import { type Database } from '../common/db.js';
import type { TrustScore, TrustLevel, TrustSignal as TrustSignalType, TrustComponents, ID } from '../common/types.js';
/**
 * Dependencies for TrustEngine
 *
 * Use these to inject dependencies for testing or custom configurations.
 * If not provided, defaults to lazy initialization from global singletons.
 */
export interface TrustEngineDependencies {
    /** Pre-initialized database instance (optional, will lazy-init if not provided) */
    database?: Database;
}
/**
 * Options for trust engine operations that require tenant context
 */
export interface TrustOperationOptions {
    /** Tenant ID for multi-tenant isolation (REQUIRED for security) */
    tenantId: ID;
}
import { CertificationTier, RuntimeTier, CapabilityLevel, ParsedCAR, ParsedACI, parseCAR, parseACI, type CARIdentity, type ACIIdentity } from '@vorionsys/contracts/car';
import { type ACITrustContext, type Attestation, type PermissionCheckResult } from './car-integration.js';
import { ObservabilityClass, type ObservabilityMetadata } from './observability.js';
import { DeploymentContext } from './context.js';
import { initialFactorScores, type FactorCodeString } from '@vorionsys/basis';
/**
 * Trust level thresholds — canonical 8-tier model
 */
export declare const TRUST_THRESHOLDS: Record<TrustLevel, {
    min: number;
    max: number;
}>;
/**
 * Trust level names — canonical 8-tier model
 */
export declare const TRUST_LEVEL_NAMES: Record<TrustLevel, string>;
export declare const FACTOR_CODES: readonly ["CT-COMP", "CT-REL", "CT-OBS", "CT-TRANS", "CT-ACCT", "CT-SAFE", "CT-SEC", "CT-PRIV", "CT-ID", "OP-HUMAN", "OP-ALIGN", "OP-CONTEXT", "OP-STEW", "SF-HUM", "SF-ADAPT", "SF-LEARN"];
export type FactorCode = FactorCodeString;
export declare const FACTOR_WEIGHTS: Record<"CT-COMP" | "CT-REL" | "CT-OBS" | "CT-TRANS" | "CT-ACCT" | "CT-SAFE" | "CT-SEC" | "CT-PRIV" | "CT-ID" | "OP-HUMAN" | "OP-ALIGN" | "OP-CONTEXT" | "OP-STEW" | "SF-HUM" | "SF-ADAPT" | "SF-LEARN", number>;
export declare const SIGNAL_PREFIX_TO_FACTORS: Record<string, ("CT-COMP" | "CT-REL" | "CT-OBS" | "CT-TRANS" | "CT-ACCT" | "CT-SAFE" | "CT-SEC" | "CT-PRIV" | "CT-ID" | "OP-HUMAN" | "OP-ALIGN" | "OP-CONTEXT" | "OP-STEW" | "SF-HUM" | "SF-ADAPT" | "SF-LEARN")[]>;
export { initialFactorScores };
/**
 * @deprecated Use FACTOR_WEIGHTS for 16-factor scoring. Kept for backwards compatibility.
 * Signal weights for score calculation
 */
export declare const SIGNAL_WEIGHTS: Record<keyof TrustComponents, number>;
/**
 * Decay milestone definition
 * @deprecated Use DormancyMilestone from @vorionsys/atsf-core — this is a local duplicate.
 */
export interface DecayMilestone {
    days: number;
    multiplier: number;
}
/** Canonical type alias — prefer DormancyMilestone from @vorionsys/atsf-core */
export type DormancyMilestone = DecayMilestone;
/**
 * Stepped dormancy milestones (local duplicate)
 *
 * Canonical source: @vorionsys/atsf-core/decay-profiles DORMANCY_MILESTONES
 * This copy exists because security does not depend on atsf-core.
 *
 * Trust decays incrementally based on days since last activity.
 * 182-day half-life: after 182 days of inactivity, score is 50% of original.
 *
 * Steps 1-5: 6% drop each (100% → 70%)
 * Steps 6-9: 5% drop each (70% → 50%)
 *
 * 9 milestones, simple and predictable.
