/**
 * ChannelGuard (#2783 dream-cycle companion, arXiv 2607.19430).
 *
 * The finding: individually-safe LLM agents propagate prompt-injection
 * payloads to peers through inter-agent MESSAGE CHANNELS. Each agent's
 * per-message safety check passes; the payload survives because it's
 * a legitimate agent output at each hop. ChannelGuard closes the gap by
 * scanning message content at the routing boundary before it reaches
 * the next agent.
 *
 * SCOPE: same as the MCP Composition Inspector — heuristic detector,
 * not a runtime sandbox. Reports FINDINGS with severity; the caller
 * (swarm coordinator, SendMessage hook, whatever) decides whether to
 * block, quarantine, or forward.
 *
 * Detection method (v1 — deterministic, no LLM):
 *   1. Reuse the composition-inspector injection-phrase catalog for
 *      known bad phrases in the message body.
 *   2. Instruction-shift detection: sudden appearance of `system:` /
 *      `assistant:` / `user:` role markers inside the message body
 *      (mid-payload role reassignment is a classic injection tell).
 *   3. Encoded-payload detection: long base64 / hex runs that could
 *      hide an obfuscated instruction. Flag but don't parse.
 *   4. Zero-width unicode obfuscation: U+200B, U+200C, U+200D, U+FEFF,
 *      bidi overrides (U+202A-E, U+2066-9). These have zero legitimate
 *      use in agent-to-agent messages and are classic evasion.
 */
export type ChannelFinding = {
    kind: 'injection-phrase' | 'role-shift' | 'encoded-payload' | 'zero-width-obfuscation';
    severity: 'low' | 'medium' | 'high';
    offset: number;
    span: string;
    reason: string;
};
export interface ChannelScanResult {
    safe: boolean;
    findings: ChannelFinding[];
    stats: {
        messageLength: number;
        scanTimeMs: number;
    };
}
export declare function scanChannelMessage(message: string, options?: {
    minEncodedLen?: number;
    skipEncodedScan?: boolean;
}): ChannelScanResult;
//# sourceMappingURL=channel-guard.d.ts.map