/**
 * Attack Corpus — Manages a local database of known attack patterns.
 * Supports adding new attacks, categorizing them, and extracting
 * patterns for rule generation.
 *
 * Zero external dependencies.
 */
import type { Severity, InjectionContext } from "../types.js";
export type AttackSample = {
    /** Unique hash of the input text. */
    id: string;
    /** The attack text. */
    text: string;
    /** Attack category. */
    category: AttackCategory;
    /** Techniques used. */
    techniques: string[];
    /** Languages detected. */
    languages: string[];
    /** Whether our scanner caught it. */
    detected: boolean;
    /** Which rules caught it (if detected). */
    matchedRules: string[];
    /** Severity assigned. */
    severity: Severity | null;
    /** Source of this sample. */
    source: AttackSource;
    /** When this sample was added. */
    addedAt: string;
    /** Context where this attack applies. */
    context: InjectionContext;
};
export type AttackCategory = "role_override" | "instruction_ignore" | "exfiltration" | "delimiter_escape" | "encoding_evasion" | "tool_abuse" | "multi_turn" | "indirect_injection" | "payload_splitting" | "few_shot" | "virtualization" | "authority_confusion" | "hypothetical_framing" | "language_switching" | "unknown";
export type AttackSource = "community" | "honeypot" | "ctf" | "research" | "manual" | "auto_generated";
export type Corpus = {
    version: number;
    updatedAt: string;
    samples: AttackSample[];
    stats: CorpusStats;
};
export type CorpusStats = {
    totalSamples: number;
    detectedCount: number;
    missedCount: number;
    detectionRate: number;
    byCategory: Record<string, number>;
    byTechnique: Record<string, number>;
    bySource: Record<string, number>;
};
/**
 * Load or create the attack corpus from disk.
 */
export declare function loadCorpus(dataDir: string): Corpus;
/**
 * Save corpus to disk.
 */
export declare function saveCorpus(corpus: Corpus, dataDir: string): void;
/**
 * Add an attack sample to the corpus. Deduplicates by text hash.
 */
export declare function addSample(corpus: Corpus, params: {
    text: string;
    category: AttackCategory;
    techniques: string[];
    languages?: string[];
    detected: boolean;
    matchedRules?: string[];
    severity?: Severity | null;
    source: AttackSource;
    context?: InjectionContext;
}): AttackSample | null;
/**
 * Get all samples that were missed by the scanner.
 */
export declare function getMissedSamples(corpus: Corpus): AttackSample[];
/**
 * Get samples by category.
 */
export declare function getSamplesByCategory(corpus: Corpus, category: AttackCategory): AttackSample[];
/**
 * Export corpus stats as a human-readable report.
 */
export declare function generateReport(corpus: Corpus): string;