/**
 * Scanner Types and Interfaces
 * Defines the core data structures for the security scanning engine
 */
export type VulnerabilitySeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
export type VulnerabilityCategory = 'hardcoded_secret' | 'high_entropy_string' | 'sensitive_variable' | 'security_bypass' | 'dangerous_function' | 'sql_injection' | 'xss' | 'command_injection' | 'insecure_config' | 'missing_auth' | 'suspicious_package' | 'cors_misconfiguration' | 'root_container' | 'dangerous_file' | 'ai_pattern' | 'sensitive_url' | 'weak_crypto' | 'data_exposure' | 'ai_prompt_injection' | 'ai_unsafe_execution' | 'ai_overpermissive_tool' | 'ai_rag_exfiltration' | 'ai_endpoint_unprotected' | 'ai_schema_mismatch' | 'ai_package_hallucination' | 'ai_rag_corpus_poisoning' | 'ai_rag_pii_leakage' | 'ai_mcp_tool_poisoning' | 'ai_mcp_credential_issue' | 'ai_mcp_confused_deputy' | 'ai_mcp_description_injection' | 'ai_mcp_server_shadowing' | 'ai_mcp_config_secrets' | 'ai_mcp_config_permissions' | 'ai_rag_query_injection' | 'ai_rag_embedding_poisoning' | 'ai_rag_chunk_injection' | 'ai_package_typosquat' | 'ai_package_malicious' | 'ai_unsafe_model_load' | 'ai_unverified_model' | 'ai_unsafe_finetuning' | 'ai_excessive_agency' | 'ai_skill_injection' | 'missing_security_headers' | 'ssrf' | 'log_injection' | 'xxe';
export type ValidationStatus = 'confirmed' | 'downgraded' | 'dismissed' | 'not_validated';
export interface Vulnerability {
    id: string;
    filePath: string;
    lineNumber: number;
    lineContent: string;
    severity: VulnerabilitySeverity;
    category: VulnerabilityCategory;
    title: string;
    description: string;
    suggestedFix?: string;
    confidence: 'high' | 'medium' | 'low';
    /** @deprecated Use `source` instead. Kept for backward compatibility. */
    layer: 1 | 2 | 3;
    /** Which detector group produced this finding */
    source?: 'secrets' | 'structural' | 'ai_code' | 'config' | 'validation';
    requiresAIValidation?: boolean;
    validatedByAI?: boolean;
    validationStatus?: ValidationStatus;
    validationNotes?: string;
    originalSeverity?: VulnerabilitySeverity;
    impact?: string;
    evidence?: string;
    fixSteps?: string[];
    references?: string[];
    aiEnhanced?: boolean;
    /** Base confidence score (0.0-1.0) set by the detector. Used by scoring stage. */
    baseConfidence?: number;
}
/**
 * Cancellation token for aborting scans gracefully
 * Allows users to stop long-running scans (Ctrl+C) and get partial results
 */
export interface CancellationToken {
    /** Whether cancellation has been requested */
    cancelled: boolean;
    /** Reason for cancellation (e.g., "User pressed Ctrl+C") */
    reason?: string;
    /** Request cancellation */
    cancel(reason?: string): void;
    /** Register cleanup callback to run when cancelled */
    onCancel(callback: () => void): void;
}
/**
 * Create a new cancellation token
 *
 * @example
 * const token = createCancellationToken()
 * process.on('SIGINT', () => token.cancel('User interrupted'))
 * const result = await runScan(files, repo, { cancellationToken: token })
 */
export declare function createCancellationToken(): CancellationToken;
export interface ScanFile {
    path: string;
    content: string;
    language: string;
    size: number;
}
export interface SeverityCounts {
    critical: number;
    high: number;
    medium: number;
    low: number;
    info: number;
}
export type CategoryCounts = Partial<Record<VulnerabilityCategory, number>>;
/** Summary of a suppressed vulnerability (for --show-suppressed output) */
export interface SuppressedVulnerabilitySummary {
    /** Finding hash */
    hash: string;
    /** File path */
    filePath: string;
    /** Line number */
    lineNumber: number;
    /** Vulnerability category */
    category: VulnerabilityCategory;
    /** Severity */
    severity: VulnerabilitySeverity;
    /** Title */
    title: string;
    /** How it was suppressed */
    suppressionType: 'inline' | 'config-finding' | 'config-rule';
    /** Reason for suppression */
    suppressionReason: string;
    /** Expiration date (if any) */
    expires?: string;
}
export interface ScanResult {
    repoName: string;
    repoUrl: string;
    branch: string;
    filesScanned: number;
    filesSkipped: number;
    vulnerabilities: Vulnerability[];
    severityCounts: SeverityCounts;
    categoryCounts: CategoryCounts;
    hasBlockingIssues: boolean;
    scanDuration: number;
