import { z } from "zod";
import { looksLikeEndpointAccessSecret } from "../../foundation/authority-safe-reference";
export declare const agenticEndpointAccessSchemaVersion: "handshake.agentic-endpoint-access.v0.3.0";
export declare const AgenticEndpointAccessSafeReferenceSchema: z.ZodString;
export { looksLikeEndpointAccessSecret };
export declare const EndpointAccessSurfaceBindingSourceSchema: z.ZodEnum<{
    protocol_config: "protocol_config";
    cloud_config: "cloud_config";
    ae_projection: "ae_projection";
    operator_config: "operator_config";
    fixture: "fixture";
}>;
export type EndpointAccessSurfaceBindingSource = z.infer<typeof EndpointAccessSurfaceBindingSourceSchema>;
export declare const EndpointAccessSurfaceBindingSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    actionClass: z.ZodString;
    protectedSurfaceIntegrationRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    bindingSource: z.ZodEnum<{
        protocol_config: "protocol_config";
        cloud_config: "cloud_config";
        ae_projection: "ae_projection";
        operator_config: "operator_config";
        fixture: "fixture";
    }>;
    issuedAt: z.ZodString;
    expiresAt: z.ZodString;
    bindingDigest: z.ZodString;
}, z.core.$strict>;
export type EndpointAccessSurfaceBinding = z.infer<typeof EndpointAccessSurfaceBindingSchema>;
export declare const AgenticEndpointAccessAuthorityBoundarySchema: z.ZodObject<{
    permitsEndpointAccess: z.ZodLiteral<true>;
    permitsMutation: z.ZodLiteral<false>;
    createsIndependentPolicyDecision: z.ZodLiteral<false>;
    createsIndependentGreenlight: z.ZodLiteral<false>;
    performsIndependentGatewayCheck: z.ZodLiteral<false>;
    exportsDownstreamReceipt: z.ZodLiteral<false>;
    mintsTerminalCertificate: z.ZodLiteral<false>;
    containsCredentialMaterial: z.ZodLiteral<false>;
    containsPaymentMaterial: z.ZodLiteral<false>;
    widensOperatingBounds: z.ZodLiteral<false>;
    freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
}, z.core.$strict>;
export type AgenticEndpointAccessAuthorityBoundary = z.infer<typeof AgenticEndpointAccessAuthorityBoundarySchema>;
export declare const agenticEndpointAccessAuthorityBoundary: {
    readonly permitsEndpointAccess: true;
    readonly permitsMutation: false;
    readonly createsIndependentPolicyDecision: false;
    readonly createsIndependentGreenlight: false;
    readonly performsIndependentGatewayCheck: false;
    readonly exportsDownstreamReceipt: false;
    readonly mintsTerminalCertificate: false;
    readonly containsCredentialMaterial: false;
    readonly containsPaymentMaterial: false;
    readonly widensOperatingBounds: false;
    readonly freshActionContractRequiredForDownstreamAction: true;
};
export declare const AgenticEndpointAccessBypassPostureSchema: z.ZodEnum<{
    unknown: "unknown";
    stale: "stale";
    blocked: "blocked";
    unblocked: "unblocked";
    inconclusive: "inconclusive";
}>;
export type AgenticEndpointAccessBypassPosture = z.infer<typeof AgenticEndpointAccessBypassPostureSchema>;
export declare const AgenticEndpointAccessStateSchema: z.ZodEnum<{
    proof_gap: "proof_gap";
    refused: "refused";
    revoked: "revoked";
    expired: "expired";
    attempted: "attempted";
    leased: "leased";
    exhausted: "exhausted";
    quarantined: "quarantined";
}>;
export type AgenticEndpointAccessState = z.infer<typeof AgenticEndpointAccessStateSchema>;
export declare const AgenticEndpointAccessClearanceStatusSchema: z.ZodEnum<{
    proof_gap: "proof_gap";
    refused: "refused";
    leased: "leased";
}>;
export type AgenticEndpointAccessClearanceStatus = z.infer<typeof AgenticEndpointAccessClearanceStatusSchema>;
export declare const AgenticEndpointAccessFailClosedBehaviorSchema: z.ZodEnum<{
    proof_gap: "proof_gap";
    refuse: "refuse";
    quarantine: "quarantine";
}>;
export type AgenticEndpointAccessFailClosedBehavior = z.infer<typeof AgenticEndpointAccessFailClosedBehaviorSchema>;
export declare const AgenticEndpointAccessUsageKindSchema: z.ZodEnum<{
    request: "request";
    token: "token";
    tool_call: "tool_call";
    cost_unit: "cost_unit";
}>;
export type AgenticEndpointAccessUsageKind = z.infer<typeof AgenticEndpointAccessUsageKindSchema>;
export declare const AgenticEndpointAccessCapabilityStatusSchema: z.ZodEnum<{
    unknown: "unknown";
    stale: "stale";
    unsupported: "unsupported";
    supported: "supported";
}>;
export type AgenticEndpointAccessCapabilityStatus = z.infer<typeof AgenticEndpointAccessCapabilityStatusSchema>;
export declare const AgenticEndpointAccessRequestEvidenceSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    requestMethod: z.ZodString;
    requestUrlDigest: z.ZodString;
    requestHeaderDigest: z.ZodString;
    requestBodyDigest: z.ZodString;
    redactionPolicyId: z.ZodString;
    requestEvidenceDigest: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessRequestEvidence = z.infer<typeof AgenticEndpointAccessRequestEvidenceSchema>;
export declare const AgenticEndpointAccessPolicySchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    policyId: z.ZodString;
    policyVersionId: z.ZodString;
    configRevision: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    operatingBoundsId: z.ZodString;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    gatewayAuthorityHolderRef: z.ZodString;
    requiredDelegationEvidence: z.ZodDefault<z.ZodArray<z.ZodString>>;
    acceptedAgentRegistrationRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    principalBindingRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    agentBindingRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    runtimePostureRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    rawBypassPostureRequirements: z.ZodDefault<z.ZodArray<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>>>;
    siblingBypassPostureRequirements: z.ZodDefault<z.ZodArray<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>>>;
    rateLimit: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    tokenBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    toolBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    costBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    leaseTtlSeconds: z.ZodNumber;
    failClosedBehavior: z.ZodEnum<{
        proof_gap: "proof_gap";
        refuse: "refuse";
        quarantine: "quarantine";
    }>;
    capabilityRequirements: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    issuedAt: z.ZodString;
    expiresAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessPolicy = z.infer<typeof AgenticEndpointAccessPolicySchema>;
export declare const AgenticEndpointAccessAttemptSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    attemptId: z.ZodString;
    candidateActionId: z.ZodString;
    generatedCodeOrSpecRef: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    principalRef: z.ZodString;
    agentRef: z.ZodString;
    objectiveRef: z.ZodString;
    delegationEvidenceRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    agentRegistrationRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    runtimePostureRefs: z.ZodArray<z.ZodString>;
    rawBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    siblingBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    requestEvidence: z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        requestMethod: z.ZodString;
        requestUrlDigest: z.ZodString;
        requestHeaderDigest: z.ZodString;
        requestBodyDigest: z.ZodString;
        redactionPolicyId: z.ZodString;
        requestEvidenceDigest: z.ZodString;
    }, z.core.$strict>;
    requestedLeaseTtlSeconds: z.ZodNumber;
    requestedBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    kernelVersion: z.ZodString;
    middlewareVersion: z.ZodString;
    capabilitiesPresented: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    idempotencyKey: z.ZodString;
    attemptedAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessAttempt = z.infer<typeof AgenticEndpointAccessAttemptSchema>;
export declare const AgenticEndpointAccessClearanceBindingSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    clearanceBindingId: z.ZodString;
    attemptId: z.ZodString;
    candidateActionId: z.ZodString;
    actionContractId: z.ZodString;
    policyDecisionId: z.ZodNullable<z.ZodString>;
    greenlightId: z.ZodNullable<z.ZodString>;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    gatewayAuthorityHolderRef: z.ZodString;
    gatewayCheckAttemptId: z.ZodNullable<z.ZodString>;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    refusalRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    proofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    clearanceStatus: z.ZodEnum<{
        proof_gap: "proof_gap";
        refused: "refused";
        leased: "leased";
    }>;
    reasonCodes: z.ZodDefault<z.ZodArray<z.ZodString>>;
    evaluatedAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessClearanceBinding = z.infer<typeof AgenticEndpointAccessClearanceBindingSchema>;
export declare const AgenticEndpointAccessLeaseSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    leaseId: z.ZodString;
    attemptId: z.ZodString;
    candidateActionId: z.ZodString;
    actionContractId: z.ZodString;
    policyDecisionId: z.ZodString;
    greenlightId: z.ZodString;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    gatewayAuthorityHolderRef: z.ZodString;
    gatewayCheckAttemptId: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    principalRef: z.ZodString;
    agentRef: z.ZodString;
    operatingBoundsId: z.ZodString;
    policyVersionId: z.ZodString;
    configRevision: z.ZodString;
    runtimePostureRef: z.ZodString;
    rawBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    siblingBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    allowedUse: z.ZodLiteral<"bounded_endpoint_entry_only">;
