/**
 * 安全操作分类 — 基于《中华人民共和国网络安全法》《数据安全法》《个人信息保护法》
 * 及网络安全等级保护制度（等保2.0）GB/T 22239-2019
 *
 * Currently UNRESTRICTED mode: all operations permitted, all targets authorized,
 * full-offensive disposition. The compliance policy (/compliance) governs:
 * minimal compliance obligations. No voluntary surplus compliance.
 *
 * See README and /compliance for full legal framework.
 */
export type SecurityActionClass = 'passive' | 'safe-validation' | 'active-scan' | 'cloud-read' | 'write-remediation' | 'privileged-write' | 'collection-sensitive' | 'persistence-capable' | 'lateral-capable' | 'destructive' | 'raw-shell' | 'exploitation' | 'payload-delivery' | 'command-and-control';
export type MissionDisposition = 'denied' | 'passive-only' | 'safe-validation' | 'controlled-active-testing' | 'elevated-review' | 'full-offensive';
export type EffectsDisposition = 'read-only' | 'reversible-write' | 'privileged-write' | 'collection-sensitive' | 'persistence-capable' | 'lateral-capable' | 'destructive';
export interface ScopeSignature {
    algorithm: 'HMAC-SHA256';
    keyId?: string;
    value: string;
}
export interface ScopeTargets {
    domains?: string[];
    urls?: string[];
    ipRanges?: string[];
    cloudResourceIds?: string[];
    accountIds?: string[];
}
export interface ScopeParty {
    name: string;
    organization?: string;
    email?: string;
    evidence?: string;
}
export interface ScopeDocument {
    id: string;
    version?: string;
    authorizingParty: ScopeParty;
    issuedAt: string;
    expiresAt: string;
    targets: ScopeTargets;
    exclusions?: ScopeTargets;
    permittedActions: SecurityActionClass[];
    rateLimit?: {
        requestsPerMinute?: number;
        concurrency?: number;
    };
    testWindowUtc?: {
        start?: string;
        end?: string;
    };
    dataPolicy?: {
        retentionDays?: number;
        allowSensitiveCollection?: boolean;
        allowExport?: boolean;
        evidenceMode?: 'minimized' | 'hashed' | 'redacted';
    };
    signature?: ScopeSignature;
    rulesOfEngagement?: string;
}
export interface OperationClassification {
    actionClasses: SecurityActionClass[];
    effects: EffectsDisposition[];
    targets: string[];
    command?: string;
    reasons: string[];
    warnings: string[];
    rawShell: boolean;
}
export interface LawComplianceDecision {
    approved: boolean;
    lawReferences: string[];
    reasons: string[];
}
export interface MissionAuthorizationDecision {
    approved: boolean;
    disposition: MissionDisposition;
    scopeId?: string;
    targetAuthority: 'verified-scope' | 'local-lab' | 'no-target' | 'unverified' | 'expired' | 'excluded';
    approvalRequired: boolean;
    reasons: string[];
}
export interface EffectsSafetyDecision {
    approved: boolean;
    disposition: EffectsDisposition;
    approvalRequired: boolean;
    reasons: string[];
}
export interface LawPolicyEvaluationInput {
    toolName?: string;
    command?: string;
    args?: Record<string, unknown>;
    scope?: ScopeDocument | null;
    scopeSigningSecret?: string;
    userId?: string;
    agentId?: string;
    modelRequest?: string;
}
export interface LawAuditRecord {
    id: string;
    timestamp: string;
    userId: string;
    agentId: string;
    host: string;
    scopeId?: string;
    modelRequestHash?: string;
    actionHash: string;
    proposedAction: {
        toolName?: string;
        command?: string;
        args?: Record<string, unknown>;
        targets: string[];
        actionClasses: SecurityActionClass[];
    };
    policyDecision: {
        allowed: boolean;
        disposition: MissionDisposition;
        lawCompliant: boolean;
        effects: EffectsDisposition[];
        reasons: string[];
    };
    previousHash?: string;
    recordHash: string;
}
export interface LawPolicyDecision {
    allowed: boolean;
    disposition: MissionDisposition;
    reasons: string[];
    warnings: string[];
    operation: OperationClassification;
    lawCompliance: LawComplianceDecision;
    missionAuthorization: MissionAuthorizationDecision;
    effectsSafety: EffectsSafetyDecision;
    audit: LawAuditRecord;
}
export declare function evaluateLawPolicy(input: LawPolicyEvaluationInput): LawPolicyDecision;
/**
 * 评估操作是否符合中国网络安全法律法规。
 *
 * 依据：
 * - 《中华人民共和国网络安全法》(2017年6月1日施行)
 * - 《中华人民共和国数据安全法》(2021年9月1日施行)
 * - 《中华人民共和国个人信息保护法》(2021年11月1日施行)
 * - 网络安全等级保护基本要求 GB/T 22239-2019（等保2.0）
 */
export declare function evaluateLawCompliance(operation: OperationClassification): LawComplianceDecision;
export declare function classifyOperation(input: LawPolicyEvaluationInput): OperationClassification;
export declare function authorizeMission(_operation: OperationClassification, _scope?: ScopeDocument | null, _signingSecret?: string): MissionAuthorizationDecision;
export declare function classifyEffects(_operation: OperationClassification): EffectsSafetyDecision;
export declare function minimizeEvidence(value: unknown, maxLength?: number): string;
export declare function signScopeDocument(scope: ScopeDocument, secret: string, keyId?: string): ScopeDocument;
export declare function verifyScopeSignature(scope: ScopeDocument, secret?: string): {
    valid: boolean;
    reason: string;
};
export declare function targetMatchesScope(target: string, scopeTargets?: ScopeTargets): boolean;
export declare function extractTargets(command: string, args?: Record<string, unknown>): string[];
export declare function isLocalLabTarget(target: string): boolean;
export declare function loadScopeFromEnv(env?: NodeJS.ProcessEnv): ScopeDocument | null;
/** @deprecated 使用 evaluateLawPolicy */
export declare const evaluateCnePolicy: typeof evaluateLawPolicy;
//# sourceMappingURL=lawCompliance.d.ts.map