/**
 * PromptInjectionDetector -- pre-LLM-call prompt injection classifier.
 *
 * Rule-based classifier covering OWASP LLM01 injection patterns.
 * Designed to run synchronously in the LLM adapter pre-call path with
 * negligible latency impact (< 1ms on realistic message arrays).
 *
 * Pattern catalog:
 *   - Instruction override: "ignore previous", "disregard above", "new instructions:"
 *   - Role-play exploits: "you are now DAN", "pretend you are unrestricted"
 *   - Data exfiltration: "output your system prompt", "list your tools"
 *   - Encoded payloads: base64-like sequences, hex sequences in user content
 *   - Jailbreak patterns: DAN, STAN, DUDE, and other known names
 *   - Authority escalation: "I am your admin", "system override"
 *
 * Severity thresholds:
 *   - HIGH: triggers DENY (default behavior)
 *   - MEDIUM: triggers WARN/log (audit event, allow by default)
 *   - LOW: logs only
 *
 * False-positive avoidance: legitimate sentences that contain the word "ignore"
 * in natural context (e.g., "you can ignore the warning") do not trigger
 * because patterns require the word to appear with command-forming phrases.
 *
 * Onyx #5 gap closure: Prompt Injection Detection and Blocking.
 *
 * @connexum/ai-governance
 */
export interface InjectionMessage {
    role: string;
    content: string;
}
export type InjectionSeverity = 'low' | 'medium' | 'high';
export interface InjectionDetectionResult {
    /** Whether any injection pattern was detected. */
    detected: boolean;
    /** List of pattern IDs that matched. */
    patterns: string[];
    /** Highest severity of any matched pattern. */
    severity: InjectionSeverity;
    /** 0-1 confidence score (ratio of patterns fired vs total checked, capped). */
    confidence: number;
}
export interface InjectionDetectorConfig {
    /**
     * Minimum severity level that causes `detected=true` to be returned.
     * Patterns below this threshold are scanned but do not raise a flag.
     * Default: 'low' (all patterns contribute to detected=true).
     */
    detectionThreshold?: InjectionSeverity;
}
export declare class PromptInjectionDetector {
    private readonly config;
    constructor(config?: InjectionDetectorConfig);
    /**
     * Analyse an array of LLM messages for injection patterns.
     *
     * Returns a detection result. When `detected=true` and severity is HIGH,
     * callers should return a synthetic DENY and emit an audit event.
     *
     * Designed for the pre-call path: synchronous, no I/O, < 1ms on typical inputs.
     */
    detectInjection(messages: InjectionMessage[]): InjectionDetectionResult;
    /**
     * Produce a privacy-respecting redacted snippet of the offending content.
     * Never logs the full content to prevent exfil of sensitive system prompts.
     *
     * Returns up to 120 characters with the matching segment highlighted and
     * the rest masked with asterisks.
     */
    redactedSnippet(content: string, patternId: string): string;
}
/** Return (or create) the process-scoped default detector instance. */
export declare function getDefaultDetector(config?: InjectionDetectorConfig): PromptInjectionDetector;
/**
 * Build a signed audit event payload for a detected injection.
 * Includes a redacted snippet and a hash of the raw content for integrity.
 * Never includes the full message content.
 */
export declare function buildInjectionAuditEvent(messages: InjectionMessage[], result: InjectionDetectionResult, agentId: string, tenantId: string): Record<string, unknown>;
//# sourceMappingURL=prompt-injection-detector.d.ts.map