import type { ValidationIssue } from '../types';
export type PIILocale = 'us' | 'de' | 'all';
export interface SecurityValidationConfig {
    detectPHI: boolean;
    detectSensitiveIdentifiers: boolean;
    requireSecurityLabels: boolean;
    validateAuditTrail: boolean;
    piiLocale: PIILocale;
    customPatterns?: {
        pattern: string;
        name: string;
        severity: 'warning' | 'info';
    }[];
}
export interface PHIDetectionResult {
    found: boolean;
    type: string;
    path: string;
    preview?: string;
}
export declare class SecurityValidator {
    private config;
    constructor(config?: Partial<SecurityValidationConfig>);
    setConfig(config: Partial<SecurityValidationConfig>): void;
    /**
     * Validate a resource for security concerns.
     *
     * Each sub-check (PHI detection, sensitive identifiers, security labels,
     * audit trail, custom patterns) is wrapped in its own try/catch so a
     * single failing check does not silently mask the other checks. Any
     * failure is promoted to a `security-validator-error` issue so the caller
     * knows a check was skipped — the previous behaviour only logged the
     * error, which could hide real PHI-detection failures from reviewers.
     */
    validate(resource: any): ValidationIssue[];
    /**
     * Run one security sub-check and promote any thrown error to a
     * `security-validator-error` issue. The error is **not** swallowed — it
     * becomes visible in the validation result so reviewers know a check
     * was skipped.
     */
    private runSubCheck;
    private get checkUS();
    private get checkDE();
    private matchAny;
    private detectPHIInNarrative;
    private detectSensitiveIdentifiers;
    private validateSecurityLabels;
    private validateAuditTrail;
    private detectCustomPatterns;
}
export declare const securityValidator: SecurityValidator;
//# sourceMappingURL=security-validator.d.ts.map