/**
 * sanitize — Guards the LLM context against the Lethal Trifecta (Simon Willison).
 * MUST be called before ANY externally-scraped content (Reddit post, tweet,
 * Discord msg, web page, competitor blog) is injected into an LLM prompt or
 * tool result.
 *
 * Defense layers:
 *   Layer 1 — content length cap: 500 chars max per item (hard truncation
 *             with "…" suffix). Protects context budget + limits injection surface.
 *   Layer 2 — instruction marker regex: detects the most common jailbreak
 *             patterns. If match → SKIP the item entirely (NOT sanitize; log
 *             + discard). False positives are acceptable; missed injections are not.
 *   Layer 3 (future) — embedding-based adversarial classifier.
 *
 * IMPORTANT: E2B sandbox protects execution; it does NOT protect LLM context.
 * This sanitizer is the ONLY guard before content reaches the LLM prompt.
 */
export interface SanitizeConfig {
    /** Maximum characters per item (Unicode code points, not bytes). Default: 500. */
    maxContentChars?: number;
    /** Regex list; a match on any pattern causes the item to be skipped. */
    instructionMarkerPatterns?: RegExp[];
    /** If true, log skipped items via console.warn with a structured payload. Default: true. */
    logSkips?: boolean;
}
export interface SanitizedItem<T> {
    /** True if the item survived sanitization (possibly truncated); false if discarded. */
    kept: boolean;
    /** Original item (with content possibly truncated in the `.content` field). */
    item: T;
    /** Reason the item was dropped (undefined if kept). */
    reason?: string;
}
/**
 * Default instruction marker patterns. These target the most common LLM
 * jailbreak vectors observed in 2024-2026:
 *   - Direct instruction overrides ("ignore previous instructions")
 *   - Role impersonation ("SYSTEM:", "ASSISTANT:")
 *   - Tool-call smuggling via fake XML/markdown tags
 *   - ChatML control tokens ("<|system|>")
 *   - Anthropic-style Human:/Assistant: markers smuggled via \n\n escapes
 *   - DAN / jailbreak prompt injections
 *
 * Precision is deliberately tuned toward false-positives-acceptable. A
 * false negative here means a prompt injection succeeds — catastrophic.
 * A false positive means a benign Reddit post is dropped — recoverable.
 */
export declare const DEFAULT_INSTRUCTION_PATTERNS: RegExp[];
/**
 * Sanitize a batch of externally-scraped items before LLM ingestion.
 *
 * Contract:
 *   - Throws TypeError if an item's `.content` field is not a string.
 *   - Never mutates input items; returns new objects with truncated content.
 *   - Returns one SanitizedItem per input (1:1 mapping, order preserved).
 *
 * @param items  Array of objects with a `.content: string` field.
 * @param opts   Optional config override.
 */
export declare function sanitizeExternalInput<T extends {
    content: string;
}>(items: T[], opts?: SanitizeConfig): SanitizedItem<T>[];
/**
 * Convenience: run `sanitizeExternalInput` and return only the kept items,
 * already content-truncated. Shape-preserving — the returned array contains
 * the same T type as the input, with content possibly shortened.
 */
export declare function keepSafeOnly<T extends {
    content: string;
}>(items: T[], opts?: SanitizeConfig): T[];
//# sourceMappingURL=sanitize.d.ts.map