/**
 * MemoryChainVerifier -- SHA-256 hash-chaining for memory state integrity.
 *
 * Every memory write produces a chained hash entry. On session start,
 * the verifier confirms that the current memory state matches the chain
 * head from the last session. A mismatch indicates memory poisoning
 * across sessions -- the session is refused to load and a CRITICAL audit
 * event is emitted.
 *
 * Each chain entry contains:
 *   { agentId, sessionId, previousHash, currentHash, writeOp, pseudonymized, timestamp }
 *
 * The genesis entry (cold start) is a well-known empty hash so that the
 * chain can be bootstrapped without a prior session.
 *
 * P3-T1 coverage gap: Memory-state audit chain verification.
 *
 * Compliance bindings:
 *   - SOC 2 CC7.2: monitoring of system components for tampering
 *   - HIPAA 164.312(c)(1): integrity controls
 *   - EU AI Act Art. 12: record-keeping requirements
 *   - ISO 42001 A.9.1: AI system monitoring
 *
 * @connexum/ai-governance
 */
export declare class MemoryPoisoningDetectedError extends Error {
    readonly agentId: string;
    readonly sessionId: string;
    readonly expectedHash: string;
    readonly actualHash: string;
    constructor(opts: {
        agentId: string;
        sessionId: string;
        expectedHash: string;
        actualHash: string;
    });
}
export type MemoryWriteOp = 'set' | 'delete' | 'clear' | 'session-open' | 'session-close';
export interface MemoryChainEntry {
    type: 'governance:memory-write';
    agentId: string;
    sessionId: string;
    previousHash: string;
    currentHash: string;
    writeOp: MemoryWriteOp;
    pseudonymized: boolean;
    timestamp: string;
}
export interface MemoryPoisoningAuditEvent {
    type: 'governance:memory-poisoning-detected';
    severity: 'CRITICAL';
    agentId: string;
    sessionId: string;
    expectedHash: string;
    actualHash: string;
    timestamp: string;
}
export interface MemoryChainVerifierConfig {
    /**
     * Optional persistent chain storage adapter. If omitted, the chain is
     * in-memory only (sufficient for tests; production wires a file/DB adapter).
     */
    persistAdapter?: MemoryChainPersistAdapter;
}
export interface MemoryChainPersistAdapter {
    /** Load the most recent chain entry for (agentId). Returns undefined on cold start. */
    loadHead(agentId: string): Promise<MemoryChainEntry | undefined>;
    /** Append a new chain entry. */
    append(entry: MemoryChainEntry): Promise<void>;
}
export declare class MemoryChainVerifier {
    private readonly config;
    /**
     * In-memory chain tail per agentId. Used when no persistAdapter is
     * configured or as a fast-path before persisting.
     */
    private readonly chainHeads;
    private readonly auditSink;
    constructor(config?: MemoryChainVerifierConfig, auditSink?: (event: MemoryChainEntry | MemoryPoisoningAuditEvent) => void);
    /**
     * Verify that memory state matches the chain at session start.
     *
     * `currentMemoryHash` is the hash the caller computed over the current
     * in-memory state (e.g. SHA-256 of sorted JSON of all keys+values).
     *
     * If a prior chain head exists and does not match, throws
     * `MemoryPoisoningDetectedError` and emits a CRITICAL audit event.
     * Never silently passes a mismatch.
     *
     * Cold start (no prior chain) always passes.
     */
    verifyOnSessionStart(agentId: string, sessionId: string, currentMemoryHash: string): Promise<void>;
    /**
     * Record a memory write operation. Must be called after every successful
     * write to `SessionMemoryStore` or `CrossSessionMemoryStore` so the chain
     * stays in sync with the memory state.
     */
    recordWrite(agentId: string, sessionId: string, writeOp: MemoryWriteOp, newMemoryHash: string, pseudonymized: boolean): Promise<void>;
    /**
     * Compute a deterministic SHA-256 hash over a memory snapshot.
     * Keys are sorted to ensure determinism.
     */
    static hashMemorySnapshot(snapshot: Record<string, unknown>): string;
    /** Expose genesis hash for test introspection. */
    static get genesisHash(): string;
    private loadHead;
    private appendEntry;
}
//# sourceMappingURL=memory-chain.d.ts.map