/**
 * CAR Extension Executor
 *
 * Executes extension hooks in order with proper timeout handling,
 * error management, and result aggregation. This is the core engine
 * that drives the Layer 4 Runtime Assurance functionality.
 *
 * @packageDocumentation
 * @module @vorion/car-extensions/executor
 * @license Apache-2.0
 */
import type { ExtensionRegistry } from './registry.js';
import { type AgentIdentity, type CapabilityRequest, type CapabilityGrant, type ActionRequest, type ActionRecord, type BehaviorMetrics, type AnomalyReport, type RevocationEvent, type TrustAdjustment, type PolicyContext, type AggregatedPreCheckResult, type AggregatedPreActionResult, type AggregatedFailureResponse, type AggregatedBehaviorResult, type AggregatedMetricsReport, type AggregatedAnomalyResponse, type AggregatedTrustResult, type AggregatedPolicyDecision, type ExtensionServiceConfig } from './types.js';
/**
 * Extension Hook Executor
 *
 * Executes extension hooks with:
 * - Timeout enforcement per hook type
 * - Error isolation between extensions
 * - Result aggregation according to protocol rules
 * - Logging and observability
 *
 * @example
 * ```typescript
 * const executor = new ExtensionExecutor(registry, {
 *   defaultTimeout: 1000,
 *   failFast: false,
 *   logExecution: true,
 * });
 *
 * const result = await executor.executeCapabilityPreCheck(
 *   ['car-ext-governance-v1', 'car-ext-audit-v1'],
 *   agent,
 *   request
 * );
 * ```
 */
export declare class ExtensionExecutor {
    private registry;
    private config;
    /**
     * Create a new executor
     *
     * @param registry - The extension registry to use
     * @param config - Optional configuration
     */
    constructor(registry: ExtensionRegistry, config?: ExtensionServiceConfig);
    /**
     * Execute capability pre-check hooks
     *
     * All extensions must return allow=true for the request to be allowed.
     * Constraints from all extensions are combined.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param request - Capability request
     * @returns Aggregated result from all extensions
     */
    executeCapabilityPreCheck(extensionIds: string[], agent: AgentIdentity, request: CapabilityRequest): Promise<AggregatedPreCheckResult>;
    /**
     * Execute capability post-grant hooks
     *
     * Each extension can modify the grant (e.g., add constraints).
     * Modifications are applied in extension order.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param grant - Capability grant to modify
     * @returns Modified capability grant
     */
    executeCapabilityPostGrant(extensionIds: string[], agent: AgentIdentity, grant: CapabilityGrant): Promise<CapabilityGrant>;
    /**
     * Execute pre-action hooks
     *
     * All extensions must return proceed=true for the action to proceed.
     * Modifications and approval requirements are combined.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param action - Action request
     * @returns Aggregated result from all extensions
     */
    executeActionPreAction(extensionIds: string[], agent: AgentIdentity, action: ActionRequest): Promise<AggregatedPreActionResult>;
    /**
     * Execute post-action hooks
     *
     * Called after action execution for logging/audit purposes.
     * Errors are logged but do not affect the action result.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param action - Action record
     */
    executeActionPostAction(extensionIds: string[], agent: AgentIdentity, action: ActionRecord): Promise<void>;
    /**
     * Execute failure handler hooks
     *
     * Determines retry behavior and fallback actions.
     * Takes the most permissive retry suggestion and first fallback.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param action - Failed action record
     * @param error - Error that occurred
     * @returns Aggregated failure response
     */
    executeActionOnFailure(extensionIds: string[], agent: AgentIdentity, action: ActionRecord, error: Error): Promise<AggregatedFailureResponse>;
    /**
     * Execute behavior verification hooks
     *
     * Returns the most severe recommendation and whether any extension
     * found behavior out of bounds.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param metrics - Behavior metrics to verify
     * @returns Aggregated verification result
     */
    executeVerifyBehavior(extensionIds: string[], agent: AgentIdentity, metrics: BehaviorMetrics): Promise<AggregatedBehaviorResult>;
    /**
     * Execute metrics collection hooks
     *
     * Collects metrics from all extensions and aggregates health status.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @returns Aggregated metrics report
     */
    executeCollectMetrics(extensionIds: string[], agent: AgentIdentity): Promise<AggregatedMetricsReport>;
    /**
     * Execute anomaly handler hooks
     *
     * Returns the most severe action taken and aggregates notifications.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param anomaly - Anomaly report
     * @returns Aggregated anomaly response
     */
    executeOnAnomaly(extensionIds: string[], agent: AgentIdentity, anomaly: AnomalyReport): Promise<AggregatedAnomalyResponse>;
    /**
     * Execute revocation handler hooks
     *
     * Notifies all extensions of a revocation event.
     * Errors are logged but do not stop propagation.
     *
     * @param extensionIds - Extension IDs to execute
     * @param revocation - Revocation event
     */
    executeOnRevocation(extensionIds: string[], revocation: RevocationEvent): Promise<void>;
    /**
     * Execute trust adjustment hooks
     *
     * Applies trust adjustments from all extensions sequentially.
     *
     * @param extensionIds - Extension IDs to execute
     * @param agent - Agent identity
     * @param adjustment - Trust adjustment request
     * @returns Aggregated trust result
     */
    executeAdjustTrust(extensionIds: string[], agent: AgentIdentity, adjustment: TrustAdjustment): Promise<AggregatedTrustResult>;
    /**
     * Execute policy evaluation hooks
     *
     * Evaluates policies across all extensions and aggregates decisions.
     * Deny wins over require_approval, which wins over allow.
     *
     * @param extensionIds - Extension IDs to execute
     * @param context - Policy context
     * @returns Aggregated policy decision
     */
    evaluatePolicy(extensionIds: string[], context: PolicyContext): Promise<AggregatedPolicyDecision>;
    /**
     * Execute a hook with timeout enforcement
     *
     * @param fn - The hook function to execute
     * @param hookType - Type of hook for timeout lookup
     * @param extensionId - Extension ID for logging
     * @returns Hook result
     * @throws TimeoutError if hook exceeds timeout
     */
    private executeWithTimeout;
    /**
     * Log a hook execution error
     *
     * @param hookType - Type of hook that failed
     * @param extensionId - Extension that failed
     * @param error - Error that occurred
     */
    private logHookError;
}
/**
 * Create a new extension executor
 *
 * @param registry - Extension registry to use
 * @param config - Optional configuration
 * @returns New executor instance
 *
 * @example
 * ```typescript
 * const executor = createExtensionExecutor(registry, {
 *   failFast: true,
 *   logExecution: true,
 * });
 * ```
 */
export declare function createExtensionExecutor(registry: ExtensionRegistry, config?: ExtensionServiceConfig): ExtensionExecutor;
//# sourceMappingURL=executor.d.ts.map