/**
 * AutonomousActionIsolator -- Cycle-composition gate for autonomous agents.
 *
 * Enforces the structural rule that an agent which READS the world in a cycle
 * cannot also CHANGE the world in that same cycle. This stops the prompt-injection
 * cascade: a hostile document retrieved in cycle N cannot trigger a consequential
 * action until cycle N+1, at which point the operator has visibility into what
 * cycle N retrieved before authorising cycle N+1's writes.
 *
 * BUILD_PLAN_V3_FULL_LIFECYCLE.md line 278:
 *   "Autonomous action isolation: no consequential action in same cycle as
 *    information gathering"
 *
 * OWASP A05 -- Security Misconfiguration (cascading hallucination + prompt injection):
 *   Without isolation, an agent that retrieves a hostile document ("delete all files")
 *   can obey in the same execution cycle. With isolation, the consequential action is
 *   deferred to a fresh cycle; the operator can review the cycle N retrieval before
 *   cycle N+1 is allowed to mutate state.
 *
 * Action taxonomy (orthogonal to PR #24 autonomy spectrum):
 *   - info-gathering  read, retrieve, query, search, fetch, list (non-mutating)
 *   - reasoning       self-check, regenerate, output (per PR #17 taxonomy)
 *   - consequential   write, send, deploy, transact, create, update, delete (mutates:true)
 *
 * Relation to PR #24 (autonomy spectrum):
 *   Both gates compose in the PreToolUse chain. Autonomy spectrum runs first and
 *   decides action class + autonomy level (WHAT kind of action, at WHAT level).
 *   Action isolation runs second and decides cycle composition (WHEN relative to
 *   info-gathering in the same cycle). Both must pass before tool dispatch.
 *
 * Three operating modes (operator-configured per agent):
 *   'none'          No enforcement. Agent can mix freely. Default for non-strict packs.
 *   'strict'        Any info-gathering in this cycle blocks ALL consequential actions.
 *                   Consequential actions throw ActionIsolationViolationError.
 *   'sourced-only'  Only blocks consequential actions that reference data sourced in the
 *                   same cycle (targetIds overlap with prior sourceIds). Allows same-cycle
 *                   consequential actions on pre-existing data. Used by strict packs
 *                   (HIPAA, GDPR, PCI DSS, HMDA, DORA) as a pragmatic default that
 *                   blocks the prompt-injection cascade without breaking legitimate
 *                   same-cycle workflows on pre-existing data.
 *
 * Pack-binding is mandatory on every operation (per feedback_pack_binding_primacy.md).
 *
 * Pen-test gates:
 *   PT-ACTION-ISO-1: source-spoofing -- agent declares info-gathering with empty
 *     sourceIds to evade sourced-only mode. Compensating control: INFO_GATHERING_NO_SOURCES_DECLARED
 *     warning event so auditors can detect the pattern.
 *   PT-ACTION-ISO-2: cycle-id reuse -- agent reuses a cleared cycleId hoping to carry
 *     over the cleared log. clearCycle() deletes the log; new cycleId starts empty.
 *   PT-ACTION-ISO-3: parallel-action timing -- agent fires info-gathering and consequential
 *     simultaneously hoping the guard sees an empty log. Per-cycle Mutex serialises calls.
 *
 * Compliance bindings:
 *   HIPAA 164.308(a)(5) -- Security awareness; anomaly detection
 *   GDPR Art. 25 -- Data protection by design; access minimisation
 *   PCI DSS Req 6.4 -- Protect public-facing web applications
 *   DORA Art. 9 -- ICT risk management; untrusted data handling
 *   SOC 2 CC7.2 -- System monitoring; anomaly response
 *   NIST 800-53 SI-10 -- Information input validation
 *
 * @connexum/ai-governance P3-T2
 */
import { OperatorRoles } from '../security/operator-roles';
export declare class ActionIsolationViolationError extends Error {
    readonly orgId: string;
    readonly agentId: string;
    readonly cycleId: string;
    readonly mode: IsolationMode;
    readonly remediation: 'deferred-to-next-cycle' | 'sourced-this-cycle';
    constructor(opts: {
        orgId: string;
        agentId: string;
        cycleId: string;
        mode: IsolationMode;
        remediation: 'deferred-to-next-cycle' | 'sourced-this-cycle';
        detail: string;
    });
}
export declare class EmptyPackBindingError extends Error {
    constructor(operation: string);
}
export declare class UnauthorizedIsolationConfigError extends Error {
    readonly approverIdentity: string;
    constructor(approverIdentity: string, detail: string);
}
/**
 * Operating modes for the AutonomousActionIsolator.
 * Configured per-agent by an operator.
 */
export type IsolationMode = 'none' | 'strict' | 'sourced-only';
/**
 * Action kinds in the isolation taxonomy.
 * Orthogonal to the autonomy-spectrum action classes (PR #24).
