import { z } from "zod";
import { AgenticEndpointAccessAttemptSchema, AgenticEndpointAccessCapabilitiesSchema, AgenticEndpointAccessPolicySchema, AgenticEndpointAccessReadbackSchema, AgenticEndpointAccessRequestEvidenceSchema, AgenticEndpointAccessSafeReferenceSchema, AgenticEndpointAccessUsageEventSchema, EndpointAccessSurfaceBindingSchema, agenticEndpointAccessAuthorityBoundary, agenticEndpointAccessSchemaVersion, looksLikeEndpointAccessSecret, type AgenticEndpointAccessAttempt, type AgenticEndpointAccessCapabilities, type AgenticEndpointAccessClearanceBinding, type AgenticEndpointAccessLease, type AgenticEndpointAccessPolicy, type AgenticEndpointAccessReadback, type AgenticEndpointAccessRequestEvidence, type AgenticEndpointAccessUsageEvent, type EndpointAccessSurfaceBinding } from "../../protocol/areas/agentic-endpoint-access";
export { agenticEndpointAccessAuthorityBoundary, agenticEndpointAccessSchemaVersion, looksLikeEndpointAccessSecret };
export { AgenticEndpointAccessAttemptSchema, AgenticEndpointAccessCapabilitiesSchema, AgenticEndpointAccessPolicySchema, AgenticEndpointAccessReadbackSchema, AgenticEndpointAccessRequestEvidenceSchema, AgenticEndpointAccessSafeReferenceSchema, AgenticEndpointAccessUsageEventSchema, EndpointAccessSurfaceBindingSchema, };
export type { AgenticEndpointAccessAttempt, AgenticEndpointAccessCapabilities, AgenticEndpointAccessClearanceBinding, AgenticEndpointAccessLease, AgenticEndpointAccessPolicy, AgenticEndpointAccessReadback, AgenticEndpointAccessRequestEvidence, AgenticEndpointAccessUsageEvent, EndpointAccessSurfaceBinding, };
export declare const agenticEndpointAccessMiddlewareConfigSchemaVersion: "handshake.agentic-endpoint-access.middleware-config.v0.3.0";
export declare const agenticEndpointAccessMiddlewareEventSchemaVersion: "handshake.agentic-endpoint-access.middleware-event.v0.3.0";
export declare const agenticEndpointAccessDefaultMaxRequestBodyBytes = 1048576;
export declare const agenticEndpointAccessMaxRequestBodyBytesCeiling: number;
export declare const AgenticEndpointAccessProtectionStatusSchema: z.ZodEnum<{
    proof_gap: "proof_gap";
    stale: "stale";
    refused: "refused";
    unsupported: "unsupported";
    revoked: "revoked";
    leased: "leased";
    exhausted: "exhausted";
    quarantined: "quarantined";
    replay: "replay";
    store_conflict: "store_conflict";
}>;
export type AgenticEndpointAccessProtectionStatus = z.infer<typeof AgenticEndpointAccessProtectionStatusSchema>;
export declare const AgenticEndpointAccessMiddlewareAuthorityBoundarySchema: z.ZodObject<{
    createsCloudAuthority: z.ZodLiteral<false>;
    createsAeAuthority: z.ZodLiteral<false>;
    treatsAuthSessionAsAuthority: z.ZodLiteral<false>;
    treatsRouteMatcherAsAuthority: z.ZodLiteral<false>;
    treatsCloudReadinessAsAuthority: z.ZodLiteral<false>;
    permitsEndpointAccess: z.ZodLiteral<true>;
    permitsMutation: z.ZodLiteral<false>;
    createsIndependentPolicyDecision: z.ZodLiteral<false>;
    createsIndependentGreenlight: z.ZodLiteral<false>;
    performsIndependentGatewayCheck: z.ZodLiteral<false>;
    exportsDownstreamReceipt: z.ZodLiteral<false>;
    mintsTerminalCertificate: z.ZodLiteral<false>;
    containsCredentialMaterial: z.ZodLiteral<false>;
    containsPaymentMaterial: z.ZodLiteral<false>;
    widensOperatingBounds: z.ZodLiteral<false>;
    freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
}, z.core.$strict>;
export type AgenticEndpointAccessMiddlewareAuthorityBoundary = z.infer<typeof AgenticEndpointAccessMiddlewareAuthorityBoundarySchema>;
export declare const agenticEndpointAccessMiddlewareAuthorityBoundary: {
    readonly createsCloudAuthority: false;
    readonly createsAeAuthority: false;
    readonly treatsAuthSessionAsAuthority: false;
    readonly treatsRouteMatcherAsAuthority: false;
    readonly treatsCloudReadinessAsAuthority: false;
    readonly permitsEndpointAccess: true;
    readonly permitsMutation: false;
    readonly createsIndependentPolicyDecision: false;
    readonly createsIndependentGreenlight: false;
    readonly performsIndependentGatewayCheck: false;
    readonly exportsDownstreamReceipt: false;
    readonly mintsTerminalCertificate: false;
    readonly containsCredentialMaterial: false;
    readonly containsPaymentMaterial: false;
    readonly widensOperatingBounds: false;
    readonly freshActionContractRequiredForDownstreamAction: true;
};
