//#region src/redaction/patterns.d.ts
/**
 * Built-in PII / secret detection patterns. The catalogue is intentionally
 * conservative - every pattern has both positive and negative test
 * fixtures and is documented so operators understand exactly what is
 * matched.
 *
 * The catalogue is split into two groups:
 *
 * - **secret** - credentials, API tokens, JWTs, private keys. Matches
 *   are always dropped + counted, regardless of the configured tier
 *   floor.
 * - **pii** - email / phone / IBAN / credit card / SSN / IP address.
 *   Subject to the configured tier floor + per-pattern enable / disable
 *   knobs.
 *
 * @packageDocumentation
 */
/**
 * Stable pattern identifier. The catalogue is curated; user-supplied
 * patterns can use any identifier they want and will be passed through
 * the validator in addition to the built-ins.
 *
 * @stable
 */
type BuiltInPatternName = 'graphorin-token' | 'openai-key' | 'anthropic-key' | 'aws-access-key' | 'gcp-service-account' | 'github-pat' | 'jwt' | 'bearer-header' | 'basic-auth' | 'private-key-pem' | 'email' | 'creditcard' | 'us-ssn' | 'phone-e164' | 'iban' | 'ipv4' | 'ipv6';
/**
 * Pattern category - `secret` matches always force a drop; `pii`
 * matches respect the configured `enabledPatterns` allow-list.
 *
 * @stable
 */
type PatternCategory = 'secret' | 'pii';
/**
 * One entry in the redaction catalogue.
 *
 * @stable
 */
interface RedactionPattern {
  readonly name: string;
  readonly category: PatternCategory;
  readonly description: string;
  readonly regex: RegExp;
  /** Replacement string used when `mode === 'mask'`. */
  readonly mask?: string;
  /**
   * Optional per-match predicate. When present, a regex hit is only
   * treated as a real match - and masked - when this returns `true` for the
   * matched substring. Every catalogue consumer honours it: the OTLP
   * `RedactionValidator`, the `withRedaction` provider middleware (both the
   * request scrub and the streaming response scan), and user-supplied
   * patterns may carry their own predicate. Used by the `creditcard`
   * pattern to require a valid Luhn checksum plus a major-network leading
   * digit so look-alike digit runs (epoch-ms timestamps, order ids,
   * serialized floats) are not corrupted.
   */
  readonly verify?: (match: string) => boolean;
  /**
   * Optional opt-in flag. When `true` the pattern is **not** active by
   * default; operators must add it to `enabledPatterns` explicitly. Used
   * by the IPv4 / IPv6 patterns because raw IPs frequently appear in
   * non-PII log lines (host headers, debug traces, …).
   */
  readonly optIn?: boolean;
}
/**
 * The 14 default-on built-in patterns (the IPv4 and IPv6 detectors are
 * opt-in and live in {@link OPT_IN_PATTERNS}).
 *
 * @stable
 */
declare const BUILT_IN_PATTERNS: readonly RedactionPattern[];
/**
 * Patterns that are recognised by the validator but are NOT enabled by
 * default. Use them via `patterns: [...BUILT_IN_PATTERNS, ...OPT_IN_PATTERNS]`.
 *
 * @stable
 */
declare const OPT_IN_PATTERNS: readonly RedactionPattern[];
/**
 * Full registry - for tooling that wants to introspect every pattern
 * the framework knows about (e.g. CLI `graphorin redaction list`).
 *
 * @stable
 */
declare const ALL_BUILT_IN_PATTERNS: readonly RedactionPattern[];
/**
 * A replacement decision from {@link jsonSafeSpan}: replace
 * `source.slice(start, end)` with `text`. `start` normally equals the
 * match index; it moves one lexeme left only when a leading minus sign
 * has to be absorbed so a signed numeric leaf stays parseable.
 *
 * @stable
 */
interface JsonSafeSpan {
  readonly start: number;
  readonly end: number;
  readonly text: string;
}
/**
 * Grammar-preserving mask placement. When the matched span occupies a bare
 * JSON *value* position - the nearest non-whitespace neighbour on the left
 * is `:` / `,` / `[` (or the start of the text) and on the right `,` / `}`
 * / `]` (or the end of the text) - the mask is wrapped in double quotes,
 * so masking a raw numeric leaf (`{"card":4111111111111111}`) yields a
 * document that still parses (`{"card":"[REDACTED creditcard]"}`). A
 * leading minus sign is part of the value position: for
 * `{"card":-4111111111111111}` the returned span absorbs the sign
 * (`start` moves to the `-`), because a mask emitted after a stranded
 * sign (`-"[REDACTED ...]"`) would not parse. Everywhere else (prose,
 * CSV, inside a JSON string leaf) the mask is returned unquoted and the
 * span covers exactly the match. The text is never parsed, so lexemes
 * outside the returned span keep their exact source form.
 *
 * Ambiguity note: a text consisting solely of the match (plus
 * insignificant whitespace) is indistinguishable from a single-value
 * JSON document, so the mask is quoted even when the caller meant plain
 * prose. That direction is safe - the redacted document parses in the
 * JSON reading and leaks nothing in the prose reading.
 *
 * @stable
 */
declare function jsonSafeSpan(source: string, matchIndex: number, matchLength: number, mask: string): JsonSafeSpan;
/**
 * String-returning wrapper around {@link jsonSafeSpan} for callers that
 * replace exactly the matched span. Because its signature cannot widen
 * the replaced region, it CANNOT absorb the leading minus of a signed
 * numeric leaf - for `{"card":-4111111111111111}` it returns the plain
 * unquoted mask (its historical behaviour), which leaves the document
 * unparseable. Prefer {@link jsonSafeSpan} in new code; this wrapper is
 * kept for custom catalogues that adopted it in 0.13.4. The same
 * whole-text ambiguity documented on {@link jsonSafeSpan} applies.
 *
 * @stable
 */
declare function jsonSafeMask(source: string, matchIndex: number, matchLength: number, mask: string): string;
//#endregion
export { ALL_BUILT_IN_PATTERNS, BUILT_IN_PATTERNS, BuiltInPatternName, JsonSafeSpan, OPT_IN_PATTERNS, PatternCategory, RedactionPattern, jsonSafeMask, jsonSafeSpan };
//# sourceMappingURL=patterns.d.ts.map