/**
 * ComplianceContractPort — runtime compliance gate for the Vauban Integration Spine.
 *
 * Implements the G-2 Cedar pivot from S5 spec:
 * - pre-step: block or warn before capability invocation
 * - post-step: audit trail after invocation
 * - validateManifest: conflict detection at registration
 *
 * Cedar policy bundles: eu.gdpr / eu.mica / eu.tfr (V0 scope per S5 Q5.1).
 */
export type Jurisdiction = "FR.v1" | "EU.v1" | "CH.v1" | "UK.v1" | "SG.v1";
export declare const SUPPORTED_JURISDICTIONS_V0: Jurisdiction[];
export type LegalBasisRef = "gdpr.art6_1_a" | "gdpr.art6_1_b" | "gdpr.art6_1_c" | "gdpr.art6_1_f" | "mica.art14" | "tfr.art4" | "cjeu.c520_21";
export type LegalBasisDomain = "processing" | "retention" | "transfer" | "consent";
export interface LegalBasisDecl {
    domain: LegalBasisDomain;
    basis: LegalBasisRef;
    scope?: Jurisdiction[];
}
export type DataClass = "public" | "internal" | "confidential" | "secret";
export type EnforcementLevel = "block" | "warn" | "log";
export type RuleSource = "declared" | "normative";
export interface ComplianceRule {
    readonly id: string;
    readonly source: RuleSource;
    readonly jurisdiction: Jurisdiction;
    readonly legal_ref: LegalBasisRef;
    readonly enforcement: EnforcementLevel;
    readonly rationale: string;
    readonly authority?: string;
}
export type ComplianceMode = "strict" | "audit_only";
export interface ComplianceContract {
    readonly jurisdictions: Jurisdiction[];
    readonly legal_bases: LegalBasisDecl[];
    readonly data_class: DataClass;
    readonly mode: ComplianceMode;
    readonly tier: string;
    readonly rules: ComplianceRule[];
    readonly retention: string;
    readonly audit_format?: "json" | "pdf";
}
export interface CapabilityInvocation {
    readonly action: string;
    readonly tenantId: string;
    readonly dataClass: DataClass;
    readonly legalBasis?: LegalBasisRef;
    readonly jurisdiction?: Jurisdiction;
    readonly requiresConsent?: boolean;
    readonly requiresVerifiedHuman?: boolean;
    readonly stepIndex?: number;
    readonly workflowRunId?: string;
}
export interface TenantContext {
    readonly tenantId: string;
    readonly glacisMode: "verified" | "degraded_verified" | "unverified";
    readonly verifiedHuman: boolean;
    readonly jurisdictions: Jurisdiction[];
}
export interface ComplianceViolation {
    readonly ruleId: string;
    readonly articleRef: string;
    readonly description: string;
    readonly severity: "block" | "warn";
    readonly remediationHint?: string;
}
export type ComplianceGate = {
    readonly decision: "proceed";
    readonly warnings: ComplianceViolation[];
} | {
    readonly decision: "block";
    readonly violation: ComplianceViolation;
};
export interface ComplianceAuditResult {
    readonly decision: "proceed" | "block" | "warn";
    readonly violations: ComplianceViolation[];
    readonly auditClaimEmitted: boolean;
    readonly evaluatedRules: number;
}
export interface PolicyConflict {
    readonly rule1Id: string;
    readonly rule2Id: string;
    readonly description: string;
    readonly status: "CONFLICT" | "CONFLICT_UNDETERMINED";
}
export interface ManifestValidationResult {
    readonly valid: boolean;
    readonly conflicts: PolicyConflict[];
    readonly missingLegalBases: string[];
    readonly jurisdictionWarnings: string[];
    readonly evaluationTimeMs: number;
}
export interface ComplianceContractPort {
    /**
     * Pre-step gate — called before any capability invocation.
     * In 'strict' mode: block on first violation.
     * In 'audit_only' mode: never block, accumulate warnings.
     */
    preStep(invocation: CapabilityInvocation, contract: ComplianceContract, ctx: TenantContext): Promise<ComplianceGate>;
    /**
     * Post-step audit — called after capability invocation to emit audit claims.
     * Always runs regardless of pre-step outcome.
     */
    postStep(invocation: CapabilityInvocation, contract: ComplianceContract, ctx: TenantContext): Promise<ComplianceAuditResult>;
    /**
     * Manifest validation — called at registration, before any workflow runs.
     * Cedar conflict detection per G-3. Timeout → CONFLICT_UNDETERMINED (not fail).
     */
    validateManifest(contract: ComplianceContract, opts?: {
        timeoutMs?: number;
    }): Promise<ManifestValidationResult>;
}
export declare class CompliancePolicyError extends Error {
    readonly ruleId: string;
    readonly cause?: unknown | undefined;
    constructor(message: string, ruleId: string, cause?: unknown | undefined);
}
export declare class ComplianceEvaluationTimeoutError extends Error {
    readonly timeoutMs: number;
    readonly cause?: unknown | undefined;
    constructor(timeoutMs: number, cause?: unknown | undefined);
}
//# sourceMappingURL=compliance-contract.d.ts.map