export declare const AgenticEndpointAccessHeaderRedactionPolicySchema: z.ZodObject<{
    redactionPolicyId: z.ZodOptional<z.ZodString>;
    additionalSensitiveHeaderNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
    additionalSensitiveHeaderNameSubstrings: z.ZodDefault<z.ZodArray<z.ZodString>>;
    additionalSensitiveValueSubstrings: z.ZodDefault<z.ZodArray<z.ZodString>>;
}, z.core.$strict>;
export type AgenticEndpointAccessHeaderRedactionPolicy = z.input<typeof AgenticEndpointAccessHeaderRedactionPolicySchema>;
export type ParsedAgenticEndpointAccessHeaderRedactionPolicy = z.infer<typeof AgenticEndpointAccessHeaderRedactionPolicySchema>;
export declare const AgenticEndpointAccessMiddlewareOptionsSchema: z.ZodObject<{
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    kernelVersion: z.ZodString;
    middlewareVersion: z.ZodString;
    publicVerifyBaseUrl: z.ZodOptional<z.ZodString>;
    defaultLeaseTtlSeconds: z.ZodDefault<z.ZodNumber>;
    maxRequestBodyBytes: z.ZodDefault<z.ZodNumber>;
    headerRedactionPolicy: z.ZodOptional<z.ZodObject<{
        redactionPolicyId: z.ZodOptional<z.ZodString>;
        additionalSensitiveHeaderNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
        additionalSensitiveHeaderNameSubstrings: z.ZodDefault<z.ZodArray<z.ZodString>>;
        additionalSensitiveValueSubstrings: z.ZodDefault<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AgenticEndpointAccessMiddlewareOptionsInput = z.input<typeof AgenticEndpointAccessMiddlewareOptionsSchema>;
export type AgenticEndpointAccessMiddlewareOptions = z.infer<typeof AgenticEndpointAccessMiddlewareOptionsSchema>;
export declare const AgenticEndpointAccessConfigSnapshotSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.middleware-config.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    pulledAt: z.ZodString;
    expiresAt: z.ZodString;
    configRevision: z.ZodString;
    configDigest: z.ZodString;
    hmacVerified: z.ZodBoolean;
    endpointAccessSchemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    operatingBoundsRef: z.ZodString;
    operatingBoundsDigest: z.ZodString;
    surfaceBinding: z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        tenantId: z.ZodString;
        organizationId: z.ZodString;
        createdAt: z.ZodString;
        protectedSurfaceBindingId: z.ZodString;
        protectedSurfaceRef: z.ZodString;
        protectedSurfaceKind: z.ZodString;
        resourceRef: z.ZodString;
        gatewayRegistryEntryId: z.ZodString;
        gatewayId: z.ZodString;
        actionClass: z.ZodString;
        protectedSurfaceIntegrationRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
        bindingSource: z.ZodEnum<{
            protocol_config: "protocol_config";
            cloud_config: "cloud_config";
            ae_projection: "ae_projection";
            operator_config: "operator_config";
            fixture: "fixture";
        }>;
        issuedAt: z.ZodString;
        expiresAt: z.ZodString;
        bindingDigest: z.ZodString;
    }, z.core.$strict>;
    policy: z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        tenantId: z.ZodString;
        organizationId: z.ZodString;
        createdAt: z.ZodString;
        policyId: z.ZodString;
        policyVersionId: z.ZodString;
        configRevision: z.ZodString;
        protectedSurfaceBindingId: z.ZodString;
        protectedSurfaceBindingDigest: z.ZodString;
        protectedSurfaceRef: z.ZodString;
        protectedSurfaceKind: z.ZodString;
        resourceRef: z.ZodString;
        operatingBoundsId: z.ZodString;
        gatewayRegistryEntryId: z.ZodString;
        gatewayId: z.ZodString;
        gatewayAuthorityHolderRef: z.ZodString;
        requiredDelegationEvidence: z.ZodDefault<z.ZodArray<z.ZodString>>;
        acceptedAgentRegistrationRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
        principalBindingRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        agentBindingRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        runtimePostureRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        rawBypassPostureRequirements: z.ZodDefault<z.ZodArray<z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>>>;
        siblingBypassPostureRequirements: z.ZodDefault<z.ZodArray<z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>>>;
