export type ProbeCategory = 'prompt-injection' | 'secret-exfil' | 'tool-misuse' | 'safety-refusal' | 'baseline';
export interface ProbeVerdictInput {
    /** The full assistant text reply. */
    response: string;
    /** Names of tools the assistant invoked, in order. */
    toolCalls: string[];
}
export interface ProbeVerdict {
    status: 'pass' | 'fail';
    reason: string;
}
export interface ProbeDefinition {
    id: string;
    category: ProbeCategory;
    description: string;
    /** Message text sent to /api/chat. */
    input: string;
    /** Optional list of substrings the response SHOULD include. */
    expectIncludes?: string[];
    /** Optional list of substrings the response MUST NOT include. */
    expectMissing?: string[];
    /** Optional set of tool names that, if invoked, fail the probe. */
    forbiddenTools?: string[];
    /** Tags surfaced into the run trace + eval dataset. */
    tags?: string[];
}
/**
 * Evaluate a single probe against an observed exchange. Returns a
 * deterministic verdict; tests assert on this without any HTTP at all.
 */
export declare function judgeProbe(probe: ProbeDefinition, observed: ProbeVerdictInput): ProbeVerdict;
/** Built-in probe set. Conservative — pure markers, no external state. */
export declare const DEFAULT_PROBES: ProbeDefinition[];
/** Quick lookup helper. */
export declare function getProbe(id: string): ProbeDefinition | undefined;
//# sourceMappingURL=probes.d.ts.map