/**
 * OWASP Agentic Top 10 Scanner — W1.7 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12.
 *
 * Analyses an AgentManifest against the OWASP Agentic Top 10 (A01-A10), emits
 * structured findings with severity, remediation, and suggested company-pack
 * gates, and produces a build-structure score (0-100) that feeds the third
 * trust-score dimension (W1.8).
 *
 * Customer flow:
 *   1. Customer-side scan produces an AgentManifest per agent.
 *   2. scanAgent(manifest) -> ScanReport with findings + suggested rules.
 *   3. Each suggested rule maps to a CapabilityRule consumable by buildCompanyPack.
 *   4. Customer accepts/rejects rules; accepted ones become the auto-generated
 *      company pack for that agent.
 *   5. buildStructureScore feeds the agent_build_structure trust-score dimension.
 *
 * Coverage reference: docs/cisos/07-owasp-agentic-top10.md (A01-A10).
 *
 * @connexum/ai-governance  F-NEW-PRODUCT-OWASP-AGENTIC-SCANNER
 */
import { type CapabilityClassId } from './capability-classes.js';
import type { CapabilityRule } from './company-pack-builder.js';
/** OWASP Agentic Top 10 risk classes (LLM/agent variant). */
export declare const OWASP_AGENTIC_RISK: {
    readonly A01_PROMPT_INJECTION: "A01-prompt-injection";
    readonly A02_INSECURE_OUTPUT: "A02-insecure-output";
    readonly A03_RAG_POISONING: "A03-rag-poisoning";
    readonly A04_DOS: "A04-denial-of-service";
    readonly A05_SUPPLY_CHAIN: "A05-supply-chain";
    readonly A06_SENSITIVE_DISCLOSURE: "A06-sensitive-disclosure";
    readonly A07_INSECURE_PLUGIN: "A07-insecure-plugin";
    readonly A08_EXCESSIVE_AGENCY: "A08-excessive-agency";
    readonly A09_OVERRELIANCE: "A09-overreliance";
    readonly A10_MODEL_THEFT: "A10-model-theft";
    /**
     * ASI-08 Cascading Failures (Agentic Security Initiative extension).
     * Tracks whether the CircuitBreaker is wired into the agent's PreToolUse
     * enforcement path. Without it, a failure spiral in one agent can cascade
     * to every downstream tool call in the same session.
     */
    readonly ASI08_CASCADING_FAILURES: "ASI-08-cascading-failures";
    /**
     * ASI-10 Rogue Agents (Agentic Security Initiative extension).
     * Detects agents that lack operator-initiated kill-switch controls:
     *   - No circuit breaker configured (no forceOpen capability)
     *   - No revocation capability declared
     *   - Autonomy level > 3 for strict-pack deployments (HIPAA / PCI DSS)
     * These gaps mean a rogue agent cannot be hard-stopped without a full
     * process restart — an unacceptable blast radius in production.
     */
    readonly ASI10_ROGUE_AGENT: "ASI-10-rogue-agent";
    /**
     * ASI-07 Insecure Inter-Agent Communication (Agentic Security Initiative).
     * Detects agents that participate in agent-to-agent messaging (delegation /
     * handoff / multi-agent orchestration) WITHOUT per-message authenticity:
     * identity bound only at handshake, no per-message Ed25519 signature. A
     * compromised relay or man-in-the-middle can then forge/inject messages
     * mid-session. The fix is to enable AgentMessageEnvelope signing on the
     * adapter (src/security/agent-message-envelope.ts).
     */
    readonly ASI07_INSECURE_INTER_AGENT_COMMS: "ASI-07-insecure-inter-agent-comms";
    /**
     * ASI-06 Memory & Context Poisoning (Agentic Security Initiative).
     * Detects agents whose persistent memory or multi-turn context window can be
     * poisoned undetected:
     *   - no per-cycle context-window integrity hash (in-session prompt/turn
     *     rewrite, reorder, or truncation goes unnoticed), and/or
     *   - persistent memory protected only by a forgeable plain SHA-256 footer
     *     instead of a keyed HMAC.