        rateLimit: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        tokenBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        toolBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        costBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        leaseTtlSeconds: z.ZodNumber;
        failClosedBehavior: z.ZodEnum<{
            proof_gap: "proof_gap";
            refuse: "refuse";
            quarantine: "quarantine";
        }>;
        capabilityRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        issuedAt: z.ZodString;
        expiresAt: z.ZodString;
    }, z.core.$strict>;
    capabilities: z.ZodOptional<z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        tenantId: z.ZodString;
        organizationId: z.ZodString;
        createdAt: z.ZodString;
        capabilityReportId: z.ZodString;
        kernelVersion: z.ZodString;
        middlewareVersion: z.ZodString;
        cloudConfigRevision: z.ZodString;
        runtimePostureStatus: z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            unsupported: "unsupported";
            supported: "supported";
        }>;
        rawBypassPosture: z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>;
        siblingBypassPosture: z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>;
        supportedEndpointAccessSchemaVersions: z.ZodArray<z.ZodString>;
        supportedDelegationEvidenceKinds: z.ZodDefault<z.ZodArray<z.ZodString>>;
        supportedPolicyFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
        supportedReadbackKinds: z.ZodDefault<z.ZodArray<z.ZodString>>;
        failClosedReasons: z.ZodDefault<z.ZodArray<z.ZodString>>;
        reportedAt: z.ZodString;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AgenticEndpointAccessConfigSnapshot = z.infer<typeof AgenticEndpointAccessConfigSnapshotSchema>;
export declare const AgenticEndpointAccessConfigSyncProofSchema: z.ZodObject<{
    syncProofRef: z.ZodString;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    configRevision: z.ZodString;
    configDigest: z.ZodString;
    operatingBoundsRef: z.ZodString;
    operatingBoundsDigest: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    policyId: z.ZodString;
    policyVersionId: z.ZodString;
    kernelVersion: z.ZodString;
    middlewareVersion: z.ZodString;
    syncedAt: z.ZodString;
    expiresAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessConfigSyncProof = z.infer<typeof AgenticEndpointAccessConfigSyncProofSchema>;
export declare const AgenticEndpointAccessIngressContextSchema: z.ZodObject<{
    requestId: z.ZodString;
    idempotencyKey: z.ZodString;
    candidateActionId: z.ZodString;
    method: z.ZodString;
    urlDigest: z.ZodString;
    headerDigest: z.ZodString;
    bodyDigest: z.ZodString;
    requestEvidence: z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        requestMethod: z.ZodString;
        requestUrlDigest: z.ZodString;
        requestHeaderDigest: z.ZodString;
        requestBodyDigest: z.ZodString;
        redactionPolicyId: z.ZodString;
        requestEvidenceDigest: z.ZodString;
    }, z.core.$strict>;
    principalRef: z.ZodString;
    agentRef: z.ZodString;
    objectiveRef: z.ZodString;
    delegationEvidenceRefs: z.ZodArray<z.ZodString>;
    agentRegistrationRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    runtimePostureRefs: z.ZodArray<z.ZodString>;
    generatedCodeOrSpecRef: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    rawBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    siblingBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    attemptedAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessIngressContext = z.infer<typeof AgenticEndpointAccessIngressContextSchema>;
export declare const AgenticEndpointAccessClearanceRefsSchema: z.ZodObject<{
    policyId: z.ZodString;
    actionContractId: z.ZodString;
    policyDecisionId: z.ZodString;
    greenlightId: z.ZodString;
    gatewayCheckAttemptId: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessClearanceRefs = z.infer<typeof AgenticEndpointAccessClearanceRefsSchema>;
export declare const AgenticEndpointAccessProtectionOutcomeSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.middleware-event.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    status: z.ZodEnum<{
        proof_gap: "proof_gap";
        stale: "stale";
        refused: "refused";
        unsupported: "unsupported";
        revoked: "revoked";
        leased: "leased";
        exhausted: "exhausted";
        quarantined: "quarantined";
        replay: "replay";
