/**
 * FissionGuardService — Task fission prevention
 *
 * Prevents agents from creating unbounded sub-tasks by enforcing
 * 6 guardrails:
 *   1. maxDepth — parentWorkItemId chain depth limit
 *   2. maxTasks — per-Mission task count limit
 *   3. Rate limit — per-agent creation rate within a sliding window
 *   4. Branching factor — max children per WorkItem
 *   5. Task TTL — time-to-live enforcement
 *   6. Budget gate — cost threshold requiring approval
 *
 * @module services/fission/fission-guard.service
 */
import type { WorkItem } from '../../types/v2/work-item.types.js';
import type { GuardResult, FissionGuardConfig, FissionViolation, FissionViolationType } from './fission-guard.types.js';
/**
 * Interface for resolving WorkItem relationships and Mission task counts.
 * Injected to keep the guard service testable without real storage.
 */
export interface FissionDataProvider {
    /** Resolve a WorkItem by ID */
    getWorkItemById(id: string): Promise<WorkItem | null>;
    /** Count all non-terminal WorkItems belonging to a Mission */
    countMissionWorkItems(missionId: string): Promise<number>;
    /** Count direct children of a WorkItem */
    countChildWorkItems(parentWorkItemId: string): Promise<number>;
}
/**
 * Interface for checking agent budget status.
 * Matches the subset of BudgetService used by the guard.
 */
export interface BudgetChecker {
    /** Check whether the agent's spend is within budget */
    isWithinBudget(agentId: string): Promise<boolean>;
}
export declare class FissionGuardService {
    private static instance;
    private config;
    private dataProvider;
    private budgetChecker;
    private readonly logger;
    /** Per-agent creation timestamps for rate limiting */
    private creationRecords;
    /** Violation audit trail (newest first) */
    private violations;
    /**
     * Creates a new FissionGuardService.
     *
     * @param dataProvider - Provides WorkItem relationship data
     * @param budgetChecker - Optional budget checking interface
     * @param config - Optional configuration override
     */
    constructor(dataProvider: FissionDataProvider, budgetChecker?: BudgetChecker | null, config?: Partial<FissionGuardConfig>);
    /**
     * Get or create the singleton instance.
     * Must be initialized with init() before first use.
     *
     * @returns The singleton FissionGuardService
     */
    static getInstance(): FissionGuardService;
    /**
     * Initialize the singleton with dependencies.
     *
     * @param dataProvider - Provides WorkItem relationship data
     * @param budgetChecker - Optional budget checking interface
     * @param config - Optional configuration override
     * @returns The initialized singleton
     */
    static init(dataProvider: FissionDataProvider, budgetChecker?: BudgetChecker | null, config?: Partial<FissionGuardConfig>): FissionGuardService;
    /** Reset singleton (for testing). */
    static resetInstance(): void;
    /**
     * Check whether an agent is allowed to create a sub-task under the given parent.
     * Evaluates all 6 guardrails in order. Returns on the first violation.
     *
     * @param parent - The parent WorkItem the sub-task would be created under
     * @param agentId - The agent attempting the creation
     * @param missionId - Optional Mission ID for per-mission limits
     * @returns GuardResult indicating whether the creation is allowed
     */
    canCreateSubTask(parent: WorkItem, agentId: string, missionId?: string): Promise<GuardResult>;
    /**
     * Guardrail 1: Check parent chain depth.
     * Walks parentWorkItemId links to determine depth.
     *
     * @param parent - The parent WorkItem
     * @returns GuardResult
     */
    checkMaxDepth(parent: WorkItem): Promise<GuardResult>;
    /**
     * Guardrail 2: Check total tasks for a Mission.
     *
     * @param missionId - The Mission to check
     * @returns GuardResult
     */
    checkMaxTasks(missionId: string): Promise<GuardResult>;
    /**
     * Guardrail 3: Check agent creation rate within sliding window.
     *
     * @param agentId - The agent to check
     * @returns GuardResult
     */
    checkRateLimit(agentId: string): GuardResult;
    /**
     * Guardrail 4: Check children count for a parent WorkItem.
     *
     * @param parentWorkItemId - The parent WorkItem ID
     * @returns GuardResult
     */
    checkBranchingFactor(parentWorkItemId: string): Promise<GuardResult>;
    /**
     * Guardrail 5: Check if parent WorkItem has exceeded its TTL.
     * If the parent is already past max TTL, creating children is pointless.
     *
     * @param parent - The parent WorkItem
     * @returns GuardResult
     */
    checkTTL(parent: WorkItem): GuardResult;
    /**
     * Guardrail 6: Check agent budget.
     * Uses the injected BudgetChecker to verify the agent hasn't exceeded spend.
     *
     * @param agentId - The agent to check
     * @returns GuardResult
     */
    checkBudget(agentId: string): Promise<GuardResult>;
    /**
     * Returns recent violations for auditing.
     *
     * @param limit - Maximum number of violations to return
     * @returns Array of FissionViolation (newest first)
     */
    getViolations(limit?: number): FissionViolation[];
    /**
     * Returns violations filtered by type.
     *
     * @param type - Violation type to filter by
     * @returns Array of matching violations
     */
    getViolationsByType(type: FissionViolationType): FissionViolation[];
    /**
     * Returns the current configuration.
     *
     * @returns A copy of the current FissionGuardConfig
     */
    getConfig(): FissionGuardConfig;
    /**
     * Updates configuration at runtime.
     *
     * @param updates - Partial configuration to merge
     */
    updateConfig(updates: Partial<FissionGuardConfig>): void;
    /**
     * Resolves the depth of a WorkItem by walking the parentWorkItemId chain.
     * Depth 0 = root (no parent), depth 1 = direct child, etc.
     *
     * @param item - The WorkItem to resolve depth for
     * @returns The depth (0-based)
     */
    private resolveDepth;
    /**
     * Count recent creations within the rate limit window.
     *
     * @param record - The agent's creation record
     * @returns Number of creations within the window
     */
    private getRecentCount;
    /**
     * Record a successful creation for rate limiting.
     *
     * @param agentId - The agent that created a sub-task
     */
    private recordCreation;
    /**
     * Record a violation for auditing.
     *
     * @param violationType - Which guardrail was violated
     * @param agentId - Agent that triggered the violation
     * @param parentWorkItemId - The parent WorkItem ID
     * @param missionId - Optional Mission ID
     * @param reason - Human-readable reason
     * @param currentValue - The value that exceeded the limit
     * @param configuredLimit - The configured limit
     */
    private recordViolation;
}
//# sourceMappingURL=fission-guard.service.d.ts.map