    timestamp: string;
    validationStats?: {
        totalFindings: number;
        validatedFindings: number;
        confirmedFindings: number;
        dismissedFindings: number;
        downgradedFindings: number;
        autoDismissedFindings: number;
        estimatedInputTokens: number;
        estimatedOutputTokens: number;
        estimatedCost: number;
        apiCalls: number;
        cacheCreationTokens: number;
        cacheReadTokens: number;
        cacheHitRate: number;
    };
    cancelled?: boolean;
    cancelReason?: string;
    suppressionStats?: {
        /** Total findings before suppression */
        total: number;
        /** Findings suppressed by inline comments */
        inlineSuppressed: number;
        /** Findings suppressed by config (finding hash) */
        configFindingSuppressed: number;
        /** Findings suppressed by config (rule) */
        configRuleSuppressed: number;
        /** Findings that would have been suppressed but suppression expired */
        expired: number;
    };
    /** Suppressed vulnerabilities (when --show-suppressed is used) */
    suppressedVulnerabilities?: SuppressedVulnerabilitySummary[];
    baselineDiff?: {
        /** When the baseline was created */
        baselineCreatedAt: string;
        /** Git commit of the baseline (if available) */
        baselineCommit?: string;
        /** Number of new findings (not in baseline) */
        newCount: number;
        /** Number of fixed findings (in baseline, not in current) */
        fixedCount: number;
        /** Number of existing findings (in both) */
        existingCount: number;
        /** Details of fixed findings for display */
        fixedFindings: Array<{
            hash: string;
            filePath: string;
            lineNumber: number;
            category: string;
            severity: string;
            title: string;
        }>;
    };
    /** Filter audit trail (when includeFilterAudit option is enabled) */
    filterAuditTrail?: import('../postprocess/filtering/pipeline').AnnotatedFinding[];
}
export interface ScanProgress {
    status: 'fetching' | 'layer1' | 'layer2' | 'layer3' | 'validating' | 'complete' | 'failed';
    message: string;
    filesProcessed: number;
    totalFiles: number;
    vulnerabilitiesFound: number;
}
export type ProgressCallback = (progress: ScanProgress) => void;
export interface SecretPattern {
    name: string;
    pattern: RegExp;
    severity: VulnerabilitySeverity;
    description: string;
}
export interface ConfigRule {
    name: string;
    filePatterns: string[];
    check: (content: string, filePath: string) => ConfigViolation[];
}
export interface ConfigViolation {
    line: number;
    lineContent: string;
    message: string;
    severity: VulnerabilitySeverity;
}
export interface SensitiveVariablePattern {
    pattern: RegExp;
    severity: VulnerabilitySeverity;
    description: string;
}
export interface AIAnalysisRequest {
    filePath: string;
    content: string;
    context: string;
}
export interface AIFinding {
    lineNumber: number;
    lineContent: string;
    severity: VulnerabilitySeverity;
    category: VulnerabilityCategory;
    title: string;
    description: string;
    suggestedFix: string;
}
/**
 * DetectorContext provides rich context information to Layer 2 detectors
 * This allows detectors to make smarter decisions based on:
 * - Project-level auth configuration
 * - Framework detection
 * - Per-file context (server vs client, test vs production)
 */
export interface DetectorContext {
    auth: {
        /** Middleware configuration (if detected) */
        middleware: MiddlewareAuthContextSummary | null;
        /** Auth helpers detected in the project */
        authHelpers: AuthHelperContextSummary;
        /** Public endpoint patterns (health, webhook, etc.) */
        publicEndpoints: string[];
    };
    framework: {
        /** Primary backend framework detected */
        primary: 'nextjs' | 'express' | 'fastify' | 'koa' | 'hono' | 'nestjs' | 'django' | 'flask' | 'rails' | 'unknown' | null;
        /** Frontend framework detected */
        frontend: 'react' | 'vue' | 'svelte' | 'angular' | 'unknown' | null;
        /** Whether the project uses TypeScript */
        hasTypeScript: boolean;
    };
    dataAccess: {
        /** ORM/query builder detected */
        orm: 'prisma' | 'drizzle' | 'typeorm' | 'sequelize' | 'knex' | null;
        /** Whether RLS (Row-Level Security) is detected */
