/**
 * design/97 CORE-2 — the SINGLE home for "untrusted text → human/LLM egress". Two trust concerns compose here so
 * the per-agent transcript (#5) and steer content (#6), plus the existing notifier summary, cannot each reopen
 * the same hole in their own place:
 *  1. HOST-leak redaction — strip endpoints/baseUrl, auth tokens/headers, named secrets, and absolute fs paths,
 *     so a summary/transcript never leaks the host's internals.
 *  2. INJECTION fencing — wrap untrusted content (a worker's prompt/output, a human's steer) so it cannot forge
 *     a `</system-reminder>` or otherwise pose as instructions to the reader (delimitUntrusted).
 * The notifier uses {@link boundedRedactedSummary} (a short status line — redact+bound, no fence); a transcript
 * panel / steer echo shown to a human or fed back to the originating LLM uses {@link untrustedEgressForHuman}
 * (redact+bound+fence).
 */
/**
 * Strip the obvious host-internal leak vectors from a string: URLs of ANY protocol (http/https/ftp/ssh/…), auth
 * tokens (Bearer/Basic), named-secret assignments INCLUDING suffixed env-var names (OPENAI_API_KEY=…,
 * GIT_API_TOKEN=…, AWS_SECRET_ACCESS_KEY=…, *_SECRET / *_PASSWORD), and absolute filesystem paths of ≥2 segments.
 * Scope (audit): single-segment paths like `/etc` are intentionally NOT redacted (too noisy); this is
 * defense-in-depth, not a guarantee — the failed path additionally avoids the raw error entirely.
 */
export declare function redactHostLeaks(s: string): string;
/** Redact host leaks + size-bound (NO injection fence) — a short status line for a notifier / summary. */
export declare function boundedRedactedSummary(value: unknown, max: number): string;
/**
 * The FULL untrusted-egress transform (design/97 CORE-2): redact host leaks + size-bound + FENCE. Use for any
 * worker prompt/output (#5 transcript) or steer content (#6) shown to a human or fed back to the originating
 * LLM, so untrusted text can neither leak host internals nor pose as instructions.
 */
export declare function untrustedEgressForHuman(value: unknown, opts: {
    label: string;
    max: number;
}): string;
//# sourceMappingURL=untrusted-egress.d.ts.map