/**
 * Action Executor - Executes ATR response actions via platform adapters.
 *
 * Deduplicates actions, sorts by priority, and delegates execution
 * to a PlatformAdapter. Handles per-action errors so one failure
 * does not block the rest.
 *
 * ENFORCEMENT GATE: actions above the OBSERVE blast-radius tier are dispatched
 * only when the operator has enabled blocking (`blocking: true` here; the CLI
 * maps ATR_BLOCKING / `atr guard --blocking` onto it). Without it they are
 * recorded as suppressed and the adapter is never called. See
 * src/enforcement.ts for why this is opt-in and
 * src/quality/action-eligibility.ts for the tier ladder this gate reads.
 *
 * @module agent-threat-rules/action-executor
 */
import type { ATRAction, ActionResult, ExecutionContext, PlatformAdapter } from "./types.js";
/**
 * Map action names to PlatformAdapter method names.
 *
 * Exported because it is the authoritative list of actions this engine can
 * actually dispatch. Rule files also carry SPEC Appendix A vocabulary
 * (`revoke_credential`, `quarantine_artifact`, ...) that has no entry here and
 * therefore never reaches an adapter — see executeOne's "Unknown action" branch.
 * src/quality/action-eligibility.ts ranks exactly these keys by blast radius, and
 * tests/action-eligibility.test.ts pins the two sets equal, so implementing a new
 * adapter method forces an explicit decision about how destructive it is.
 */
export declare const ACTION_METHOD_MAP: Readonly<Record<ATRAction, keyof PlatformAdapter>>;
export interface ActionExecutorConfig {
    readonly adapter: PlatformAdapter;
    readonly dryRun?: boolean;
    /**
     * Operator directive permitting enforcement actions. OFF BY DEFAULT.
     *
     * When false, any action above the OBSERVE blast-radius tier
     * (block_input / block_output / block_tool / reduce_permissions /
     * reset_context / quarantine_session / kill_agent) is refused before the
     * adapter is touched; OBSERVE actions (alert / snapshot / shadow / escalate)
     * run exactly as before.
     *
     * This field is the only input — the executor does not read `ATR_BLOCKING`.
     * A non-boolean throws rather than being coerced: `blocking: "false"` is
     * truthy in JavaScript and would otherwise enable enforcement. `atr guard`
     * resolves the environment itself and passes the result here.
     *
     * This is the runtime half of SPEC.md §5.5 ("Engines MUST NOT execute
     * response actions automatically without an explicit configuration directive
     * from the operator"). Until it existed, `atr guard` built an executor
     * unconditionally and dispatched every declared action, including on a verdict
     * of `allow`.
     */
    readonly blocking?: boolean;
    readonly onActionComplete?: (result: ActionResult) => void;
}
export declare class ActionExecutor {
    private readonly adapter;
    private readonly dryRun;
    private readonly blocking;
    private readonly onActionComplete?;
    constructor(config: ActionExecutorConfig);
    /**
     * Execute all actions from the verdict context.
     *
     * Actions are deduplicated, sorted by priority, and executed
     * sequentially. Each action is wrapped in try/catch so a single
     * failure does not prevent subsequent actions from running.
     *
     * Returns a frozen array of ActionResult.
     */
    execute(context: ExecutionContext): Promise<readonly ActionResult[]>;
    /**
     * Deduplicate actions and sort by priority (highest priority first).
     */
    private deduplicateAndSort;
    /**
     * Execute a single action, returning a result even on failure.
     */
    private executeOne;
    /** Get the adapter name for diagnostics */
    getAdapterName(): string;
    /** Check if dry-run mode is enabled */
    isDryRun(): boolean;
    /** Is this executor permitted to dispatch enforcement actions? */
    isBlocking(): boolean;
}
//# sourceMappingURL=action-executor.d.ts.map