        hasRLS: boolean;
        /** Validation library detected */
        validationLib: 'zod' | 'yup' | 'joi' | 'valibot' | null;
    };
    file: {
        /** Whether this file is server-only (not bundled to client) */
        isServerOnly: boolean;
        /** Whether this file is client-bundled (exposed to browser) */
        isClientBundled: boolean;
        /** Whether this file is a test/mock/fixture file */
        isTestFile: boolean;
        /** Whether this file is a config file */
        isConfigFile: boolean;
        /** Whether this file is in a tooling directory */
        isToolingDir: boolean;
    };
}
/** Simplified middleware auth config for DetectorContext */
export interface MiddlewareAuthContextSummary {
    /** Whether auth middleware was detected */
    hasAuthMiddleware: boolean;
    /** The type of auth detected */
    authType: 'clerk' | 'nextauth' | 'auth0' | 'supabase' | 'custom' | 'unknown' | null;
    /** Protected path patterns */
    protectedPaths: string[];
    /** Public/excluded path patterns */
    publicPaths: string[];
}
/** Simplified auth helper context for DetectorContext */
export interface AuthHelperContextSummary {
    /** Whether the project has throwing auth helpers */
    hasThrowingHelpers: boolean;
    /** Names of throwing auth helpers */
    throwingHelperNames: string[];
}
/**
 * Create an empty/default DetectorContext
 * Useful for tests or when context isn't available
 */
export declare function createEmptyDetectorContext(): DetectorContext;
export declare const SCANNABLE_EXTENSIONS: string[];
export declare const SPECIAL_FILES: string[];
export declare const MAX_FILE_SIZE: number;
/**
 * Scan mode determines the depth and cost of the scan
 *
 * - full: Complete scan with AI validation on all files (initial onboarding, deep audits)
 * - incremental: Focused scan on changed files only (CI/CD, fast feedback)
 */
export type ScanMode = 'full' | 'incremental';
/**
 * Scan depth controls AI usage independent of full vs incremental mode
 *
 * - local: Layer 1 + Layer 2 only. No AI validation, no Layer 3.
 *          Only Tier A (core) findings are surfaced.
 *          Target: <5s for typical PR scans.
 *
 * - verified: Layer 1 + Layer 2 + AI validation on selected findings. No Layer 3.
 *             Tier A is surfaced directly, Tier B goes through AI validation.
 *             Target: <15s with <10 AI calls.
 *
 * - deep: Layer 1 + Layer 2 + AI validation + Layer 3 semantic analysis.
 *         Full analysis for initial onboarding or deep security audits.
 *         Target: Complete thoroughness, cost secondary.
 *
 * ## Workflow Profile Recommendations:
 *
 * | Workflow       | Default Depth | Rationale                            |
 * |----------------|---------------|--------------------------------------|
 * | GitHub PR      | local         | Fast feedback, high-signal findings  |
 * | VS Code        | verified      | Interactive, balance depth + speed   |
 * | CLI (default)  | local         | Fast local scans                     |
 * | CLI --deep     | deep          | Thorough analysis when requested     |
 * | Onboarding     | deep          | Full picture on first scan           |
 */
export type ScanDepth = 'local' | 'verified' | 'deep';
export interface ScanModeConfig {
    /** The scan mode */
    mode: ScanMode;
    /** For incremental scans: paths of changed files */
    changedFiles?: string[];
    /** For incremental scans: base commit/branch to diff against */
    baseBranch?: string;
    /** Whether to skip AI validation entirely (for very fast scans) */
    skipAIValidation?: boolean;
    /** Whether to skip Layer 3 deep analysis (reduces cost) */
    skipLayer3?: boolean;
    /** Maximum files to send to AI validation (cost control) */
    maxAIValidationFiles?: number;
    /** Maximum files for Layer 3 analysis (cost control) */
    maxLayer3Files?: number;
    /** Scan depth mode (cheap/validated/deep) - controls AI usage */
    scanDepth?: ScanDepth;
    /** Whether to exclude test files from scanning (default: true) */
    excludeTestFiles?: boolean;
    /** Whether to exclude seed files from scanning (default: true) */
    excludeSeedFiles?: boolean;
    /** Custom file path patterns to exclude (glob format) */
    customExclusions?: string[];
}
/**
 * Default configurations for each scan mode
 */
export declare const SCAN_MODE_DEFAULTS: Record<ScanMode, Partial<ScanModeConfig>>;
//# sourceMappingURL=types.d.ts.map