/**
 * ClassificationRule table for the P4-RET-01 data classifier.
 *
 * Maps write-site signatures (string literals or RegExp patterns) to
 * DataClass values. The `packBindingResolver` and `sovereigntyResolver`
 * are called at classification time with the caller-supplied context.
 *
 * DEFAULT DENY: there is no fallback rule. Any write site not listed here
 * causes DataClassifier.classify() to throw UnclassifiedWriteError
 * synchronously at the storage call site (AC 3, AC 19).
 *
 * Write-site strings must be stable identifiers -- prefer module-path style
 * (e.g. 'audit:chain:append') so they survive refactors without silent
 * reclassification.
 *
 * @connexum/ai-governance
 */
import { DataClass, type SovereigntyZone } from './data-class';
/** Minimal context available at a storage write site. */
export interface ClassificationContext {
    /** Owning tenant */
    tenantId: string;
    /** Contract this write belongs to */
    contractId: string;
    /**
     * Pack IDs active for this tenant at write time.
     * The classifier intersects these with the resolver output to produce
     * the final packBinding. Empty means no packs -- write is refused.
     */
    activePackIds: string[];
    /** Optional: explicit sovereignty hint from the caller. */
    sovereigntyHint?: SovereigntyZone;
}
export interface ClassificationRule {
    /**
     * Identifies the write site. Can be:
     *   - A string for exact match (preferred for stability).
     *   - A RegExp for pattern match (use sparingly -- string is faster).
     */
    writeSitePattern: string | RegExp;
    /** Data class assigned to records at this write site. */
    dataClass: DataClass;
    /**
     * Returns the pack IDs that should govern records at this write site.
     * The classifier intersects this with ctx.activePackIds -- if the
     * result is empty, UnboundDataError is thrown.
     *
     * Return ctx.activePackIds to bind to ALL active packs (most write sites).
     * Return a subset for write sites that are only governed by specific packs.
     */
    packBindingResolver: (ctx: ClassificationContext) => string[];
    /**
     * Returns the sovereignty zone for records at this write site.
     * Defaults to 'global' when no sovereignty is resolvable from context.
     */
    sovereigntyResolver: (ctx: ClassificationContext) => SovereigntyZone;
}
export declare const DEFAULT_CLASSIFICATION_RULES: ClassificationRule[];
//# sourceMappingURL=classification-rules.d.ts.map