 */
export declare const DORMANCY_MILESTONES: DecayMilestone[];
/** @deprecated Use DORMANCY_MILESTONES */
export declare const DECAY_MILESTONES: DecayMilestone[];
/**
 * Entity trust record
 */
export interface TrustRecord {
    entityId: ID;
    score: TrustScore;
    level: TrustLevel;
    /** @deprecated Use factorScores instead */
    components: TrustComponents;
    /** Per-factor scores (0.0 to 1.0) for each of the 16 trust factors */
    factorScores: Record<string, number>;
    signals: TrustSignalType[];
    lastCalculatedAt: string;
    lastActivityAt: string;
    history: TrustHistoryEntry[];
    decayApplied: boolean;
    decayMultiplier: number;
    baseScore: TrustScore;
    nextMilestone: {
        days: number;
        multiplier: number;
    } | null;
}
/**
 * Trust history entry
 */
export interface TrustHistoryEntry {
    score: TrustScore;
    level: TrustLevel;
    reason: string;
    timestamp: string;
}
/**
 * Trust calculation result
 */
export interface TrustCalculation {
    score: TrustScore;
    level: TrustLevel;
    /** @deprecated Use factorScores */
    components: TrustComponents;
    /** Per-factor scores for all 16 trust factors */
    factorScores: Record<string, number>;
    factors: string[];
}
/**
 * Trust Engine service with PostgreSQL persistence
 *
 * Uses stepped decay milestones (182-day half-life) for trust score degradation.
 *
 * SECURITY: All trust operations now require tenantId for multi-tenant isolation.
 * Cross-tenant queries are prevented by validating entity ownership.
 *
 * @see DORMANCY_MILESTONES
 */
export declare class TrustEngine {
    private db;
    private initialized;
    private injectedDb;
    /**
     * Entity-to-tenant mapping cache (in production, use Redis or dedicated table)
     * This maps entityId -> tenantId for ownership validation
     */
    private entityTenantCache;
    /**
     * Create a new TrustEngine instance.
     *
     * @param deps - Optional dependencies for dependency injection.
     *               If database is provided, it will be used immediately without lazy init.
     *
     * @example
     * // Default usage (lazy initialization)
     * const engine = new TrustEngine();
     * await engine.initialize();
     *
     * @example
     * // With dependency injection (for testing)
     * const engine = new TrustEngine({ database: mockDb });
     */
    constructor(deps?: TrustEngineDependencies);
    /**
     * Validate that an entity belongs to the specified tenant
     *
     * SECURITY: This prevents cross-tenant data access by ensuring
     * the requesting tenant owns the entity being accessed.
     *
     * @throws TrustEngineError if entity does not belong to tenant
     */
    private validateTenantOwnership;
    /**
     * Register entity-tenant association
     * Call this when creating or importing entities
     */
    registerEntityTenant(entityId: ID, tenantId: ID): void;
    /**
     * Initialize the service
     */
    initialize(): Promise<void>;
    /**
     * Ensure service is initialized
     */
    private ensureInitialized;
    /**
     * Calculate trust score for an entity
     *
     * SECURITY: Requires tenantId for multi-tenant isolation
     *
     * @param entityId - The entity to calculate trust for
     * @param options - Operation options including tenantId
     */
    calculate(entityId: ID, options?: TrustOperationOptions): Promise<TrustCalculation>;
    /**
     * Get trust score for an entity
     *
     * SECURITY: Requires tenantId for multi-tenant isolation
     *
     * @param entityId - The entity to get trust score for
     * @param options - Operation options including tenantId
     */
    getScore(entityId: ID, options?: TrustOperationOptions): Promise<TrustRecord | undefined>;
    /**
     * Record a trust signal
     *
     * SECURITY: Requires tenantId for multi-tenant isolation
     *
     * @param signal - The trust signal to record
     * @param options - Operation options including tenantId
     */
    recordSignal(signal: TrustSignalType, options?: TrustOperationOptions): Promise<void>;
    /**
     * Get trust history for an entity
     *
     * SECURITY: Requires tenantId for multi-tenant isolation
     *
     * @param entityId - The entity to get history for
     * @param options - Operation options including tenantId
     * @param limit - Maximum number of history entries to return (default: 100)
     */
    getHistory(entityId: ID, options: TrustOperationOptions, limit?: number): Promise<TrustHistoryEntry[]>;
    /**
     * Initialize trust for a new entity
     *
     * SECURITY: Requires tenantId for multi-tenant isolation
     *
     * @param entityId - The entity to initialize
     * @param initialLevel - Initial trust level (default: 1)
     * @param options - Operation options including tenantId
     */
    initializeEntity(entityId: ID, initialLevel?: TrustLevel, options?: TrustOperationOptions): Promise<TrustRecord>;
    /**
     * Convert score to trust level
     */
    private scoreToLevel;
    /**
     * @deprecated Use calculateFactorScores for 16-factor model. Kept for backwards compatibility.
