/**
 * OutputGuard (L35)
 *
 * Detects dangerous payloads in LLM/tool output *before* it reaches a
 * downstream sink (browser/DOM, SQL engine, OS shell, markdown renderer,
 * spreadsheet/CSV importer). This closes OWASP **LLM05:2025 — Improper Output
 * Handling**, which the existing OutputFilter (PII/secret egress) does not cover.
 *
 * > "Treat model output as untrusted input to the next system."
 *
 * This is a CONTENT guard — it inspects the text the model produced, not the
 * user input. It does not understand intent; it flags syntactic payloads that
 * are dangerous when interpolated unescaped into a downstream interpreter.
 *
 * Threat Model (sinks):
 * - HTML/DOM   → stored/reflected XSS (<script>, javascript:, on*= handlers)
 * - SQL        → second-order SQL injection (UNION SELECT, ' OR 1=1, ;DROP)
 * - OS shell   → command injection ($(...), backticks, ; rm, curl | bash)
 * - Markdown   → data exfiltration via auto-fetched images (![](https://x?=DATA))
 * - Spreadsheet→ CSV/formula injection (cells starting =,+,-,@ with HYPERLINK/cmd)
 *
 * Maps to: OWASP LLM05:2025, OWASP ASI02:2026 (Tool Misuse), CWE-79/89/78/1236.
 * Refs: https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/
 *       https://arxiv.org/abs/2507.13169 (Prompt Injection 2.0)
 */
import { GuardLogger } from "../types";
export type OutputSink = "html" | "sql" | "shell" | "markdown" | "csv";
export interface OutputGuardConfig {
    /** Detect HTML/DOM XSS payloads (default: true) */
    detectHtml?: boolean;
    /** Detect SQL injection payloads (default: true) */
    detectSql?: boolean;
    /** Detect OS shell / command injection payloads (default: true) */
    detectShell?: boolean;
    /** Detect markdown-image data-exfiltration links (default: true) */
    detectMarkdownExfil?: boolean;
    /** Detect spreadsheet/CSV formula injection (default: true) */
    detectCsvFormula?: boolean;
    /**
     * Domains allowed in markdown image/link URLs. When set, external URLs whose
     * host is not in this list are flagged. Empty (default) = only flag image
     * URLs that carry a query string (the exfil signal).
     */
    allowedDomains?: string[];
    /** Additional regex patterns to flag (treated as "high" severity) */
    blockedPatterns?: string[];
    /** Risk score (0-1) at or above which output is blocked (default: 0.7) */
    riskThreshold?: number;
    /** Return a neutralized copy of the output in `sanitized` (default: false) */
    sanitize?: boolean;
    /** Logger */
    logger?: GuardLogger;
}
export interface OutputThreat {
    sink: OutputSink | "custom";
    type: string;
    detail: string;
    severity: "low" | "medium" | "high" | "critical";
}
export interface OutputGuardResult {
    allowed: boolean;
    reason?: string;
    violations: string[];
    riskScore: number;
    threats: OutputThreat[];
    /** Present only when config.sanitize is true */
    sanitized?: string;
}
export declare class OutputGuard {
    readonly guardName = "OutputGuard";
    readonly guardLayer = "L35";
    private config;
    constructor(config?: OutputGuardConfig);
    /**
     * Scan model/tool output for downstream-sink payloads.
     * @param output the text produced by the model (or a tool result)
     */
    scan(output: string): OutputGuardResult;
    private match;
    /**
     * "`$(cmd)`" (a $() substitution wrapped in backticks — the standard way to
     * show inline shell syntax in markdown/docs, e.g. "In bash, `$(date)`
     * returns...") independently matches BOTH the backtick pattern and the
     * $(...) pattern, double-counting one syntactic construct as two "high"
     * (0.45 each) threats that sum to 0.9 and cross the 0.7 block threshold —
     * an ordinary shell-syntax doc mention shouldn't auto-block. If every
     * $(...) occurrence in the output falls entirely inside a backtick span,
     * drop the redundant $(...) threat and keep only the backtick one (a
     * standalone $(...) with no backtick wrapping anywhere in the output is
     * unaffected and still counted normally).
     */
    private dedupeNestedShellSubstitution;
    private detectMarkdownExfil;
    private detectCsvFormula;
    /** Best-effort lowercase host extraction without the URL constructor (zero-dep, never throws) */
    private hostOf;
    private computeRiskScore;
    private buildReason;
    /** Opt-in neutralization: strip script tags and prefix CSV formula cells with a quote */
    private neutralize;
}