/**
 * ToolChainValidator v2
 *
 * Detects and prevents dangerous tool chaining attacks by:
 * - Validating tool call sequences
 * - Blocking dangerous tool combinations
 * - Enforcing cooldown periods between sensitive operations
 * - Tracking tool usage patterns for anomaly detection
 *
 * v2 Enhancements (2026):
 * - ASI07: Agent State Corruption detection
 * - ASI04: Agent Autonomy Escalation detection
 * - Loop/repetition attack detection
 * - Resource accumulation monitoring
 * - Time-based anomaly detection
 * - Cumulative impact scoring
 * - Cross-tool data flow tracking
 */
import { GuardLogger } from "../types";
export interface ToolChainValidatorConfig {
    forbiddenSequences?: ForbiddenSequence[];
    requiredPreconditions?: ToolPrecondition[];
    toolCooldowns?: Record<string, number>;
    maxToolsPerRequest?: number;
    maxSensitiveToolsPerSession?: number;
    sensitiveTools?: string[];
    sessionTTLMinutes?: number;
    enableStateTracking?: boolean;
    stateModifyingTools?: string[];
    enableAutonomyDetection?: boolean;
    autonomyExpandingTools?: string[];
    enableLoopDetection?: boolean;
    maxRepetitionsPerMinute?: number;
    enableResourceTracking?: boolean;
    resourceAcquiringTools?: string[];
    maxResourcesPerSession?: number;
    enableTimeAnomalyDetection?: boolean;
    minTimeBetweenToolsMs?: number;
    enableImpactScoring?: boolean;
    maxCumulativeImpact?: number;
    toolImpactScores?: Record<string, number>;
    detectParameterInjection?: boolean;
    logger?: GuardLogger;
}
export interface ForbiddenSequence {
    name: string;
    sequence: string[];
    reason: string;
    severity: "warning" | "block";
}
export interface ToolPrecondition {
    tool: string;
    requires: string[];
    within_turns?: number;
}
export interface ToolChainValidatorResult {
    allowed: boolean;
    reason?: string;
    violations: string[];
    chain_analysis: {
        current_tool: string;
        previous_tools: string[];
        forbidden_sequences_detected: string[];
        precondition_violations: string[];
        cooldown_violations: string[];
        state_corruption_detected?: boolean;
        autonomy_escalation_detected?: boolean;
        loop_detected?: boolean;
        resource_accumulation?: number;
        time_anomaly_detected?: boolean;
        cumulative_impact?: number;
    };
    warnings: string[];
}
export declare class ToolChainValidator {
    private config;
    private logger;
    private sessions;
    private static readonly _OS_CMD_RE;
    private defaultForbiddenSequences;
    private defaultSensitiveTools;
    private defaultStateModifyingTools;
    private defaultAutonomyExpandingTools;
    private defaultResourceAcquiringTools;
    private defaultToolImpactScores;
    constructor(config?: ToolChainValidatorConfig);
    /**
     * Validate a tool call in context of the session
     */
    validate(sessionId: string, toolName: string, allToolsInRequest?: string[], requestId?: string): ToolChainValidatorResult;
    /**
     * Validate multiple tools at once (for parallel tool calls)
     */
    validateBatch(sessionId: string, tools: string[], requestId?: string): ToolChainValidatorResult;
    /**
     * Get session tool history
     */
    getToolHistory(sessionId: string): string[];
    /**
     * Reset session
     */
    resetSession(sessionId: string): void;
    private getOrCreateSession;
    private matchesSequence;
    private cleanupSessions;
}