 */
export type ActionKind = 'info-gathering' | 'reasoning' | 'consequential';
/**
 * Mapping from existing action emit points to isolation taxonomy:
 *
 *   PR #18 (rag-source-allowlist) retrievals:
 *     guardPreRetrieval() allowed events -> 'info-gathering'
 *     All source kinds: vector-store, document-collection, url-prefix, mcp-resource
 *
 *   PR #17 (anomaly-self-reflection) actions:
 *     SelfReflectionActionKind 'output'      -> 'reasoning'
 *     SelfReflectionActionKind 'self-check'  -> 'reasoning'
 *     SelfReflectionActionKind 'regenerate'  -> 'reasoning'
 *
 *   PR #24 (autonomy-spectrum) mutating actions:
 *     GuardAction { mutates: true }  -> 'consequential'
 *     GuardAction { mutates: false } -> 'info-gathering' (if a read/query)
 *                                      'reasoning' (if a self-check/output)
 *
 * Integration sites call recordAction() from their existing audit emit points.
 * The taxonomy bridge is documented here; no new emit-helper is required because
 * the existing hooks already fire before/after tool dispatch. Callers pass the
 * appropriate ActionKind based on the mapping above.
 */
export interface RecordedAction {
    kind: ActionKind;
    /**
     * Source identifiers for info-gathering actions.
     * Examples: vector-store IDs, document IDs, URL hashes, MCP URIs.
     * NEVER raw URLs -- pass hashed or opaque identifiers only.
     * Empty array triggers PT-ACTION-ISO-1 warning (source-spoofing compensating control).
     */
    sourceIds?: string[];
    /**
     * Target identifiers for consequential actions.
     * Examples: file paths (hashed), resource IDs, recipient hashes.
     * Used in 'sourced-only' mode to detect sourceId/targetId overlap.
     */
    targetIds?: string[];
    /** ISO 8601 timestamp. Defaults to Date.now() if absent. */
    timestamp?: string;
}
export interface ConsequentialGuardAction {
    /** Action class (from PR #24 taxonomy, e.g. 'production-write', 'financial-transaction'). */
    class: string;
    /** True if this action changes persistent state (from PR #24 GuardAction.mutates). */
    mutates: boolean;
    /**
     * Target identifiers. Used in 'sourced-only' mode to check overlap with
     * sourceIds from prior info-gathering actions in this cycle.
     */
    targetIds?: string[];
}
export type IsolationDecision = 'execute' | 'deferred';
export interface IsolationResult {
    decision: IsolationDecision;
    reason: string;
}
export type IsolationEventKind = 'ACTION_ISOLATION_VIOLATION' | 'ACTION_ISOLATION_PASSED' | 'ACTION_ISOLATION_CONFIGURED' | 'INFO_GATHERING_NO_SOURCES_DECLARED';
export interface IsolationAuditEvent {
    type: IsolationEventKind;
    severity: 'ERROR' | 'WARN' | 'NOTICE' | 'INFO';
    orgId: string;
    agentId: string;
    cycleId: string;
    timestamp: string;
    /** SHA-256 of the previous audit event for this agent (chain linkage). */
    prevSha: string;
    data: Record<string, unknown>;
}
export type IsolationAuditSink = (event: IsolationAuditEvent) => void;
/**
 * AutonomousActionIsolator
 *
 * Operator-configured gate that enforces cycle-composition isolation between
 * information-gathering and consequential actions.
 *
 * Usage:
 *   const isolator = new AutonomousActionIsolator(auditSink, operatorRoles);
 *
 *   // Operator configures mode (requires ADMIN role):
 *   isolator.configure('org-1', 'agent-1', 'strict', ['hipaa'], 'admin-alice');
 *
 *   // PreToolUse chain -- info-gathering tool:
 *   await isolator.recordAction('org-1', 'agent-1', 'cycle-abc', {
 *     kind: 'info-gathering',
 *     sourceIds: ['vs_pubmed_2026'],
 *   }, ['hipaa']);
 *
 *   // PreToolUse chain -- before mutating tool (after autonomy-spectrum check):
 *   const result = await isolator.guardConsequentialAction(
 *     'org-1', 'agent-1', 'cycle-abc',
 *     { class: 'production-write', mutates: true, targetIds: ['doc-123'] },
 *     ['hipaa'],
 *   );
 *   // mode:'strict' + info-gathering present -> throws ActionIsolationViolationError
 *
 *   // Cycle teardown:
 *   isolator.clearCycle('cycle-abc');
 */
export declare class AutonomousActionIsolator {
    private readonly auditSink;
    private readonly operatorRoles;
    /**
     * Test-only operator map. When provided, OperatorRoles RBAC is bypassed
     * in favour of this simple identity->role map.
     */
    private readonly testOperatorMap;
    /** Per-agent isolation config. Key: orgId::agentId */
    private readonly configs;
    /**
     * Per-agent-cycle action log. Key: orgId::agentId::cycleId
     * Keyed by agent+cycle so that two different agents' cycle logs
     * are fully independent even if they share the same cycleId string.
     */
    private readonly cycleLogs;
    /**
     * Per-agent-cycle mutex. Key: orgId::agentId::cycleId
     * PT-ACTION-ISO-3: ensures recordAction and guardConsequentialAction
     * are serialised per agent+cycle pair, not globally.