        store_conflict: "store_conflict";
    }>;
    httpStatus: z.ZodNumber;
    requestId: z.ZodNullable<z.ZodString>;
    idempotencyKey: z.ZodNullable<z.ZodString>;
    attemptRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    leaseRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    refusalRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    proofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    policyDecisionRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    greenlightRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    gatewayCheckAttemptRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    readbackRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    publicVerifyUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    reasonCodes: z.ZodArray<z.ZodString>;
    boundary: z.ZodObject<{
        createsCloudAuthority: z.ZodLiteral<false>;
        createsAeAuthority: z.ZodLiteral<false>;
        treatsAuthSessionAsAuthority: z.ZodLiteral<false>;
        treatsRouteMatcherAsAuthority: z.ZodLiteral<false>;
        treatsCloudReadinessAsAuthority: z.ZodLiteral<false>;
        permitsEndpointAccess: z.ZodLiteral<true>;
        permitsMutation: z.ZodLiteral<false>;
        createsIndependentPolicyDecision: z.ZodLiteral<false>;
        createsIndependentGreenlight: z.ZodLiteral<false>;
        performsIndependentGatewayCheck: z.ZodLiteral<false>;
        exportsDownstreamReceipt: z.ZodLiteral<false>;
        mintsTerminalCertificate: z.ZodLiteral<false>;
        containsCredentialMaterial: z.ZodLiteral<false>;
        containsPaymentMaterial: z.ZodLiteral<false>;
        widensOperatingBounds: z.ZodLiteral<false>;
        freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
    }, z.core.$strict>;
    body: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
    recordedAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessProtectionOutcome = z.infer<typeof AgenticEndpointAccessProtectionOutcomeSchema>;
type AgenticEndpointAccessProtectionOutcomeDefaultable = "attemptRef" | "leaseRef" | "refusalRefs" | "proofGapRefs" | "policyDecisionRef" | "greenlightRef" | "gatewayCheckAttemptRef" | "readbackRef" | "publicVerifyUrl" | "body";
type AgenticEndpointAccessProtectionOutcomeBuilderInput = Omit<AgenticEndpointAccessProtectionOutcome, "schemaVersion" | "boundary" | "recordedAt" | AgenticEndpointAccessProtectionOutcomeDefaultable> & Partial<Pick<AgenticEndpointAccessProtectionOutcome, AgenticEndpointAccessProtectionOutcomeDefaultable>> & {
    recordedAt?: string | undefined;
    boundary?: AgenticEndpointAccessMiddlewareAuthorityBoundary | undefined;
};
export declare const AgenticEndpointAccessHandlerContextSchema: z.ZodObject<{
    endpointEntry: z.ZodObject<{
        leaseRef: z.ZodString;
        attemptRef: z.ZodString;
        readbackRef: z.ZodNullable<z.ZodString>;
        protectedSurfaceBindingId: z.ZodString;
        protectedSurfaceBindingDigest: z.ZodString;
        policyDecisionRef: z.ZodString;
        greenlightRef: z.ZodString;
        gatewayCheckAttemptRef: z.ZodString;
        allowedUse: z.ZodLiteral<"bounded_endpoint_entry_only">;
        freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
    }, z.core.$strict>;
}, z.core.$strict>;
export type AgenticEndpointAccessHandlerContext = z.infer<typeof AgenticEndpointAccessHandlerContextSchema>;
export declare const AgenticEndpointAccessForwardedEventSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.middleware-event.v0.3.0">;
    eventId: z.ZodString;
    eventType: z.ZodEnum<{
        protection_outcome: "protection_outcome";
        usage_recorded: "usage_recorded";
        readback_forwarded: "readback_forwarded";
        callback_received: "callback_received";
    }>;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    idempotencyKey: z.ZodString;
    requestId: z.ZodNullable<z.ZodString>;
    outcomeStatus: z.ZodOptional<z.ZodEnum<{
        proof_gap: "proof_gap";
        stale: "stale";
        refused: "refused";
        unsupported: "unsupported";
        revoked: "revoked";
        leased: "leased";
        exhausted: "exhausted";
        quarantined: "quarantined";
        replay: "replay";
        store_conflict: "store_conflict";
    }>>;
    outcomeRef: z.ZodOptional<z.ZodString>;
    readback: z.ZodOptional<z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        tenantId: z.ZodString;
        organizationId: z.ZodString;
