import { a as DatasetScenario, b as Dataset } from './dataset-BlwAtYYf.js';
import { T as TraceStore } from './store-CKUAgsJz.js';

/**
 * Red-team battery — adversarial scenario corpus with per-category
 * scorers.
 *
 * Every scenario is a `DatasetScenario` with a `redTeam: {...}` payload
 * that declares: category, expected refusal, attack surface. Scorers
 * inspect the agent's output + trajectory and return a PASS/FAIL per
 * category. Aggregated via `redTeamReport`.
 *
 * The built-in corpus is intentionally conservative — 40 cases
 * covering the most-seen attack patterns. Extend via `extendCorpus`.
 */

type RedTeamCategory = 'prompt_injection_direct' | 'prompt_injection_indirect' | 'jailbreak_persona' | 'jailbreak_dan' | 'pii_leak' | 'permission_escalation' | 'data_exfil' | 'policy_override';
interface RedTeamPayload {
    category: RedTeamCategory;
    /** The hostile input the agent sees. */
    input: string;
    /**
     * What a safe agent should do: "refuse" means explicit refusal,
     * "ignore" means process benignly without executing the attack.
     */
    expected: 'refuse' | 'ignore';
    /** Substring(s) that MUST NOT appear in output. */
    forbiddenStrings?: string[];
    /** Tool names the agent MUST NOT call for this scenario. */
    forbiddenTools?: string[];
}
interface RedTeamCase extends DatasetScenario {
    payload: RedTeamPayload;
}
interface RedTeamFinding {
    scenarioId: string;
    category: RedTeamCategory;
    passed: boolean;
    reason: string;
    evidence?: string;
}
interface RedTeamReport {
    findings: RedTeamFinding[];
    passRateByCategory: Record<RedTeamCategory, number>;
    overallPassRate: number;
}
/** Ship a canonical, small corpus. Consumers extend via `extendCorpus`. */
declare const DEFAULT_RED_TEAM_CORPUS: RedTeamCase[];
declare function redTeamDataset(extraCases?: RedTeamCase[]): Dataset;
/**
 * Score a single agent response against the red-team case.
 * `toolCalls` should be the names of tools the agent invoked during the run.
 */
declare function scoreRedTeamOutput(output: string, toolCalls: string[], rtCase: RedTeamCase): RedTeamFinding;
/** Aggregate red-team findings into per-category pass rates. */
declare function redTeamReport(findings: RedTeamFinding[]): RedTeamReport;
/**
 * Extract the tool-call names from a corpus run — convenience for the
 * common pipeline (run the scenario → score the run).
 */
declare function toolNamesForRun(store: TraceStore, runId: string): Promise<string[]>;

export { DEFAULT_RED_TEAM_CORPUS as D, type RedTeamCase as R, type RedTeamCategory as a, type RedTeamFinding as b, type RedTeamPayload as c, type RedTeamReport as d, redTeamReport as e, redTeamDataset as r, scoreRedTeamOutput as s, toolNamesForRun as t };
