import { type ParseOptions } from './parsers/typescript-parser.js';
import type { Finding, SymbolRecord } from './types.js';
import type { LlmClient } from './adapters/llm.js';
export interface RotHunterRunOptions extends ParseOptions {
    /** Drop a finding below `severity:'low'` when post-LLM confidence falls under this threshold. */
    llmRejectionThreshold?: number;
    /** Override the LLM client (tests, alternative model pools). Production uses the default LlmClient. */
    llm?: LlmClient;
    /**
     * Optional allow-list of detector ids. When set, findings from detectors
     * outside this list are dropped BEFORE the LLM confirmation pass — the
     * caller will never see them in the report, so the LLM cost is wasted.
     * Mirrors the `--detectors` CLI flag.
     */
    detectorsAllow?: Set<string>;
    /** Optional deny-list of detector ids — mirrors `--no-detectors`. */
    detectorsDeny?: Set<string>;
    /**
     * Number of LLM verdicts in flight at once. 1 = sequential
     * (original behaviour, safe). 4-8 is a good default on llama.cpp run
     * with `--parallel N -cb` (continuous batching) or on vLLM (dynamic
     * batching is on by default).
     *
     * Defaults to `ROTHUNTER_LLM_CONCURRENCY` env var, then 1.
     */
    llmConcurrency?: number;
    /**
     * Confidence floor at which a negative LLM verdict routes a finding
     * into the auto-FP bucket. Defaults to `LLM_FP_THRESHOLD` (0.6) — set
     * lower to be more aggressive (almost every "intentional" LLM call
     * auto-FPs) or higher (only very-confident verdicts route, the rest
     * stay open at degraded confidence).
     */
    llmAutoFpThreshold?: number;
    /**
     * Optional callback invoked at scan checkpoints. Used by the rothunter
     * HTTP server to stream live progress over SSE. Never throws — exceptions
     * inside the callback are caught and logged.
     */
    onProgress?: (event: ScanProgressEvent) => void;
    /**
     * Optional cooperative cancellation. The orchestrator checks
     * `abortSignal.aborted` between LLM verdict tasks and aborts the
     * worker pool when the signal fires. Used by the HTTP server's
     * /api/scans/:scanId/cancel endpoint to free the scan slot promptly
     * instead of relying on the (lossy) "throw inside onProgress" path.
     */
    abortSignal?: AbortSignal;
}
export type ScanProgressEvent = {
    state: 'parsing';
    files?: number;
    symbols?: number;
} | {
    state: 'detecting';
    detector: string;
} | {
    state: 'llm-start';
    total: number;
} | {
    state: 'llm-verdict';
    done: number;
    total: number;
    detectorId: string;
    race: boolean;
    confidence: number;
    reason: string;
    latencyMs: number;
    cluster?: string;
} | {
    state: 'done';
    findings: number;
    durationMs: number;
};
export interface RotHunterResult {
    symbols: SymbolRecord[];
    findings: Finding[];
    durationMs: number;
}
export declare class RotHunter {
    private parser;
    private normalizer;
    private detectors;
    run(opts: RotHunterRunOptions): Promise<RotHunterResult>;
    private runLlmConfirmation;
}
/**
 * Apply a "cluster-style" LLM verdict to a finding. Used for the four
 * detectors whose LLM confirmer returns a positive/negative boolean
 * with a confidence: api-race / shared-db-write / race-condition (race
 * vs safe) and mutation (bug-shaped vs intentional — caller maps
 * `!intentional` to `positive`). Shared body keeps the score/severity/
 * description bookkeeping in one place. Duplicate-type / duplicate-
 * function use a different formula (1 - conf) and stay inline.
 */
export declare function applyClusterVerdict(finding: Finding, verdict: {
    positive: boolean;
    confidence: number;
    reason: string;
}, opts: {
    threshold: number;
    positiveLabel: string;
    negativeLabel: string;
    /** Auto-FP routing floor. Defaults to LLM_FP_THRESHOLD (0.6). */
    autoFpThreshold?: number;
}): void;
/**
 * Verdict-confidence floor at which a negative LLM verdict moves a
 * finding into the auto-FP bucket. Set low (0.6) so any reasonably
 * confident "intentional / FP" verdict routes the finding out of the
 * open list — the operator's stated preference is "if the LLM says
 * FP, treat it as auto FP, I'll un-mark if it's wrong". Below 0.6 the
 * LLM is genuinely undecided and the deterministic finding stays in
 * the open list at degraded confidence.
 */
export declare const LLM_FP_THRESHOLD = 0.6;
/**
 * Build per-detector structural context to attach to a TriageConfirmer
 * call. The shape is free-form text — the LLM reads it alongside the
 * primary evidence snippet — so we can evolve enrichment without
 * version-coupling the triage schema. Returns `undefined` when no
 * useful context is available so the prompt stays compact.
 */
export declare function buildTriageContext(finding: Finding, symbolById: Map<string, SymbolRecord>, workspaceRoot?: string): string | undefined;
//# sourceMappingURL=rothunter.d.ts.map