/**
 * Tier 2 Traces Contract
 *
 * This file defines the Tier 2 telemetry contract:
 * - Forbidden attributes (removed by Collector)
 * - Hashed attributes (pseudonymized by Collector)
 * - Dropped attributes (removed by Collector)
 * - Forbidden value patterns (for lint-time detection)
 *
 * ENFORCEMENT: The OTEL Collector handles runtime enforcement.
 * These definitions are used for:
 * - ESLint rules (static analysis at CI time)
 * - Development warnings (guardrails.ts)
 * - Collector config generation
 *
 * See: obs/otel-collector/config-tiered.yaml
 * Source of truth: engineering/projects/o11y-refactor/contracts/tier2-traces.v0.3.0.json
 */
/**
 * Attributes that are FORBIDDEN in Tier 2 telemetry.
 * These contain sensitive data that should never leave the customer's environment.
 * The Collector strips these entirely (not hashed, not present in Tier 2).
 */
export declare const TIER2_FORBIDDEN_ATTRIBUTES: Set<string>;
/**
 * Attributes that should be HASHED (pseudonymized) in Tier 2 telemetry.
 * The Collector replaces these with SHA256 hashes for privacy.
 * Hashes enable aggregate analysis without exposing plaintext identifiers.
 *
 * Mapping:
 *   user-email, user.email, etc. → user.hash
 *   organization-id, organization_id → organization.hash
 *   application-id, application_id → application.hash
 *   session.id → session.hash
 *   enduser.id → enduser.pseudo.id
 */
export declare const TIER2_HASHED_ATTRIBUTES: Set<string>;
/**
 * Attributes that should be DROPPED entirely in Tier 2.
 * These are correlation IDs that don't provide operational value.
 */
export declare const TIER2_DROPPED_ATTRIBUTES: Set<string>;
/**
 * Spans that should ALWAYS be sampled (never dropped by rate limiting).
 */
export declare const ALWAYS_SAMPLE_SPANS: Set<string>;
/**
 * Patterns that indicate forbidden content in attribute values.
 * Used for secondary filtering when attribute names aren't explicit.
 *
 * IMPORTANT: Patterns should NOT use ^ and $ anchors so they match
 * secrets embedded anywhere in a string (e.g., in query params, headers).
 */
export declare const FORBIDDEN_VALUE_PATTERNS: RegExp[];
/**
 * Check if an attribute name is forbidden in Tier 2.
 */
export declare function isForbiddenAttribute(name: string): boolean;
/**
 * Check if an attribute should be hashed in Tier 2.
 */
export declare function isHashedAttribute(name: string): boolean;
/**
 * Check if an attribute should be dropped in Tier 2.
 */
export declare function isDroppedAttribute(name: string): boolean;
/**
 * Check if a value contains forbidden patterns (like tokens, keys).
 */
export declare function containsForbiddenPattern(value: unknown): boolean;
/**
 * Check if a span should always be sampled.
 */
export declare function shouldAlwaysSample(spanName: string): boolean;
//# sourceMappingURL=tier2-traces.d.ts.map