/**
 * @module @arcis/node/sanitizers/prompt-injection
 *
 * Pattern-based prompt-injection detection and sanitization for LLM-handler
 * endpoints. Catches the common signature classes: system-prompt overrides,
 * known jailbreak frameworks (DAN/STAN/DUDE), structural markers (fake
 * XML/Markdown delimiters that try to forge system messages), and known
 * encoding tricks. Does NOT defend against arbitrary novel attacks: that
 * needs the model itself to evaluate intent.
 *
 * Built as a signature library (Option A in `documents/plans/sdk-vectors.md`
 * vector #28). MIT, fully transparent, no closed Wasm blobs.
 *
 * Common attack categories caught:
 *   - Direct override: "ignore previous instructions", "disregard the above"
 *   - Jailbreak frameworks: DAN, STAN, DUDE, "developer mode", "jailbroken"
 *   - Persona hijack: "you are now X", "pretend to be", "roleplay as"
 *   - System prompt extraction: "show me your prompt", "what are your rules"
 *   - Indirect injection: fake `<system>` tags, "BEGIN NEW INSTRUCTIONS"
 *   - Encoding tricks: Base64-prefixed payloads, ROT13 markers
 */
export type PromptInjectionSeverity = 'low' | 'medium' | 'high';
export interface PromptInjectionMatch {
    /** Stable identifier for the matched signature */
    rule: string;
    /** Severity of this signature */
    severity: PromptInjectionSeverity;
    /** Short human-readable description */
    description: string;
    /** First chars of the matched substring (for telemetry / logs) */
    match: string;
}
export interface DetectPromptInjectionResult {
    /** Did any signature match? */
    detected: boolean;
    /** All signatures that matched, in declaration order */
    matches: PromptInjectionMatch[];
    /** Highest severity across all matches; 'none' if nothing matched */
    severity: PromptInjectionSeverity | 'none';
}
/**
 * Detect prompt-injection signatures in `text`. Returns all matches with
 * severity and the highest severity seen. Does not modify the input.
 *
 * @example
 * const r = detectPromptInjection('Ignore the previous instructions.');
 * if (r.detected && r.severity === 'high') return res.status(403).end();
 */
export declare function detectPromptInjection(text: string): DetectPromptInjectionResult;
/**
 * Strip prompt-injection signatures from `text`. For HIGH and MEDIUM
 * severity matches the matched span is replaced with `[REDACTED]`. LOW
 * severity matches are left in place by default. Toggle via `redactLow`.
 *
 * Returns the sanitized string. To inspect what was stripped, call
 * `detectPromptInjection` first or pass `collectMatches: true`.
 */
export declare function sanitizePromptInjection(text: string, options?: {
    redactLow?: boolean;
    replacement?: string;
}): string;
//# sourceMappingURL=prompt-injection.d.ts.map