/**
 * Server-side PII redaction scanner (backstop).
 *
 * Client agents are required to redact before sending (see the REDACTION MUST
 * clause in docs/developer/mcp/instructions.md), but we scan server-side too so
 * a submitter-side bug cannot leak PII. Hash-suffixed placeholders keep the
 * debug story intact: `<EMAIL:a3f9>` is stable within a single submission so
 * relationships stay legible.
 *
 * Two modes controlled by `REDACTION_MODE`:
 *   - "strip" (default): auto-strip with `redaction_applied=true` and hits logged.
 *   - "reject": respond 400 with `error=redaction_required` so the submitter can fix
 *     their scanner before the payload ever persists.
 */
export interface RedactionResult {
    title: string;
    body: string;
    error_message?: string;
    hits: string[];
    applied: boolean;
    fields_redacted: number;
}
/**
 * Shape-check a hash-suffixed placeholder so downstream redactors can
 * skip values that have already been sanitized (matches `<NAME:a3f9>` etc).
 */
export declare function isExistingPlaceholder(value: string): boolean;
/**
 * Hash-suffixed placeholder per the `hash_redaction_placeholders` todo.
 * Salt is per-submission so cross-submission correlation is prevented.
 */
export declare function makePlaceholder(label: "EMAIL" | "PHONE" | "TOKEN" | "UUID" | "PATH", matched: string, salt: string): string;
export declare function generateRedactionSalt(): string;
/**
 * Scan title/body/error_message for obvious PII leakage patterns and
 * return redacted versions plus a hit list. See docs/subsystems/agent_feedback_pipeline.md
 * for the full rule set.
 */
export declare function scanAndRedact(input: {
    title: string;
    body: string;
    error_message?: string;
    salt: string;
}): RedactionResult;
export type RedactionMode = "strip" | "reject";
export declare function redactionModeFromEnv(): RedactionMode;
//# sourceMappingURL=redaction.d.ts.map