import type { TrustTier, WrappedContext, ScanDecision, Violation } from "../types.js";
/**
 * Input shape for `wrapContext()`. Each named field is conventional;
 * pass only what applies.
 */
export interface WrapContextInput {
    /** Developer-controlled prompt. Always `trust: "system"`. */
    system?: string;
    /** Direct user message(s). `trust: "untrusted"`, `source: "user"`. */
    user?: string | string[];
    /** Retrieved documents. `trust: "untrusted"`, `source: "rag"`. */
    retrieved?: Array<{
        content: string;
        label?: string;
    } | string>;
    /** MCP / function tool descriptions about to be exposed to the model. */
    tools?: Array<{
        content: string;
        label?: string;
    } | string>;
    /** Stored memory facts. `trust: "untrusted"`, `source: "memory"`. */
    memory?: Array<{
        content: string;
        label?: string;
    } | string>;
    /** Scraped / fetched web content. */
    web?: Array<{
        content: string;
        label?: string;
    } | string>;
    /** Output from another agent (multi-agent pipelines). */
    agentOutput?: Array<{
        content: string;
        label?: string;
    } | string>;
    /**
     * Promote specific named segments to `"trusted"` (e.g. an internal
     * knowledge base whose contents you control end-to-end).
     * Match is by `label` substring, case-insensitive.
     */
    trustedLabels?: string[];
}
/**
 * Build a `WrappedContext` from typed inputs.
 *
 * Trust assignment:
 * - `system` -> system
 * - `retrieved`/`tools`/`memory`/`web`/`agent-output` -> untrusted
 * - `user` -> untrusted (a user is not trusted in this threat model — they
 *   can also inject; the `untrusted` label means "scan aggressively")
 * - any segment whose `label` matches one of `trustedLabels` -> trusted
 *
 * Trust does NOT mean "skip scanning". It only governs how
 * `assemblePrompt()` and the per-segment policy decide whether to
 * include the segment in the final assembled prompt.
 */
export declare function wrapContext(input: WrapContextInput): WrappedContext;
/**
 * Scan every segment with the source-specific ingestion profile.
 * Mutates `ctx` in place by attaching `scanResults` + `decision`,
 * AND returns the same object for chaining.
 */
export declare function scanWrappedContext(ctx: WrappedContext, options?: {
    strictness?: "low" | "medium" | "high";
}): Promise<WrappedContext>;
/**
 * Assemble a prompt string respecting tier boundaries.
 *
 * Order: `system` → `trusted` retrieved/memory/tool-desc → `user`
 *      → all remaining `untrusted` segments wrapped in fenced markers.
 *
 * Why `trusted` before `user`? Putting developer-marked trusted
 * context above the user message reduces the chance an untrusted user
 * prompt re-frames the trusted reference material below it.
 *
 * Untrusted segments are wrapped in an explicit fence so a downstream
 * model has a chance to attend to provenance. This is not a guarantee
 * (no in-band marker is) but it is the single highest-leverage
 * mitigation we can apply at the toolkit layer per Anthropic +
 * OpenAI Model Spec guidance.
 *
 * Pass `strictMode: true` to OMIT blocked segments entirely. Default
 * keeps them but fences them with a `<BLOCKED>` marker so an auditor
 * can see what was tried.
 */
export interface AssembleOptions {
    strictMode?: boolean;
    /** Custom fence labels. Defaults are sensible. */
    fences?: {
        untrusted?: {
            open: string;
            close: string;
        };
        blocked?: {
            open: string;
            close: string;
        };
    };
}
export declare function assemblePrompt(ctx: WrappedContext, options?: AssembleOptions): string;
/**
 * Convenience aggregator: violations across all scanned segments.
 */
export declare function flattenViolations(ctx: WrappedContext): Violation[];
export interface AgentHop {
    /** The agent that PRODUCED the payload entering this hop. */
    agentId: string;
    /** Trust tier the payload was treated as at this hop. */
    trust: TrustTier;
    /** Scan decision for this hop's payload. */
    decision: ScanDecision;
    /** Violations found at this hop. */
    violations: Violation[];
}
export interface PropagateTrustOptions {
    /**
     * Trust tier of the producing agent's output. Defaults to `untrusted` —
     * agent output is attacker-influenceable by construction. Only set to
     * `trusted` for an agent whose output you control end-to-end.
     */
    fromTrust?: TrustTier;
    /**
     * Chain returned by an earlier `propagateTrust()` call. Pass it to keep
     * contamination sticky across A→B→C. Omit for the first link.
     */
    priorChain?: AgentHop[];
    /** Ingestion-scanner strictness for the contagion scan. Default `high`. */
    strictness?: "low" | "medium" | "high";
}
export interface TrustPropagationResult {
    /** No contamination anywhere in the chain (including prior hops). */
    safe: boolean;
    /** Worst decision across the whole chain — sticky (once block, stays). */
    decision: ScanDecision;
    /**
     * Trust tier the RECEIVING agent should treat the payload as. Degrades to
     * `untrusted` the moment this hop — or any prior hop — warns or blocks.
     */
    effectiveTrust: TrustTier;
    /** Full chain including this hop. Feed back as `priorChain` for the next. */
    hops: AgentHop[];
    /** Every violation across the chain, newest hop last. */
    violations: Violation[];
}
/**
 * Scan one agent-to-agent hand-off and propagate trust along the chain.
 *
 * @param payload      The producing agent's output (= consuming agent's input).
 * @param fromAgentId  Agent that produced `payload`.
 * @param toAgentId    Agent about to consume `payload`.
 *
 * @example
 * ```ts
 * import { propagateTrust } from "ai-shield-core";
 *
 * // A → B
 * let chain = await propagateTrust(aOutput, "researcher", "planner");
 * // B → C, contamination at A stays sticky through to C
 * chain = await propagateTrust(bOutput, "planner", "executor", {
 *   priorChain: chain.hops,
 * });
 * if (chain.effectiveTrust !== "trusted" && !chain.safe) {
 *   // an upstream agent was poisoned — do not let the executor act on it
 *   haltPipeline(chain.violations);
 * }
 * ```
 */
export declare function propagateTrust(payload: string, fromAgentId: string, toAgentId: string, options?: PropagateTrustOptions): Promise<TrustPropagationResult>;
//# sourceMappingURL=wrap-context.d.ts.map