     * Calculate component scores from signals
     */
    private calculateComponents;
    /**
     * Calculate per-factor scores from signals.
     * Signals can use either:
     *   - Factor code prefix (e.g. 'CT-COMP.success')
     *   - Legacy bucket prefix (e.g. 'behavioral.success') — mapped to factors via SIGNAL_PREFIX_TO_FACTORS
     */
    private calculateFactorScores;
    /**
     * Build the initial factor scores record with all 16 factors at 0.5 (neutral)
     */
    private static initialFactorScores;
    /**
     * Calculate average signal value with default
     */
    private averageSignalValue;
    /**
     * Get significant factors affecting the score
     */
    private getSignificantFactors;
    /**
     * Calculate decay multiplier based on days since last activity
     *
     * Uses stepped milestones with interpolation for smooth decay.
     * 182-day half-life: after 182 days of inactivity, score is 50% of original.
     */
    private calculateDecayMultiplier;
    /**
     * Apply decay to a base score
     */
    private applyDecay;
    /**
     * Calculate days since last activity from a date
     */
    private calculateInactiveDays;
    /**
     * Get the next decay milestone for an entity
     */
    private getNextMilestone;
    /**
     * Get trust context with CAR ID integration
     *
     * Combines CAR ID identity with attestation-based certification and Vorion
     * runtime layer to produce a complete trust context. The effective tier/score
     * is the minimum of all contributing factors.
     *
     * IMPORTANT: Trust tier comes from attestations, NOT the CAR ID itself.
     * The CAR ID is just an identifier; trust is computed at runtime.
     *
     * @param entityId - The entity to get trust context for
     * @param carId - The CAR ID string for the entity
     * @param attestation - Optional attestation for this entity
     * @returns Complete CAR ID trust context with effective permissions
     */
    getACITrustContext(entityId: ID, carId: string, attestation?: Attestation): Promise<ACITrustContext>;
    /**
     * Apply CAR ID attestation as trust signal
     *
     * Converts a CAR ID attestation into a trust signal and applies it to
     * the entity's trust record. Also enforces the certification floor -
     * the entity's score cannot fall below their certified tier minimum.
     *
     * @param entityId - The entity to apply attestation to
     * @param attestation - The CAR ID attestation record
     */
    applyAttestation(entityId: ID, attestation: Attestation): Promise<void>;
    /**
     * Check if action is allowed under effective permission
     *
     * Evaluates whether an entity has sufficient effective trust to perform
     * an action requiring a specific tier and domains.
     *
     * @param entityId - The entity requesting the action
     * @param carId - The entity's CAR ID string
     * @param requiredTier - Minimum tier required for the action
     * @param requiredDomains - Domains required for the action
     * @returns Permission check result with reason if denied
     */
    checkEffectivePermission(entityId: ID, carId: string, requiredTier: RuntimeTier, requiredDomains: string[]): Promise<PermissionCheckResult>;
    /**
     * Set trust score directly with reason
     *
     * Used internally for applying floors and ceilings from CAR ID.
     *
     * @param entityId - The entity to update
     * @param score - The new trust score
     * @param reason - Reason for the change
     */
    setScore(entityId: ID, score: TrustScore, reason: string): Promise<void>;
    /**
     * Get observability class for an entity
     *
     * Retrieves or determines the observability class from entity metadata.
     *
     * @param entityId - The entity to check
     * @returns The entity's observability class
     */
    getObservabilityClass(entityId: ID): Promise<ObservabilityClass>;
    /**
     * Set observability metadata for an entity
     *
     * Updates the trust record with observability information that determines
     * the entity's trust ceiling.
