/**
 *
 * This MITIGATES prompt injection from page content; it does not solve it. No
 * string in this module (or in any help text, comment, or warning built on it)
 * may claim injection is prevented — the notice says "This is a mitigation,
 * not a sanitizer" precisely so the claim cannot drift (tech-doc §6.3).
 */
import type { WebOp } from './web-protocol.js';
export declare const UNTRUSTED_BEGIN = "===UNTRUSTED-PAGE-CONTENT-BEGIN===";
export declare const UNTRUSTED_END = "===UNTRUSTED-PAGE-CONTENT-END===";
/**
 * The 3-line notice emitted immediately after the BEGIN marker. Kept as an
 * exact string: AC4 asserts the Chinese phrase reaches stdout verbatim.
 */
export declare const UNTRUSTED_NOTICE: string;
/**
 * Wrap a page-derived payload in the UNTRUSTED block. Call this AFTER the byte
 * caps, so the markers themselves are never truncated (tech-doc §6.1).
 */
export declare function wrapUntrusted(payload: string): string;
/**
 * Verbs whose output carries page-controlled content and is therefore wrapped.
 * `shot` is deliberately excluded: it returns a path and a byte count, both of
 * which we produced ourselves (tech-doc §6.2).
 */
export declare const WRAPPED_OPS: ReadonlySet<WebOp>;