/**
 * PromptGuard — Inbound message injection scanner.
 *
 * Scans user-facing inbound messages for common prompt injection patterns
 * across 6 categories. Disabled by default (opt-in via config).
 *
 * Extends patterns from `external-content.ts` with more targeted category-based
 * scanning for pre-agent-loop validation.
 *
 * @module
 */
export type PromptGuardSensitivity = "low" | "medium" | "high";
export type PromptGuardAction = "warn" | "block" | "sanitize";
export type PromptGuardConfig = {
    enabled: boolean;
    sensitivity: PromptGuardSensitivity;
    action: PromptGuardAction;
};
export type PromptGuardResult = {
    flagged: boolean;
    categories: string[];
    action: "allow" | "warn" | "block";
    detail: string;
};
export declare const DEFAULT_PROMPT_GUARD_CONFIG: PromptGuardConfig;
/**
 * Resolve prompt guard config, auto-enabling for multi-tenant sessions.
 *
 * When a `userContext` is present (multi-tenant session) and the guard is
 * disabled, returns a minimal enabled config with low sensitivity and warn
 * action. Otherwise returns the config unchanged.
 */
export declare function resolvePromptGuardConfig(config: PromptGuardConfig, opts?: {
    userContext?: unknown;
}): PromptGuardConfig;
/**
 * Scan an inbound user message for prompt injection patterns.
 *
 * Returns a result indicating whether the message was flagged, which
 * categories matched, and the recommended action.
 *
 * Credential scanning runs unconditionally even when `config.enabled` is
 * false — leaked API keys / tokens are always blocked.
 */
export declare function scanInboundMessage(content: string, config?: PromptGuardConfig): PromptGuardResult;