     * Fixes: ContextWindowHasher (src/security/context-window-hasher.ts) +
     * MemoryIntegrity keyed-HMAC mode (src/governance/memory-integrity.ts).
     */
    readonly ASI06_MEMORY_CONTEXT_POISONING: "ASI-06-memory-context-poisoning";
    /**
     * ASI-05 Unsafe Code Execution (Agentic Security Initiative).
     * A permitted shell command runs with full process authority unless confined.
     * Fires when the agent can execute shell but no sandbox policy (allowlist /
     * no-network / no-priv-esc / path-confinement / injection-deny) is enforced.
     * Fix: ShellSandbox policy (src/security/shell-sandbox.ts) + an OS-primitive jail.
     */
    readonly ASI05_UNSAFE_CODE_EXECUTION: "ASI-05-unsafe-code-execution";
};
export type OwaspAgenticRiskId = (typeof OWASP_AGENTIC_RISK)[keyof typeof OWASP_AGENTIC_RISK];
/** Canonical OWASP Agentic (ASI / AGT) Top 10 — 2026. */
export declare const ASI_TOP_10: Record<string, string>;
/** Canonical ASI ids in order. */
export declare const ASI_IDS: readonly string[];
/**
 * CANONICAL taxonomy bridge (consolidation 2026-05-30).
 *
 * The codebase historically carried TWO OWASP representations: the runtime
 * posture surface (audit `owasp_category` tagger + `/api/v1/owasp/posture` +
 * dashboard tile) used the OLD OWASP-LLM `A01..A10` ids, while the build scanner
 * + coverage model use the OWASP Agentic `ASI-01..ASI-10` ids. This map folds
 * the legacy A0x ids onto the canonical ASI items so EVERY surface — scanner,
 * runtime tagger, posture endpoint, dashboard tile, CLI, packs/middleware —
 * speaks ONE taxonomy. Persisted A0x-tagged audit events keep their history:
 * the posture endpoint normalizes them through this map at query time.
 *
 * Mapping per docs/decisions/owasp-agentic-AGT-parity-matrix-2026-05-29.md.
 * `ASI-10-rogue-agent` (already emitted by the tagger for suspend/resume) and
 * the other ASI-0x risk ids pass through unchanged.
 */
export declare const A0X_TO_ASI: Readonly<Record<string, string>>;
/**
 * Normalize ANY OWASP category id (legacy `A0x-*` or canonical `ASI-0x[-*]`) to
 * its canonical `ASI-0x` item id. Unknown ids return undefined (caller decides).
 */
export declare function toCanonicalAsi(category: string | null | undefined): string | undefined;
/**
 * Which finding-risks (and therefore which analyzers) assess each ASI item.
 * An ASI item is "assessed" iff at least one of its risks is produced by an
 * analyzer that actually ran. Maintained alongside scanAgent()'s analyzer list:
 * adding an analyzer for a previously-unassessed ASI item is what flips its
 * coverage to true.
 */
export declare const ASI_RISK_COVERAGE: Record<string, OwaspAgenticRiskId[]>;
/**
 * The set of ASI items that scanAgent() currently has a real analyzer for.
 * Items NOT in this set are reported as `assessed:false` (not evaluated) so the
 * Trust Score never treats "no findings" as "passed" for an unrun check.
 * Update this as parity analyzers land (ASI-05 is the remaining gap).
 */
export declare const ASI_ASSESSED_ITEMS: ReadonlySet<string>;
/** Per-ASI-item coverage + finding rollup, surfaced on the scan report. */
export interface AsiCoverageEntry {
    asi: string;
    name: string;
    /** True iff an analyzer for this item actually ran. */
    assessed: boolean;
    /** Number of findings attributed to this item (0 when assessed-and-clean). */
    findingCount: number;
    /** Highest finding severity for this item, or null when none/unassessed. */
    worstSeverity: Severity | null;
    /**
     * Per-finding remediation for this ASI item — what's wrong + how to fix it.
