/**
 * Org-level policy inheritance for workspace-scoped compliance configuration.
 *
 * Pack-binding primacy: every policy decision traces to the compliance pack.
 * The pack supplies the policy floor. Tenants may ADD stricter overrides on
 * top via TenantPolicyOverride but NEVER loosen below the pack minimum.
 *
 * Strictest-wins resolution order:
 *   1. Workspace override (if present and STRICTER than pack floor)
 *   2. Pack default (from pack.retentionPolicy / pack.moduleConfig)
 *   3. System default (if neither workspace nor pack specifies)
 *
 * Integration note (P4-RET-02):
 *   PolicyMatrix calls resolveInherited() to determine effective retention
 *   settings. If P4-RET-02 has not merged yet, the stub below returns the
 *   pack default directly.
 *
 * @connexum/ai-governance tenant substrate
 */
import type { CompliancePack } from '../packs/index';
/**
 * The set of policy fields a workspace may override.
 * Each field has a pack-defined floor that workspace overrides cannot breach.
 */
export type PolicyOverrideField = 'retentionDays' | 'minConfidenceAutonomous' | 'tokenBudgetPerCycle' | 'timeoutMs' | 'approvalTier';
export interface PolicyOverride {
    /** The policy field being overridden. */
    field: PolicyOverrideField;
    /** The workspace-configured value (must be stricter than pack floor). */
    value: unknown;
    /** Human-readable justification, required for audit. */
    reason: string;
}
export interface TenantPolicy {
    policyId: string;
    workspaceId: string;
    /** The compliance pack this override applies to. */
    packId: string;
    overrides: PolicyOverride[];
    createdBy: string;
    createdAt: string;
    /** ISO timestamp from which this policy is active. */
    activeFromAt: string;
    /** Optional expiry. When absent the policy is perpetually active. */
    activeUntilAt?: string;
}
export declare class PolicyWeakeningRefusedError extends Error {
    readonly field: PolicyOverrideField;
    readonly packFloor: unknown;
    readonly attempted: unknown;
    constructor(field: PolicyOverrideField, packFloor: unknown, attempted: unknown);
}
export interface AppendPolicyAuditFn {
    (workspaceId: string, entry: Record<string, unknown>): Promise<void>;
}
export declare class PolicyInheritanceResolver {
    private policies;
    private byWorkspacePack;
    private audit?;
    /** Pack loader: injected so the resolver can read pack floors. */
    private loadPack;
    constructor(opts: {
        loadPack: (packId: string) => CompliancePack | undefined;
        appendAudit?: AppendPolicyAuditFn;
    });
    private emit;
    private wsPackKey;
    /**
     * Resolve the effective policy value for a given workspace, pack, and field.
     *
     * Resolution order (strictest-wins):
     *   1. If workspace has an active override for this pack+field, use it
     *      (the override is guaranteed to be >= pack floor by setOverride).
     *   2. Pack floor (extracted from retentionPolicy / moduleConfig).
     *   3. System default.
     *
     * TODO(P4-RET-02): When PolicyMatrix lands, it calls this method.
     * Until then, stub: returns pack floor when no workspace override exists.
     */
    resolveInherited(workspaceId: string, packId: string, field: PolicyOverrideField): unknown;
    private isPolicyActive;
    /**
     * Create or replace the TenantPolicy for a workspace+pack combination.
     *
     * Fail-closed: if ANY override would loosen below the pack floor,
     * the entire operation is rejected with PolicyWeakeningRefusedError.
     * No partial writes occur.
     */
    setOverride(params: Omit<TenantPolicy, 'policyId' | 'createdAt'>): Promise<TenantPolicy>;
    /**
     * Update an existing policy's overrides.
     * Same strictest-wins validation applies -- any weakening attempt throws.
     */
    updateOverride(policyId: string, updates: {
        overrides: PolicyOverride[];
        updatedBy: string;
    }): Promise<TenantPolicy>;
    /**
     * Delete a TenantPolicy by ID.
     * After deletion, resolveInherited falls back to pack floor / system default.
     */
    deleteOverride(policyId: string, deletedBy: string): Promise<void>;
    getPolicy(policyId: string): TenantPolicy | null;
    listPolicies(workspaceId: string): TenantPolicy[];
}
export declare function getPolicyInheritanceResolver(opts: {
    loadPack: (packId: string) => CompliancePack | undefined;
    appendAudit?: AppendPolicyAuditFn;
}): PolicyInheritanceResolver;
/** Test helper. */
export declare function __resetPolicyResolverForTest(): void;
//# sourceMappingURL=policy-inheritance.d.ts.map