/**
 * Rego Policy Evaluation Module
 * Hybrid approach: WASM (fast, no deps) + OPA CLI fallback
 *
 * This module provides integration with Open Policy Agent (OPA) for policy evaluation.
 * It supports loading and evaluating Rego policies against Dockerfile and Kubernetes content.
 *
 * **Evaluation Strategy:**
 * 1. Pre-compiled WASM bundle (policies/compiled/policies.wasm) - Fast, zero-dependency
 * 2. OPA CLI fallback for custom .rego files - Requires OPA installation
 */
import type { Logger } from 'pino';
import { type Result } from '../types/index.js';
/**
 * Policy violation returned from Rego evaluation
 */
export interface RegoPolicyViolation {
    rule: string;
    message: string;
    severity: 'block' | 'warn' | 'suggest';
    category: string;
    priority?: number;
    description?: string;
}
/**
 * Rego policy evaluation result
 */
export interface RegoPolicyResult {
    allow: boolean;
    violations: RegoPolicyViolation[];
    warnings: RegoPolicyViolation[];
    suggestions: RegoPolicyViolation[];
    summary?: {
        total_violations: number;
        total_warnings: number;
        total_suggestions: number;
    };
}
/**
 * Categorized policy violations for tool consumption
 */
export interface CategorizedViolations {
    blocking: RegoPolicyViolation[];
    warnings: RegoPolicyViolation[];
    suggestions: RegoPolicyViolation[];
}
/**
 * Rego policy evaluator interface
 */
export interface RegoEvaluator {
    /**
     * Evaluate policy against input
     * @param input - Content to evaluate (Dockerfile text, K8s manifest, etc.)
     */
    evaluate(input: string | Record<string, unknown>): Promise<RegoPolicyResult>;
    /**
     * Evaluate policy against input with Result wrapper
     * @param result - Result containing content to evaluate
     * @param packageName - Package name to query (optional)
     * @returns Result containing policy evaluation
     */
    evaluatePolicy<T>(result: Result<T>, packageName?: string): Promise<Result<CategorizedViolations>>;
    /**
     * Query policy for configuration data
     * @param packageName - OPA package name to query (e.g., 'containerization.generation_config')
     * @param input - Input data for the query
     * @returns Configuration object from policy
     */
    queryConfig<T = unknown>(packageName: string, input: Record<string, unknown>): Promise<T | null>;
    /**
     * Clean up resources
     */
    close(): void;
    /**
     * Policy file path(s)
     */
    policyPaths: string[];
}
/**
 * Load and compile a Rego policy from file
 *
 * Hybrid approach:
 * 1. Check for pre-compiled WASM (fast, no OPA required)
 * 2. Fall back to OPA binary for .rego files (requires OPA installed)
 *
 * @param policyPath - Path to .rego policy file
 * @param logger - Logger instance for diagnostics
 * @returns Result containing RegoEvaluator or error
 *
 * @example
 * ```typescript
 * const result = await loadRegoPolicy('policies/security.rego', logger);
 * if (result.ok) {
 *   const evalResult = await result.value.evaluate(dockerfileContent);
 *   if (!evalResult.allow) {
 *     console.log('Violations:', evalResult.violations);
 *   }
 * }
 * ```
 */
export declare function loadRegoPolicy(policyPath: string, logger: Logger): Promise<Result<RegoEvaluator>>;
/**
 * Load and merge multiple Rego policy files
 *
 * OPA CLI automatically merges multiple policy files when passed with multiple -d flags.
 * All policies will be evaluated together and their results combined.
 *
 * @param policyPaths - Array of .rego policy file paths
 * @param logger - Logger instance
 * @returns Result containing RegoEvaluator or error
 */
export declare function loadAndMergeRegoPolicies(policyPaths: string[], logger: Logger): Promise<Result<RegoEvaluator>>;
/**
 * Simplified policy loading API for tests
 * Wrapper around loadAndMergeRegoPolicies for convenience
 *
 * @param options - Loading options
 * @param options.policiesPath - Directory containing policies
 * @param options.filePattern - Glob pattern for policy files (e.g., '*.rego', 'validation.rego')
 * @param logger - Optional logger instance
 * @returns Policy evaluator or failure
 */
export declare function loadPolicies(options: {
    policiesPath: string;
    filePattern?: string;
}, logger?: Logger): Promise<Result<RegoPolicy>>;
/**
 * Convenience type alias for RegoEvaluator used in tests
 */
export type RegoPolicy = RegoEvaluator;
//# sourceMappingURL=policy-rego.d.ts.map