/**
 * Core content inspection for the agent firewall. Pure and synchronous — given a
 * blob of untrusted content (a fetched page, a tool result, an issue body), it
 * decides whether the agent should be allowed to act on it. Reuses the
 * promptguard scanner; no network, no state.
 */
import { type GuardPolicy, type GuardResult } from "./types.js";
/**
 * Spotlighting (structural defense): wrap untrusted content in explicit data
 * boundaries so the model treats it as data, not instructions — neutralizing
 * injections by FRAMING rather than detection. Detection will always miss some
 * adaptive prose; this is the backstop the mentor's review called for. Applied to
 * flagged content the guard doesn't hard-block, so the residual is still defanged.
 */
export declare function spotlightUntrusted(content: string): string;
export declare function inspectContent(text: string, policy?: GuardPolicy): GuardResult;