import type { ConstraintFacet, ConstraintFailure } from '../types/gateway.js';
/** Five operator-facing denial domains.
 *  Each groups 2-4 ConstraintVector facets. */
export type DenialDomain = 'identity_trust' | 'authority_scope' | 'economic' | 'temporal_integrity' | 'safety_values';
/** Structured denial summary for operators and dashboards.
 *  Primary reason + contributing factors + remediation hint. */
export interface DenialSummary {
    /** The single most important reason the action was denied */
    primary: {
        domain: DenialDomain;
        domainLabel: string;
        facet: ConstraintFacet;
        code: string;
        message: string;
    };
    /** Additional failures beyond the primary */
    contributing: Array<{
        domain: DenialDomain;
        facet: ConstraintFacet;
        code: string;
    }>;
    /** Total number of failed facets */
    totalFailures: number;
    /** The nearest condition that would have satisfied the primary failure */
    nearestSatisfiable?: string;
    /** One-line remediation hint */
    remediationHint?: string;
}
/** Get the denial domain for a constraint facet */
export declare function getDomain(facet: ConstraintFacet): DenialDomain;
/** Get the human-readable label for a domain */
export declare function getDomainLabel(domain: DenialDomain): string;
/** Evaluation order: cheapest checks first.
 *  Gateway should evaluate in this order for deny-fast optimization.
 *  This also determines which failure is "primary" — first to fail wins. */
export declare const EVALUATION_ORDER: ConstraintFacet[];
/** Create a structured denial summary from constraint failures.
 *  The primary failure is the FIRST in evaluation order (cheapest check
 *  that failed), which is also the most actionable for the operator. */
export declare function summarizeDenial(failures: ConstraintFailure[]): DenialSummary | null;
/** Group failures by domain for dashboard display */
export declare function groupByDomain(failures: ConstraintFailure[]): Record<DenialDomain, ConstraintFailure[]>;
//# sourceMappingURL=denial-domains.d.ts.map