     */
    private readonly cycleMutexes;
    /** Per-agent SHA chain head. Key: orgId::agentId */
    private readonly chainHead;
    constructor(auditSink?: IsolationAuditSink, operatorRoles?: OperatorRoles, options?: {
        testOperatorMap?: Map<string, string>;
    });
    /**
     * Configure isolation mode for an agent. Operator-only (ADMIN role required).
     *
     * @param orgId          Organisation identifier.
     * @param agentId        Agent identifier.
     * @param mode           Isolation mode: 'none' | 'strict' | 'sourced-only'.
     * @param packBinding    Non-empty array of compliance pack IDs.
     * @param approverIdentity Operator identity (must have ADMIN role).
     */
    configure(orgId: string, agentId: string, mode: IsolationMode, packBinding: string[], approverIdentity: string): void;
    /**
     * Record an action in a cycle's log.
     *
     * This is called from existing audit chain emit points:
     *   - PR #18 (rag-source-allowlist) allowed retrievals -> kind: 'info-gathering'
     *   - PR #17 (anomaly-self-reflection) actions -> kind: 'reasoning'
     *   - PR #24 (autonomy-spectrum) mutating tool calls -> kind: 'consequential'
     *   - PR #24 non-mutating tool calls -> kind: 'info-gathering' or 'reasoning'
     *
     * PT-ACTION-ISO-1 compensating control: if kind is 'info-gathering' and
     * sourceIds is empty, emits INFO_GATHERING_NO_SOURCES_DECLARED warning.
     *
     * @param orgId       Organisation identifier.
     * @param agentId     Agent identifier.
     * @param cycleId     Cycle identifier (server-generated, one-shot per PR #15).
     * @param action      Action descriptor.
     * @param packBinding Non-empty array of compliance pack IDs.
     */
    recordAction(orgId: string, agentId: string, cycleId: string, action: RecordedAction, packBinding: string[]): Promise<void>;
    /**
     * Pre-execution gate for consequential actions.
     *
     * Must run AFTER PR #24 autonomy-spectrum gate and BEFORE tool dispatch.
     * Order: autonomy-spectrum (class+level check) -> action-isolation (cycle-composition) -> dispatch.
     *
     * Returns { decision: 'execute', reason } when allowed.
     * Throws ActionIsolationViolationError when blocked.
     * Emits ACTION_ISOLATION_PASSED (NOTICE) when mode is non-'none' and allowed.
     * Emits ACTION_ISOLATION_VIOLATION (ERROR) when blocked.
     *
     * @param orgId       Organisation identifier.
     * @param agentId     Agent identifier.
     * @param cycleId     Cycle identifier.
     * @param action      Consequential action descriptor.
     * @param packBinding Non-empty array of compliance pack IDs.
     */
    guardConsequentialAction(orgId: string, agentId: string, cycleId: string, action: ConsequentialGuardAction, packBinding: string[]): Promise<IsolationResult>;
    /**
     * Release the per-cycle action log when a cycle completes.
     * PT-ACTION-ISO-2: A new cycleId starts with an empty log; cleared state
     * is not carried over even if the cycleId string is reused by a caller.
     *
     * The key is agent-scoped (orgId::agentId::cycleId), so clearing agent A's
     * cycle does not affect agent B's cycle with the same cycleId string.
     *
     * @param orgId   Organisation identifier.
     * @param agentId Agent identifier.
     * @param cycleId Cycle identifier to clear.
     */
    clearCycle(orgId: string, agentId: string, cycleId: string): void;
    private agentKey;
    /**
     * Per-agent-cycle compound key. Ensures that two agents running the same
     * cycleId string have fully independent action logs (multi-agent isolation).
     */
    private agentCycleKey;
    private getCycleLog;
    private getCycleMutex;
    /**
     * Resolve the effective isolation mode for an agent.
     *
     * Priority order:
     * 1. Explicitly configured mode (via configure()).
     * 2. Pack-derived default: if any pack in packBinding is a strict pack,
     *    default to 'sourced-only'.
     * 3. Fallback: 'none'.
     */
    private resolveMode;
    private validatePackBinding;
    private verifyOperatorIdentity;
    private emitEvent;
    private genesisHash;
}
/**
 * Returns the default isolation mode for a set of pack IDs.
 * Used by packs that set requiresActionIsolation to communicate their
 * preferred default to the runtime.
 *
 * Strict regulated packs default to 'sourced-only' (not 'strict') because:
 *   - 'strict' would block all same-cycle mutating actions whenever ANY
 *     retrieval happened, which is too broad for most regulated workflows.
 *   - 'sourced-only' specifically blocks consequential actions on freshly-retrieved
 *     content, which is the precise attack vector (prompt-injection cascade).
 *   - Operators who need full 'strict' isolation can configure it explicitly.
 */
export declare function defaultIsolationModeForPacks(packIds: string[]): IsolationMode;
//# sourceMappingURL=action-isolation.d.ts.map