     *
     * @param entityId - The entity to update
     * @param metadata - Observability metadata (class, attestation info, etc.)
     * @returns True if update was successful
     */
    setObservabilityMetadata(entityId: ID, metadata: Partial<ObservabilityMetadata>): Promise<boolean>;
    /**
     * Get full observability metadata for an entity
     *
     * @param entityId - The entity to query
     * @returns The observability metadata or undefined if not set
     */
    getObservabilityMetadata(entityId: ID): Promise<ObservabilityMetadata | undefined>;
    /**
     * Get deployment context for an entity
     *
     * Retrieves or determines the deployment context for trust calculations.
     *
     * @param entityId - The entity to check (may have context override)
     * @returns The applicable deployment context
     */
    getDeploymentContext(_entityId: ID): Promise<DeploymentContext>;
}
/**
 * Create a new Trust Engine instance with dependency injection.
 *
 * This is the preferred way to create trust engines in production code
 * as it makes dependencies explicit and testable.
 *
 * @param deps - Optional dependencies. If database provided, skips lazy init.
 * @returns Configured TrustEngine instance
 *
 * @example
 * // Default usage (lazy initialization)
 * const engine = createTrustEngine();
 * await engine.initialize();
 *
 * @example
 * // With custom dependencies (pre-initialized)
 * const engine = createTrustEngine({ database: customDb });
 */
export declare function createTrustEngine(deps?: TrustEngineDependencies): TrustEngine;
/**
 * Calculate decay multiplier based on days since last activity
 *
 * Uses stepped milestones with linear interpolation for smooth decay.
 *
 * @param daysSinceLastActivity - Number of days since last trust-positive activity
 * @returns Decay multiplier between 0.5 and 1.0
 */
export declare function calculateDecayMultiplier(daysSinceLastActivity: number): number;
/**
 * Apply decay multiplier to a base score
 *
 * @param baseScore - The undecayed trust score
 * @param daysSinceLastActivity - Number of days since last activity
 * @returns Decayed score (rounded to nearest integer)
 */
export declare function applyDecay(baseScore: number, daysSinceLastActivity: number): number;
/**
 * Get the next decay milestone for a given number of inactive days
 *
 * @param daysSinceLastActivity - Current days of inactivity
 * @returns Next milestone or null if past final milestone
 */
export declare function getNextDecayMilestone(daysSinceLastActivity: number): DecayMilestone | null;
export type { CertificationTier, RuntimeTier, CapabilityLevel, ParsedCAR, ParsedACI, CARIdentity, ACIIdentity };
export { parseCAR, parseACI };
export type { CARTrustContext, ACITrustContext, Attestation, EffectivePermission, PermissionCheckResult, } from './car-integration.js';
export { AttestationSchema, calculateEffectiveFromCAR, calculateEffectiveFromACI, attestationToTrustSignal, applyCARFloor, applyACIFloor, enforceCARCeiling, enforceACICeiling, calculateEffectiveTier, calculateEffectiveScore, scoreToTier, certificationTierToMinScore, certificationTierToMaxScore, certificationTierToScore, tierToMinScore, competenceLevelToCeiling, determineCeilingReason, } from './car-integration.js';
export { ObservabilityClass, OBSERVABILITY_CEILINGS, OBSERVABILITY_CLASS_NAMES, ObservabilityClassSchema, ObservabilityMetadataSchema, getObservabilityCeiling, getObservabilityMaxScore, applyObservabilityCeiling, isTierAllowedForObservability, getRequiredObservabilityForTier, determineObservabilityClass, describeObservabilityConstraints, } from './observability.js';
export type { ObservabilityCeiling, ObservabilityMetadata, } from './observability.js';
export { DeploymentContext, CONTEXT_CEILINGS, CONTEXT_NAMES, DeploymentContextSchema, ContextConfigSchema, getContextCeiling, getContextMaxScore, applyContextCeiling, requiresHumanApproval, requiresAttestation, evaluateContextPolicy, describeContextConstraints, detectDeploymentContext, } from './context.js';
export type { ContextCeiling, ContextPolicyResult, ContextConfig, } from './context.js';
//# sourceMappingURL=index.d.ts.map