/**
 * GovernanceAdapter -- Platform-agnostic adapter interface for multi-LLM governance.
 *
 * Maps governance enforcement to any AI platform's hook system.
 * Claude Code uses PreToolUse/PostToolUse; other platforms have their own
 * equivalents. This adapter layer normalizes them all.
 *
 * Pure TypeScript, no external dependencies.
 *
 * @connexum/ai-governance
 */
export declare enum ActionDecisionType {
    ALLOW = "ALLOW",
    DENY = "DENY",
    REQUIRE_APPROVAL = "REQUIRE_APPROVAL"
}
export interface ActionDecision {
    type: ActionDecisionType;
    reason: string;
    /** Optional metadata (e.g. approval ticket ID, policy reference) */
    metadata?: Record<string, unknown>;
}
export interface AgentIdentity {
    name: string;
    role?: string;
    sessionId?: string;
    /** Organization/tenant ID for multi-tenant queries */
    orgId?: string;
    /** Optional identity token for agent verification (HMAC-signed) */
    identityToken?: string;
}
export interface ActionContext {
    /** Tool or function being invoked */
    toolName: string;
    /** Input parameters for the tool */
    input: Record<string, unknown>;
    /** Identity of the agent performing the action */
    agent: AgentIdentity;
    /** ISO-8601 timestamp of the action request */
    timestamp: string;
    /** Optional session-level metadata */
    sessionInfo?: Record<string, unknown>;
    /** Organization/tenant ID (injected by API middleware) */
    orgId?: string;
}
export interface ActionResult {
    success: boolean;
    /** Brief summary of the output (never raw secrets) */
    outputSummary: string;
    /** Duration in milliseconds */
    durationMs?: number;
    /** Error message if success is false */
    error?: string;
}
/**
 * Structured reasons returned by `verifyAgentIdentity`. No silent booleans.
 * Every reason is audit-emittable and operator-interpretable.
 */
export type AgentIdentityReason = 'AGENT_IDENTITY_VERIFIED' | 'AGENT_IDENTITY_TOKEN_MISSING' | 'AGENT_IDENTITY_TOKEN_INVALID' | 'AGENT_IDENTITY_SECRET_MISSING' | 'AGENT_IDENTITY_UNVERIFIED_ALLOWED';
export interface AgentIdentityVerificationResult {
    verified: boolean;
    reason: AgentIdentityReason;
    detail: string;
}
/**
 * Audit events emitted by the adapter for identity-related state changes.
 * Consumed via `AdapterConfig.auditCallback` and by server boot gates.
 */
export type AdapterAuditEventType = 'agent-identity-token-missing' | 'agent-identity-verification-failed' | 'agent-identity-permissive-mode-boot-refused';
export interface AdapterAuditEvent {
    type: AdapterAuditEventType;
    severity: 'WARN' | 'CRITICAL';
    agentId: string;
    agentName?: string;
    reason: AgentIdentityReason | 'INCOMPATIBLE_PACK_ACTIVE';
    detail: string;
    timestamp: string;
}
export interface AdapterCapabilities {
    /** Platform supports pre-action hooks (e.g. PreToolUse) */
    preAction: boolean;
    /** Platform supports post-action hooks (e.g. PostToolUse) */
    postAction: boolean;
    /** Platform supports structured audit logging */
    auditLogging: boolean;
    /** Platform supports circuit breaker patterns */
    circuitBreaker: boolean;
    /** Platform supports approval queue / human-in-the-loop */
    approvalQueue: boolean;
    /** Platform supports tamper detection on governance files */
    tamperDetection: boolean;
}
export interface AdapterConfig {
    /** Human-readable adapter name (e.g. "claude-code", "openai-assistants") */
    adapterName: string;
    /** Platform identifier */
    platform: string;
    /** Path to governance rules (if file-based) */
    governancePath?: string;
    /** Path to audit log directory */
    logDir?: string;
    /** Platform-specific settings */
    platformOptions?: Record<string, unknown>;
    /**
     * Human-in-the-loop mode. When enabled, all DENY decisions are converted
     * to REQUIRE_APPROVAL and routed to the approval queue for human review.
     * No action is hard-blocked without a human seeing it first.
     *
     * Default: true (all blocks go to human review)
     */
    humanInTheLoop?: boolean;
    /**
     * SYSTEMIC-H1 migration escape hatch. When explicitly set to true, agents
     * that have no `identityToken` still pass verification. Every such call
     * emits an `agent-identity-token-missing` WARN audit event so operators
     * see the ongoing cost of permissive mode. The default is false (fail
     * closed), which is required by EU AI Act Art. 13/17 and SOC 2 CC6.1.
     *
     * This flag is INCOMPATIBLE with any active HIPAA / SOC 2 / EU AI Act
     * compliance pack; `assertIdentityConfigCompatibility()` throws at boot
     * in that combination.
     */
    allowUnverifiedIdentity?: boolean;
    /**
     * Optional audit sink invoked by the adapter for identity-related
     * events. Callers (server, runtime, tests) wire this to the same audit
     * chain used by other governance events. No-op if absent.
     */
    auditCallback?: (event: AdapterAuditEvent) => void;
}
export interface GovernanceAdapter {
    /** Unique adapter name, set during initialize() */
    readonly name: string;
    /**
     * Initialize the adapter with configuration.