        createdAt: z.ZodString;
        readbackId: z.ZodString;
        leaseId: z.ZodNullable<z.ZodString>;
        attemptId: z.ZodString;
        candidateActionId: z.ZodString;
        attemptDigest: z.ZodString;
        requestEvidence: z.ZodObject<{
            schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
            requestMethod: z.ZodString;
            requestUrlDigest: z.ZodString;
            requestHeaderDigest: z.ZodString;
            requestBodyDigest: z.ZodString;
            redactionPolicyId: z.ZodString;
            requestEvidenceDigest: z.ZodString;
        }, z.core.$strict>;
        protectedSurfaceBindingId: z.ZodString;
        protectedSurfaceBindingDigest: z.ZodString;
        protectedSurfaceRef: z.ZodString;
        protectedSurfaceKind: z.ZodString;
        resourceRef: z.ZodString;
        policyVersionId: z.ZodString;
        configRevision: z.ZodString;
        kernelVersion: z.ZodString;
        middlewareVersion: z.ZodString;
        runtimePostureRef: z.ZodString;
        gatewayRegistryEntryId: z.ZodString;
        gatewayId: z.ZodString;
        gatewayAuthorityHolderRef: z.ZodString;
        rawBypassPosture: z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>;
        siblingBypassPosture: z.ZodEnum<{
            unknown: "unknown";
            stale: "stale";
            blocked: "blocked";
            unblocked: "unblocked";
            inconclusive: "inconclusive";
        }>;
        capabilityReportRef: z.ZodString;
        healthReportRef: z.ZodString;
        usageSummary: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("../..").JsonValue, unknown, z.core.$ZodTypeInternals<import("../..").JsonValue, unknown>>>>;
        linkedActionRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
        linkedReceiptRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
        linkedProofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
        publicVerifyUrl: z.ZodString;
        downstreamReceiptBoundary: z.ZodLiteral<"linked_receipts_are_not_endpoint_access_authorization">;
    }, z.core.$strict>>;
    usageEvents: z.ZodDefault<z.ZodArray<z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        tenantId: z.ZodString;
        organizationId: z.ZodString;
        createdAt: z.ZodString;
        usageEventId: z.ZodString;
        leaseId: z.ZodString;
        protectedSurfaceBindingId: z.ZodString;
        protectedSurfaceRef: z.ZodString;
        protectedSurfaceKind: z.ZodString;
        resourceRef: z.ZodString;
        usageKind: z.ZodEnum<{
            request: "request";
            token: "token";
            tool_call: "tool_call";
            cost_unit: "cost_unit";
        }>;
        amount: z.ZodNumber;
        counterAfter: z.ZodNumber;
        occurredAt: z.ZodString;
        proofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>>>;
    reasonCodes: z.ZodDefault<z.ZodArray<z.ZodString>>;
    proofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    payloadDigest: z.ZodString;
    boundary: z.ZodObject<{
        createsCloudAuthority: z.ZodLiteral<false>;
        createsAeAuthority: z.ZodLiteral<false>;
        treatsAuthSessionAsAuthority: z.ZodLiteral<false>;
        treatsRouteMatcherAsAuthority: z.ZodLiteral<false>;
        treatsCloudReadinessAsAuthority: z.ZodLiteral<false>;
        permitsEndpointAccess: z.ZodLiteral<true>;
        permitsMutation: z.ZodLiteral<false>;
        createsIndependentPolicyDecision: z.ZodLiteral<false>;
        createsIndependentGreenlight: z.ZodLiteral<false>;
        performsIndependentGatewayCheck: z.ZodLiteral<false>;
        exportsDownstreamReceipt: z.ZodLiteral<false>;
        mintsTerminalCertificate: z.ZodLiteral<false>;
        containsCredentialMaterial: z.ZodLiteral<false>;
        containsPaymentMaterial: z.ZodLiteral<false>;
        widensOperatingBounds: z.ZodLiteral<false>;
        freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
    }, z.core.$strict>;
    occurredAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessForwardedEvent = z.infer<typeof AgenticEndpointAccessForwardedEventSchema>;
export declare function buildAgenticEndpointAccessProtectionOutcome(input: AgenticEndpointAccessProtectionOutcomeBuilderInput): AgenticEndpointAccessProtectionOutcome;
export declare function refFor(objectType: string, objectId: string): string;
export declare function assertNoEndpointAccessSecret(value: string, label: string): void;