/**
 * Untrusted-content boundary (untrusted-content-boundary design).
 *
 * Structurally tags tool-returned content that came from an attacker-controllable source (web/search,
 * subagent output, memory/graph recall, third-party tools) so prompt-injection payloads embedded in it
 * are framed as DATA, never instructions — by construction, not by hoping the model follows a rule. The
 * agent's own first-party working files (read/grep/find/ls/edit/write) are trusted and not wrapped.
 */
import { UNTRUSTED_BOUNDARY_SYSTEM_RULE } from "../provider-prompt-contracts.ts";
export { UNTRUSTED_BOUNDARY_SYSTEM_RULE };
export type ToolTrustLevel = "trusted" | "untrusted";
/**
 * Classify a tool's output trust. Precedence: explicit declared trust → trusted built-in → untrusted
 * name heuristic → trusted default. Local execution tools (`bash` and `python`) are trusted by default;
 * a deployment can opt them into wrapping by passing `bashUntrusted`.
 */
export declare function classifyToolTrust(toolName: string, opts?: {
    declaredTrust?: ToolTrustLevel;
    bashUntrusted?: boolean;
}): ToolTrustLevel;
/**
 * Wrap a single block of untrusted text in a nonce-fenced boundary. Neutralizes any attempt to break
 * out of (or spoof) the fence: literal boundary tags in the content are escaped, and any occurrence of
 * the random nonce is replaced so the model can always trust the real fence. Deterministic given the
 * nonce, so the prefix cache stays stable for a fixed result.
 */
export declare function wrapUntrustedText(text: string, source: string, options?: {
    nonce?: string;
    freshness?: string;
}): string;
//# sourceMappingURL=untrusted-boundary.d.ts.map