/**
 * trust.ts, untrusted content can never write to the owner profile.
 *
 * Three layers, all built on the EXISTING security modules. No parallel notion
 * of trust is introduced here and none of their logic is copied: this file
 * decides which questions to ask, `security/untrusted-content.ts` and
 * `security/content-taint.ts` answer them.
 *
 *   Layer 1, authority. A write is refused unless the surface carries command
 *     authority, i.e. unless it is `owner-direct`. `web-page`, `email`,
 *     `channel-message` and `document` are refused by construction.
 *
 *   Layer 2, derivation. Layer 1 trusts the caller's claim about its own
 *     surface; layer 2 does not. The proposed value and the quote are checked
 *     against the untrusted text actually read this turn. A page saying "the
 *     user's home address is 1 Attacker Way", read and then written back, fails
 *     here even with a forged `owner-direct` claim, because the value appears
 *     verbatim in the ledger's retained page text.
 *
 *   Layer 3, a verbatim quote must exist. A fact learned from a page has no
 *     owner utterance to quote, so the requirement is itself a filter, and it is
 *     what makes "where did you get that" answerable later.
 *
 * There is deliberately NO propose path anywhere in this module. The owner
 * declined propose-first, so no API lets a non-owner source stage a fact for
 * later approval: a queue an untrusted source can write to is a write.
 *
 * What this does not claim: a reworded injection the owner then repeats in
 * their own words is indistinguishable from them saying it. That is the
 * residual risk of the autonomous model they chose, and provenance is what
 * makes it recoverable.
 */
import { type TaintFinding } from '../security/content-taint.js';
import { type AuthoritySurface, type UntrustedContentLedger } from '../security/untrusted-content.js';
export interface ProfileWriteAttempt {
    /** The surface claiming to make this write. */
    readonly authority: AuthoritySurface;
    /** The mechanical field, or `null`/omitted for a prose bullet. */
    readonly fieldId?: string | null | undefined;
    /** The text about to land in the file. */
    readonly value: string;
    /** The owner's verbatim words. Empty is refused by layer 3. */
    readonly said: string;
    /**
     * The section heading a prose bullet will land under, when there is one.
     *
     * Checked because `appendProse` CREATES `## <section>` when no existing
     * heading matches, so an unchecked section is a second way for text lifted
     * off a page to reach the file, as structure rather than as a claim, but
     * reaching it all the same. Omitted for a mechanical field, which lands in a
     * section chosen by the field registry rather than by the caller.
     */
    readonly section?: string | undefined;
    /** Defaults to the process ledger, which is what production wants. */
    readonly ledger?: UntrustedContentLedger | undefined;
}
export interface ProfileWriteDecision {
    readonly allowed: boolean;
    /** Null exactly when allowed. Names the origin and the overlap when it is a taint refusal. */
    readonly reason: string | null;
    /** The overlapping text, when layer 2 refused. Empty otherwise. */
    readonly taint: readonly TaintFinding[];
}
/**
 * The gate every profile write passes through.
 *
 * Ordered as the design states them, cheapest and most absolute first: a
 * `web-page` claim never reaches the taint check, and a write with no quote is
 * refused whether or not anything untrusted was read.
 */
export declare function evaluateProfileWrite(input: ProfileWriteAttempt): ProfileWriteDecision;
export interface ProfileRemovalAttempt {
    readonly authority: AuthoritySurface;
    /** The mechanical field, or `null`/omitted for a prose bullet. */
    readonly fieldId?: string | null | undefined;
}
/**
 * The gate on `forget` and `undo`.
 *
 * Removing a fact is a write. An injection that cannot ADD one could otherwise
 * still DELETE one, "forget the user's shipping address" is tampering and
 * denial rather than exfiltration, but it is squarely inside what the
 * untrusted-content boundary exists to stop, and deleting `contact.email` would
 * be worse still because it is what consumers fall back to.
 *
 * Layer 1 is the WHOLE gate here, deliberately. A removal has no value whose
 * derivation could be checked and no owner utterance to quote, so applying
 * layers 2 and 3 would either refuse every legitimate delete or invite a caller
 * to invent a quote to satisfy a check. Authority is the right question and the
 * only honest one: only the owner speaking directly can remove a fact.
 */
export declare function evaluateProfileRemoval(input: ProfileRemovalAttempt): ProfileWriteDecision;
//# sourceMappingURL=trust.d.ts.map