/**
 * AgentAuth -- Inter-agent authentication via HMAC-signed handoffs.
 *
 * Prevents handoff forgery between agents. Each agent has a derived
 * secret from its name + SOUL content. All handoffs carry HMAC-SHA256
 * signatures that are verified before acceptance.
 *
 * Addresses OWASP ASI07 (Inter-Agent Authentication).
 *
 * @connexum/ai-governance
 */
export interface AgentAuthConfig {
    /** Directory containing agent SOUL/identity files */
    agentsDir: string;
    /** Shared secret seed (combined with agent identity for per-agent secrets) */
    secretSeed: string;
    /** Handoff log file path (JSONL) */
    handoffLogPath?: string;
    /** Signature validity window in ms (default: 300000 = 5 min) */
    signatureWindowMs?: number;
    /** Directory for persistent nonce storage (enables cross-restart replay protection) */
    nonceStoreDir?: string;
}
export interface SignedHandoff {
    id: string;
    from: string;
    to: string;
    task: string;
    payload?: Record<string, unknown>;
    timestamp: string;
    signature: string;
    /** Nonce to prevent replay attacks */
    nonce: string;
}
export interface HandoffVerification {
    valid: boolean;
    handoff: SignedHandoff;
    reason?: string;
}
export declare class AgentAuth {
    private config;
    /** Cache of agent secrets derived from identity files */
    private secretCache;
    /** Used nonces with timestamps (prevent replay with TTL-based expiry) */
    private usedNonces;
    /** Persistent nonce store (survives process restart) */
    private nonceStore;
    constructor(config: AgentAuthConfig);
    /**
     * Create a signed handoff from one agent to another.
     */
    createHandoff(from: string, to: string, task: string, payload?: Record<string, unknown>): SignedHandoff;
    /**
     * Verify a signed handoff is authentic and hasn't been tampered with.
     */
    verifyHandoff(handoff: SignedHandoff): HandoffVerification;
    /**
     * Accept a handoff: verify + mark as accepted.
     */
    acceptHandoff(handoff: SignedHandoff, acceptingAgent: string): HandoffVerification;
    /**
     * Get the agent secret for signing. Derives using HKDF from agent identity + seed.
     * Cached for performance with file modification tracking.
     */
    deriveAgentSecret(agentName: string): string;
    /**
     * Generate a shared verification token that two agents can use
     * to establish a trusted channel.
     */
    createChannelToken(agent1: string, agent2: string): string;
    /**
     * List recent handoffs from the log.
     */
    getRecentHandoffs(limit?: number): Array<Record<string, unknown>>;
    /**
     * Clear the nonce cache (for testing or maintenance).
     */
    clearNonces(): void;
    /**
     * Prune nonces older than 2x the signature window.
     * Prevents unbounded memory growth while maintaining replay protection
     * for all nonces within the validity window.
     */
    private pruneExpiredNonces;
    /**
     * Clear the secret cache (if agent files change).
     */
    clearSecretCache(): void;
    private buildSignatureMessage;
    private logHandoff;
}
//# sourceMappingURL=agent-auth.d.ts.map