/**
 * Curated attack corpus for the semantic-similarity defence layer.
 *
 * These are short, representative phrasings of prompt-injection, jailbreak,
 * instruction-override, system-prompt-exfiltration and data-exfiltration
 * intent. They are deliberately PARAPHRASES that the literal regex patterns in
 * `firewall/instruction-detector.ts` do NOT match — the semantic layer's whole
 * job is to catch the novel/rephrased variants the regexes miss. (E.g. the
 * regex catches "ignore previous instructions"; the corpus carries "kindly
 * disregard the directives given to you earlier" instead.)
 *
 * Embedded at RUNTIME (see ./index.ts), never at build time, so the corpus
 * vectors always use the SAME embedding model as the content being scanned and
 * we carry no build-time model dependency.
 *
 * Quality over quantity: a focused, category-balanced set is more precise than
 * a large noisy one. Keep entries short (a single intent each) so each vector
 * is a tight semantic anchor rather than a diffuse paragraph.
 */
export declare const ATTACK_CORPUS: readonly string[];
/** Coarse category labels, parallel-indexed conceptually with the corpus above. */
export declare const ATTACK_CORPUS_CATEGORIES: readonly ["instruction_override", "role_reassignment", "guardrail_bypass", "prompt_exfiltration", "data_exfiltration", "memory_tool_poisoning", "indirect_compliance"];
