/**
 * 强制护栏注册表 — 问题十一 (Enforcement Guard)。
 *
 * 覆盖七类护栏: write、state、knowledge_injection、execution、
 * external_side_effect、prompt、delivery。
 * 护栏 finding 必须绑定 contract_id + diagnostic_code。
 * 只有 contract state=enforced 且 hard_fail_allowed=true 时才能 hard fail。
 */
import { type DiagnosticEvent } from "../audit/diagnostic_registry.js";
import type { VerificationPlan, VerificationResult } from "./verification_contract.js";
export type GuardType = "write" | "state" | "knowledge_injection" | "execution" | "external_side_effect" | "prompt" | "delivery";
export type GuardAction = "block" | "warn" | "require_human" | "downgrade";
export interface EnforcementGuardEntry {
    guard_id: string;
    guard_type: GuardType;
    enforced: boolean;
    trigger_description: string;
    block_condition: string;
    allow_condition: string;
    failure_behavior: GuardAction;
    contract_id: string;
    diagnostic_code: string;
    human_gate?: string[];
    required_context: string[];
}
export interface GuardFinding {
    guard_id: string;
    contract_id: string;
    diagnostic_code: string;
    severity: "hard_fail" | "warning" | "advisory";
    action: GuardAction;
    reason_zh: string;
    blocked: boolean;
    diagnostic_event: DiagnosticEvent | null;
}
export interface GuardEvaluationReport {
    evaluated_at: string;
    workflow_id: string;
    route: string;
    mutation_allowed: boolean;
    evaluated_guards: string[];
    allowed: string[];
    blocked: GuardFinding[];
    warnings: GuardFinding[];
    human_required: GuardFinding[];
}
/** 列出所有护栏 */
export declare function listAllGuards(): EnforcementGuardEntry[];
/** 按类型列出护栏 */
export declare function listGuardsByType(type: GuardType): EnforcementGuardEntry[];
/** 注册新护栏（运行时） */
export declare function registerGuard(entry: EnforcementGuardEntry): {
    success: boolean;
    error?: string;
};
/**
 * 评估写入护栏。
 * 检查 route 和 target_path 是否违反写入规则。
 */
export declare function evaluateWriteGuard(route: string, targetPath: string, outputArtifactPaths: string[], contractId: string): GuardFinding[];
/**
 * 评估状态护栏。
 * 检查状态转移是否合法。
 */
export declare function evaluateStateGuard(currentStatus: string, targetStatus: string, contractId: string): GuardFinding[];
/**
 * 生成完整护栏评估报告。
 */
export declare function generateGuardEvaluationReport(workflowId: string, route: string, mutationAllowed: boolean, guardIds: string[]): GuardEvaluationReport;
/**
 * 校验所有 guard 的 contract_id 是否存在于 Contract Registry。
 */
export declare function validateGuardContractIds(contractExistsFn: (id: string) => boolean): Array<{
    guard_id: string;
    contract_id: string;
    severity: "hard_fail";
}>;
/**
 * 评估交付就绪护栏。
 * 检查交付是否由 sf_deliver 显式触发，验证结果是否满足交付条件。
 */
export declare function evaluateDeliveryReadinessGuard(verificationResult: VerificationResult | undefined, _verificationPlan: VerificationPlan | undefined): GuardFinding[];
/**
 * 评估破坏性命令护栏。
 * 结合 riskLevel 和命令模式双重判定，人工确认后可放行。
 *
 * 判定逻辑:
 * - riskLevel === "destructive" 且匹配破坏性模式 → hard_fail（不可确认放行）
 * - riskLevel === "destructive" 或匹配破坏性模式 → 需确认
 *   - humanConfirmed=true → 放行（清空 findings）
 *   - humanConfirmed=false → 阻断
 * - 仅模式匹配（riskLevel !== "destructive"） → warning
 * - 均不匹配 → 放行（空 findings）
 */
export declare function evaluateExecutionDestructiveGuard(command: string, riskLevel: string, humanConfirmed: boolean): GuardFinding[];
/**
 * 评估外部副作用护栏。
 * 检查外部副作用操作是否有 evidence 记录，根据操作类型区分严重度。
 *
 * 判定逻辑:
 * - hasEvidence=true → 放行（空 findings）
 * - hasEvidence=false:
 *   - critical 类型（deploy/migration/database_change）→ hard_fail
 *   - standard 类型（git_push/pr_create/release）→ warning
 *   - 未知类型 → warning（保守降级）
 */
export declare function evaluateExternalSideEffectGuard(actionType: string, hasEvidence: boolean): GuardFinding[];
/** 重置注册表（测试用） */
export declare function resetGuardRegistry(): void;
//# sourceMappingURL=enforcement_guard.d.ts.map