// ══════════════════════════════════════════════════════════════════
// Governance Posture — Tier definitions + constraint primitives
// ══════════════════════════════════════════════════════════════════
// Review Priority 5 — Gemini's framing:
//   "behavioral failures update a governance posture tier,
//    posture tier changes what the gateway allows by default,
//    identity stays intact."
//
// SDK retains pure tier types, default constraint shapes, scope checks,
// and tier ordering helpers. The downgrade/upgrade STATE MACHINE
// (createInitialPosture, recordBehavioralFailure, recordBehavioralSuccess,
// upgradePosture, plus DEFAULT_DOWNGRADE_POLICY) MOVED to
// @aeoess/gateway src/sdk-migrated/core/posture-state.ts on 2026-04-17.
// Posture state tracking is gateway product policy — the SDK only
// describes the tiers and what they constrain.
// ══════════════════════════════════════════════════════════════════
/** Posture tier ordering — lower number = more restrictive */
const TIER_ORDER = {
    quarantine: 0,
    restricted: 1,
    cautious: 2,
    standard: 3,
    full_trust: 4,
};
/** Default constraints for each posture tier */
export const DEFAULT_POSTURE_CONSTRAINTS = {
    full_trust: {
        maxSpendPerAction: null,
        maxDelegationDepth: 5,
        allowIrreversible: true,
        allowEscalation: true,
        minFidelityScore: 0.3,
    },
    standard: {
        maxSpendPerAction: null,
        maxDelegationDepth: 3,
        allowIrreversible: true,
        allowEscalation: true,
        minFidelityScore: 0.5,
    },
    cautious: {
        maxSpendPerAction: 100,
        maxDelegationDepth: 2,
        blockedScopes: ['commerce:checkout'],
        allowIrreversible: false,
        allowEscalation: true,
        minFidelityScore: 0.6,
    },
    restricted: {
        maxSpendPerAction: 10,
        maxDelegationDepth: 1,
        blockedScopes: ['commerce:checkout', 'data:write', 'admin'],
        allowIrreversible: false,
        allowEscalation: false,
        minFidelityScore: 0.8,
    },
    quarantine: {
        maxSpendPerAction: 0,
        maxDelegationDepth: 0,
        blockedScopes: ['*'],
        allowIrreversible: false,
        allowEscalation: false,
        minFidelityScore: 1.0,
    },
};
// ── Pure constraint helpers ──
/** Get the constraints for a given posture tier */
export function getPostureConstraints(tier, custom) {
    const base = DEFAULT_POSTURE_CONSTRAINTS[tier];
    const override = custom?.[tier];
    if (!override)
        return base;
    return { ...base, ...override };
}
/** Check if a scope is blocked at the current posture tier */
export function isScopeBlocked(tier, scope) {
    const constraints = DEFAULT_POSTURE_CONSTRAINTS[tier];
    if (!constraints.blockedScopes)
        return false;
    if (constraints.blockedScopes.includes('*'))
        return true;
    return constraints.blockedScopes.some(blocked => scope === blocked || scope.startsWith(blocked + ':'));
}
/** Compare two posture tiers. Returns negative if a < b, 0 if equal, positive if a > b */
export function comparePostureTiers(a, b) {
    return TIER_ORDER[a] - TIER_ORDER[b];
}
// ── Removed state-machine stubs ──
const MIGRATED_MSG = 'governance-posture state machine moved to @aeoess/gateway ' +
    'src/sdk-migrated/core/posture-state.ts (2026-04-17). ' +
    'SDK keeps tier types, DEFAULT_POSTURE_CONSTRAINTS, getPostureConstraints, ' +
    'isScopeBlocked, comparePostureTiers.';
// Stubs preserve original signatures so consumers continue to typecheck;
// calling them at runtime throws.
export function createInitialPosture(_tier) {
    throw new Error(MIGRATED_MSG);
}
export function recordBehavioralFailure(_posture, _reason, _policy) {
    throw new Error(MIGRATED_MSG);
}
export function recordBehavioralSuccess(_posture) {
    throw new Error(MIGRATED_MSG);
}
export function upgradePosture(_posture, _principalDid, _reason) {
    throw new Error(MIGRATED_MSG);
}
//# sourceMappingURL=governance-posture.js.map