import { TaintLabel } from "./types.js";
import { Sensitivity, ToolSource, ToolTrustClass } from "@graphorin/core";

//#region src/dataflow/derive.d.ts

/**
 * Whether a tool trust class is an UNTRUSTED-content source.
 * The single definition shared by the taint engine
 * ({@link deriveTaintLabel}) and the Rule-of-Two `untrustedInput` leg -
 * the two layers must never disagree about what "untrusted" means.
 *
 * @stable
 */
declare function isUntrustedTrustClass(trustClass: ToolTrustClass): boolean;
/**
 * Derive the provenance label for a tool's output from its resolved
 * trust class, source, and declared sensitivity.
 *
 * - `untrusted` is keyed off the {@link ToolTrustClass}: `mcp-derived`,
 *   `web-search`, and `skill-untrusted` produce untrusted output.
 * - `sensitive` is `true` only for the `'secret'` tier. `'internal'` is
 *   the default tier for ordinary user content, so counting it would make
 *   the lethal-trifecta gate fire on essentially every run; operators who
 *   want a broader gate widen it via policy, not here.
 *
 * @stable
 */
declare function deriveTaintLabel(input: {
  readonly trustClass: ToolTrustClass;
  readonly source?: ToolSource;
  readonly sensitivity?: Sensitivity;
  /**
   * Sensitivity tiers that count as "sensitive" for the lethal-trifecta
   * leg. Default `['secret']` - out of the box only secret-tagged
   * content arms the trifecta, so the gate does not fire on every run.
   * Widen to e.g. `['secret', 'internal']` to also treat ordinary
   * user/PII content (which defaults to `'internal'`) as sensitive.
   */
  readonly sensitiveTiers?: ReadonlyArray<Sensitivity>;
}): TaintLabel;
//#endregion
export { deriveTaintLabel, isUntrustedTrustClass };
//# sourceMappingURL=derive.d.ts.map