/**
 * ProviderCompliance -- LLM provider compliance verification.
 *
 * Verifies that LLM providers meet compliance requirements for
 * regulated workloads. Blocks providers that cannot meet BAA,
 * GDPR transfer, or other regulatory obligations.
 *
 * Policy:
 *   - Only US/EU-based providers with verified compliance posture
 *   - DeepSeek blocked: PRC National Intelligence Law conflicts with
 *     GDPR (Art. 44-49), HIPAA (BAA requirement), FedRAMP, DORA
 *   - Per-pack provider restrictions (HIPAA pack blocks non-BAA providers)
 *
 * @connexum/ai-governance
 */
export type ReviewCadence = '30d' | '90d' | '180d' | '365d';
/**
 * Registration payload from an LLM provider adapter.
 * Adapters call `providerCompliance.register()` on module load.
 * Fields mirror ProviderComplianceRegistration in src/llm-adapters/index.ts.
 */
export interface AdapterProviderRegistration {
    providerId: string;
    baa: boolean;
    /** If BAA coverage is modality-restricted (e.g. 'text-modalities-only') */
    baaScope?: string;
    /** Public URL where the BAA/DPA attestation can be verified */
    attestationUrl?: string;
    /** ISO-8601 date when the attestation was last human-verified */
    attestationDate?: string;
    /** Re-verification cadence for the governance team */
    reviewCadence?: ReviewCadence;
    gdprDpa: boolean;
    soc2Type2: boolean;
    sovereignty: string;
    /** Google-specific: BAA only via vertex-ai path */
    baaPath?: string;
    /** Human-readable note about BAA scope limitations */
    baaNote?: string;
}
export interface ProviderComplianceConfig {
    /** Active compliance packs (e.g., 'hipaa', 'gdpr', 'pci-dss', 'sox', 'dora') */
    activePacks: string[];
    /** Custom blocked providers (in addition to pack-based blocks) */
    customBlocklist?: string[];
    /** Custom allowed providers (overrides pack defaults, use with caution) */
    customAllowlist?: string[];
    /**
     * Strict mode for KNOWN providers with partial capability coverage.
     *
     * - `true` (default, fail-closed): a known provider that lacks a capability
     *   required by an active pack (e.g., no BAA under HIPAA) is rejected.
     * - `false` (permissive, NOT for production): known providers with missing
     *   capabilities are allowed with warnings. Emits a loud warning at
     *   construction so operators cannot silently run in permissive mode.
     *
     * UNKNOWN providers (not in PROVIDER_DB) are ALWAYS rejected, regardless
     * of this flag. strictMode does not unlock unknown providers. C-2 remediation
     * (2026-04-21): default flipped from false to true to restore fail-closed
     * posture for compliance evaluation paths.
     */
    strictMode?: boolean;
    /** Pack-based provider policies (from PackRegistry.getMergedProviderPolicy) */
    packPolicies?: PackProviderPolicyInput[];
}
/** Input from compliance pack provider policies (T-083) */
export interface PackProviderPolicyInput {
    packId: string;
    blockedProviders: string[];
    requiredCapabilities: string[];
    blockReasons: Record<string, string>;
}
/** EU AI Act GPAI model compliance check result (T-064) */
export interface GPAICheck {
    provider: string;
    model?: string;
    gpaiCompliant: boolean;
    obligations: GPAIObligation[];
    riskTier: 'STANDARD' | 'SYSTEMIC_RISK';
    missingObligations: string[];
}
export interface GPAIObligation {
    article: string;
    requirement: string;
    met: boolean;
    detail?: string;
}
export interface ProviderCheck {
    provider: string;
    allowed: boolean;
    reasons: string[];
    blockedByPacks: string[];
    complianceCaps: string[];
}
export interface ProviderProfile {
    name: string;
    /** Canonical ID used for matching */
    id: string;
    /** Country/region of headquarters */
    jurisdiction: string;
    /** Known compliance capabilities */
    capabilities: string[];
    /** Packs that block this provider */
    blockedBy: string[];
    /** Why it's blocked (per pack) */
    blockReasons: Record<string, string>;
    /**
     * SYSTEMIC-P3: Attestation metadata. All entries MUST have these fields.
     * Capabilities self-asserted without a source URL and date are unverifiable
     * and constitute an audit gap under SOC 2 CC3.2, HIPAA 164.308(a)(1)(ii)(D).
     */
    /** URL of the provider's compliance documentation page */
    attestationUrl: string;
    /**
     * ISO-8601 date when attestation was last human-verified by the governance
     * team. `null` means the date has not been independently verified and the
     * entry should not be treated as attested. See `verificationStatus`.
     */
    attestationDate: string | null;
    /**
     * Verification state. `verified` = a human pulled the dated attestation
     * document from the provider's trust portal and set `attestationDate`
     * accordingly. `pending` = we believe the attestation exists but have not
     * verified the date. `not-applicable` = no commercial attestation is
     * issued for this provider class (e.g. open-source model weights).
     * `blocked` = provider is in `blockedBy` for all relevant packs and an
     * attestation date is not expected by design.
