/**
 * Policy Service
 *
 * Handles CRUD operations for policies with versioning and validation.
 * Supports full version history, rollback, and diff capabilities.
 *
 * @packageDocumentation
 */
import type { ID } from '../common/types.js';
import { type PolicyDiffResult } from './diff.js';
import type { TenantContext } from '../common/tenant-context.js';
import type { Policy, PolicyVersion, PolicyDefinition, PolicyStatus, CreatePolicyInput, UpdatePolicyInput, PolicyListFilters, PolicyValidationResult, PolicyValidationError } from './types.js';
/**
 * Input for updating a policy with versioning
 */
export interface UpdateWithVersioningInput {
    definition?: PolicyDefinition;
    description?: string;
    status?: PolicyStatus;
    changeSummary?: string;
    changedBy?: string;
}
/**
 * Extended policy version with additional metadata
 */
export interface PolicyVersionWithMeta extends PolicyVersion {
    isCurrent: boolean;
}
/**
 * Result of comparing two policy versions
 */
export interface PolicyVersionCompareResult {
    policyId: ID;
    version1: number;
    version2: number;
    diff: PolicyDiffResult;
}
/**
 * Validate a policy definition
 */
export declare function validatePolicyDefinition(definition: unknown): PolicyValidationResult;
/**
 * Policy Service class
 *
 * SECURITY: All methods now accept TenantContext instead of raw tenantId.
 * TenantContext can only be created from validated JWT tokens, preventing
 * tenant ID injection attacks.
 *
 * SECURITY: Uses distributed locking and 2-phase cache invalidation to
 * prevent race conditions where concurrent requests read stale policy data
 * (MEDIUM vulnerability fix).
 *
 * @see TenantContext in ../common/tenant-context.ts
 * @see distributed-cache.ts for locking and cache implementation
 */
export declare class PolicyService {
    private distributedCache;
    /**
     * Create a new policy with write-through caching
     *
     * SECURITY: Atomically updates distributed cache after DB commit.
     *
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param input - Policy creation input
     * @returns Created policy
     */
    create(ctx: TenantContext, input: CreatePolicyInput): Promise<Policy>;
    /**
     * Get a policy by ID with distributed cache support
     *
     * SECURITY: Checks distributed cache first with stale detection.
     * Rejects stale cache entries to prevent reading outdated policies.
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Policy or null if not found
     */
    findById(id: ID, ctx: TenantContext): Promise<Policy | null>;
    /**
     * Get a policy by name and namespace
     *
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param name - Policy name
     * @param namespace - Policy namespace (default: 'default')
     * @returns Policy or null if not found
     */
    findByName(ctx: TenantContext, name: string, namespace?: string): Promise<Policy | null>;
    /**
     * Update a policy with distributed locking and 2-phase cache invalidation
     *
     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation
     * to prevent race conditions where concurrent requests read stale policies.
     *
     * Flow:
     * 1. Acquire distributed lock on policy
     * 2. Mark cache as stale (2-phase step 1) - BEFORE DB commit
     * 3. Perform database transaction
     * 4. Invalidate local in-memory cache
     * 5. Write to distributed cache atomically (write-through, 2-phase step 2)
     * 6. Release lock
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param input - Policy update input
     * @returns Updated policy or null if not found
     */
    update(id: ID, ctx: TenantContext, input: UpdatePolicyInput): Promise<Policy | null>;
    /**
     * Publish a policy (makes it active)
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Published policy or null if not found
     */
    publish(id: ID, ctx: TenantContext): Promise<Policy | null>;
    /**
     * Deprecate a policy
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Deprecated policy or null if not found
     */
    deprecate(id: ID, ctx: TenantContext): Promise<Policy | null>;
    /**
     * Archive a policy
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Archived policy or null if not found
     */
    archive(id: ID, ctx: TenantContext): Promise<Policy | null>;
    /**
     * List policies with filters
     *
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param filters - Optional filters (namespace, status, etc.)
     * @returns Array of policies
     */
    list(ctx: TenantContext, filters?: Omit<PolicyListFilters, 'tenantId'>): Promise<Policy[]>;
    /**
     * Get published policies for evaluation
     *
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param namespace - Optional namespace filter
     * @returns Array of published policies
     */
    getPublishedPolicies(ctx: TenantContext, namespace?: string): Promise<Policy[]>;
    /**
     * Update a policy with explicit versioning and distributed locking.
     * Creates a new version record before applying changes.
     *
     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @param changes - Changes to apply
     * @returns Updated policy with new version number
     */
    updateWithVersioning(id: ID, ctx: TenantContext, changes: UpdateWithVersioningInput): Promise<Policy | null>;
    /**
     * Get complete version history for a policy.
     * Returns all historical versions plus the current version.
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns List of all versions, newest first
     */
    getVersionHistory(id: ID, ctx: TenantContext): Promise<PolicyVersionWithMeta[]>;
    /**
     * Get a specific version of a policy.
     *
     * @param id - Policy ID
     * @param version - Version number to retrieve
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns The policy version or null if not found
     */
    getVersion(id: ID, version: number, ctx: TenantContext): Promise<PolicyVersion | null>;
    /**
     * Rollback a policy to a previous version with distributed locking.
     * Creates a new version with the definition from the target version.
     *
     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
     *
     * @param id - Policy ID
     * @param targetVersion - Version number to rollback to
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Updated policy with new version number
     */
    rollbackToVersion(id: ID, targetVersion: number, ctx: TenantContext): Promise<Policy | null>;
    /**
     * Compare two versions of a policy.
     *
     * @param id - Policy ID
     * @param version1 - First version to compare
     * @param version2 - Second version to compare
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns Diff result between the two versions
     */
    compareVersions(id: ID, version1: number, version2: number, ctx: TenantContext): Promise<PolicyVersionCompareResult | null>;
    /**
     * Delete a policy with distributed locking (soft delete - archives it)
     *
     * SECURITY FIX: Uses distributed locking and 2-phase cache invalidation.
     *
     * @param id - Policy ID
     * @param ctx - Validated tenant context from JWT (REQUIRED for security)
     * @returns True if deleted successfully
     */
    delete(id: ID, ctx: TenantContext): Promise<boolean>;
    /**
     * Get policies for evaluation with stale cache rejection
     *
     * This method is used by the policy evaluator to get policies for
     * evaluation. It validates cache versions and rejects stale data.
     *
     * SECURITY: Ensures policy evaluation always uses fresh data.
     *
     * @param ctx - Validated tenant context from JWT
     * @param policyIds - Policy IDs to evaluate
     * @returns Array of policies (refreshed if stale)
     */
    getPoliciesForEvaluation(ctx: TenantContext, policyIds: ID[]): Promise<Policy[]>;
    /**
     * Convert database row to Policy object
     */
    private rowToPolicy;
}
/**
 * Custom error for policy validation failures
 */
export declare class PolicyValidationException extends Error {
    readonly errors: PolicyValidationError[];
    constructor(message: string, errors: PolicyValidationError[]);
}
/**
 * Create a new policy service instance
 */
export declare function createPolicyService(): PolicyService;
export { withPolicyLock, PolicyLockError } from './distributed-cache.js';
//# sourceMappingURL=service.d.ts.map