/**
 * RetrievalAllowlistEnforcer -- Per-agent + per-pack source allowlisting
 * for RAG / vector-store / external retrieval.
 *
 * When an agent's tool invokes a retrieval (RAG, vector-store lookup,
 * external search), the source URL/URI is checked against:
 *   1. Per-agent allowlist (explicit agent-level configuration)
 *   2. Per-pack allowlist (derived from the agent's bound compliance packs)
 *
 * Denial throws `UnauthorizedRetrievalSourceError` synchronously and emits
 * a CRITICAL `governance:retrieval-source-denied` audit event.
 *
 * Pack-binding specifics:
 *   - FCRA: consumer-report sources require an explicit `permissiblePurpose`
 *     tag in the request; requests without it are refused.
 *   - MRPC (legal): matter-scoped agents can only retrieve from their
 *     declared matter archive; any other source is refused.
 *
 * defaultPolicy:
 *   - 'deny': any source not in an allowlist throws (fail-closed, default).
 *   - 'allow-with-audit': unknown sources emit an audit event but proceed.
 *
 * P3-T1 coverage gap: Retrieval source allowlisting per agent.
 *
 * Compliance bindings:
 *   - FCRA 15 U.S.C. 1681b: permissible purpose requirement
 *   - MRPC 1.6: confidentiality of client information
 *   - SOC 2 CC6.1: logical access controls
 *   - HIPAA 164.312(a)(1): access control to PHI sources
 *
 * @connexum/ai-governance
 */
export declare class UnauthorizedRetrievalSourceError extends Error {
    readonly agentId: string;
    readonly source: string;
    readonly denyReason: RetrievalDenyReason;
    readonly packBinding: string[];
    constructor(opts: {
        agentId: string;
        source: string;
        denyReason: RetrievalDenyReason;
        packBinding?: string[];
    });
}
export type RetrievalDenyReason = 'not-in-agent-allowlist' | 'not-in-pack-allowlist' | 'default-deny' | 'fcra-missing-permissible-purpose' | 'mrpc-not-declared-matter-archive';
export interface RetrievalRequest {
    agentId: string;
    /** Source URI/URL being retrieved from. */
    source: string;
    /**
     * FCRA: permissible purpose code (e.g. 'credit-transaction', 'employment',
     * 'insurance'). Required when FCRA pack is bound.
     */
    permissiblePurpose?: string;
    /**
     * MRPC: matter archive identifier. Must match the agent's declared
     * matter archive when the MRPC pack is bound.
     */
    matterArchiveId?: string;
}
export interface RetrievalAllowedAuditEvent {
    type: 'governance:retrieval-source-allowed';
    agentId: string;
    source: string;
    matchedList: 'agent' | 'pack' | 'allow-with-audit';
    timestamp: string;
}
export interface RetrievalDeniedAuditEvent {
    type: 'governance:retrieval-source-denied';
    severity: 'CRITICAL';
    agentId: string;
    source: string;
    denyReason: RetrievalDenyReason;
    timestamp: string;
}
export interface RetrievalAllowlistConfig {
    /**
     * Per-agent allowlist. Key = agentId, value = allowed source URI/URL prefixes.
     * An agent whose agentId is NOT in this map falls through to pack allowlist.
     */
    perAgentAllowlist: Record<string, string[]>;
    /**
     * Per-pack allowlist. Key = packId, value = allowed source URI/URL prefixes.
     */
    perPackAllowlist: Record<string, string[]>;
    /**
     * What to do when a source is not explicitly allowed.
     * 'deny' = throw (fail-closed, default).
     * 'allow-with-audit' = log and allow.
     */
    defaultPolicy: 'deny' | 'allow-with-audit';
    /**
     * MRPC matter archives per agentId. Key = agentId, value = allowed archive IDs.
     */
    mrpcMatterArchives?: Record<string, string[]>;
    /** FCRA valid permissible purpose codes. */
    fcraPermissiblePurposes?: string[];
}
export declare class RetrievalAllowlistEnforcer {
    private readonly config;
    private readonly auditSink;
    constructor(config: RetrievalAllowlistConfig, auditSink?: (event: RetrievalAllowedAuditEvent | RetrievalDeniedAuditEvent) => void);
    /**
     * Enforce allowlist for a retrieval request. Throws synchronously on
     * denial. Returns void on success.
     *
     * Must be called before dispatching any RAG / vector-store / external
     * retrieval tool so that the block fires during PreToolUse.
     */
    enforce(request: RetrievalRequest, activePackIds?: string[]): void;
    /**
     * Check if `source` matches any prefix in `list`.
     * Prefix match is used (e.g. 'https://docs.example.com' matches
     * 'https://docs.example.com/anything').
     */
    private matches;
    private allow;
    private deny;
}
//# sourceMappingURL=retrieval-allowlist.d.ts.map