/**
 * CAR Integration for Trust Engine
 *
 * Bridges CAR identity layer with Vorion runtime trust enforcement.
 *
 * **CRITICAL DESIGN PRINCIPLE:**
 * The CAR is an IMMUTABLE identifier. Trust is NOT embedded in the CAR.
 * Trust is computed at RUNTIME from:
 * 1. Attestations (external certifications linked to the CAR identity)
 * 2. Behavioral signals (runtime observations)
 * 3. Deployment context policies
 *
 * This separation ensures:
 * - CAR remains stable (like a passport number)
 * - Trust can evolve independently
 * - Same agent can have different trust in different deployments
 *
 * @packageDocumentation
 */
import { ParsedCAR, CertificationTier, RuntimeTier, CapabilityLevel, type CARIdentity } from '@vorionsys/contracts/car';
import type { TrustScore, ID } from '../common/types.js';
import { z } from 'zod';
/**
 * Attestation record from CAR certification
 */
export interface Attestation {
    /** Unique attestation identifier */
    id: string;
    /** Subject entity (agent) this attestation is for */
    subject: ID;
    /** Issuing authority (e.g., auditor, certifier) */
    issuer: string;
    /** Certified trust tier (T0-T5) */
    trustTier: CertificationTier;
    /** Scope of the attestation (domains, capabilities) */
    scope: string[];
    /** When the attestation was issued */
    issuedAt: Date;
    /** When the attestation expires */
    expiresAt: Date;
    /** Supporting evidence references */
    evidence: string[];
}
/**
 * CAR Trust Context
 *
 * Combines identity (from CAR) with trust (from attestations + runtime).
 *
 * IMPORTANT: The certificationTier comes from ATTESTATIONS, not the CAR itself.
 * The CAR is just an identifier; trust is computed at runtime.
 */
export interface CARTrustContext {
    /** Parsed CAR string (identifier only, no trust info) */
    car: ParsedCAR;
    /** Unique identity portion: registry.organization.agentClass */
    identity: CARIdentity;
    /** Competence/capability level from CAR */
    competenceLevel: CapabilityLevel;
    /** Domains the agent operates in (from CAR) */
    operationalDomains: string[];
    /** Certification tier from attestations (T0-T5) - defaults to T0 if no attestation */
    certificationTier: CertificationTier;
    /** Whether a valid attestation exists for this agent */
    hasValidAttestation: boolean;
    /** Attestation expiry (if any) */
    attestationExpiresAt?: Date;
    /** Current runtime trust tier based on behavioral signals */
    runtimeTier: RuntimeTier;
    /** Current runtime trust score (0-1000) */
    runtimeScore: TrustScore;
    /** Max tier based on observability class */
    observabilityCeiling: RuntimeTier;
    /** Max tier based on deployment context policy */
    contextPolicyCeiling: RuntimeTier;
    /** Effective tier after applying all ceilings */
    effectiveTier: RuntimeTier;
    /** Effective score after applying all ceilings */
    effectiveScore: TrustScore;
}
/** @deprecated Use CARTrustContext instead */
export type ACITrustContext = CARTrustContext;
/**
 * Result of effective permission calculation
 */
export interface EffectivePermission {
    /** Effective trust tier */
    tier: RuntimeTier;
    /** Effective trust score */
    score: TrustScore;
    /** Certified domains */
    domains: string[];
    /** Capability level */
    level: CapabilityLevel;
    /** Reason why the ceiling was applied (if any) */
    ceilingReason?: string;
}
/**
 * Trust signal derived from an attestation
 */
export interface TrustSignal {
    /** Unique signal identifier */
    id: string;
    /** Entity this signal is for */
    entityId: ID;
    /** Signal type */
    type: string;
    /** Signal value (impact on trust) */
    value: number;
    /** Weight multiplier */
    weight: number;
    /** Source of the signal */
    source: string;
    /** When this signal was created */
    timestamp: string;
    /** Additional metadata */
    metadata: Record<string, unknown>;
}
/**
 * Result of a permission check
 */
export interface PermissionCheckResult {
    /** Whether the action is allowed */
    allowed: boolean;
    /** Effective trust tier */
    effectiveTier: RuntimeTier;
    /** Effective trust score */
    effectiveScore: TrustScore;
    /** Reason for denial (if not allowed) */
    reason?: string;
    /** Explanation of which ceiling limited the permission */
    ceilingReason?: string;
}
/**
