/**
 * ENFORCE - Policy Decision Point with Fluid Governance
 *
 * Makes enforcement decisions based on rule evaluations and trust levels.
 * Supports three-tier fluid governance (GREEN/YELLOW/RED) with refinement
 * options for agents to modify requests.
 *
 * @packageDocumentation
 */
import type { Intent, ControlAction, TrustLevel, TrustScore, ID } from '../common/types.js';
import type { EvaluationResult } from '../basis/types.js';
import { type Decision, type RefinementOption, type WorkflowInstance } from './repository.js';
import type { EscalationService } from '../intent/escalation.js';
import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
/**
 * Decision tier for fluid governance
 */
export type DecisionTier = 'GREEN' | 'YELLOW' | 'RED';
/**
 * Enforcement context combining intent and evaluation results
 */
export interface EnforcementContext {
    intent: Intent;
    evaluation: EvaluationResult;
    trustScore: TrustScore;
    trustLevel: TrustLevel;
    tenantId: ID;
    correlationId?: ID;
}
/**
 * Enforcement policy configuration
 */
export interface EnforcementPolicy {
    /** Default action when no rules match */
    defaultAction: ControlAction;
    /** Minimum trust level required */
    requireMinTrustLevel?: TrustLevel;
    /** Trust level thresholds for automatic approval */
    trustThresholds?: {
        /** Auto-approve GREEN if trust level >= this */
        autoApproveLevel: TrustLevel;
        /** Force YELLOW (refinement) if trust level < this */
        requireRefinementLevel: TrustLevel;
        /** Force RED (deny) if trust level < this */
        autoDenyLevel: TrustLevel;
    };
    /** Escalation rules */
    escalationRules?: EscalationRule[];
    /** Default constraints for GREEN decisions */
    defaultConstraints?: Partial<DecisionConstraintsConfig>;
    /** Decision expiration time in milliseconds */
    decisionExpirationMs?: number;
    /** Refinement deadline in milliseconds */
    refinementDeadlineMs?: number;
    /** Maximum refinement attempts */
    maxRefinementAttempts?: number;
}
/**
 * Escalation rule definition
 */
export interface EscalationRule {
    /** Condition expression */
    condition: string;
    /** Who to escalate to */
    escalateTo: string;
    /** Timeout duration (ISO 8601) */
    timeout: string;
    /** Reason category */
    reasonCategory?: 'trust_insufficient' | 'high_risk' | 'policy_violation' | 'manual_review';
}
/**
 * Decision constraints configuration
 */
export interface DecisionConstraintsConfig {
    allowedTools: string[];
    dataScopes: string[];
    rateLimits: Array<{
        resource: string;
        limit: number;
        windowSeconds: number;
    }>;
    requiredApprovals: Array<{
        type: 'none' | 'human_review' | 'automated_check' | 'multi_party';
        approver: string;
        timeoutMs?: number;
        reason: string;
    }>;
    reversibilityRequired: boolean;
    maxExecutionTimeMs?: number;
    maxRetries?: number;
    resourceQuotas?: Record<string, number>;
}
/**
 * Fluid decision result with workflow tracking
 */
export interface FluidDecisionResult {
    decision: Decision;
    workflow: WorkflowInstance;
    tier: DecisionTier;
    /** Action derived from tier: GREEN->allow, RED->deny, YELLOW->escalate */
    action: ControlAction;
    /** Whether constraints were evaluated */
    constraintsEvaluated: boolean;
    refinementOptions?: RefinementOption[];
}
/**
 * Refinement request
 */
export interface RefinementRequest {
    decisionId: ID;
    selectedRefinements: ID[];
    refinementContext?: Record<string, unknown>;
    modifiedIntent?: Partial<{
        goal: string;
        resourceScope: string[];
        dataSensitivity: string;
        reversibility: string;
        context: Record<string, unknown>;
    }>;
}
/**
 * Policy enforcement service with fluid governance
 */
export declare class EnforcementService {
    private policy;
    private repository;
    private escalationService;
    constructor(policy?: EnforcementPolicy);
    /**
     * Initialize with database connection
     */
    initialize(db: PostgresJsDatabase, escalationService?: EscalationService): void;
    /**
     * Make an enforcement decision with fluid governance
     */
    decide(context: EnforcementContext): Promise<FluidDecisionResult>;
    /**
     * Process a refinement request for a YELLOW decision
     */
    refine(request: RefinementRequest, tenantId: ID): Promise<FluidDecisionResult | null>;
    /**
     * Get decision by ID
     */
    getDecision(id: ID, tenantId: ID): Promise<Decision | null>;
    /**
     * Get workflow by intent ID
     */
    getWorkflow(intentId: ID, tenantId: ID): Promise<WorkflowInstance | null>;
    /**
     * Update enforcement policy
     */
    setPolicy(policy: EnforcementPolicy): void;
    /**
     * Determine decision tier based on evaluation and trust
     */
    private determineTier;
    /**
     * Build decision input from context
     */
    private buildDecisionInput;
    /**
     * Build reasoning array for decision
     */
    private buildReasoning;
    /**
     * Determine denial reason for RED decisions
     */
    private determineDenialReason;
    /**
     * Extract violated policies for RED decisions
     */
    private extractViolatedPolicies;
    /**
     * Build constraints from evaluation results
     */
    private buildConstraintsFromEvaluation;
    /**
     * Build constraints for a decision
     */
    private buildConstraints;
    /**
     * Generate refinement options for YELLOW decisions
     */
    private generateRefinementOptions;
    /**
     * Evaluate if refinements are sufficient to upgrade to GREEN
     */
    private evaluateRefinements;
    /**
     * Check if we should create an escalation
     */
    private shouldEscalate;
    /**
     * Create an escalation for a decision
     */
    private createEscalation;
    /**
     * Convert workflow state based on decision tier
     */
    private tierToWorkflowState;
    /**
     * Convert trust level to trust band string
     */
    private trustLevelToTrustBand;
}
/**
 * Create a new enforcement service instance
 */
export declare function createEnforcementService(policy?: EnforcementPolicy): EnforcementService;
export type { Decision, DecisionConstraints, RefinementOption, WorkflowInstance } from './repository.js';
export { DecisionRepository, createDecisionRepository } from './repository.js';
export * from './adapters.js';
//# sourceMappingURL=index.d.ts.map