/**
 * Security Scanner Patterns - SMI-587, SMI-685, SMI-1189
 *
 * Pattern definitions for security scanning.
 */
export declare const DEFAULT_ALLOWED_DOMAINS: string[];
export declare const ANON_PASTE_HOSTS: string[];
export declare const TRANSIENT_TRANSFER_HOSTS: string[];
export declare const URL_SHORTENER_DOMAINS: string[];
export { ENV_PATH_PATTERN, SENSITIVE_PATH_PATTERNS, VALUE_GATED_KEYWORD_PATTERNS, PATH_FORM_PATTERNS, VALUE_GATED_ASSIGNMENT_PATTERNS, OBSERVE_ONLY_MEDIUM_PATTERNS, } from './patterns.sensitive-path.js';
export { JAILBREAK_PATTERNS, AI_DEFENCE_PATTERNS } from './patterns.jailbreak.js';
export { EVIDENCE_TYPE_BY_PATTERN } from './patterns.jailbreak.evidence.js';
/**
 * SMI-5876 §0.1/§0.2: bump on ANY pattern-array or evidence-table change in
 * this module, patterns.jailbreak.ts, or patterns.sensitive-path.ts (SMI-5207
 * moved the sensitive_path family there; the bump obligation moved with it).
 * The security-audit baseline
 * (packages/mcp-server/src/audit/security-baseline.ts /
 * security-audit.ts) stamps every stored entry with the version that
 * produced it and treats a mismatch as "not comparable" — forcing a re-scan
 * instead of silently reusing a stale verdict from a scanner that no longer
 * exists. Without this, the pattern/evidence-tier fix could not clear an
 * already-flagged skill's stale `malicious` baseline on any machine that had
 * scanned it before (see the security-audit.ts `comparable` gate).
 *
 * Bumped to `.2`: SMI-5876 design-pass follow-up added the `state_assertion`
 * evidence tier + 5 new JAILBREAK_PATTERNS entries (J-S1/S2/S3a/S3b/S4) and
 * widened #6 (bypass) + J-N1 in place — this is precisely the
 * previously-clean-content-now-fires scenario the ruleset-version gate
 * exists for.
 *
 * Bumped to `2026-07-29.1`: SMI-5881 P0 — AD_CRLF_INJECTION's source changed
 * (ReDoS fix, same match language, see patterns.jailbreak.ts) and 4
 * AI_DEFENCE_PATTERNS entries were promoted from 'line' to 'both' scope
 * (AD_HTML_COMMENT_VERB/NOUN, AD_NESTED_INSTRUCTION_BLOCK, AD_ZERO_WIDTH — new
 * cross-line matches now possible where none fired before), plus SSRF_
 * INSTRUCTION_PATTERNS word-boundary narrowing (some previously-firing
 * substring FPs, e.g. "budget to localhost", no longer match).
 *
 * Bumped to `2026-08-14.1`: SMI-6033 Wave 2 added four new standalone
 * detector/finding-type categories that did not exist under the prior
 * version — `gatekeeper_bypass` (xattr quarantine-attribute stripping,
 * SecurityScanner.compound.ts), `archive_evasion` (password-protected
 * archive extraction, SecurityScanner.archive.ts), `paste_host_fetch`
 * (anonymous paste/snippet-host fetch-and-execute, SecurityScanner.paste-
 * host.ts), and `encoded_payload` (base64 decode-and-recursive-rescan,
 * SecurityScanner.encoding.ts). Each is exactly the
 * previously-clean-content-now-fires scenario the ruleset-version gate
 * exists for: a skill whose bundled content or SKILL.md legitimately
 * contained an xattr troubleshooting snippet, a password-protected archive
 * step, a paste-host link, or a base64 blob scanned clean before this wave
 * and can now legitimately surface a new finding (up to standalone-critical
 * for the correlated/inline-secret/execution-correlated forms of the first
 * three) purely because new detection exists, not because the content
 * changed. A stored acceptance-baseline entry produced under
 * `2026-07-29.1` predates all four categories and is not comparable —
 * this bump forces the local MCP audit baseline to re-scan rather than
 * silently reuse it.
 *
 * Bumped to `2026-08-15.1`: SMI-6033 Wave 4 added a fifth standalone
 * detector/finding-type category, `decoy_misdirection` (a fetch target
 * whose domain doesn't match a vendor brand/authority claim made nearby in
 * the skill's own prose, SecurityScanner.decoy.ts), plus the
 * `IMPERATIVE_FETCH_EXEC_PROSE` pattern set (patterns.exec.ts — free-text
 * "download the installer from thisurl.com and run it" now emits a
 * `code_execution` medium finding where it previously matched nothing) and
 * replaced `CODE_EXECUTION_CO_OCCURRENCE` with `CO_SIGNAL_MIN_SEVERITY`
 * (SecurityScanner.exec.ts), whose new two-distinct-medium-signal path can
 * escalate a `code_execution` finding to critical on content that only ever
 * produced advisory-tier findings before. All three are the
 * previously-clean-content-now-fires scenario this gate exists for. Scope
 * note (unchanged from Wave 3): this forces re-evaluation of the local MCP
 * audit baseline only (this constant and its `comparable` consumer,
 * packages/mcp-server/src/audit/security-audit.ts:219-222); the edge indexer
 * never reads this constant, which is why it has no edge counterpart.
 * (SMI-5207 replaced a `patterns.ts:100-125` line-range citation here — that
 * range addressed the sensitive_path family, which moved to
 * patterns.sensitive-path.ts, so the numbers no longer resolve.)
