<typeof KeysFileSchema>;
export declare const parseChainFile: (u: unknown) => ChainFile;
export declare const parseKeysFile: (u: unknown) => KeysFile;