import type { EvaluationResult } from '../aws/iam';
import type { CallerIdentity } from '../aws/sts';
import type { JsonValue } from '../control-plane';
import type { SecurityPostureStore } from './posture-store';
import type { PreDeployScanner } from './pre-deploy-scanner';
import type { SecurityCheckStatus, SecurityFindingInput, SecurityScope } from './types';
export interface SecurityScannerContext extends SecurityScope {
    artifactRoot?: string;
    imageRef?: string;
    signal: AbortSignal;
}
export interface SecurityScannerResult {
    status: SecurityCheckStatus;
    findings: SecurityFindingInput[];
    metadata?: JsonValue;
    error?: string;
}
export interface SecurityScanner {
    id: string;
    version: string;
    timeoutMs?: number;
    scan: (context: SecurityScannerContext) => Promise<SecurityScannerResult>;
}
export interface SecurityScannerRunnerOptions {
    defaultTimeoutMs?: number;
    now?: () => Date;
}
export declare class SecurityScannerRunner {
    private readonly posture;
    private readonly defaultTimeoutMs;
    private readonly nowFn;
    constructor(posture: SecurityPostureStore, options?: SecurityScannerRunnerOptions);
    run(scanner: SecurityScanner, scope: Omit<SecurityScannerContext, 'signal'>): Promise<ReturnType<SecurityPostureStore['recordScan']>>;
    runAll(scanners: SecurityScanner[], scope: Omit<SecurityScannerContext, 'signal'>): Promise<Array<ReturnType<SecurityPostureStore['recordScan']>>>;
}
export declare class SecretFindingScanner implements SecurityScanner {
    private readonly scanner;
    readonly id = "source-secrets";
    readonly version = "1.0.0";
    readonly timeoutMs = 30000;
    constructor(scanner?: PreDeployScanner);
    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
}
/** Runs Trivy locally with a deliberately minimal environment and never uploads source or reports. */
export declare class TrivyImageScanner implements SecurityScanner {
    readonly id = "trivy-image";
    readonly version: string;
    readonly timeoutMs: number;
    constructor(options?: {
        version?: string;
        timeoutMs?: number;
        executable?: string;
    });
    private readonly executable;
    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
}
export interface AwsCapabilityClient {
    getCallerIdentity: () => Promise<CallerIdentity>;
    simulatePrincipalPolicy: (input: {
        PolicySourceArn: string;
        ActionNames: string[];
        ResourceArns?: string[];
    }) => Promise<{
        EvaluationResults: EvaluationResult[];
    }>;
}
/** Validates the actual caller and required IAM actions instead of treating configured credentials as sufficient. */
export declare class AwsIamCapabilityScanner implements SecurityScanner {
    private readonly actions;
    readonly id = "aws-iam-capabilities";
    readonly version = "1.0.0";
    readonly timeoutMs = 30000;
    private readonly client;
    constructor(actions: string[], options?: {
        region?: string;
        client?: AwsCapabilityClient;
        resourceArns?: string[];
    });
    private readonly resourceArns;
    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
}
