/**
 * 隐私/机密/数据主权合约 — 类型定义
 *
 * 将敏感信息读取、prompt 注入、TaskContext/evidence/artifact 存储、
 * 外发、用户授权、脱敏和用户反馈统一建模。
 *
 * 核心原则:
 * - secret/credential 默认 forbidden
 * - PII/customer_data/production_data 默认 require_human 或 summarize_only
 * - .env、私钥、cookie、token store 默认禁止读取内容
 * - 外部发送前必须做 redaction check
 */
export type SensitivityLabel = "public" | "internal" | "confidential" | "secret" | "credential" | "pii" | "customer_data" | "production_data" | "unknown";
export type HandlingMode = "allow" | "redact" | "summarize_only" | "require_human" | "forbidden";
export type RedactionType = "secret_mask" | "credential_removed" | "pii_mask" | "customer_data_summary" | "production_data_summary" | "path_only" | "hash_only";
export type AllowedOperation = "read" | "summarize" | "redact" | "prompt_inject" | "store_private" | "external_send";
export type CheckContext = "prompt_injection" | "task_context_store" | "artifact_store" | "evidence_store" | "external_send" | "read_operation";
export interface DataSensitivityLabel {
    label: SensitivityLabel;
    source_ref: string;
    detected_by: string[];
    confidence: number;
    handling: HandlingMode;
}
export interface DataAccessGrant {
    grant_id: string;
    granted_by: string;
    scope_refs: string[];
    sensitivity_allowed: SensitivityLabel[];
    allowed_operations: AllowedOperation[];
    purpose: string;
    expires_at: string;
    revocable: boolean;
}
export interface RedactionRecord {
    source_ref: string;
    redaction_type: RedactionType;
    before_hash?: string;
    after_hash: string;
    fields_redacted: string[];
}
export interface PrivacyGovernanceFinding {
    severity: "hard_fail" | "advisory";
    rule: string;
    source_ref?: string;
    message: string;
}
//# sourceMappingURL=privacy_types.d.ts.map