/**
 * Input validation and prompt-injection guards.
 *
 * Inlined from the former @monomind/security package. Provides a single
 * typed entry point for input validation covering string, number, path,
 * url, and orgName types, plus a heuristic prompt-injection detector
 * for untrusted external content.
 *
 * @module @monomind/cli/utils/input-guards
 */
export interface ValidationResult {
    valid: boolean;
    error?: string;
    sanitized?: string;
}
export interface ValidateInputOpts {
    type: 'string' | 'number' | 'path' | 'url' | 'orgName';
    maxLength?: number;
    required?: boolean;
}
/** Resolve symlinks so the containment check below can't be bypassed by a
 * link that lexically resolves inside cwd but physically points outside it
 * (e.g. `./link -> /etc`). `realpathSync` requires the full path to exist,
 * which a not-yet-created file (or a symlinked *directory* holding a
 * not-yet-created file) would fail — so walk up to the longest existing
 * ancestor, realpath *that* (resolving any symlink components in it), and
 * re-append the non-existent tail. Falls back to the lexical path only when
 * no ancestor at all can be resolved. */
export declare function realOrResolved(p: string): string;
/**
 * Validate and sanitize an input value.
 *
 * @example
 * const result = validateInput(req.body.name, { type: 'orgName' });
 * if (!result.valid) throw new Error(result.error);
 * const safeName = result.sanitized!;
 */
export declare function validateInput(value: unknown, opts: ValidateInputOpts): ValidationResult;
/**
 * Sanitize an error before returning it to MCP callers.
 * Strips filesystem paths (POSIX and Windows) from error messages to avoid
 * leaking internal layout. Shared with crash-reporter.ts and
 * neural-optimize.ts's PII stripping via utils/redaction.ts — this used to
 * be a single POSIX-only regex with no Windows-path handling.
 */
export declare function sanitizeError(error: unknown): string;
/**
 * Validate a string value for MCP tool handlers.
 * Returns the string when valid, or null when invalid.
 * Lighter-weight than `validateInput({ type: 'string' })` — designed
 * for the fast-path guard pattern used in MCP tool handlers.
 */
export declare function validateMcpString(value: unknown, _name: string, maxLen?: number): string | null;
/**
 * Validate a positive integer for MCP tool parameters.
 * Returns the clamped value or the default.
 */
export declare function validatePositiveInt(value: unknown, defaultVal: number, max: number): number;
/**
 * Validate a score (0–1 range) for MCP tool parameters.
 * Returns the clamped value or the default.
 */
export declare function validateScore(value: unknown, defaultVal: number): number;
export declare function validateRef(value: unknown, maxLen?: number): string | null;
export interface ExternalContentResult {
    safe: boolean;
    reason?: string;
}
/**
 * Heuristically check whether `content` contains prompt-injection
 * patterns. This is a structural / regex-based guard — it does not
 * call any LLM.
 *
 * This is defense-in-depth, not a security boundary: a rephrased or
 * non-English injection attempt can trivially evade a fixed pattern list.
 * Do not rely on this as the sole safeguard for content that then gets
 * treated as trusted/authoritative — pair it with least-privilege handling
 * of whatever downstream action the content can influence.
 *
 * @param content - The untrusted string to inspect.
 * @param source  - Optional label describing where the content came
 *                  from (used only in log-friendly diagnostics, not
 *                  in the returned reason).
 * @returns `{ safe: true }` when no injection signal is found, or
 *          `{ safe: false, reason }` describing the first match.
 *
 * @example
 * const check = await validateExternalContent(userQuery, 'memory search');
 * if (!check.safe) throw new Error(`Blocked: ${check.reason}`);
 */
export declare function validateExternalContent(content: string, _source?: string): Promise<ExternalContentResult>;
//# sourceMappingURL=input-guards.d.ts.map