/**
 * Layer Integration Helpers
 *
 * Bridges the ATREngine (Layer 1 regex) with:
 * - SkillFingerprintStore (Layer 2 behavioral fingerprinting)
 * - SemanticModule (Layer 3 LLM-as-judge)
 *
 * Extracted from engine.ts to keep file sizes manageable.
 *
 * @module agent-threat-rules/layer-integration
 */
import type { AgentEvent, ATRMatch } from './types.js';
import type { SkillFingerprintStore } from './skill-fingerprint.js';
import type { SemanticModule, SemanticModuleConfig } from './modules/semantic.js';
/** Configuration for Layer 3 semantic analysis */
export interface SemanticLayerConfig {
    /** OpenAI-compatible API key */
    readonly apiKey: string;
    /** API base URL (default: https://api.openai.com) */
    readonly baseUrl?: string;
    /** Model identifier (default: gpt-4o-mini) */
    readonly model?: string;
}
/**
 * Resolve the skill identifier from an agent event.
 * Returns undefined if no skill identifier is present.
 */
export declare function resolveSkillId(event: AgentEvent): string | undefined;
/**
 * Run Layer 2 fingerprint analysis on an event.
 * Returns additional ATRMatch entries for any detected anomalies.
 */
export declare function runFingerprintLayer(store: SkillFingerprintStore, event: AgentEvent, skillId: string): readonly ATRMatch[];
/**
 * Determine whether Layer 3 semantic analysis should run.
 *
 * Triggers when:
 * - Any Layer 1/2 match has medium or higher severity
 * - The event explicitly requests deep analysis via metadata
 */
export declare function shouldRunSemanticLayer(layer1Matches: readonly ATRMatch[], event: AgentEvent): boolean;
/**
 * Create a SemanticModule instance from simplified config.
 * Returns undefined if the semantic module cannot be imported.
 */
export declare function createSemanticModuleFromConfig(config: SemanticLayerConfig): SemanticModuleConfig;
/**
 * Run Layer 3 semantic analysis and return upgraded/new matches.
 *
 * The semantic module is called with `analyze_threat` to get a threat score.
 * If the score is >= 0.7, a synthetic high-severity match is produced.
 * If the score is 0.4-0.7, existing matches may have confidence boosted.
 */
export declare function runSemanticLayer(semanticModule: SemanticModule, event: AgentEvent, existingMatches: readonly ATRMatch[]): Promise<readonly ATRMatch[]>;
//# sourceMappingURL=layer-integration.d.ts.map