 * Schema for Attestation validation
 */
export declare const AttestationSchema: z.ZodObject<{
    id: z.ZodString;
    subject: z.ZodString;
    issuer: z.ZodString;
    trustTier: z.ZodType<CertificationTier>;
    scope: z.ZodArray<z.ZodString, "many">;
    issuedAt: z.ZodDate;
    expiresAt: z.ZodDate;
    evidence: z.ZodArray<z.ZodString, "many">;
}, "strip", z.ZodTypeAny, {
    id?: string;
    expiresAt?: Date;
    issuer?: string;
    scope?: string[];
    subject?: string;
    issuedAt?: Date;
    evidence?: string[];
    trustTier?: CertificationTier;
}, {
    id?: string;
    expiresAt?: Date;
    issuer?: string;
    scope?: string[];
    subject?: string;
    issuedAt?: Date;
    evidence?: string[];
    trustTier?: CertificationTier;
}>;
/**
 * Convert certification tier to minimum trust score
 */
export declare function certificationTierToMinScore(tier: CertificationTier): TrustScore;
/**
 * Convert certification tier to maximum trust score
 */
export declare function certificationTierToMaxScore(tier: CertificationTier): TrustScore;
/**
 * Convert certification tier to a representative trust score
 */
export declare function certificationTierToScore(tier: CertificationTier): number;
/**
 * Convert trust score to runtime tier
 */
export declare function scoreToTier(score: TrustScore): RuntimeTier;
/**
 * Get minimum score for a given tier
 */
export declare function tierToMinScore(tier: RuntimeTier): TrustScore;
/**
 * Convert competence level to ceiling tier
 */
export declare function competenceLevelToCeiling(level: CapabilityLevel): RuntimeTier;
/**
 * Determine which factor is limiting the effective tier
 */
export declare function determineCeilingReason(ctx: CARTrustContext, effectiveTier: RuntimeTier): string | undefined;
/**
 * Calculate effective permission from CAR context
 *
 * The effective tier is the minimum of:
 * 1. Certification tier (from attestations, NOT the CAR itself)
 * 2. Competence ceiling (what the agent's capability allows)
 * 3. Runtime tier (what behavioral signals indicate)
 * 4. Observability ceiling (what we can verify)
 * 5. Context policy ceiling (what the deployment allows)
 */
export declare function calculateEffectiveFromCAR(ctx: CARTrustContext): EffectivePermission;
/** @deprecated Use calculateEffectiveFromCAR instead */
export declare const calculateEffectiveFromACI: typeof calculateEffectiveFromCAR;
/**
 * Create a CAR Trust Context from a parsed CAR and attestation lookup.
 */
export declare function createCARTrustContext(parsedCAR: ParsedCAR, attestation: Attestation | null, runtimeScore: TrustScore, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): CARTrustContext;
/** @deprecated Use createCARTrustContext instead */
export declare const createACITrustContext: typeof createCARTrustContext;
/**
 * Convert attestation to Vorion trust signal
 */
export declare function attestationToTrustSignal(attestation: Attestation): TrustSignal;
/**
 * Apply CAR floor to runtime trust
 *
 * An agent with T3 certification starts at minimum T3 score.
 * The certification tier provides a "floor".
 */
export declare function applyCARFloor(runtimeScore: TrustScore, certificationTier: CertificationTier): TrustScore;
/** @deprecated Use applyCARFloor instead */
export declare const applyACIFloor: typeof applyCARFloor;
/**
 * Enforce CAR ceiling on runtime trust
 *
 * Runtime cannot exceed what the agent is certified for.
 */
export declare function enforceCARCeiling(runtimeScore: TrustScore, certificationTier: CertificationTier): TrustScore;
/** @deprecated Use enforceCARCeiling instead */
export declare const enforceACICeiling: typeof enforceCARCeiling;
/**
 * Calculate effective tier combining multiple factors
 */
export declare function calculateEffectiveTier(certificationTier: CertificationTier, competenceLevel: CapabilityLevel, runtimeTier: RuntimeTier, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): RuntimeTier;
/**
 * Calculate effective score combining multiple factors
 */
export declare function calculateEffectiveScore(certificationTier: CertificationTier, runtimeScore: TrustScore, observabilityCeiling: RuntimeTier, contextCeiling: RuntimeTier): TrustScore;
/**
 * Look up the certification tier for a CAR identity from attestations.
 */
export declare function lookupCertificationTier(identity: CARIdentity, attestations: Attestation[]): CertificationTier;
//# sourceMappingURL=car-integration.d.ts.map