/**
 * ContaminationGuard — ensures held-out scenarios don't leak into
 * training/prompt paths, and flags model memorization.
 *
 * Three probes:
 *   1. `checkCanaries(output, scenario)` — if the scenario carries a
 *      canary token, it MUST NOT appear in the agent's output.
 *      Canaries are strings that are statistically impossible to
 *      reconstruct from the scenario description alone — so if they
 *      echo back, the model memorized them.
 *   2. `canaryLeakView(store)` — cross-corpus view of every run whose
 *      output contained a canary, with the offending scenario + run.
 *   3. `HoldoutAuditor` — wraps a Dataset and emits a structured error
 *      on any code path that reads holdout scenarios but doesn't flag
 *      `purpose: 'evaluation'`. Keeps engineers honest.
 */
import type { DatasetScenario } from './dataset';
import type { TraceStore } from './trace/store';
export interface CanaryLeak {
    scenarioId: string;
    canary: string;
    runId?: string;
    evidence: string;
}
export declare function checkCanaries(output: string, scenarios: DatasetScenario[]): CanaryLeak[];
/**
 * Behavioral canary: tests the AGENT, not the eval grep.
 *
 *   - `forbiddenPattern` PRESENT in output ⇒ AGENT EMITTED BAD CONTENT ⇒ LEAK.
 *   - `forbiddenPattern` ABSENT from output ⇒ AGENT HELD THE LINE       ⇒ PASS.
 *
 * Use when running known-bad-prompt scenarios against the agent under
 * test and you want to know if the agent misbehaved. The classical
 * {@link checkCanaries} / {@link import('./canary').runCanaries | runCanaries}
 * test whether the eval check fires when the bad output is forced
 * into the eval flow — different question, different answer.
 *
 * Pattern resolution order (first match wins):
 *   1. `scenario.forbiddenPattern` — if it parses as `/body/flags`,
 *      treated as a regex; otherwise a literal substring.
 *   2. `scenario.canary` — literal substring fallback so the helper
 *      works on existing scenario fixtures.
 *
 * Returns `null` when nothing forbidden was found OR the scenario
 * declared no pattern.
 */
export declare function checkBehavioralCanary(output: string, scenario: DatasetScenario): CanaryLeak | null;
/**
 * Behavioral canary over many (scenario, output) pairs. Sibling to
 * {@link import('./canary').runCanaries | runCanaries} — same idea
 * (run-many → report) but the question being answered is "did the
 * AGENT misbehave?" rather than "did the EVAL grep fire?".
 *
 * Returns one `CanaryLeak` per pair where the agent's output
 * contained its scenario's `forbiddenPattern` (or `canary` fallback).
 */
export declare function runBehavioralCanaries(cases: Array<{
    scenario: DatasetScenario;
    output: string;
    runId?: string;
}>): CanaryLeak[];
/**
 * Scan the LLM-output history in a corpus; returns every case where a
 * canary from a known scenario appeared in agent output. Pass the full
 * set of scenarios whose canaries you care about (typically the whole
 * held-out slice).
 */
export declare function canaryLeakView(store: TraceStore, scenarios: DatasetScenario[]): Promise<CanaryLeak[]>;
export declare class HoldoutAuditor {
    private scenarios;
    private accessLog;
    constructor(scenarios: DatasetScenario[]);
    /** Retrieve a holdout scenario for a declared purpose. Non-'evaluation' throws. */
    get(scenarioId: string, purpose: 'evaluation' | 'debugging'): DatasetScenario;
    getAccessLog(): ReadonlyArray<{
        scenarioId: string;
        purpose: string;
        at: number;
    }>;
}
//# sourceMappingURL=contamination-guard.d.ts.map