/**
 * AgentCommunicationGuard (L12)
 *
 * Secures communication between agents in multi-agent systems.
 * Prevents impersonation, replay attacks, and message tampering.
 *
 * Threat Model:
 * - ASI07: Insecure Inter-Agent Communication
 * - Agent impersonation attacks
 * - Message replay attacks
 * - Man-in-the-middle attacks
 *
 * Protection Capabilities:
 * - Message authentication (HMAC signing)
 * - Agent identity verification
 * - Replay attack prevention (nonces)
 * - Message encryption (optional)
 * - Channel integrity validation
 */
export interface AgentCommunicationGuardConfig {
    /** Secret key for HMAC signing (auto-generated if not provided) */
    signingKey?: string;
    /** Enable message encryption */
    enableEncryption?: boolean;
    /** Encryption key (required if encryption enabled) */
    encryptionKey?: string;
    /** Nonce expiration time in milliseconds */
    nonceExpiration?: number;
    /** Maximum message age in milliseconds */
    maxMessageAge?: number;
    /** Require all messages to be signed */
    requireSignatures?: boolean;
    /** Allowed agent IDs (empty = allow all registered) */
    allowedAgents?: string[];
    /** Enable strict mode (block on any violation) */
    strictMode?: boolean;
}
export interface AgentIdentity {
    /** Unique agent identifier */
    agentId: string;
    /** Agent type/role */
    agentType: string;
    /** Agent capabilities/permissions */
    capabilities: string[];
    /** Public key for verification (optional, for asymmetric signing) */
    publicKey?: string;
    /** Registration timestamp */
    registeredAt: number;
    /** Trust score (0-100) */
    trustScore: number;
    /** Metadata */
    metadata?: Record<string, any>;
}
export interface AgentMessage {
    /** Message unique identifier */
    messageId: string;
    /** Sender agent ID */
    fromAgent: string;
    /** Recipient agent ID(s) */
    toAgent: string | string[];
    /** Message type */
    type: "request" | "response" | "broadcast" | "event";
    /** Message payload */
    payload: any;
    /** Timestamp */
    timestamp: number;
    /** Nonce for replay prevention */
    nonce: string;
    /** HMAC signature */
    signature?: string;
    /** Encrypted flag */
    encrypted?: boolean;
    /** Reference to parent message (for responses) */
    replyTo?: string;
    /** Time-to-live in milliseconds */
    ttl?: number;
}
export interface MessageValidationResult {
    allowed: boolean;
    reason: string;
    violations: string[];
    request_id: string;
    validation: {
        sender_verified: boolean;
        recipient_valid: boolean;
        signature_valid: boolean;
        nonce_valid: boolean;
        timestamp_valid: boolean;
        payload_safe: boolean;
        trust_score: number;
    };
    decrypted_payload?: any;
    recommendations: string[];
}
export interface ChannelStatus {
    agentId: string;
    connected: boolean;
    lastSeen: number;
    messageCount: number;
    trustScore: number;
    violations: number;
}
export declare class AgentCommunicationGuard {
    private config;
    private signingKey;
    private encryptionKey?;
    private registeredAgents;
    private usedNonces;
    private messageHistory;
    private agentViolations;
    private readonly PAYLOAD_INJECTION_PATTERNS;
    private readonly STRING_PAYLOAD_INJECTION_PATTERNS;
    constructor(config?: AgentCommunicationGuardConfig);
    /**
     * Register an agent for communication
     */
    registerAgent(agentId: string, agentType: string, capabilities: string[], metadata?: Record<string, any>): AgentIdentity;
    /**
     * Unregister an agent
     */
    unregisterAgent(agentId: string): boolean;
    /**
     * Create a signed message
     */
    createMessage(fromAgent: string, toAgent: string | string[], type: AgentMessage["type"], payload: any, replyTo?: string, ttl?: number): AgentMessage;
    /**
     * Validate an incoming message
     */
    /**
     * Destroy guard and release resources
     */
    destroy(): void;
    private lastCleanup;
    private lazyCleanupNonces;
    validateMessage(message: AgentMessage, receivingAgentId: string, requestId?: string): MessageValidationResult;
    /**
     * Create a response to a message
     */
    createResponse(originalMessage: AgentMessage, fromAgent: string, payload: any): AgentMessage;
    /**
     * Get channel status for an agent
     */
    getChannelStatus(agentId: string): ChannelStatus | null;
    /**
     * Get all registered agents
     */
    getRegisteredAgents(): AgentIdentity[];
    /**
     * Check if agent has capability
     */
    hasCapability(agentId: string, capability: string): boolean;
    /**
     * Update agent trust score
     */
    updateTrustScore(agentId: string, delta: number): void;
    /**
     * Reset agent violations
     */
    resetViolations(agentId: string): void;
    /**
     * Verify message chain (for multi-hop scenarios)
     */
    verifyMessageChain(messages: AgentMessage[]): {
        valid: boolean;
        broken_at?: number;
        violations: string[];
    };
    private signMessage;
    private encryptPayload;
    private decryptPayload;
    private validatePayload;
    private getObjectDepth;
    private cleanupNonces;
    private generateRecommendations;
}