    rateLimit: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    tokenBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    toolBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    costBudget: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    usageCounters: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodNumber>>;
    issuedAt: z.ZodString;
    expiresAt: z.ZodString;
    revokedAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    authorityBoundary: z.ZodObject<{
        permitsEndpointAccess: z.ZodLiteral<true>;
        permitsMutation: z.ZodLiteral<false>;
        createsIndependentPolicyDecision: z.ZodLiteral<false>;
        createsIndependentGreenlight: z.ZodLiteral<false>;
        performsIndependentGatewayCheck: z.ZodLiteral<false>;
        exportsDownstreamReceipt: z.ZodLiteral<false>;
        mintsTerminalCertificate: z.ZodLiteral<false>;
        containsCredentialMaterial: z.ZodLiteral<false>;
        containsPaymentMaterial: z.ZodLiteral<false>;
        widensOperatingBounds: z.ZodLiteral<false>;
        freshActionContractRequiredForDownstreamAction: z.ZodLiteral<true>;
    }, z.core.$strict>;
}, z.core.$strict>;
export type AgenticEndpointAccessLease = z.infer<typeof AgenticEndpointAccessLeaseSchema>;
export declare const AgenticEndpointAccessUsageEventSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    usageEventId: z.ZodString;
    leaseId: z.ZodString;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    usageKind: z.ZodEnum<{
        request: "request";
        token: "token";
        tool_call: "tool_call";
        cost_unit: "cost_unit";
    }>;
    amount: z.ZodNumber;
    counterAfter: z.ZodNumber;
    occurredAt: z.ZodString;
    proofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
}, z.core.$strict>;
export type AgenticEndpointAccessUsageEvent = z.infer<typeof AgenticEndpointAccessUsageEventSchema>;
export declare const AgenticEndpointAccessReadbackSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    readbackId: z.ZodString;
    leaseId: z.ZodNullable<z.ZodString>;
    attemptId: z.ZodString;
    candidateActionId: z.ZodString;
    attemptDigest: z.ZodString;
    requestEvidence: z.ZodObject<{
        schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
        requestMethod: z.ZodString;
        requestUrlDigest: z.ZodString;
        requestHeaderDigest: z.ZodString;
        requestBodyDigest: z.ZodString;
        redactionPolicyId: z.ZodString;
        requestEvidenceDigest: z.ZodString;
    }, z.core.$strict>;
    protectedSurfaceBindingId: z.ZodString;
    protectedSurfaceBindingDigest: z.ZodString;
    protectedSurfaceRef: z.ZodString;
    protectedSurfaceKind: z.ZodString;
    resourceRef: z.ZodString;
    policyVersionId: z.ZodString;
    configRevision: z.ZodString;
    kernelVersion: z.ZodString;
    middlewareVersion: z.ZodString;
    runtimePostureRef: z.ZodString;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    gatewayAuthorityHolderRef: z.ZodString;
    rawBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    siblingBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    capabilityReportRef: z.ZodString;
    healthReportRef: z.ZodString;
    usageSummary: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("./types").JsonValue, unknown, z.core.$ZodTypeInternals<import("./types").JsonValue, unknown>>>>;
    linkedActionRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    linkedReceiptRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    linkedProofGapRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    publicVerifyUrl: z.ZodString;
    downstreamReceiptBoundary: z.ZodLiteral<"linked_receipts_are_not_endpoint_access_authorization">;
}, z.core.$strict>;
export type AgenticEndpointAccessReadback = z.infer<typeof AgenticEndpointAccessReadbackSchema>;
export declare const AgenticEndpointAccessCapabilitiesSchema: z.ZodObject<{
    schemaVersion: z.ZodLiteral<"handshake.agentic-endpoint-access.v0.3.0">;
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    createdAt: z.ZodString;
    capabilityReportId: z.ZodString;
    kernelVersion: z.ZodString;
    middlewareVersion: z.ZodString;
    cloudConfigRevision: z.ZodString;
    runtimePostureStatus: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        unsupported: "unsupported";
        supported: "supported";
    }>;
    rawBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    siblingBypassPosture: z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        blocked: "blocked";
        unblocked: "unblocked";
        inconclusive: "inconclusive";
    }>;
    supportedEndpointAccessSchemaVersions: z.ZodArray<z.ZodString>;
    supportedDelegationEvidenceKinds: z.ZodDefault<z.ZodArray<z.ZodString>>;
    supportedPolicyFeatures: z.ZodDefault<z.ZodArray<z.ZodString>>;
    supportedReadbackKinds: z.ZodDefault<z.ZodArray<z.ZodString>>;
    failClosedReasons: z.ZodDefault<z.ZodArray<z.ZodString>>;
    reportedAt: z.ZodString;
}, z.core.$strict>;
export type AgenticEndpointAccessCapabilities = z.infer<typeof AgenticEndpointAccessCapabilitiesSchema>;