/**
 * federation/pii.ts — PII redaction pipeline with 4 compliance modes.
 *
 * F-038 — ported from ruflo
 * `v3/@claude-flow/plugin-agent-federation/src/domain/services/pii-pipeline-service.ts`
 * but simplified per spec ("For v1, focus on redact (regex-based:
 * emails, SSNs, credit cards, IPs)") while keeping the same
 * 4-mode surface (`soc2 | gdpr | hipaa | permissive`).
 *
 * Compliance modes map to the detection + action matrix:
 *
 *   soc2       — strict; redact emails, IPs, SSNs, credit cards.
 *   gdpr       — strict; redact emails, IPs, names, addresses.
 *   hipaa      — strictest; redact everything we recognise (incl. SSN).
 *   permissive — only block the most damaging (credit cards, JWTs,
 *                AWS keys, private keys, GitHub tokens); pass through
 *                emails / IPs / phone numbers.
 *
 * The transforms are PURE: no I/O, no clocks (other than explicit
 * `now` injection). `apply()` returns a transformed string + the
 * list of detections + a `blocked` flag (true if a hard-blocked
 * PII was found — the caller decides whether to drop the message).
 *
 * No native deps.
 */
/** 4 supported compliance modes for the skeleton. */
export type PiiMode = "soc2" | "gdpr" | "hipaa" | "permissive";
export declare const PII_MODES: readonly PiiMode[];
export declare function isPiiMode(m: unknown): m is PiiMode;
export type PiiAction = "redact" | "hash" | "pass" | "block";
/** Internal PII categories — finer-grained than the modes. */
export type PiiCategory = "email" | "ssn" | "credit_card" | "ip_address" | "phone" | "name" | "address" | "jwt" | "aws_key" | "private_key" | "github_token";
export interface PiiDetection {
    readonly category: PiiCategory;
    readonly value: string;
    readonly offset: number;
    readonly confidence: number;
}
export interface PiiResult {
    readonly transformed: string;
    readonly detections: readonly PiiDetection[];
    readonly actionsApplied: readonly {
        category: PiiCategory;
        action: PiiAction;
    }[];
    readonly blocked: boolean;
    readonly mode: PiiMode;
}
export interface ApplyOptions {
    /** Salt for hash() actions. Defaults to "bizar". */
    readonly salt?: string;
}
/** Pure-function PII pipeline. Walks the regex table, decides an
 *  action per category under the chosen mode, applies the
 *  replacement. Returns enough metadata for the audit service to
 *  log what was stripped. */
export declare function apply(text: string, mode: PiiMode, opts?: ApplyOptions): PiiResult;
/** PiiPipeline — class wrapper for parity with ruflo's
 *  PIIPipelineService shape. Holds a default mode + salt, exposes
 *  `process(text)` and `setMode(mode)`. */
export declare class PiiPipeline {
    private mode;
    private readonly salt;
    constructor(opts?: {
        mode?: PiiMode;
        salt?: string;
    });
    setMode(mode: PiiMode): void;
    getMode(): PiiMode;
    process(text: string): PiiResult;
}
//# sourceMappingURL=pii.d.ts.map