/**
 * CompliancePack -- Interface and loader for pluggable compliance frameworks.
 *
 * Each compliance pack defines:
 *   - Required modules and their configuration
 *   - Validation rules
 *   - Provider restrictions
 *   - Retention policies
 *   - Incident notification deadlines
 *
 * Packs are composable: multiple packs can be active simultaneously.
 * When packs conflict, the strictest rule wins.
 *
 * @connexum/ai-governance
 */
export interface CompliancePack {
    /** Unique pack identifier (e.g., 'hipaa', 'soc2', 'gdpr') */
    id: string;
    /**
     * Optional public-facing alias identifiers for this pack.
     * GAP-S1-01: Allows site/packs.html short codes (e.g., 'MT-01', 'LG-04')
     * to resolve to the same pack object as the canonical id. Aliases are
     * case-insensitive and are registered in PackRegistry automatically.
     */
    aliases?: string[];
    /** Human-readable name */
    name: string;
    /** Pack version */
    version: string;
    /** Short description */
    description: string;
    /** Regulatory body or standard */
    authority: string;
    /** Target industries */
    industries: string[];
    /** Required governance modules */
    requiredModules: PackModule[];
    /** Module configuration overrides */
    moduleConfig: Record<string, Record<string, unknown>>;
    /** Provider restrictions */
    providerPolicy: PackProviderPolicy;
    /** Data handling rules */
    dataPolicy: PackDataPolicy;
    /** Retention requirements */
    retentionPolicy: PackRetentionPolicy;
    /** Incident notification rules */
    incidentPolicy: PackIncidentPolicy;
    /** Validation checks to run */
    validators: PackValidator[];
    /** RAG retrieval pairing with subsequent decision is mandatory for strict-mode packs. */
    requiresRetrievalAuditLogging?: boolean;
    /** Every claim grounded in retrieval must cite the source for auditor replay. */
    requiresCitations?: boolean;
    /** RAG retrieval limited to allowlisted sources under this pack. */
    requiresRagSourceAllowlist?: boolean;
    /** Maximum autonomy level (0-4) allowed without explicit operator attestation. */
    maxAutonomyLevelWithoutAttestation?: number;
    /** Hook profile recommendation: 'strict' / 'standard' / 'maintenance'. */
    recommendedHookProfile?: 'strict' | 'standard' | 'maintenance';
    /** Active provider health probe interval in milliseconds. */
    providerHealthCheckIntervalMs?: number;
    /** Action isolation requirement: true / false / 'sourced-only' (cycle-id-bound source/target overlap detection). */
    requiresActionIsolation?: boolean | 'sourced-only' | 'strict' | 'none';
}
export interface PackModule {
    /** Module name (e.g., 'encryption-layer', 'data-classifier') */
    name: string;
    /** Whether this module is mandatory for the pack */
    required: boolean;
    /** Reason it's needed */
    reason: string;
    /** Specific regulatory reference */
    reference: string;
}
export interface PackProviderPolicy {
    /** Providers explicitly blocked by this pack */
    blockedProviders: string[];
    /** Required capabilities for providers */
    requiredCapabilities: string[];
    /** Block reasons per provider */
    blockReasons: Record<string, string>;
}
export interface PackDataPolicy {
    /** Data categories to scan for */
    scanCategories: string[];
    /** Actions for each category: 'LOG' | 'WARN' | 'BLOCK' */
    categoryActions: Record<string, string>;
    /** Whether encryption at rest is required */
    encryptionRequired: boolean;
    /** Minimum encryption standard */
    encryptionStandard?: string;
    /** Data classification level required */
    minimumClassification?: string;
}
export interface PackRetentionPolicy {
    /** Audit log retention in days */
    auditLogRetentionDays: number;
    /** Session data retention in days */
    sessionRetentionDays: number;
    /** Incident record retention in days */
    incidentRetentionDays: number;
    /** Regulatory reference */
    reference: string;
    /**
     * P4-RET-02: When true, the pack requires data to be DELETED (not archived)
     * at end of the retention window. When false, archival is preferred over
     * deletion. When absent, PolicyMatrix defaults to 'delete'. Default: undefined.
     */
    forceDelete?: boolean;
    /**
     * P4-RET-02: When true (the conservative default), any record bound to
     * this pack must consult LegalHoldStore before any deletion proceeds.
     * Set explicitly to false only for packs where legal-hold consultation is
     * definitively not required. Default: true.
