/**
 * OPA/Rego Policy Evaluation
 *
 * Integrates with Open Policy Agent for policy-as-code evaluation.
 * Supports both local OPA bundles and remote OPA servers.
 *
 * @module enterprise/policy/opa
 */
import type { Finding, Severity } from "../../certification/types.js";
/**
 * OPA evaluation mode
 */
export type OPAMode = "local" | "remote";
/**
 * OPA configuration
 */
export interface OPAConfig {
    /** Evaluation mode */
    mode: OPAMode;
    /** For local: path to OPA bundle or policy file */
    bundlePath?: string;
    /** For remote: OPA server URL */
    serverUrl?: string;
    /** Decision path (default: "vaspera/certification/allow") */
    decisionPath?: string;
    /** Timeout in milliseconds */
    timeout?: number;
    /** Custom headers for remote requests */
    headers?: Record<string, string>;
}
/**
 * Policy input for evaluation
 */
export interface PolicyInput {
    /** Certification context */
    certification: {
        id: string;
        target: string;
        status: string;
        score: number;
        findings: FindingSummary[];
        frameworks: string[];
        startedAt: string;
    };
    /** User context */
    user?: {
        id: string;
        email: string;
        role: string;
        groups?: string[];
    };
    /** Environment context */
    environment?: {
        ci: boolean;
        branch?: string;
        commit?: string;
        repository?: string;
    };
}
/**
 * Summarized finding for policy evaluation
 */
export interface FindingSummary {
    id: string;
    severity: Severity;
    category: string;
    confidence: number;
}
/**
 * Policy evaluation result
 */
export interface PolicyResult {
    /** Whether the policy allows the action */
    allow: boolean;
    /** Reasons for denial (if not allowed) */
    denialReasons?: string[];
    /** Warnings (non-blocking) */
    warnings?: string[];
    /** Required remediations before approval */
    requiredRemediations?: string[];
    /** Compliance findings from policy */
    complianceFindings?: ComplianceFinding[];
    /** Raw policy output */
    rawResult?: Record<string, unknown>;
    /** Evaluation timestamp */
    evaluatedAt: string;
    /** Policy version/hash */
    policyVersion?: string;
}
/**
 * Compliance finding from policy
 */
export interface ComplianceFinding {
    control: string;
    framework: string;
    status: "pass" | "fail" | "warning";
    message: string;
    evidence?: string;
}
/**
 * OPA policy evaluator
 */
export declare class OPAClient {
    private config;
    constructor(config: OPAConfig);
    /**
     * Evaluate policy
     */
    evaluate(input: PolicyInput): Promise<PolicyResult>;
    /**
     * Evaluate policy remotely via OPA server
     */
    private evaluateRemote;
    /**
     * Evaluate policy locally using bundled policies
     */
    private evaluateLocal;
    /**
     * Evaluate JSON policy bundle
     */
    private evaluatePolicy;
    /**
     * Evaluate a single compliance check
     */
    private evaluateComplianceCheck;
    /**
     * Parse OPA result into PolicyResult
     */
    private parseResult;
    /**
     * Check if OPA is available
     */
    isAvailable(): Promise<boolean>;
}
/**
 * JSON policy bundle format
 */
interface PolicyBundle {
    version: string;
    rules: PolicyRules;
    complianceChecks?: ComplianceCheck[];
}
/**
 * Policy rules
 */
interface PolicyRules {
    minScore?: number;
    maxCriticalFindings?: number;
    maxHighFindings?: number;
    requiredFrameworks?: string[];
    blockedCategories?: string[];
    requireRemediationFor?: Severity[];
    warnOnCategories?: string[];
}
/**
 * Compliance check definition
 */
interface ComplianceCheck {
    control: string;
    framework: string;
    message: string;
    blocking: boolean;
    type: "no_findings" | "max_findings" | "min_score" | "has_framework";
    category?: string;
    maxCount?: number;
    minScore?: number;
    requiredFramework?: string;
}
/**
 * Generate default policy bundle
 */
export declare function generateDefaultPolicy(): PolicyBundle;
/**
 * Generate SOC 2 policy bundle
 */
export declare function generateSOC2Policy(): PolicyBundle;
/**
 * Convert policy result to findings
 */
export declare function policyResultToFindings(result: PolicyResult): Finding[];
/**
 * Create OPA client
 */
export declare function createOPAClient(config: OPAConfig): OPAClient;
/**
 * Create local OPA client from bundle
 */
export declare function createLocalOPAClient(bundlePath: string): OPAClient;
/**
 * Create remote OPA client
 */
export declare function createRemoteOPAClient(serverUrl: string): OPAClient;
export {};
//# sourceMappingURL=opa.d.ts.map