     * Powers the "Improve this agent" surface: each entry is an actionable gap the
     * customer can close to raise the build axis. Empty when assessed-and-clean.
     */
    remediations: Array<{
        severity: Severity;
        title: string;
        detail: string;
        remediation: string;
    }>;
}
export type Severity = 'LOW' | 'MED' | 'HIGH' | 'CRIT';
/** Shape of the customer-side scan output that gets fed to the scanner. */
export interface AgentManifest {
    /** Agent identifier (stable across scans). */
    agentId: string;
    /** Human-readable name. */
    name?: string;
    /** Declared tool names (e.g. 'Bash', 'WebFetch', 'mcp__list_resources'). */
    tools: string[];
    /** MCP server URIs the agent connects to. */
    mcpServers?: string[];
    /** System prompt / role description (may be redacted by customer-side scanner). */
    systemPrompt?: string;
    /** LLM provider + model (e.g. 'anthropic/claude-sonnet-4-6'). */
    llmProvider?: string;
    /** Whether governance hooks are wired on this agent (PreToolUse / PostToolUse / PostResponse). */
    hooks?: {
        preToolUse?: boolean;
        postToolUse?: boolean;
        postResponse?: boolean;
    };
    /** Approval-required gates already declared. Empty => agent has no human-in-loop. */
    declaredApprovalGates?: ReadonlyArray<{
        capability: CapabilityClassId;
        reviewer: string;
    }>;
    /** Capability classes the agent explicitly forbids. */
    declaredForbiddenCapabilities?: ReadonlyArray<CapabilityClassId>;
    /** Whether the agent's plugins / framework adapters have been attestation-signed. */
    pluginIntegrityVerified?: boolean;
    /** Per-tool blast-radius caps already configured. */
    rateLimitsConfigured?: boolean;
    /**
     * Whether a CircuitBreaker has been wired into this agent's PreToolUse path.
     * When false/absent, the ASI-08 scanner emits a MED finding and a suggestedRule
     * so the customer can enable the breaker via company-pack remediation.
     * Set to true once evaluatePreFlightWithBreaker() (or equivalent) is configured.
     */
    circuitBreakerConfigured?: boolean;
    /**
     * ASI-10: whether this agent's platform supports an operator-initiated
     * hard kill-switch (i.e. the CircuitBreaker has forceOpen() / the registry
     * exposes a suspend endpoint). When false/absent, the ASI-10 scanner emits
     * a HIGH finding because a rogue agent cannot be stopped without a process
     * restart.
     *
     * Propagated from agent.operatorSuspended capability flag at registration.
     * Set to true once the agent is registered on a platform with the
     * POST /api/v1/agents/:id/suspend endpoint available.
     */
    killSwitchCapable?: boolean;
    /**
     * ASI-10: whether the agent's passport has been bound to a revocation-capable
     * registry (one that implements RevocationListEntry). When absent/false, the
     * ASI-10 scanner emits a MED finding.
     */
    revocationCapable?: boolean;
    /**
     * ASI-10: declared autonomy level (0-5 scale).
     *   0 = fully supervised (human in loop for every action)
     *   3 = semi-autonomous (human approval for high-risk actions)
     *   5 = fully autonomous (no human loop)
     * When > 3 and the agent is bound to strict packs (HIPAA, PCI DSS),
     * the ASI-10 scanner emits a HIGH finding.
     */
    autonomyLevel?: number;
    /**
     * F-5 / ASI-10: whether this agent's traffic is routed through the governance
     * proxy (`packages/governance-proxy`). When false/absent, the kill-switch enforces
     * only via the registry lifecycleState path; the proxy-tier forceOpen() shortcut
     * (immediate blocking at the proxy CircuitBreaker) is NOT applied because there is
     * no proxy in the traffic path.
