/**
 * GovernedAgent -- Simple "front door" factory for @connexum/ai-governance.
 *
 * Instead of wiring 50+ classes together, call createGovernedAgent(config)
 * and get back a governed agent that enforces rules, logs audit trails,
 * and computes compliance scores.
 *
 * @connexum/ai-governance
 */
import { type ActionContext, type ActionDecision } from './adapters/index';
import { type CompliancePack } from './packs/index';
import { CircuitBreaker } from './security/circuit-breaker';
import { PackEvaluator, type PackEvaluatorVerdict } from './governance/pack-evaluator';
/**
 * Thrown by execute() when the SDK-path operator kill-switch is active for
 * this agentId. Indicates that an operator has explicitly suspended the agent
 * via POST /api/v1/agents/:id/suspend, and the SuspendStateCache has
 * propagated the state to the local CircuitBreaker.
 *
 * ASI-10 SDK kill-switch. Callers should surface this to the end user as a
 * hard block distinct from a pack policy violation.
 */
export declare class OperatorSuspendedError extends Error {
    /** The agentId that is currently suspended. */
    readonly agentId: string;
    constructor(agentId: string);
}
/**
 * Thrown by execute() when the pack evaluator produces a DENY verdict.
 * Callers should catch this to surface a governance-blocked result.
 */
export declare class PackPolicyViolation extends Error {
    /** Human-readable explanation from the pack evaluator. */
    readonly packReason: string;
    /** IDs of packs whose rules produced the DENY verdict. */
    readonly triggeringPackIds: string[];
    /**
     * F-NEW-CRIT-39i-2: classifier IDs (e.g. PHI_MRN, GDPR_DOB) that
     * fired inside the triggering packs. Surfaces from
     * PackEvaluatorVerdict.triggeringClassifierIds so the gov-server
     * audit chain (CRIT-39i regulatoryViolations) can record per-
     * category breadcrumbs instead of pack-level only.
     */
    readonly triggeringClassifierIds: string[];
    /** F-NEW-CRIT-39j-3: true when DENY came from adapter default-deny (no rule matched). */
    readonly defaultDenyTriggered: boolean;
    constructor(reason: string, triggeringPackIds: string[], triggeringClassifierIds?: string[], defaultDenyTriggered?: boolean);
}
/**
 * Thrown by createGovernedAgent() when a requested pack ID is not found in
 * BUILT_IN_PACKS. Replaces the previous silent-skip behavior (Task 3 fix).
 *
 * A customer requesting a non-existent pack was silently getting zero
 * enforcement -- indistinguishable from a correctly-configured agent with
 * no restrictions. This error makes the misconfiguration immediately visible.
 *
 * Callers that want softer handling (e.g., during pack catalog migrations)
 * can catch MissingPackError at the call site.
 */
export declare class MissingPackError extends Error {
    /** The pack ID that was not found. */
    readonly packId: string;
    constructor(packId: string, message: string);
}
/**
 * Thrown by createGovernedAgent() when a compliance pack's runtime content
 * does not match its embedded contentHash. This detects monkey-patching of
 * a pack's validators[] or requiredModules[] after the module was loaded.
 *
 * Layer 3 of the third-party pack rejection defence.
 * F-NEW-LAYER3-PACK-CONTENT-HASH-NOT-WIRED-2026-05-25
 *
 * Attack scenario: an attacker clears validators[] on HIPAA_PACK in-memory
 * so it enforces nothing, but the audit chain still says "HIPAA enforced".
 * Layer 3 catches this by re-computing the hash at createGovernedAgent()
 * time and comparing against pack.contentHash (embedded at build time).
 */
export declare class PackContentTamperedError extends Error {
    /** The id field of the pack whose content hash mismatched. */
    readonly packId: string;
    /**
     * The hash stored in pack.contentHash (trusted — set at build time).
     * Private: hash values are NOT surfaced publicly to prevent oracle attacks
     * where an attacker reads expected hashes off the wire and crafts a
     * matching tampered pack. Use structured server-side logging instead.
     */
    private readonly _expectedHash;
    /**
     * The hash recomputed from the live runtime pack object.
     * Private: same oracle-attack rationale as _expectedHash.
     */
    private readonly _actualHash;
    constructor(packId: string, expectedHash: string, actualHash: string);
}
/**
 * Thrown by createGovernedAgent() when a caller attempts to inject a
 * third-party / custom pack object into the packs array instead of
 * referencing a registry pack by string ID.
 *
 * Security boundary: the @connexum/ai-governance runtime ONLY evaluates
 * packs from the BUILT_IN_PACKS registry. Customers cannot ship custom pack
 * code that would execute inside our runtime and emit audit-chain entries
 * claiming compliance with a standard the runtime did not actually enforce.
 *
 * To request a new pack, contact support or use the dashboard's
 * "Request a new compliance pack" feature (my-cc.io/dashboard/packs/request).
 *
 * Fix: replace custom pack objects with their official string IDs (e.g.
 * 'hipaa', 'soc2', 'gdpr'). See BUILT_IN_PACKS in src/governed-agent.ts for
 * the full list of accepted identifiers.