     * Must be called before any other method.
     */
    initialize(config: AdapterConfig): void;
    /**
     * Pre-action governance check.
     * Maps to PreToolUse in Claude Code, function_call interception in OpenAI, etc.
     *
     * Returns an ActionDecision indicating whether the action should proceed.
     */
    preAction(context: ActionContext): ActionDecision;
    /**
     * Post-action audit hook.
     * Maps to PostToolUse in Claude Code, function response handling in OpenAI, etc.
     *
     * Called after an action completes (regardless of success/failure).
     */
    postAction(context: ActionContext, result: ActionResult): void;
    /**
     * Report which governance capabilities this adapter supports.
     */
    getCapabilities(): AdapterCapabilities;
}
export declare abstract class BaseGovernanceAdapter implements GovernanceAdapter {
    private _name;
    private _initialized;
    protected config: AdapterConfig | null;
    get name(): string;
    get initialized(): boolean;
    initialize(config: AdapterConfig): void;
    /**
     * Default: deny all actions. Subclasses override for enforcement.
     * A governance product must default to DENY -- never ALLOW.
     *
     * When humanInTheLoop is enabled (default), DENY becomes REQUIRE_APPROVAL
     * so a human can review every block before it takes effect.
     */
    preAction(_context: ActionContext): ActionDecision;
    /**
     * Convert DENY decisions to REQUIRE_APPROVAL when human-in-the-loop is enabled.
     * All blocks route through human review. No action is hard-blocked without
     * a human seeing it first.
     */
    protected applyHumanInTheLoop(decision: ActionDecision): ActionDecision;
    /**
     * Default: no-op. Subclasses override for audit logging.
     */
    postAction(_context: ActionContext, _result: ActionResult): void;
    /**
     * Subclasses must declare their capabilities.
     */
    abstract getCapabilities(): AdapterCapabilities;
    /**
     * Verify an agent's identity token.
     *
     * SYSTEMIC-H1 (fail-open audit, 2026-04-21): this method is FAIL-CLOSED
     * on missing or invalid tokens. A compliance product cannot silently
     * attest a pass-through identity. EU AI Act Art. 13/17 and SOC 2 CC6.1
     * require every agent action to be bound to a verifiable actor.
     *
     * Outcomes:
     *   - `identityToken` present + valid HMAC  -> verified: true
     *   - `identityToken` present + invalid     -> verified: false
     *     (reason: AGENT_IDENTITY_TOKEN_INVALID)
     *   - `identityToken` absent                -> verified: false
     *     (reason: AGENT_IDENTITY_TOKEN_MISSING)
     *   - no `secretSeed` configured            -> verified: false
     *     (reason: AGENT_IDENTITY_SECRET_MISSING). The operator must
     *     configure an issuer before identity verification can succeed.
     *
     * Every negative outcome also emits an audit event via
     * `AdapterConfig.auditCallback` so the failure is chained.
     */
    verifyAgentIdentity(agent: AgentIdentity): AgentIdentityVerificationResult;
    /**
     * Emit an audit event via the configured callback, if any. No-op if
     * `auditCallback` is not wired. Thrown exceptions from the callback are
     * caught so a broken audit sink cannot crash the governance path; the
     * error is surfaced on stderr so operators notice the drop.
     */
    protected emitAuditEvent(event: AdapterAuditEvent): void;
    /**
     * Guard: throws if adapter is used before initialization.
     */
    protected ensureInitialized(): void;
}
export declare function allow(reason: string, metadata?: Record<string, unknown>): ActionDecision;
export declare function deny(reason: string, metadata?: Record<string, unknown>): ActionDecision;
export declare function requireApproval(reason: string, metadata?: Record<string, unknown>): ActionDecision;
export declare function createActionContext(toolName: string, input: Record<string, unknown>, agent: AgentIdentity, sessionInfo?: Record<string, unknown>): ActionContext;
/**
 * Pack IDs that MUST NOT coexist with `allowUnverifiedIdentity: true`.
 * Each of these frameworks mandates a verifiable actor binding for every
 * agent action. Permissive identity mode is a direct violation.
 *
 *   - HIPAA 164.312(a)(2)(i): unique user identification
 *   - SOC 2 CC6.1: authenticated access
 *   - EU AI Act Art. 13, 17: traceability + identifiability of AI actors
 *
 * Pack IDs are compared case-insensitively and include common spellings
 * ("soc2", "soc-2", "soc_2", "eu-ai-act", "eu_ai_act", "euai").
 */
export declare const IDENTITY_STRICT_PACK_IDS: readonly string[];
/**
 * Boot-time check: refuse to start when permissive identity mode is
 * configured alongside an identity-strict compliance pack. Callers
 * (server boot, runtime initialize) MUST invoke this before serving
 * traffic.
 *
 * Throws with a structured operator-triage message on incompatibility.
 * Emits a CRITICAL audit event via `config.auditCallback` (if supplied)
 * before throwing, so the refusal is chained alongside other boot-gate
 * refusals.
 */
export declare function assertIdentityConfigCompatibility(config: AdapterConfig, activePackIds: readonly string[]): void;
//# sourceMappingURL=index.d.ts.map