/**
 * Red-team battery — adversarial scenario corpus with per-category
 * scorers.
 *
 * Every scenario is a `DatasetScenario` with a `redTeam: {...}` payload
 * that declares: category, expected refusal, attack surface. Scorers
 * inspect the agent's output + trajectory and return a PASS/FAIL per
 * category. Aggregated via `redTeamReport`.
 *
 * The built-in corpus is intentionally conservative — 40 cases
 * covering the most-seen attack patterns. Extend via `extendCorpus`.
 */
import type { DatasetScenario } from './dataset';
import { Dataset } from './dataset';
import type { TraceStore } from './trace/store';
export type RedTeamCategory = 'prompt_injection_direct' | 'prompt_injection_indirect' | 'jailbreak_persona' | 'jailbreak_dan' | 'pii_leak' | 'permission_escalation' | 'data_exfil' | 'policy_override';
export interface RedTeamPayload {
    category: RedTeamCategory;
    /** The hostile input the agent sees. */
    input: string;
    /**
     * What a safe agent should do: "refuse" means explicit refusal,
     * "ignore" means process benignly without executing the attack.
     */
    expected: 'refuse' | 'ignore';
    /** Substring(s) that MUST NOT appear in output. */
    forbiddenStrings?: string[];
    /** Tool names the agent MUST NOT call for this scenario. */
    forbiddenTools?: string[];
}
export interface RedTeamCase extends DatasetScenario {
    payload: RedTeamPayload;
}
export interface RedTeamFinding {
    scenarioId: string;
    category: RedTeamCategory;
    passed: boolean;
    reason: string;
    evidence?: string;
}
export interface RedTeamReport {
    findings: RedTeamFinding[];
    passRateByCategory: Record<RedTeamCategory, number>;
    overallPassRate: number;
}
/** Ship a canonical, small corpus. Consumers extend via `extendCorpus`. */
export declare const DEFAULT_RED_TEAM_CORPUS: RedTeamCase[];
export declare function redTeamDataset(extraCases?: RedTeamCase[]): Dataset;
/**
 * Score a single agent response against the red-team case.
 * `toolCalls` should be the names of tools the agent invoked during the run.
 */
export declare function scoreRedTeamOutput(output: string, toolCalls: string[], rtCase: RedTeamCase): RedTeamFinding;
/** Aggregate red-team findings into per-category pass rates. */
export declare function redTeamReport(findings: RedTeamFinding[]): RedTeamReport;
/**
 * Extract the tool-call names from a corpus run — convenience for the
 * common pipeline (run the scenario → score the run).
 */
export declare function toolNamesForRun(store: TraceStore, runId: string): Promise<string[]>;
//# sourceMappingURL=red-team.d.ts.map