import type { CompletionRequest } from '../types/messages.js';
import type { InjectionDetectionConfig, SecurityFinding } from '../types/security.js';
/** What kind of attack a guardrail pattern catches. */
export type AttackCategory = 'injection' | 'exfiltration' | 'jailbreak';
/** A guardrail's attack pattern, as an attack it catches: the seed an adversarial dataset grows from. */
export interface AttackSeed {
    /** The pattern's label, as its findings name it. */
    label: string;
    /** What the attack is after. */
    category: AttackCategory;
    /** How serious a match is. */
    severity: SecurityFinding['severity'];
    /** Words of the attack that the pattern matches. */
    example: string;
}
/**
 * The attacks the injection detector's own patterns catch, one per pattern, as seeds for an
 * adversarial dataset. A pattern added to the detector adds its seed here too.
 */
export declare function attackSeeds(): AttackSeed[];
/** Finds prompt-injection attempts by pattern. */
export declare class InjectionDetector {
    /** Finds injection attempts in a request's messages. */
    detect(request: CompletionRequest, config?: InjectionDetectionConfig): SecurityFinding[];
    /** Returns the request with injection markers defused. */
    neutralize(request: CompletionRequest): CompletionRequest;
    private extractText;
    /** Defuses what `detect()` finds. Text with nothing to defuse is returned exactly as it was. */
    private escapeInstructionLikeText;
    private escapeNormalized;
}