     *
     * An SDK-embedded agent with no proxy runs in-process alongside the LLM SDK
     * and is never routed through the proxy's PreToolUse gate. The operator kill-switch
     * on the registry side (lifecycleState → 'suspended') is advisory for that agent;
     * enforcement depends on the SDK adapter polling the registry or checking the
     * agent's JWT claims at each call.
     *
     * When killSwitchCapable is true but proxyRouted is false/absent AND
     * sdkKillSwitchEnabled is false/absent, the ASI-10 scanner emits a LOW note
     * documenting the known gap.
     */
    proxyRouted?: boolean;
    /**
     * ASI-10 (SDK path): whether the SDK-embedded kill-switch is active for this
     * agent. Set to true when:
     *   (a) `GovernedAgentConfig.circuitBreaker` is provided (root SDK CircuitBreaker
     *       with per-agent forceOpen() support), AND
     *   (b) a SuspendStateCache is running to keep the breaker's forced-OPEN set
     *       current by polling the governance server.
     *
     * When true (with or without `proxyRouted`), the F-5 LOW finding
     * ("Kill-switch partially covered: agent is SDK-embedded without proxy routing")
     * is suppressed because the SDK path now also enforces operator suspension.
     *
     * Propagated from agent.metadata.sdkKillSwitchEnabled by buildManifestFromAgent
     * in onboarding-routes.ts.
     */
    sdkKillSwitchEnabled?: boolean;
    /**
     * ASI-07: whether this agent participates in agent-to-agent messaging
     * (delegation / handoff / multi-agent orchestration). Derived at registration
     * from the agent's orchestrator binding or declared delegation tools. When
     * true and `interAgentSigningEnabled` is false/absent, the ASI-07 scanner
     * emits a HIGH finding because messages between agents are unauthenticated
     * past the initial handshake.
     *
     * Propagated from agent.metadata.interAgentComms by buildManifestFromAgent.
     */
    interAgentComms?: boolean;
    /**
     * ASI-07: whether per-message Ed25519 signing is enabled on this agent's
     * inter-agent communication path (i.e. the orchestrator adapter is configured
     * with `interAgentSigning` so outbound messages are signed and inbound ones
     * are verified via AgentMessageEnvelope). When true, the ASI-07 finding is
     * suppressed. When false/absent AND interAgentComms is true, the scanner
     * emits a HIGH finding.
     *
     * Propagated from agent.metadata.interAgentSigningEnabled by buildManifestFromAgent.
     */
    interAgentSigningEnabled?: boolean;
    /**
     * ASI-06: whether this agent maintains persistent memory and/or a
     * multi-turn context window that could be poisoned. Derived at registration
     * from the agent having a memory dir / cross-session memory / multi-turn
     * orchestration. When true and the integrity controls below are absent, the
     * ASI-06 scanner emits findings.
     *
     * Propagated from agent.metadata.hasPersistentMemory by buildManifestFromAgent.
     */
    hasPersistentMemory?: boolean;
    /**
     * ASI-06: whether per-cycle context-window integrity hashing is enabled
     * (ContextWindowHasher capture/verify wired into the agent's execution loop),
     * so a rewritten/reordered/truncated prior turn or swapped system prompt is
     * detected as CONTEXT_INTEGRITY_VIOLATION. When false/absent, in-session
     * context poisoning is undetected → ASI-06 finding.
     *
     * Propagated from agent.metadata.contextIntegrityEnabled.
     */
    contextIntegrityEnabled?: boolean;
    /**
     * ASI-06: whether persistent memory files use a KEYED HMAC footer
     * (MemoryIntegrity hmacKey) rather than a plain SHA-256 hash. A plain hash is
     * forgeable by anyone who can write the file; only an HMAC footer resists a
     * memory-poisoning rewrite. When hasPersistentMemory is true and this is
     * false/absent, the ASI-06 scanner emits a finding (forgeable memory).
     *
     * Propagated from agent.metadata.memoryHmacEnabled.