     */
    requiresLegalHoldSupport?: boolean;
    /**
     * P4-RET-02: Optional array of ISO jurisdiction codes this pack requires
     * data to remain within. Merged into the jurisdiction union.
     */
    sovereignty?: string[];
}
export interface PackIncidentPolicy {
    /** Initial notification deadline in hours */
    notificationDeadlineHours: number;
    /**
     * Secondary breach-reporting deadline in hours (distinct from the initial notification window).
     * Optional -- only present when a pack has a separate statutory window for formal breach reports
     * to a secondary regulator (e.g. ASIC s.912D 30-day window vs the primary s.994F 10-BD window).
     * F-NEW-VERA-PACK-FINAL-002 (2026-05-03): added for au-asic-rg-274.
     */
    breachReportingDeadlineHours?: number;
    /** Regulatory reference */
    reference: string;
    /** Required notification recipients */
    requiredRecipients: string[];
    /** Whether a formal breach notification template is required */
    formalNotificationRequired: boolean;
}
export interface PackValidator {
    /** Validator ID */
    id: string;
    /** What it checks */
    description: string;
    /** Regulatory reference */
    reference: string;
    /** The check function name (maps to validation logic) */
    check: string;
    /** Severity if check fails */
    failSeverity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
}
export interface PackValidationResult {
    packId: string;
    passed: boolean;
    checks: Array<{
        validatorId: string;
        description: string;
        passed: boolean;
        detail?: string;
    }>;
    score: number;
    totalChecks: number;
    passedChecks: number;
}
/**
 * Registry for managing compliance packs.
 *
 * Per-tenant scoping (F-NEW-PACK-HOT-RELOAD-1, 2026-05-04):
 *   activePacksByTenant tracks per-tenant pack selections. When a tenant
 *   has explicit rows, getActiveForTenant() returns those packs only.
 *   When a tenant has NO explicit rows, it falls back to the global
 *   activePacks set (env-var-seeded defaults).
 *
 *   This allows ACTIVE_PACKS env var to seed defaults for all tenants
 *   that haven't individually customised their pack selection, while
 *   tenants that have customised get strict isolation.
 */
export declare class PackRegistry {
    private packs;
    private activePacks;
    /**
     * GAP-S1-01: alias -> canonical pack id mapping.
     * Populated automatically when packs with `aliases` are registered.
     * Keys are stored lowercase for case-insensitive lookup.
     */
    private aliasIndex;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: per-tenant pack selections.
     * Key = tenantId. Value = Set of canonical pack IDs active for that tenant.
     * When a tenant has an entry here, getActiveForTenant() returns ONLY those
     * packs. When absent (and NOT in tenantsWithExplicitMgmt), falls back to
     * the global activePacks (env defaults).
     */
    private activePacksByTenant;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: tracks tenants that have opted into explicit
     * per-tenant pack management (via activateForTenant or deactivateForTenant).
     * Once a tenant opts in, getActiveForTenant() NEVER falls back to global
     * defaults -- it returns only what the tenant has explicitly activated.
     * This prevents a tenant's deactivation from accidentally re-enabling
     * all globally-seeded packs through the fallback path.
     */
    private tenantsWithExplicitMgmt;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: per-tenant mutation version counters.
     * Incremented on every activateForTenant / deactivateForTenant call.
     * PackEvaluator stores the version at cache-build time and compares on
     * cache hit -- if the version has advanced, the cache entry is stale
     * and must be rebuilt. This avoids relying on cross-bus event delivery
     * for cache invalidation.
     */
    private tenantVersions;
    /**
     * Return the current mutation version for a tenant. Returns 0 if the
     * tenant has never been explicitly managed.
     */
    getTenantVersion(tenantId: string): number;
    /**
     * Register a compliance pack.
     * If the pack declares `aliases`, each alias is indexed so that
     * `get(alias)` and `activate(alias)` resolve to the same pack.
     */
    register(pack: CompliancePack): void;
    /**
     * Resolve a pack id or alias to its canonical id.
     * Returns undefined when neither matches.
     */
    private resolveId;
    /**
     * Activate a pack by ID or alias.
     */
    activate(packId: string): void;
    /**
     * Deactivate a pack (by canonical id or alias).
     */
    deactivate(packId: string): void;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: activate a pack for a specific tenant.
     * Creates the tenant's pack set if it does not exist yet.
     * Backward-compat: env-var-driven activations via activate() remain in
     * the global activePacks set and serve as fallback for tenants that have
     * NEVER called activateForTenant() or deactivateForTenant().
     */
    activateForTenant(tenantId: string, packId: string): void;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: deactivate a pack for a specific tenant.
