/**
 * Untrusted-content wrapping for prompts that embed external text.
 *
 * Connector-derived text (chat messages from other people, emails, documents)
 * is DATA, not instructions. Wrapping it in explicit delimiters with a
 * treat-as-data preamble raises the bar against indirect prompt injection.
 * This is a mitigation, not a guarantee: the real blast-radius control stays
 * with role-based gateway tool permissions and envelope destination scoping.
 */
/**
 * Whether a tool's OUTPUT is untrusted external evidence.
 *
 * The invariant: anything that reads an external system directly returns text other
 * people wrote. That includes every direct connector reader, so this derives from the
 * same map the envelope scope uses rather than keeping a second hand-maintained list -
 * a reader registered for scope but forgotten here would reach a prompt unfenced.
 *
 * Uploading is excluded: it sends our own content outward and returns no foreign text.
 */
export declare function isUntrustedExternalEvidenceTool(toolName: string): boolean;
export declare const UNTRUSTED_EXTERNAL_EVIDENCE_INSTRUCTION: string;
/**
 * Wrap external text in untrusted-content delimiters.
 *
 * @param source short label for where the text came from (e.g. "connector-window")
 * @param content the external text; embedded end-markers are neutralized so the
 *                block cannot be closed early from inside the content
 */
export declare function wrapUntrustedContent(source: string, content: string): string;
/**
 * Remove every untrusted-content block, leaving only the surrounding
 * (owner-authored) text. Unambiguous because wrap-time neutralization
 * guarantees each block terminates at its own END marker - wrapped content
 * cannot escape its block.
 *
 * Consumers: the sensitive-request wall (owner text only - a forwarded
 * phishing message must not trip it) and the save-candidate extractor
 * (a "remember this" INSIDE forwarded content is data, not an instruction).
 */
export declare function stripUntrustedBlocks(text: string, options?: {
    unterminated?: 'drop' | 'keep';
}): string;
//# sourceMappingURL=untrusted-content.d.ts.map