import { VorionError } from '../common/errors.js';
import { type ContextAuthenticationRequirements, type TrustProfile, type ProviderValidationResult, type ContentValidationResult, type InjectionScanResult, type ContextValidationResult, type MessageChannel } from './types.js';
/**
 * Error thrown when context validation fails
 */
export declare class ContextValidationError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Injection patterns to detect in context content
 *
 * These patterns indicate potential prompt injection attempts
 * embedded in external data.
 */
export declare const INJECTION_PATTERNS: Array<{
    pattern: RegExp;
    description: string;
    severity: InjectionScanResult['severity'];
}>;
/**
 * Context Validator
 *
 * Validates context providers and their content to prevent indirect injection.
 */
export declare class ContextValidator {
    private readonly config;
    private readonly allowedProviderPatterns;
    private readonly blockedProviderPatterns;
    /**
     * Create a new ContextValidator
     *
     * @param config - Context authentication requirements
     */
    constructor(config: ContextAuthenticationRequirements);
    /**
     * Validate a context provider
     *
     * @param providerId - Provider identifier (DID)
     * @param providerTrust - Provider's trust profile
     * @returns Provider validation result
     */
    validateProvider(providerId: string, providerTrust: TrustProfile): ProviderValidationResult;
    /**
     * Validate context content
     *
     * @param content - The content to validate
     * @param signature - Optional content signature
     * @param timestamp - Optional content timestamp
     * @returns Content validation result
     */
    validateContent(content: unknown, signature?: string, timestamp?: Date): ContentValidationResult;
    /**
     * Scan content for injection patterns
     *
     * @param content - Content to scan
     * @returns Injection scan result
     */
    scanForInjection(content: string): InjectionScanResult;
    /**
     * Classify a message as control plane or data plane
     *
     * @param message - Message to classify
     * @returns Message channel classification
     */
    classifyChannel(message: {
        source: string;
        authenticated: boolean;
    }): MessageChannel;
    /**
     * Perform full context validation
     *
     * @param providerId - Provider identifier
     * @param providerTrust - Provider's trust profile
     * @param content - Context content
     * @param signature - Optional content signature
     * @param timestamp - Optional content timestamp
     * @returns Complete context validation result
     */
    validateContext(providerId: string, providerTrust: TrustProfile, content: unknown, signature?: string, timestamp?: Date): ContextValidationResult;
    /**
     * Check if a provider is on the blocklist
     *
     * @param providerId - Provider identifier
     * @returns Whether the provider is blocked
     */
    private isProviderBlocked;
    /**
     * Check if a provider is on the allowlist
     *
     * @param providerId - Provider identifier
     * @returns Whether the provider is allowed
     */
    private isProviderAllowed;
    /**
     * Verify content signature using HMAC-SHA256.
     *
     * Expects signature in format `hmac-sha256:<base64_signature>`.
     * The HMAC key is derived from the VORION_CONTENT_HMAC_KEY environment
     * variable. Falls back to length check if no key is configured.
     *
     * @param content - Content to verify
     * @param signature - Signature string to verify
     * @returns Whether signature is valid
     */
    private verifyContentSignature;
    /**
     * Detect content format
     *
     * @param content - Content to analyze
     * @returns Detected format
     */
    private detectContentFormat;
    /**
     * Convert a glob pattern to a regex
     *
     * @param glob - Glob pattern
     * @returns Compiled regex
     */
    private globToRegex;
    /**
     * Get the higher severity level
     *
     * @param a - First severity
     * @param b - Second severity
     * @returns Higher severity
     */
    private getHigherSeverity;
}
/**
 * Create a ContextValidator with default configuration
 *
 * @returns ContextValidator with secure defaults
 */
export declare function createDefaultContextValidator(): ContextValidator;
/**
 * Create a strict ContextValidator for high-security environments
 *
 * @returns ContextValidator with strict settings
 */
export declare function createStrictContextValidator(): ContextValidator;
//# sourceMappingURL=context-validator.d.ts.map