/**
 * ChainTamperDetector -- P1-TAMPER-A
 *
 * Periodic full-chain re-verification worker. Runs independently of agent
 * activity so dormant periods are not unobserved windows. Emits signed
 * liveness attestations on success and CRITICAL events on failure.
 *
 * Events emitted:
 *   chain.verified      -- every interval on success
 *   chain.tamper.detected -- on any failure (CRITICAL severity)
 *   chain.agent.paused  -- when pauseAgentsOnTamper=true and tamper fires
 *
 * Config floors (strictest-wins):
 *   HIPAA / HITECH binding: intervalMs floor = 60 000 ms
 *   SOC 2 binding:          intervalMs floor = 300 000 ms
 *   Dev (intervalMs === 0): disables the loop
 *
 * @connexum/ai-governance P1-TAMPER-A
 */
import type { AuditIntegrity } from './audit-integrity.js';
import type { EventBus } from './event-bus.js';
export interface ChainTamperDetectorConfig {
    auditIntegrity: AuditIntegrity;
    eventBus: EventBus;
    /**
     * How often to re-verify the full chain (ms).
     * 0 disables the loop (dev only).
     * HIPAA/HITECH pack floor: 60 000 ms.
     * Default production: 300 000 ms.
     */
    intervalMs: number;
    /**
     * Emit chain.verified liveness attestations on success.
     * Default true; HIPAA/HITECH binding forces true.
     */
    emitLivenessAttestations: boolean;
    /**
     * If true, pause all governed agents when tamper is detected.
     * Agents remain paused until a T2 reviewer appends chain.cleared.
     * HIPAA/HITECH default: true.
     */
    pauseAgentsOnTamper: boolean;
    /**
     * Stable detector id used in events. Defaults to 'chain-tamper-detector'.
     */
    detectorId?: string;
    /**
     * HMAC secret for signing liveness attestation events (TRUST_ANCHOR_HMAC).
     * Required when emitLivenessAttestations is true.
     */
    hmacSecret?: string;
}
export interface ChainVerification {
    valid: boolean;
    chainHash: string;
    eventCount: number;
    verifiedAt: string;
    /** First broken entry index (-1 if valid) */
    brokenAt: number;
    firstBadEventId?: string;
    expectedHash?: string;
    observedHash?: string;
}
/** HIPAA/HITECH pack floor: 60 seconds */
export declare const HIPAA_INTERVAL_FLOOR_MS = 60000;
/** SOC 2 pack floor: 300 seconds */
export declare const SOC2_INTERVAL_FLOOR_MS = 300000;
export declare class ChainTamperDetector {
    private readonly cfg;
    private timer;
    private paused;
    constructor(config: ChainTamperDetectorConfig);
    /**
     * Begin the periodic verification loop.
     * Silently skips starting if intervalMs === 0 (dev mode).
     */
    start(): void;
    /**
     * Stop the verification loop cleanly.
     */
    stop(): void;
    /**
     * Run a verification cycle on-demand (used by AuditNarrativeGenerator
     * and the on-boot guard).
     */
    verifyNow(): Promise<ChainVerification>;
    /**
     * Check whether agents are currently paused due to detected tampering.
     */
    isPaused(): boolean;
    /**
     * Clear the paused state (called when a T2 reviewer appends chain.cleared).
     */
    clearPause(): void;
    private _runCycle;
    private _hmacSign;
    private _emitVerified;
    private _emitTamperDetected;
    private _emitAgentPaused;
    private _emit;
}
/**
 * Resolve the effective interval given a requested value and active pack IDs.
 * HIPAA/HITECH floor: 60 000 ms.
 * SOC 2 floor: 300 000 ms.
 * Any attempt to set an interval above the pack floor is silently clamped down.
 *
 * @throws PolicyWeakeningRefusedError if requestedMs exceeds the pack floor
 *         and the caller explicitly opted into strict mode.
 */
export declare function resolveChainVerificationInterval(requestedMs: number, activePackIds: string[]): number;
export declare class PolicyWeakeningRefusedError extends Error {
    constructor(message: string);
}
//# sourceMappingURL=chain-tamper-detector.d.ts.map