/**
 * Confidentiality gate for vault writes.
 *
 * Secrets (tokens, keys, passwords) are never allowed into a vault: the
 * write is refused and the pattern that matched is named — never the
 * value. PII (emails, phone numbers) is governed per vault by the
 * `privacy:` block in SCHEMA.md: a personal vault refuses or masks
 * inbound customer detail, an enterprise vault holds customer data by
 * design and the rule flips to "mask on the way out" (visibility).
 *
 * @module services/wiki/wiki-redaction
 */
/** A detector: name + regex; `mask` is what replaces a match when masking. */
export interface RedactionPattern {
    name: string;
    regex: RegExp;
    mask: string;
}
/** Secret detectors — always enforced, never configurable off. */
export declare const SECRET_PATTERNS: readonly RedactionPattern[];
/** PII detectors — enforced per the vault's `privacy:` policy. */
export declare const PII_PATTERNS: readonly RedactionPattern[];
/** What the vault wants done with PII on the way in. */
export type PiiMode = 'allow' | 'mask' | 'refuse';
/** Privacy policy of a vault (SCHEMA.md `privacy:` block; defaults shown). */
export interface VaultPrivacyPolicy {
    /** `allow` (enterprise KB: customer data is the content), `mask`, or `refuse` (personal KB). Default `allow`. */
    pii: PiiMode;
}
/** Outcome of scanning a body. */
export interface RedactionScan {
    /** Names of secret patterns that matched (values are never returned). */
    secrets: string[];
    /** Names of PII patterns that matched. */
    pii: string[];
}
/**
 * Scan text for secrets and PII without altering it.
 *
 * @param text - Body to scan
 * @returns Which pattern names matched
 */
export declare function scanForSensitive(text: string): RedactionScan;
/**
 * Replace every secret match with its mask (and PII when asked). Used for
 * archives and outbound copies where the text must survive but the values
 * must not.
 *
 * @param text - Body
 * @param includePii - Also mask PII
 * @returns Masked text
 */
export declare function redactSensitive(text: string, includePii?: boolean): string;
/** Result of applying a vault's policy to an inbound body. */
export type PrivacyGateResult = {
    ok: true;
    body: string;
    masked: string[];
} | {
    ok: false;
    reason: 'secret_detected' | 'pii_refused';
    patterns: string[];
    message: string;
};
/**
 * Apply the confidentiality gate to a body about to be written.
 * Secrets always refuse; PII follows `policy.pii`.
 *
 * @param body - Text to write
 * @param policy - The vault's privacy policy
 * @returns The (possibly masked) body, or a refusal naming the patterns
 */
export declare function applyPrivacyGate(body: string, policy: VaultPrivacyPolicy): PrivacyGateResult;
//# sourceMappingURL=wiki-redaction.d.ts.map