export type InjectionDefenceMode = 'off' | 'flag' | 'block';
export type InjectionCategory = 'role_override' | 'system_prompt_leak' | 'instruction_insert' | 'encoding_bypass' | 'jailbreak' | 'tool_abuse' | 'data_exfiltration';
export interface InjectionMatch {
    /** Which pattern triggered. */
    patternId: string;
    category: InjectionCategory;
    /** 0.0–1.0. Patterns ≥ 0.7 are high-confidence. */
    confidence: number;
    /** The substring that matched (trimmed to 120 chars). */
    matchedText: string;
}
export interface InjectionScanResult {
    /** Whether the message was scanned (false when mode = off). */
    scanned: boolean;
    /** Whether any patterns matched. */
    flagged: boolean;
    /** Whether the message should be blocked (only true when mode = block AND high-confidence match). */
    blocked: boolean;
    /** All matched patterns. */
    matches: InjectionMatch[];
    /** Summary string suitable for logging. */
    summary: string;
}
export interface InjectionDefenceOptions {
    mode?: InjectionDefenceMode;
    /** Confidence threshold for blocking (only in `block` mode). Default 0.7. */
    blockThreshold?: number;
    /** Extra patterns the caller wants to add on top of the built-in set. */
    extraPatterns?: InjectionPattern[];
}
export interface InjectionPattern {
    id: string;
    category: InjectionCategory;
    pattern: RegExp;
    confidence: number;
}
/**
 * Scan a user message for prompt injection patterns.
 * Returns a result object with all matches, flags, and a summary.
 */
export declare function scanForInjection(message: string, options?: InjectionDefenceOptions): InjectionScanResult;
/**
 * Sanitize a message by stripping known injection markers.
 * Best-effort mitigation — removes fake system/admin message boundaries.
 */
export declare function sanitizeMessage(message: string): string;
//# sourceMappingURL=injectionDefence.d.ts.map