/**
 * User-defined PII patterns from config.
 *
 * Same response-path scanner as the built-in detectors — not a second masker.
 * The pattern text is treated as sensitive: errors, logs and receipts carry
 * the rule NAME only.
 *
 * User regex is ReDoS-risky. This module never runs an unbounded pattern:
 * nested / overlapping quantifiers, `+` / `*`, open `{n,}` and lookaround
 * are rejected at compile. A broken rule fails the config (silent drop = leak).
 */
import type { CustomPiiPattern } from './types.js';
export declare const CUSTOM_PATTERN_MAX_SOURCE = 200;
export declare const CUSTOM_PATTERN_MAX_QUANTIFIER = 64;
export declare const CUSTOM_PATTERN_MAX_MATCHES = 256;
export type CustomPatternReject = 'invalid' | 'unsafe' | 'duplicate' | 'empty' | 'too-long' | 'bad-name' | 'bad-label';
export declare class CustomPatternError extends Error {
    readonly ruleName: string;
    readonly reason: CustomPatternReject;
    constructor(ruleName: string, reason: CustomPatternReject);
}
export interface CompiledCustomPattern {
    name: string;
    columns: string[];
    label: string;
    /** Source kept only in memory for lastIndex-safe clones. Never logged. */
    re: RegExp;
}
export declare function compileCustomPatterns(list: CustomPiiPattern[] | undefined): CompiledCustomPattern[];
/**
 * Conservative static reject. Linear class quantifiers (`[0-9]{8}`) pass.
 * Anything that can explode backtracking — or is simply unbounded — does not.
 */
export declare function looksUnsafe(source: string): boolean;
export declare function columnMatches(globs: string[], column: string): boolean;
export declare function mergeByClass(into: Record<string, number>, add?: Record<string, number>): Record<string, number>;
export declare function applyCustomPatterns(text: string, compiled: CompiledCustomPattern[], column?: string): {
    text: string;
    count: number;
    byClass: Record<string, number>;
};
//# sourceMappingURL=custom_patterns.d.ts.map