/**
 * Human-Input Compliance Gate — Trust Score component #5.
 *
 * When a human-in-the-loop sends input TO an agent, evaluate that input against
 * the agent's bound COMPLIANCE packs and return a WARN/BLOCK advisory. This
 * catches a human operator INNOCENTLY requesting a rule-breaking action — e.g.
 * "email the full patient record to dr.smith@external.com" — which contains no
 * adversarial pattern but violates a HIPAA PHI-exfiltration rule.
 *
 * This is ORTHOGONAL to adversarial prompt-injection detection
 * (src/security/prompt-injection-detector.ts): that catches attacks; this
 * catches honest human compliance errors. Both gates coexist on the inbound path.
 *
 * Reuses the existing PackDrivenClassifier — no new classification logic. The
 * classifier already maps text + bound packs → a 5-action GovernanceAction.
 *
 * Locked Invariant 3 (graceful degradation): this function NEVER throws. Any
 * internal error fails OPEN (advisory 'ALLOW') so the gate never blocks an agent
 * because of its own fault. The CALLER decides whether to enforce a BLOCK/
 * REQUIRE_APPROVAL advisory (the SDK's existing GovernanceViolation /
 * GovernancePendingApproval contract) — the gate itself is purely advisory.
 *
 * @connexum/ai-governance  F-NEW-TRUST-SCORE-5
 */
import { type GovernanceAction, type CategoryMatch, type PackDrivenClassifier } from '../classification/pack-driven-classifier.js';
/** The advisory the gate returns (mirrors the 5-action GovernanceAction). */
export type InputComplianceAdvisory = GovernanceAction;
export interface HumanInputComplianceResult {
    /** Strictest action matched across the agent's bound packs, or 'ALLOW'. */
    advisory: InputComplianceAdvisory;
    /** Compliance categories the human input matched (empty when clean). */
    matched: CategoryMatch[];
    /** Classifier decision id for audit correlation, or null when not evaluated. */
    decisionId: string | null;
    /** True iff a bound compliance rule matched with a non-ALLOW action. */
    flagged: boolean;
    /** Human-readable explanation (for stderr / audit / operator surface). */
    reason: string;
}
export interface HumanInputComplianceConfig {
    /**
     * Injectable classifier (defaults to the process-global classifier loaded at
     * SDK boot). Only `evaluate` is required, which keeps tests trivial to mock.
     */
    classifier?: Pick<PackDrivenClassifier, 'evaluate'>;
    /** Set false to disable the gate entirely (returns ALLOW). Default: enabled. */
    enabled?: boolean;
}
/**
 * Evaluate human-in-the-loop input against the agent's bound compliance packs.
 *
 * @param inputText      The human/operator input (e.g. concatenated user messages).
 * @param activePackIds  The agent's bound compliance pack ids (filters evaluation).
 * @param config         Optional injectable classifier + enable flag.
 * @returns              A never-throwing advisory result; fails OPEN to ALLOW on error.
 */
export declare function evaluateHumanInputCompliance(inputText: string, activePackIds: readonly string[], config?: HumanInputComplianceConfig): HumanInputComplianceResult;
//# sourceMappingURL=human-input-compliance-gate.d.ts.map