/**
 * SupplyChain -- Dependency and module integrity verification.
 *
 * Verifies npm dependencies, shared module hashes, and MCP server
 * integrity at agent startup. Addresses OWASP ASI04 (Supply Chain).
 *
 * @connexum/ai-governance
 */
export interface SupplyChainConfig {
    /** Project root directory */
    projectRoot: string;
    /** Directory containing shared modules to verify */
    sharedDir?: string;
    /** Path to tool registry (approved MCP servers, etc.) */
    toolRegistryPath?: string;
    /** Audit log path */
    auditLogPath?: string;
    /** Skip npm audit (for environments without npm) */
    skipNpmAudit?: boolean;
}
export interface DependencyAudit {
    timestamp: string;
    vulnerabilities: VulnerabilityReport;
    lockfileIntegrity: LockfileCheck;
    moduleIntegrity: ModuleIntegrityCheck;
    toolRegistry: ToolRegistryCheck;
    passed: boolean;
    failures: string[];
}
export interface VulnerabilityReport {
    checked: boolean;
    critical: number;
    high: number;
    moderate: number;
    low: number;
    total: number;
    details?: string;
}
export interface LockfileCheck {
    exists: boolean;
    hash?: string;
    expectedHash?: string;
    valid: boolean;
}
export interface ModuleIntegrityCheck {
    totalFiles: number;
    verified: number;
    failed: number;
    mismatches: Array<{
        file: string;
        expected: string;
        actual: string;
    }>;
}
export interface ToolRegistryCheck {
    exists: boolean;
    approvedTools: number;
    unapprovedDetected: string[];
}
export interface ModuleManifest {
    generatedAt: string;
    generatedBy: string;
    projectRoot: string;
    files: Record<string, string>;
}
export declare class SupplyChain {
    private config;
    constructor(config: SupplyChainConfig);
    /**
     * Run a full supply chain audit. Returns pass/fail with details.
     */
    audit(): DependencyAudit;
    /**
     * Run npm audit to check for known vulnerabilities.
     */
    checkVulnerabilities(): VulnerabilityReport;
    /**
     * Verify lockfile hasn't been tampered with.
     */
    checkLockfile(): LockfileCheck;
    /**
     * Verify shared module file hashes against manifest.
     */
    checkModuleIntegrity(): ModuleIntegrityCheck;
    /**
     * Check if any unapproved tools/MCP servers are in use.
     */
    checkToolRegistry(): ToolRegistryCheck;
    /**
     * Generate a module manifest from the current state of shared files.
     */
    generateManifest(agentName: string): ModuleManifest;
    /**
     * Update the lockfile hash baseline (after legitimate dependency changes).
     */
    updateLockfileBaseline(): string | null;
    private logAudit;
}
//# sourceMappingURL=supply-chain.d.ts.map