/**
 * Prompt-injection defense for local-mcp-toolbelt (F4).
 *
 * Two-layer architecture:
 *
 * Layer 1a — Spotlighting (delimiting technique)
 *   Source: arxiv 2403.14720, Hines et al. 2024, §3 "Delimiting".
 *   Wraps untrusted text in a unique per-call random token that the system
 *   prompt announces as a data boundary. Prevents the LLM from treating
 *   external content as instructions.
 *
 * Layer 1b — Unicode NFKC normalization
 *   Source: Unicode TR#15 (https://unicode.org/reports/tr15/).
 *   SEPARATE technique from Spotlighting; collapses Cyrillic and other
 *   confusable homoglyphs to their ASCII equivalents before processing.
 *
 * Layer 2 — @stackone/defender (Apache-2.0, ~23 MB bundled)
 *   Regex/pattern-based injection classifier (Tier 1) enabled by default.
 *   MiniLM ONNX classifier (Tier 2) opt-in via OMCP_DEFENDER_TIER2=1;
 *   adds ~475 MB in peer dependencies (onnxruntime-node + @huggingface/transformers).
 */
export interface SpotlightResult {
    /** Prepend this to the tool's existing system prompt. */
    systemPrefix: string;
    /** Use this as the user message instead of the raw text. */
    wrappedText: string;
    delimiter: string;
}
/**
 * Apply Spotlighting (delimiting) to untrusted text.
 * Already-NFKC-normalized text should be passed in.
 */
export declare function applySpotlighting(text: string): SpotlightResult;
/**
 * Normalize text with NFKC (Unicode TR#15).
 * Collapses Cyrillic/Greek confusables and full-width characters to their
 * ASCII equivalents, defeating basic homoglyph injection.
 */
export declare function normalizeNFKC(text: string): string;
export interface BridgeDefenseOptions {
    /** Enable Tier-2 MiniLM ONNX classifier. Default: read OMCP_DEFENDER_TIER2 env. */
    enableTier2?: boolean;
}
/** Outcome of running a text through the full defense pipeline. */
export interface DefenseOutcome {
    /** Whether the text cleared the defense (true = proceed to LLM). */
    allowed: boolean;
    /** NFKC-normalized version of the original text. */
    normalizedText: string;
    /** Spotlighting system prefix to prepend. */
    systemPrefix: string;
    /** Spotlighted + delimited version of the text. */
    wrappedText: string;
    /** Which defender tier ran. */
    defenderTier: '1' | '1+2' | 'off';
    /** Tier-2 float confidence (0–1) if Tier 2 ran. */
    score?: number;
    /** Tier-1 risk level string if an injection was detected. */
    risk?: string;
}
/**
 * Bridge-level prompt-injection defense.
 * Create one instance per server process; the PromptDefense instance inside
 * caches model state between calls.
 */
export declare class BridgeDefense {
    private readonly defense;
    private readonly tier2Enabled;
    constructor(opts?: BridgeDefenseOptions);
    /**
     * Warm up Tier-2 ONNX model if enabled. Call once at bridge startup
     * so the first real tool call doesn't pay the 1–2 s load cost.
     */
    warmup(): Promise<void>;
    /**
     * Apply the full defense pipeline to untrusted user text.
     *
     * 1. NFKC normalize
     * 2. Run @stackone/defender on the normalized text
     * 3. If blocked → return allowed=false immediately
     * 4. Apply Spotlighting wrapping
     */
    defend(text: string, toolName: string): Promise<DefenseOutcome>;
}
//# sourceMappingURL=defense.d.ts.map