 *
 * F-NEW-THIRD-PARTY-PACK-REJECTION-2026-05-24 (Layer 1 of 3).
 */
export declare class ThirdPartyPackRejected extends Error {
    /**
     * The raw value that was rejected (serialized for diagnostics).
     * Could be a non-string type or an unrecognised string ID.
     */
    readonly rejectedValue: unknown;
    /**
     * Zero-based index of the rejected entry in config.packs[].
     */
    readonly packIndex: number;
    constructor(rejectedValue: unknown, packIndex: number);
}
export interface GovernanceRule {
    tool: string | RegExp;
    decision: 'allow' | 'deny' | 'require_approval';
    reason: string;
    conditions?: Record<string, unknown>;
}
export interface GovernedAgentConfig {
    name: string;
    platform: 'claude' | 'openai' | 'gemini' | string;
    packs?: string[];
    licenseKey?: string;
    rules?: GovernanceRule[];
    onDecision?: (decision: ActionDecision) => void;
    onError?: (error: Error) => void;
    auditDir?: string;
    defaultDeny?: boolean;
    /**
     * Human-in-the-loop mode. When enabled (default: true), all DENY decisions
     * are converted to REQUIRE_APPROVAL and routed to the approval queue.
     * No action is hard-blocked without a human seeing it first.
     */
    humanInTheLoop?: boolean;
    /**
     * Optional directory for the internal EventBus used by the PackEvaluator.
     * Defaults to a temporary directory when not provided.
     * If auditDir is set and this is not, auditDir is used.
     */
    eventBusDir?: string;
    /**
     * Optional pre-constructed PackEvaluator for injection in tests.
     * When provided, the factory will use this evaluator instead of creating one.
     * This allows tests to inject a pre-seeded evaluator without needing to
     * configure packs through the config.packs[] path.
     */
    _packEvaluator?: PackEvaluator;
    /**
     * DI: optional function to submit a PENDING PackEvaluatorVerdict to the
     * approval queue storage. Eliminates the async dynamic-import boundary in
     * the execute() hot path for multi-package deployments.
     *
     * When provided: used directly -- no dynamic import occurs.
     * When absent: the legacy dynamic-import-with-graceful-degrade path is used,
     *   which preserves backward compat for single-package / unit-test deployments.
     *
     * The governance-server passes submitPendingApprovalForPackVerdict from
     * pack-verdict-adapter.ts when constructing GovernedAgent.
     */
    pendingApprovalSubmitter?: (verdict: PackEvaluatorVerdict) => Promise<{
        id: string;
    }>;
    /**
     * Opt-in flag to allow packs with PLACEHOLDER STATUS to be activated.
     * PLACEHOLDER packs bundle multiple jurisdictions and require Vera (Legal) +
     * counsel sign-off per jurisdiction before production activation. Activating a
     * PLACEHOLDER pack without this flag throws to prevent silent under/over-enforcement.
     * F-NEW-VERA-PACK-FINAL-004 (2026-05-03): added for lpo2024 PLACEHOLDER gate.
     */
    allowPlaceholderPacks?: boolean;
    /**
     * ASI-10 SDK kill-switch: optional CircuitBreaker instance that carries the
     * per-agent forced-OPEN state. When provided, execute() calls
     * `circuitBreaker.allowExecutionForAgent(agentId)` BEFORE the pack evaluator
     * on EVERY tool call. If the result is false the tool call is blocked
     * immediately with an OperatorSuspendedError.
     *
     * The agentId used for the check is `context.agent?.name ?? config.name`.
     * This matches the convention used by SuspendStateCache.
     *
     * No network call is made on the hot path — the breaker's forced-OPEN set is
     * pure in-memory (Locked Invariant 3). The SuspendStateCache background
     * refresher (src/security/suspend-state-cache.ts) keeps the forced set up to
     * date by polling GET /api/v1/agents/:id periodically.
     *
     * If omitted, the SDK kill-switch is not active (agents are not suspended by
     * the SDK enforcement path). This preserves full backward compatibility.
     */
    circuitBreaker?: CircuitBreaker;
    /**
     * ASI-10 SDK kill-switch signal for the OWASP scanner manifest.
     * When true, the scanner suppresses the F-5 LOW finding
     * ("Kill-switch partially covered: agent is SDK-embedded without proxy routing")
     * because the SDK kill-switch is now active and covers the gap.
     *
     * Set this to true when circuitBreaker is provided AND a SuspendStateCache
     * is running to keep the breaker's forced-OPEN set current.
     */
    sdkKillSwitchEnabled?: boolean;
}
export interface AuditEntry {
    timestamp: string;
    agentName: string;
    toolName: string;
    decision: ActionDecision;
    context: ActionContext;
}
export interface GovernedAgent {
    execute(context: ActionContext): Promise<ActionDecision>;
    getAuditTrail(): AuditEntry[];
    getComplianceScore(): number;
    shutdown(): Promise<void>;
}
export declare const BUILT_IN_PACKS: Record<string, CompliancePack>;
export declare function createGovernedAgent(config: GovernedAgentConfig): GovernedAgent;
//# sourceMappingURL=governed-agent.d.ts.map