 *
 * Bumped to `2026-09-07.1`: SMI-5207 added the MF-3 (path-form
 * action-context, negation-aware) and MF-4 (assignment-form value,
 * default-HIGH-unless-prose) severity gates. Unlike every bump above, this
 * one is *previously-flagged-content-now-clean* — without it, the
 * `comparable` gate keeps reusing a stored `malicious` verdict produced by
 * the pre-fix ruleset, and the fix never reaches an already-scanned skill.
 *
 * Bumped to `2026-09-09.1`: SMI-6441 added the MF-4b common-password veto on
 * the assignment-value 2-token documentation-label carve-out. Direction
 * note — unlike SMI-5207's bump immediately above (previously-flagged-
 * content-now-clean), this one is *previously-clean-now-flagged*: without
 * it, the `comparable` gate keeps reusing a stored clean verdict produced by
 * the pre-SMI-6441 ruleset and the tightening never reaches an
 * already-scanned skill.
 *
 * Bumped to `2026-09-10.1`: SMI-6505 added the embedded-key boolean-flag
 * carve-out to the MF-4 assignment-value gate (`allow_credentials=True`, a
 * FastAPI CORS flag, was scoring HIGH and blocking installation). Direction is
 * *previously-flagged-content-now-clean*, the same as SMI-5207's bump two
 * entries above and the opposite of SMI-6441's immediately above — so the bump
 * is load-bearing for exactly the reason stated there: without it the
 * `comparable` gate keeps reusing the stored pre-fix verdict, and an
 * already-scanned skill stays blocked even though the rule no longer flags it.
 * A severity-LOWERING change is the case where forgetting the bump is silent —
 * nothing fails, the fix simply never arrives.
 *
 * Bumped to `2026-09-11.1`: SMI-6508 added MF-5, a fifth severity class
 * (`OBSERVE_ONLY_MEDIUM_PATTERNS`, always MEDIUM) carrying the prefixed
 * `secrets` assignment form — `API_SECRETS=`, `app_secrets=`, `mySecrets=` and
 * the singular `API_SECRET=`, none of which the boundary-carrying
 * SECRETS_ASSIGN_PATTERN could ever match. Direction is
 * *previously-clean-content-now-flagged*, the same as SMI-6441's and the
 * opposite of SMI-6505's immediately above: content that produced no
 * `sensitive_path` finding can now produce a MEDIUM one purely because new
 * detection exists, not because the content changed. Without the bump the
 * `comparable` gate reuses the stored pre-MF-5 verdict and an already-scanned
 * skill never receives the new finding at all.
 *
 * Bumped to `2026-09-11.2`: SMI-6508 follow-up — MF-5's entry was moved to the
 * END of SENSITIVE_PATH_PATTERNS. It had shipped at index 4, and
 * scanSensitivePaths `break`s on the FIRST matching entry in array order, so an
 * always-MEDIUM entry ahead of 11 HIGH-capable ones SUPPRESSED them: `passed`
 * flipped false→true and the install block vanished (appending `# a_secrets:`
 * to a line was sufficient). Direction is *previously-clean-content-now-flagged*
 * again, but for a sharper reason than the entry above — this bump does not
 * merely deliver new detection, it INVALIDATES verdicts that `.1` computed
 * wrongly. A skill scanned under `2026-09-11.1` may carry a stored `passed:
 * true` that the suppression produced; without this bump the `comparable` gate
 * would keep serving it, so the evasion would survive in stored data even
 * though the code no longer permits it. Forgetting the bump here leaves a
 * security hole open, not just a fix undelivered.
 */
export declare const SCANNER_RULESET_VERSION: "2026-09-11.2";
export declare const SUSPICIOUS_PATTERNS: RegExp[];
export { CODE_EXECUTION_PATTERNS, IMPERATIVE_FETCH_EXEC_PROSE } from './patterns.exec.js';
export declare const SOCIAL_ENGINEERING_PATTERNS: RegExp[];
export declare const PROMPT_LEAKING_PATTERNS: RegExp[];
export declare const DATA_EXFILTRATION_PATTERNS: RegExp[];
export declare const CREDENTIAL_SUBSTITUTION_PATTERNS: RegExp[];
export declare const PRIVILEGE_ESCALATION_PATTERNS: RegExp[];
/**
 * SMI-3509: SSRF instruction patterns
 * Detects content instructing fetches to internal/dangerous endpoints.
 * These are text-oriented patterns for skill content scanning (not URL validators).
 *
 * SMI-5881: leading `\b` added to every verb alternation below — the verbs
 * (fetch/request/curl/wget/get/open/load/read/connect/send) previously had no
 * boundary, so they matched as a SUBSTRING of an unrelated word ("get" inside
 * "budget"/"target"/"forget"/"widget", "connect" inside "disconnect", "load"
 * inside "download"/"reload", "open" inside "reopen", "read" inside
 * "bread"/"spread"/"thread"). A trailing `\b` was also added after the bare
 * `localhost` literal (both the single-line and multiline forms) so
 * "localhosting" no longer matches via a "localhost" prefix. Every existing
 * `\s` quantifier is unchanged — replacing them with newline-exclusive classes
 * was tried and reverted (breaks a verb+target split across a real line
 * break, a real evasion). See scanner-ssrf-word-boundary.test.ts.
 */
export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
/**
 * SMI-3864: PII detection patterns
 * Detects personally identifiable information and credentials in skill content.
 * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
 */
export declare const PII_PATTERNS: RegExp[];
//# sourceMappingURL=patterns.d.ts.map