/**
 * safety-scanner — L2 enforcement layer for agent-emitted content and commands.
 *
 * The wizard relies on prompt-level "commandments" (`src/lib/commandments.ts`)
 * to instruct the model not to hardcode secrets, run destructive shell
 * commands, etc. — that's L0. Models occasionally violate L0. This module
 * adds an L2 regex layer that runs as a hook on every Write/Edit (content)
 * and Bash (command) tool use, so the wizard catches violations the
 * commandments missed.
 *
 * Scope of v1:
 *   - {@link scanWriteContentForSecrets}: scan Write/Edit content for
 *     hardcoded Amplitude API keys and OAuth-shaped JWTs. Match → emit a
 *     PostToolUse `additionalContext` that nudges the model to revert and
 *     use an env-var pattern. Does not block the write (it already
 *     happened); the goal is self-correction on the next turn.
 *
 *   - {@link scanBashCommandForDestructive}: scan Bash commands for the
 *     specific destructive patterns the wizard never wants to run
 *     (rm -rf on broad paths, git reset --hard, force-push, broad
 *     git checkout/restore/clean). Match → emit a PreToolUse `deny` with a
 *     specific "this is destructive, abandon this path" message instead of
 *     the generic "command not in allowlist" deny from `wizardCanUseTool`.
 *     The specific message stops the model from looping through rephrased
 *     variants of the same destructive intent.
 *
 * Fail-closed: callers should treat a thrown exception as a block
 * decision. Regex compilation is at module load, so runtime exceptions
 * here would only come from pathological input (e.g. enormous strings
 * exceeding regex backtracking budget) — and on those, blocking is the
 * right call.
 */
/**
 * A safety rule matched against agent-emitted content. Each rule has a
 * stable identifier so analytics can aggregate violations by rule
 * regardless of message wording, and a human-readable message that's
 * forwarded to the model on a match.
 */
export interface SafetyRule {
    /** Stable rule ID — analytics key. lowercase-with-spaces to match the
     *  wider analytics convention (see CLAUDE.md). */
    id: string;
    /** Short label for log output. */
    label: string;
    /** Pattern to match against the input. */
    pattern: RegExp;
    /** Message surfaced to the model on a match. Should describe what was
     *  matched and what the model should do instead. */
    message: string;
}
export interface ScanResult {
    matched: boolean;
    rule?: SafetyRule;
}
/**
 * Scan Write/Edit content for hardcoded secrets. Returns the first matched
 * rule, or `{ matched: false }` if no rule fires.
 *
 * Returning the FIRST match (not all matches) keeps the model-facing
 * message focused on one fix — telling the agent it has three problems at
 * once tends to produce sprawling un-targeted edits.
 */
export declare function scanWriteContentForSecrets(content: string): ScanResult;
/**
 * Scan a Bash command for destructive patterns. Returns the first matched
 * rule, or `{ matched: false }` if no rule fires.
 */
export declare function scanBashCommandForDestructive(command: string): ScanResult;
export declare const __INTERNAL_RULES: {
    secrets: SafetyRule[];
    destructiveBash: SafetyRule[];
};
