/**
 * Internal-ID leak detector (C1+C2 "The Agent Carries the Loop" §4.3, B-IDLEAK).
 *
 * SIGNAL ONLY, and a MITIGATION — not a complete fix (the regex is evadable).
 * It flags raw instar-internal plumbing tokens in *unsolicited, agent-initiated*
 * outbound text — the "I'm not even sure what CMT is" leak the operator hit. It
 * is a JARGON-class signal: it does NOT replace the authority-level
 * guardProxyOutput / redactSecrets passes (those handle real secret/path
 * disclosure). The full-context MessagingToneGate LLM decides whether to reframe;
 * a direct answer to a user who explicitly asked for an identifier should pass.
 */
export interface InternalIdLeakSignal {
    /** True when an internal-plumbing token is present (a SIGNAL, not a verdict). */
    leaked: boolean;
    /** Distinct pattern names that matched, bounded — for the gate's context. */
    terms: string[];
}
/**
 * Detect internal-ID / plumbing leaks. Returns `{ leaked: false, terms: [] }`
 * when none is found. Never scrubs or blocks — it only signals.
 */
export declare function detectInternalIdLeak(text: string): InternalIdLeakSignal;
//# sourceMappingURL=internal-id-leak.d.ts.map