/**
 * Content scanner for review-agent-generated artifacts.
 *
 * Anything an LLM emits that ends up in the next system prompt or in tool
 * results is a trust-boundary risk: a clever payload can override the next
 * agent's instructions, leak credentials, or smuggle destructive shell/SQL.
 * Everything written under logs/skill_notes/, the negative-pattern memory,
 * and the verifier's learned-misdiagnosis store passes through `scanContent`
 * before it can influence future runs.
 *
 * The patterns deliberately err on the side of false positives — a rejected
 * note is recoverable (review agent retries or human triages); a smuggled
 * jailbreak is not.
 *
 * See docs/architecture/self-improving-design.md §9 (Trust Boundary).
 */
export declare const THREAT_KINDS: readonly ["prompt_injection", "sys_prompt_override", "deception_hide", "exfil_curl", "sql_destructive", "shell_destructive"];
export type ThreatKind = (typeof THREAT_KINDS)[number];
export interface ThreatMatch {
    kind: ThreatKind;
    pattern: string;
    excerpt: string;
    position: number;
}
/**
 * Scan `text` for known threat patterns. Returns every match (including
 * duplicates from the same rule) so callers can decide whether to reject,
 * quarantine, or merely log.
 *
 * Empty / non-string input returns no matches; callers should treat
 * non-strings as a separate validation failure upstream.
 */
export declare function scanContent(text: unknown): ThreatMatch[];
/**
 * Short-circuit existence check — stops at the first match instead of
 * collecting the full list. Use this when only the boolean is needed.
 */
export declare function isThreatFree(text: unknown): boolean;
/**
 * Pretty-print a list of matches for log/error messages. Each match is
 * collapsed to a single line so JSONL consumers downstream parse cleanly.
 */
export declare function formatThreats(matches: ReadonlyArray<ThreatMatch>): string;
//# sourceMappingURL=contentScanner.d.ts.map