/**
 * Agent-directed instruction detection for untrusted content.
 *
 * Indirect prompt injection rarely says "ignore previous instructions" in plain
 * ASCII any more. It hides behind homoglyphs (Сyrillic "Іgnоrе"), zero-width
 * splits ("i​g​n​o​r​e"), foreign languages ("Abaikan semua panduan keamanan"),
 * and — most often — innocuous-looking prose that addresses *the assistant* and
 * asks it to read a secret, run a fetched command, or send a key somewhere.
 *
 * We can't perfectly classify adversarial prose (that's why the firewall also
 * SPOTLIGHTS untrusted content as data). But we can de-obfuscate first, then flag
 * the high-signal subset: override-instructions, role hijacks, fetch-and-run
 * directives, and secret-exfiltration instructions. Conservative on the fuzzy
 * tail (warn, not block) so ordinary docs pass.
 */
import type { Severity } from "../promptguard/types.js";
export type DirectiveHit = {
    ruleId: string;
    severity: Severity;
    message: string;
};
/** Undo the obfuscation layers attackers use to dodge keyword matching:
 *  NFKC (width/ligatures), zero-width & soft-hyphen removal, homoglyph folding. */
export declare function normalizeConfusables(text: string): string;
export declare function inspectAgentDirectives(raw: string): DirectiveHit | null;