/**
 * Prompt Injection Detector
 *
 * Scans tool results and external content for prompt injection attempts:
 * - Instruction override phrases
 * - Role impersonation markers
 * - Delimiter attacks
 * - Base64-encoded payloads
 * - Unicode homoglyph obfuscation
 */
import { type SecurityEvent } from './security-event.types.js';
export interface InjectionScanResult {
    markers: string[];
    score: number;
}
export declare class PromptInjectionDetector {
    private events;
    /**
     * Scan content for prompt injection indicators.
     * Returns a 0–1 risk score and list of matched markers.
     */
    scan(content: string): InjectionScanResult;
    /**
     * Sanitise tool result content based on injection risk.
     */
    sanitizeToolResult(toolName: string, content: string): string;
    /**
     * Get recorded security events.
     */
    getEvents(): SecurityEvent[];
    /**
     * Clear recorded events.
     */
    clearEvents(): void;
    /**
     * Match a set of weighted patterns against content, accumulating score and markers.
     */
    private matchPatterns;
    /**
     * Strip invisible/format Unicode characters used to split an injection
     * keyword across characters the pattern regexes would otherwise treat as
     * contiguous (e.g. "ignore" + ZWSP + "previous"). `\p{Cf}` (Unicode "format"
     * general category) covers ZWSP/ZWJ/ZWNJ, BOM, soft hyphen, Mongolian vowel
     * separator, the LTR/RTL marks and embedding/override/isolate controls, and
     * word joiner and friends in one principled sweep rather than enumerating
     * each codepoint as an evasion technique surfaces it; variation selectors
     * (U+FE00-U+FE0F) sit outside Cf and are added explicitly.
     */
    private stripInvisibleCharacters;
    /**
     * Replace Unicode homoglyphs with ASCII equivalents.
     */
    private normaliseHomoglyphs;
    /**
     * Scan for base64-encoded injection payloads.
     */
    private scanBase64Payloads;
    /**
     * Lightweight scan of decoded content without recursion.
     */
    private logEvent;
    private scanDecoded;
}
export declare function getPromptInjectionDetector(): PromptInjectionDetector;
export declare function resetPromptInjectionDetector(): void;
//# sourceMappingURL=prompt-injection-detector.d.ts.map