     */
    verificationStatus: 'verified' | 'pending' | 'not-applicable' | 'blocked';
    /** How frequently the governance team should re-verify this entry */
    reviewCadence: ReviewCadence;
}
export declare class ProviderCompliance {
    private config;
    private providerDb;
    constructor(config: ProviderComplianceConfig);
    /**
     * Report whether this instance is running in the fail-closed (strict) posture.
     * Used by the boot-hook and operator tooling.
     */
    isStrictMode(): boolean;
    /**
     * Read-only accessor for active packs. Used by the boot-hook to report
     * configuration state without exposing the full internal config.
     */
    getActivePacks(): string[];
    /**
     * Check if a provider is compliant with active packs.
     */
    check(providerId: string): ProviderCheck;
    /**
     * Check if a provider is allowed (simple boolean).
     */
    isAllowed(providerId: string): boolean;
    /**
     * Get all allowed providers for the current pack configuration.
     */
    getAllowedProviders(): ProviderProfile[];
    /**
     * Get all blocked providers with reasons.
     */
    getBlockedProviders(): ProviderCheck[];
    /**
     * Get a provider's full compliance profile.
     */
    getProfile(providerId: string): ProviderProfile | null;
    /**
     * P3-SUB-01 Section 3.2: Register an LLM adapter's compliance metadata.
     *
     * If `baa: true` is declared without `attestationUrl` or `attestationDate`,
     * a CRITICAL warning is logged and the provider is treated as `baa: false`
     * for pack evaluations until the registration is corrected.
     *
     * This adds or updates the provider profile in the compliance database so
     * `check()`, `isAllowed()`, and pack evaluation include the adapter's
     * compliance posture.
     */
    register(registration: AdapterProviderRegistration): void;
    /**
     * Add a custom provider profile.
     * SYSTEMIC-P3: validates that attestation metadata is present before
     * accepting the profile. A profile without attestationUrl, attestationDate,
     * and reviewCadence is rejected -- self-asserted capabilities without a
     * traceable source are an audit gap.
     */
    addProvider(profile: ProviderProfile): void;
    /**
     * SYSTEMIC-P3: Validate that a provider profile has all required attestation
     * metadata. Returns true if valid; false + logs a warning if fields are missing.
     * Called by addProvider and can be called standalone by operator tooling.
     */
    validateAttestation(profile: Pick<ProviderProfile, 'id' | 'attestationUrl' | 'attestationDate' | 'reviewCadence'>): boolean;
    /**
     * Generate a compliance report for all known providers.
     */
    generateReport(): {
        activePacks: string[];
        totalProviders: number;
        allowed: number;
        blocked: number;
        providers: ProviderCheck[];
    };
    /**
     * T-064: Check EU AI Act GPAI compliance for a provider.
     *
     * Verifies Art. 53 (all GPAI) and Art. 55 (systemic risk) obligations.
     * Systemic risk tier applies to models with >10^25 FLOPs or designated by AI Office.
     */
    checkGPAI(providerId: string, opts?: {
        systemicRisk?: boolean;
        model?: string;
    }): GPAICheck;
    /**
     * T-083: Apply provider policies from compliance packs.
     *
     * Merges pack blocklists into the provider database.
     * Called on construction if packPolicies are provided,
     * or can be called at runtime when packs change.
     */
    applyPackPolicies(policies: PackProviderPolicyInput[]): void;
    /**
     * T-083: Get which packs block a specific provider.
     */
    getBlockingPacks(providerId: string): string[];
    /**
     * T-191: Check GDPR data transfer compliance for a provider.
     *
     * Validates transfer mechanisms per GDPR Art. 44-49:
     *   - EU/EEA providers: no transfer mechanism needed
     *   - Adequacy decision countries: permitted under Art. 45
     *   - US providers: DPF (Data Privacy Framework) as primary, SCCs as fallback
     *   - Other: requires SCCs or binding corporate rules
     *   - PRC/restricted: blocked (no viable mechanism post-Schrems II)
     */
    checkGDPRTransfer(providerId: string): GDPRTransferCheck;
    /**
     * T-191: Get data residency configuration for a provider.
     */
    getDataResidency(providerId: string): DataResidencyInfo;
    /**
     * T-191: Filter providers by GDPR transfer compliance.
     * Returns only providers with valid transfer mechanisms.
     */
    getGDPRCompliantProviders(): GDPRTransferCheck[];
}
export type GDPRTransferMechanism = 'NOT_REQUIRED' | 'ADEQUACY_DECISION' | 'DPF' | 'SCCS' | 'BCR' | 'NONE';
export interface GDPRTransferCheck {
    provider: string;
    jurisdiction: string;
    transferAllowed: boolean;
    mechanism: GDPRTransferMechanism;
    mechanisms: GDPRTransferMechanism[];
    detail: string;
}
export interface DataResidencyInfo {
    provider: string;
    jurisdiction: string;
    euRegionAvailable: boolean;
    dataProcessingLocations: string[];
}
//# sourceMappingURL=provider-compliance.d.ts.map