     */
    memoryHmacEnabled?: boolean;
    /**
     * ASI-05: whether a shell-sandbox policy is enforced for this agent's shell
     * execution (allowlist / no-network / no-priv-esc / path-confinement /
     * injection-deny). When the agent can run shell but this is false/absent, the
     * ASI-05 scanner emits a HIGH finding. Propagated from agent.metadata.shellSandboxEnabled.
     */
    shellSandboxEnabled?: boolean;
    /**
     * ASI-09: whether human-oversight-effectiveness scoring is enabled (measures
     * whether reviewers exercise judgment vs rubber-stamp). When the agent has HITL
     * approval gates but this is false/absent, the A09 scanner emits a LOW finding.
     * Propagated from agent.metadata.oversightScoringEnabled.
     */
    oversightScoringEnabled?: boolean;
    /**
     * ASI-04: whether an AI Bill of Materials (AI-BOM) + provenance has been
     * generated for this agent (tamper-evident inventory of models/tools/MCP/packs/
     * deps anchored by a bomHash). When false/absent, the A05 scanner emits a MED
     * supply-chain finding. Propagated from agent.metadata.aiBomGenerated.
     */
    aiBomGenerated?: boolean;
    /**
     * ASI-01: whether the semantic injection classifier is wired as a second stage
     * after the rule-based PromptInjectionDetector (catches paraphrased indirect
     * injection). When false/absent AND the agent ingests untrusted external
     * content, the A01 scanner emits a MED finding recommending it.
     *
     * Propagated from agent.metadata.semanticInjectionEnabled by buildManifestFromAgent.
     */
    semanticInjectionEnabled?: boolean;
}
export interface OwaspFinding {
    risk: OwaspAgenticRiskId;
    severity: Severity;
    title: string;
    detail: string;
    remediation: string;
    /** Optional capability-class rule to add to the auto-generated company pack. */
    suggestedRule?: CapabilityRule;
}
export interface ScanReport {
    agentId: string;
    findings: OwaspFinding[];
    /** Count of findings by severity. */
    countsBySeverity: Record<Severity, number>;
    /** Aggregate company-pack rule suggestions deduplicated by capability+action. */
    suggestedRules: CapabilityRule[];
    /**
     * Build-structure score 0-100. Feeds the agent_build_structure dimension
     * of the trust score (W1.8).
     *   100 = no findings
     *    -8 per LOW, -16 per MED, -32 per HIGH, -50 per CRIT (clamped at 0)
     */
    buildStructureScore: number;
    /** Composite human-readable verdict label. */
    verdict: 'EXCELLENT' | 'GOOD' | 'NEEDS_REVIEW' | 'POOR' | 'CRITICAL';
    /**
     * Per-ASI-item coverage across the canonical OWASP Agentic Top 10. The Trust
     * Score build axis uses this to AVOID false confidence — an item that was not
     * assessed is reported as such, never folded into "passed". (Trust Score
     * trust-score spec, component #1.)
     */
    asiCoverage: AsiCoverageEntry[];
    /** Count of ASI items actually assessed (out of 10). */
    asiAssessedCount: number;
    /** True iff all 10 ASI items were assessed by a real analyzer. */
    coverageComplete: boolean;
}
/**
 * Risk findings derived from a declarative agent manifest.json (the fleet
 * convention). The code-based A01..A10 analyzers run against the built
 * AgentManifest (capabilities inferred from source); this complements them by
 * reading the risk the manifest *declares about itself* — unrestricted tool
 * scopes, disabled audit logging, wildcard egress, sensitive-data handling.
 * These are the "issues / missing items" surfaced on the onboarding scan page.
 *
 * Pure + defensive — NEVER throws on a malformed/partial manifest (Invariant 10).
 *
 * @param raw the parsed manifest.json object (any shape)
 */
export declare function analyzeManifestRisks(raw: unknown): OwaspFinding[];
/**
 * Run all A01..A10 analyzers against a manifest and produce a structured report.
 */
export declare function scanAgent(manifest: AgentManifest): ScanReport;
//# sourceMappingURL=owasp-agentic-scanner.d.ts.map