     * Once a tenant has called activateForTenant() or deactivateForTenant(),
     * it is in "explicit management" mode and will NEVER fall back to the
     * global default set -- even if all packs are subsequently deactivated.
     */
    deactivateForTenant(tenantId: string, packId: string): void;
    /**
     * F-NEW-PACK-REGISTRY-TENANT-LIFECYCLE: remove all per-tenant pack state
     * for a deleted tenant.
     *
     * Clears three coupled state structures:
     *   1. activePacksByTenant  -- the Set of active pack IDs for this tenant.
     *   2. tenantsWithExplicitMgmt -- the "opted into explicit management" flag.
     *   3. tenantVersions       -- the mutation version counter used by PackEvaluator
     *                             for cache invalidation.
     *
     * After this call, getActiveForTenant(tenantId) returns the global-default
     * pack set (env-var seeds) because the tenant is no longer in explicit
     * management mode. This is safe: a deleted tenant's org should never appear
     * in a subsequent enforcement path. Callers responsible for tenant deletion
     * must call this method to prevent unbounded growth of the Maps.
     *
     * FUTURE CALL SITE: When a full org/tenant deletion lifecycle is implemented
     * (F-NEW-TENANT-DELETION-LIFECYCLE), call `packRegistry.clearTenant(tenantId)`
     * immediately before or after the org record is deleted. The relevant location
     * is wherever `tenantPackActivations` is purged in `compliance-routes.ts`, or
     * a new top-level DELETE /api/v1/tenants/:tenantId endpoint. See the filed
     * gap finding F-NEW-TENANT-DELETION-LIFECYCLE.
     *
     * @param tenantId - The tenant whose pack state should be wiped.
     * @returns The number of pack IDs that were active at the time of clearing.
     */
    clearTenant(tenantId: string): number;
    /**
     * F-NEW-PACK-HOT-RELOAD-1: get active packs for a specific tenant.
     *
     * Resolution order:
     *   1. If tenant is in explicit management mode (tenantsWithExplicitMgmt):
     *      return ONLY the packs explicitly activated for this tenant.
     *      An empty set means no packs are active (even if global has packs).
     *   2. Otherwise fall back to global activePacks (env-var / boot defaults).
     *
     * Tenants enter explicit management mode on their FIRST call to
     * activateForTenant() or deactivateForTenant(). Once in that mode,
     * the global set is never consulted for that tenant.
     */
    getActiveForTenant(tenantId: string): CompliancePack[];
    /**
     * Get all active packs.
     * Returns the global (env-var-seeded) set. Use getActiveForTenant() in
     * enforcement paths where per-tenant isolation is required.
     *
     * @deprecated in enforcement paths -- prefer getActiveForTenant(tenantId).
     * Kept for backward compatibility: report endpoints, prewarm, boot checks,
     * and single-tenant deployments that never call activateForTenant().
     */
    getActive(): CompliancePack[];
    /**
     * Get a pack by ID or alias.
     */
    get(packId: string): CompliancePack | null;
    /**
     * GAP-S1-01: Return all registered alias -> canonical id mappings.
     * Used by alignment tests to verify every public code resolves.
     */
    getAliasIndex(): ReadonlyMap<string, string>;
    /**
     * Get all registered packs.
     */
    getAll(): CompliancePack[];
    /**
     * Get merged module requirements from all active packs.
     * When packs overlap, required=true wins over required=false.
     */
    getMergedModules(): PackModule[];
    /**
     * Get merged provider policy (strictest wins).
     */
    getMergedProviderPolicy(): PackProviderPolicy;
    /**
     * Get the strictest retention policy across active packs.
     */
    getMergedRetentionPolicy(): PackRetentionPolicy;
    /**
     * Get the tightest incident deadline across active packs.
     */
    getMergedIncidentPolicy(): PackIncidentPolicy;
    /**
     * Validate current governance setup against all active packs.
     *
     * P1C-03 contract: every validator runs through ComplianceCheckRegistry.
     * Unregistered check ids HARD-FAIL with a governance-defect verdict
     * (ComplianceCheckRegistry.run returns passed=false with defect-language
     * detail). There is no neutral-pass or soft-landing path. Callers that
     * do not supply a registry get the defaultCheckRegistry, which has
     * every production check id registered and is verified at server boot.
     */
    validate(opts?: {
        registry?: import('./check-registry').ComplianceCheckRegistry;
        context?: import('./check-registry').ComplianceCheckContext;
    }): PackValidationResult[];
    /**
     * Called by the PackChangeChannel subscriber when a NOTIFY message arrives
     * from another replica.
