/**
 * MemoryIntegrity -- Cryptographic verification for agent memory files.
 *
 * Every memory write gets a SHA-256 hash footer. Every read verifies
 * the hash. Tampered files are flagged, backed up copies are restored.
 * Addresses OWASP ASI06 (Memory Poisoning).
 *
 * @connexum/ai-governance
 */
export interface MemoryIntegrityConfig {
    /** Directory containing memory files */
    memoryDir: string;
    /** Agent name for audit logging */
    agentName: string;
    /** Audit log path (JSONL) */
    auditLogPath?: string;
    /** File extensions to protect (default: ['.md']) */
    protectedExtensions?: string[];
    /** Hash algorithm (default: 'sha256') */
    algorithm?: string;
}
export interface MemoryVerification {
    file: string;
    valid: boolean;
    hasHash: boolean;
    expectedHash?: string;
    actualHash?: string;
    restoredFromBackup: boolean;
    error?: string;
}
export interface MemoryWriteResult {
    file: string;
    hash: string;
    backupCreated: boolean;
}
export declare class MemoryIntegrity {
    private config;
    constructor(config: MemoryIntegrityConfig);
    /**
     * Write content to a memory file with integrity hash.
     * Creates a backup of the previous version.
     */
    writeMemory(filePath: string, content: string): MemoryWriteResult;
    /**
     * Read a memory file and verify its integrity.
     * Returns the content (without hash footer) if valid.
     * Attempts restoration from backup if tampered.
     */
    readMemory(filePath: string): {
        content: string;
        verification: MemoryVerification;
    };
    /**
     * Verify integrity of a single memory file.
     */
    verifyFile(filePath: string): MemoryVerification;
    /**
     * Verify all memory files in the memory directory.
     */
    verifyAll(): MemoryVerification[];
    /**
     * Add integrity hashes to all existing memory files that lack them.
     * Non-destructive: only adds hash footer, doesn't change content.
     */
    retroHashAll(): MemoryWriteResult[];
    /**
     * Generate a manifest of all memory file hashes.
     */
    generateManifest(): Record<string, string>;
    /**
     * Verify manifest against current files. Returns list of mismatches.
     */
    verifyManifest(manifest: Record<string, string>): Array<{
        file: string;
        expected: string;
        actual: string;
    }>;
    private resolveMemoryPath;
    private listMemoryFiles;
    private logEvent;
}
//# sourceMappingURL=memory-integrity.d.ts.map