/**
 * ASI-06 (OWASP Agentic Top 10 2026) — context-window integrity.
 *
 * Microsoft AGT parity: detect in-session context/memory poisoning. The system
 * prompt and prior conversation turns form an IMMUTABLE PREFIX; if any of it is
 * rewritten, reordered, truncated, or role-escalated mid-session (indirect
 * injection, a compromised tool inserting fake history, memory poisoning), that
 * is a `CONTEXT_INTEGRITY_VIOLATION`.
 *
 * Model: between cycles the context window GROWS (new turns appended). {@link
 * ContextWindowHasher.capture} freezes the prefix (system prompt + the turns
 * present at that moment). {@link ContextWindowHasher.verify} at the next cycle
 * re-hashes the SAME prefix length and flags a mismatch. Newly-appended turns
 * are legitimate and not compared.
 *
 * Locked Architectural Invariants honored:
 *   - I-2 / I-3 (advisory, graceful degradation): verify() NEVER throws. Every
 *     outcome — including malformed input or a malformed snapshot — returns a
 *     structured result. A poisoned context becomes a governance decision the
 *     deciding org's policy applies; it never crashes the agent path.
 *   - I-10 (push-receive only): pure in-process hashing. No network, no I/O.
 *
 * Integrity vs authenticity: this is an INTEGRITY hash (SHA-256), not a keyed
 * MAC. It detects accidental/adversarial mutation of the context the runtime
 * itself holds. Persistent on-disk memory (which an attacker could rewrite AND
 * re-hash) is protected separately by the keyed-HMAC path in MemoryIntegrity.
 *
 * @connexum/ai-governance
 */
/** One turn of the conversation context. */
export interface ContextTurn {
    /** 'system' | 'user' | 'assistant' | 'tool' | custom. */
    role: string;
    /** The turn's textual content. */
    content: string;
}
/** A point-in-time freeze of the immutable context prefix. */
export interface ContextSnapshot {
    /** Monotonic capture index for this hasher instance. */
    cycle: number;
    /** SHA-256 hex over the canonical encoding of {systemPrompt + frozen turns}. */
    hash: string;
    /** Number of leading turns frozen (the immutable prefix length). */
    frozenTurnCount: number;
    /** SHA-256 of the system prompt alone (for divergence localization). */
    systemPromptHash: string;
    /** Per-frozen-turn SHA-256 (role+content) for divergence localization. */
    perTurnHashes: string[];
    /** ISO-8601 capture time. */
    hashedAt: string;
}
export type ContextIntegrityStatus = 'ok' | 'violation' | 'malformed';
/** Structured result of {@link ContextWindowHasher.verify}. Never thrown. */
export interface ContextIntegrityResult {
    status: ContextIntegrityStatus;
    /** The snapshot cycle this verification was against (or -1 if unknown). */
    cycle: number;
    /** Human-readable explanation (safe for audit/operator surfaces). */
    reason: string;
    expectedHash?: string;
    actualHash?: string;
    /**
     * Index of the first diverging element when status === 'violation':
     *   -1  → the system prompt diverged
     *   >=0 → the frozen turn at that index diverged (rewrite / role-change / reorder)
     * undefined when not localizable (e.g. truncation, malformed).
     */
    divergedAt?: number;
}
/**
 * Hash the immutable prefix: system prompt + the first `frozenTurnCount` turns.
 * Deterministic and scoped strictly to those turns — trailing (newly appended)
 * turns never affect the result. Returns a SHA-256 hex string.
 */
export declare function hashContextPrefix(systemPrompt: string, turns: ContextTurn[], frozenTurnCount: number): string;
export declare class ContextWindowHasher {
    private _cycle;
    /**
     * Freeze the current context prefix (system prompt + all present turns) and
     * return a snapshot. Each call advances the cycle counter so a verify() can be
     * attributed to the capture it was checked against.
     */
    capture(systemPrompt: string, turns: ContextTurn[], at?: string): ContextSnapshot;
    /**
     * Verify the current context against a prior snapshot. NEVER throws.
     *
     *   - prefix unchanged (trailing turns may have grown)      → 'ok'
     *   - any frozen turn / system prompt rewritten/reordered   → 'violation' (+ divergedAt)
     *   - frozen prefix truncated (fewer turns than frozen)     → 'violation'
     *   - malformed input or snapshot                           → 'malformed'
     */
    verify(systemPrompt: string, turns: ContextTurn[], snapshot: ContextSnapshot): ContextIntegrityResult;
}
//# sourceMappingURL=context-window-hasher.d.ts.map