     *
     * Applies the same mutation that the route handler would apply on the
     * receiving replica — without going through the HTTP layer or the DB write
     * path (the DB was already written by the publishing replica).
     *
     * If the pack is not registered on this replica (should not happen in
     * production because all replicas share the same pack catalogue) the call
     * is a no-op with a warning.
     *
     * @param orgId   Tenant that owns the change.
     * @param packId  Canonical pack ID.
     * @param action  'activate' | 'deactivate'
     */
    refreshFromChannel(orgId: string, packId: string, action: 'activate' | 'deactivate'): void;
}
/**
 * Semver comparator -- returns negative/zero/positive like Array.sort.
 * Handles `\d+.\d+.\d+` format only (the structural-consistency test enforces this).
 */
export declare function compareSemver(a: string, b: string): number;
/**
 * VersionedPackRegistry: extends PackRegistry with parallel version support.
 *
 * Each pack ID maps to a Map<semver, CompliancePack> (multiple concurrent
 * versions in memory). A single "active version" per pack ID is tracked
 * and is the version returned by getActiveVersion().
 *
 * Migration manifest integration:
 *   - At construction time, the registry checks the migration manifest
 *     for deprecation warnings (< 90 days) and hard-refuses (past
 *     deprecation date).
 */
export declare class VersionedPackRegistry extends PackRegistry {
    /** Map<packId, Map<semver, CompliancePack>> */
    private versionedPacks;
    /** Map<packId, semver> -- the currently active (pinned) version per pack */
    private activeVersions;
    /**
     * Register a specific version of a pack.
     * Also registers it in the parent PackRegistry (latest wins there).
     */
    registerVersion(pack: CompliancePack): void;
    /**
     * Get the currently active version of a pack.
     * Falls back to the parent registry if no versioned entry exists.
     */
    getActiveVersion(packId: string): CompliancePack | undefined;
    /**
     * Get a specific semver of a pack.
     */
    getVersion(packId: string, semver: string): CompliancePack | undefined;
    /**
     * List all registered semver strings for a pack, sorted ascending.
     */
    listVersions(packId: string): string[];
    /**
     * Pin a project to a specific pack version for classify-time use.
     * Used by W2 project pinning + W3 upgrade flow.
     *
     * @param packId - Pack to pin
     * @param semver - Version to activate
     * @throws if the version is not registered
     */
    pinVersion(packId: string, semver: string): void;
    /**
     * Get a CompliancePack for classify-time use, respecting project version pins.
     *
     * @param packId - Pack to look up
     * @param projectVersions - Per-project selectedPackVersions map
     */
    getForProject(packId: string, projectVersions?: Record<string, string>): CompliancePack | undefined;
}
export interface PackMigrationEntry {
    /** Pack ID */
    packId: string;
    /** The version being deprecated */
    deprecatedVersion: string;
    /** ISO-8601 date when the deprecation takes effect (hard-refuse after this) */
    deprecationDate: string;
    /** Human-readable notes about what changed */
    breakingChangeNotes?: string;
    /** Recommended upgrade version */
    upgradeTo?: string;
}
/**
 * MigrationManifest -- loaded at boot. Provides:
 *   - Boot warnings when any loaded pack version is within 90 days of deprecation.
 *   - Boot refusal when any loaded pack version is past its deprecation date.
 *
 * Deprecation window: deprecated versions remain enforceable for a minimum of
 * 180 days. Boot-warning at 90 days. Hard-refuse at the declared deprecation date.
 */
export declare class MigrationManifest {
    private entries;
    /** Resolved at construction time for testable clock injection */
    private nowFn;
    constructor(entries: PackMigrationEntry[], nowFn?: () => Date);
    /**
     * Check all registered packs against the manifest.
     *
     * @returns An object with warnings (within 90 days) and errors (past date).
     *   Call this at boot time. If errors is non-empty, refuse to start.
     */
    check(loadedPacks: CompliancePack[]): {
        warnings: string[];
        errors: string[];
    };
    /**
     * Validate and apply boot checks. Writes warnings to stderr and throws
     * GovernanceMigrationError if any packs are past their deprecation date.
     */
    applyBootChecks(loadedPacks: CompliancePack[]): void;
    getEntries(): PackMigrationEntry[];
}
export declare class GovernanceMigrationError extends Error {
    readonly violations: string[];
    constructor(message: string, violations: string[]);
}
//# sourceMappingURL=index.d.ts.map