/**
 * Telemetry Guardrails
 *
 * Lint-time guardrails to detect forbidden or high-cardinality attributes.
 *
 * NOTE: In the tiered telemetry architecture, the OTEL Collector handles
 * runtime filtering and sanitization. These guardrails are for:
 * - ESLint rules (static analysis)
 * - Development warnings (not enforcement)
 * - CI validation
 *
 * See obs/otel-collector/config-tiered.yaml for runtime enforcement.
 */
import type { Attributes } from '@opentelemetry/api';
/**
 * Guardrail violation types.
 */
export declare enum ViolationType {
    /** Attribute is forbidden in Tier 2 */
    FORBIDDEN_ATTRIBUTE = "forbidden_attribute",
    /** Attribute should be a resource attribute, not span attribute */
    RESOURCE_ONLY = "resource_only",
    /** Value contains forbidden pattern (JWT, API key, etc.) */
    FORBIDDEN_VALUE = "forbidden_value",
    /** Attribute value has too high cardinality */
    HIGH_CARDINALITY = "high_cardinality"
}
/**
 * Guardrail violation record.
 */
export interface GuardrailViolation {
    /** Type of violation */
    type: ViolationType;
    /** Attribute key that violated */
    attributeKey: string;
    /** Human-readable message */
    message: string;
    /** Severity level */
    severity: 'error' | 'warning';
}
/**
 * Mode for guardrail reporting.
 *
 * NOTE: Runtime filtering is handled by the OTEL Collector.
 * These modes are for lint-time/development feedback only.
 */
export declare enum GuardrailMode {
    /** Log violations as warnings (development) */
    WARN = "warn",
    /** Throw on violations (CI/strict mode) */
    STRICT = "strict"
}
/**
 * Options for guardrail validation.
 */
export interface GuardrailOptions {
    /** Reporting mode */
    mode: GuardrailMode;
    /** Whether to check for high-cardinality values */
    checkCardinality?: boolean;
    /** Maximum allowed cardinality for string values */
    maxCardinalityLength?: number;
}
/**
 * Validate span attributes against Tier 2 guardrails.
 *
 * This is for lint-time validation. Runtime filtering is handled by Collector.
 *
 * @param attributes - Attributes to validate
 * @param options - Guardrail options
 * @returns Array of violations found
 */
export declare function validateSpanAttributes(attributes: Attributes, options?: Partial<GuardrailOptions>): GuardrailViolation[];
/**
 * Validate metric labels against Tier 2 guardrails.
 *
 * @param labels - Metric labels to validate
 * @param options - Guardrail options
 * @returns Array of violations found
 */
export declare function validateMetricLabels(labels: Record<string, string | number | boolean>, options?: Partial<GuardrailOptions>): GuardrailViolation[];
/**
 * Report guardrail violations.
 *
 * NOTE: This is for development feedback only. Runtime filtering
 * is handled by the OTEL Collector.
 *
 * @param attributes - Attributes to check
 * @param options - Guardrail options
 * @throws Error in STRICT mode if violations found
 */
export declare function reportViolations(attributes: Attributes, options?: Partial<GuardrailOptions>): void;
/**
 * Check if an attribute key is allowed in Tier 2.
 * Convenience function for quick checks.
 *
 * @param key - Attribute key
 * @returns true if allowed
 */
export declare function isTier2Allowed(key: string): boolean;
/**
 * Check if an attribute should be hashed (by Collector).
 *
 * @param key - Attribute key
 * @returns true if should be hashed
 */
export declare function shouldHash(key: string): boolean;
/**
 * Get all forbidden attribute names (for documentation/linting).
 */
export declare function getForbiddenAttributes(): string[];
/**
 * Get all hashed attribute names (for documentation/linting).
 */
export declare function getHashedAttributes(): string[];
//# sourceMappingURL=guardrails.d.ts.map