/**
 * L7: Output Filter
 *
 * Prevents sensitive data leakage by:
 * - Detecting and masking PII (emails, phone numbers, SSN, credit cards)
 * - Filtering sensitive fields from responses
 * - Blocking responses that contain secrets or credentials
 * - Applying role-based output filtering
 */
import { GuardLogger } from "../types";
export interface OutputFilterConfig {
    detectPII?: boolean;
    piiPatterns?: PIIPattern[];
    sensitiveFields?: string[];
    detectSecrets?: boolean;
    secretPatterns?: SecretPattern[];
    roleFilters?: Record<string, string[]>;
    maskingChar?: string;
    logger?: GuardLogger;
    preserveLength?: boolean;
}
export interface PIIPattern {
    name: string;
    pattern: RegExp;
    maskAs?: string;
    /** Optional secondary check a regex match must also pass (e.g. Luhn checksum). */
    validate?: (matchedText: string) => boolean;
}
export interface SecretPattern {
    name: string;
    pattern: RegExp;
    severity: "low" | "medium" | "high" | "critical";
}
export interface OutputFilterResult {
    allowed: boolean;
    reason?: string;
    violations: string[];
    pii_detected: PIIDetection[];
    secrets_detected: SecretDetection[];
    filtered_fields: string[];
    original_response?: any;
    filtered_response?: any;
    blocking_reason?: string;
}
export interface PIIDetection {
    type: string;
    count: number;
    masked: boolean;
    locations: string[];
}
export interface SecretDetection {
    type: string;
    severity: string;
    blocked: boolean;
    location: string;
}
export declare class OutputFilter {
    private config;
    private logger;
    private defaultPIIPatterns;
    private defaultSecretPatterns;
    private defaultSensitiveFields;
    constructor(config?: OutputFilterConfig);
    private buildScanVariants;
    /**
     * Filter output and detect sensitive data
     */
    filter(output: any, role?: string, requestId?: string): OutputFilterResult;
    /**
     * Quick check if output contains any sensitive data
     */
    containsSensitiveData(output: any): boolean;
    /**
     * Mask a specific value
     */
    mask(value: string, type?: string): string;
    private filterObject;
    private maskPIIInString;
    private generateMask;
    private findLocations;
}