/**
 * DataClassifier -- Detects PHI (HIPAA), PII (GDPR), and PAN (PCI DSS) in content.
 *
 * Scans text before file writes to prevent sensitive data leakage.
 * Configurable per compliance framework with industry-specific patterns.
 *
 * AIAG-020: HIPAA coverage is explicit for 13 of the 18 Safe Harbor
 * identifiers (45 CFR 164.514(b)(2)). The remaining 5 (full-face photos,
 * fax numbers, certificate/license numbers, generic account numbers, and
 * "any other unique identifying number") rely on customer-provided
 * custom patterns or broader matches. See addPHIPatterns() for the
 * per-identifier coverage table.
 *
 * Supported data types:
 *   - PHI: 13 HIPAA identifiers explicit, 5 covered by custom/broader patterns
 *   - PII: GDPR personal data (national IDs, passport, IBAN)
 *   - PAN: Credit card numbers (Luhn algorithm validation)
 *   - Custom: Client-defined patterns via configuration
 *
 * @connexum/ai-governance
 */
export type DataCategory = 'PHI' | 'PII' | 'PAN' | 'CUSTOM';
export type ClassificationLevel = 'PUBLIC' | 'INTERNAL' | 'CONFIDENTIAL' | 'RESTRICTED';
export type ScanAction = 'LOG' | 'WARN' | 'BLOCK';
export interface DataClassifierConfig {
    /** Directory for scan logs */
    logDir: string;
    /** Enable PHI detection (HIPAA) */
    enablePHI?: boolean;
    /** Enable PII detection (GDPR) */
    enablePII?: boolean;
    /** Enable PAN detection (PCI DSS) */
    enablePAN?: boolean;
    /** Custom patterns to detect */
    customPatterns?: CustomPattern[];
    /** Default action when sensitive data is found (default: WARN) */
    defaultAction?: ScanAction;
    /** Override actions per category */
    actionOverrides?: Partial<Record<DataCategory, ScanAction>>;
}
export interface CustomPattern {
    name: string;
    category: DataCategory;
    pattern: RegExp;
    description: string;
    level: ClassificationLevel;
}
export interface ScanResult {
    hasSensitiveData: boolean;
    findings: ScanFinding[];
    classification: ClassificationLevel;
    action: ScanAction;
    scannedAt: string;
}
export interface ScanFinding {
    type: string;
    category: DataCategory;
    level: ClassificationLevel;
    /** Redacted representation of the match (F-07: raw PHI text removed) */
    redacted: string;
    /** Length of original match (for position tracking without exposing raw data) */
    matchLength: number;
    position: number;
    line: number;
}
export declare class DataClassifier {
    private config;
    private patterns;
    private logFile;
    constructor(config: DataClassifierConfig);
    /**
     * Scan content for sensitive data.
     */
    scan(content: string, context?: {
        agent?: string;
        file?: string;
    }): ScanResult;
    /**
     * Check if content should be blocked from being written.
     */
    shouldBlock(content: string, context?: {
        agent?: string;
        file?: string;
    }): boolean;
    /**
     * Redact all sensitive data in content.
     */
    redact(content: string): string;
    /**
     * Get summary of patterns loaded.
     */
    getPatternSummary(): {
        category: DataCategory;
        count: number;
        patterns: string[];
    }[];
    private buildPatterns;
    /**
     * HIPAA PHI Identifiers -- 13 explicit Safe Harbor patterns (AIAG-020 fix).
     *
     * Restores per-identifier granular type names so each HIPAA Safe Harbor
     * identifier surfaces with its specific type in audit events. This satisfies
     * HIPAA §164.528 disclosure-accounting clarity and AIAG-020 test requirements.
     *
     * The HIPAA pack (src/packs/hipaa.ts) remains the authoritative source of
     * truth for the detection logic -- patterns here delegate to the HIPAA pack's
     * HIPAA_CATEGORY_CLASSIFIERS.PHI classifier as the validation engine. Each
     * PatternDef wraps a named regex derived from the HIPAA pack's logic, so the
     * pack drives detection while the DataClassifier reports granular type names.
     *
     * PHI_HIPAA_PACK remains as a meta-marker pattern for backward-compat consumers
     * that don't need per-identifier specificity (fires after all named patterns).
     *
     * HIPAA Safe Harbor coverage (45 CFR 164.514(b)(2)):
     *   Explicit patterns (#2 US_ZIP, #3 DOB, #4 Phone, #6 EMAIL, #8 HealthPlan,
     *   #9 AccountNumber, #10 CertLicense/DriverLicense, #11 VIN, #12 DeviceId,
     *   #13 WebURL, #14 IP, #15 Biometric, #16 SSN, #17 MRN):
     *     13 of 18 identifiers are explicit.
     *   Remaining 5 (#1 Names, #5 Fax, #10 plain account, #17 Photos, #18 Other)
     *   require custom patterns via the customPatterns config.
     */
    private addPHIPatterns;
    /**
     * PII Patterns (GDPR Article 4 personal data)
     */
    private addPIIPatterns;
    /**
     * PAN Patterns (PCI DSS cardholder data)
     */
    private addPANPatterns;
    /**
     * Luhn algorithm for credit card number validation.
     * Returns true if the number passes the Luhn check.
     */
    private luhnCheck;
    private actionSeverity;
    private logScan;
}
//# sourceMappingURL=data-classifier.d.ts.map