/**
 * Fix engine for audit checks.
 * Provides --fix (interactive) and --fix --dry-run (preview) modes.
 */
import type { AuditResult, AuditCheck, Severity, FixTier, FixExecutionLogEntry } from "./types.js";
import type { ImpactContext } from "./scoring.js";
/** Whitelist of known safe fix command prefixes from audit check definitions */
export declare const KNOWN_AUDIT_FIX_PREFIXES: string[];
/** Check if a fix command passes whitelist + metachar validation */
export declare function isFixCommandAllowed(command: string): boolean;
/** Categories where auto-fix is NEVER allowed regardless of check-level tier (D-02) */
export declare const FORBIDDEN_CATEGORIES: Set<string>;
/**
 * Resolve the effective fix tier for a check.
 * Category-level FORBIDDEN override trumps check-level field (D-02).
 * All sysctl fixes are promoted SAFE→GUARDED to prevent SSH breakage (D-21).
 * Reboot/shutdown commands are promoted SAFE→GUARDED to prevent mid-fix session loss (D-22).
 * Undefined safeToAutoFix defaults to GUARDED (D-04 safety net).
 */
export declare function resolveTier(check: AuditCheck, categoryName: string): FixTier;
/** A check with pre-condition info for safe fixing */
export interface FixCheck {
    id: string;
    category: string;
    name: string;
    severity: Severity;
    fixCommand: string;
    preCondition?: string;
}
/** A group of fixes at the same severity level */
export interface FixGroup {
    severity: Severity;
    checks: FixCheck[];
    estimatedImpact: number;
}
/** Plan of all fixes grouped by severity */
export interface FixPlan {
    groups: FixGroup[];
}
export interface FixPreview {
    checkId: string;
    command: string;
    tier: FixTier;
}
/** Result of running fixes */
export interface FixResult {
    applied: string[];
    skipped: string[];
    errors: string[];
    preview?: FixPlan;
    executionLog?: FixExecutionLogEntry[];
}
/**
 * Preview all available fixes without executing.
 * Groups by severity (critical first), calculates estimated score impact.
 */
export declare function previewFixes(result: AuditResult): FixPlan;
/**
 * Preview only SAFE tier fixes (no service restarts, no SSH/FW/Docker).
 * Returns a FixPlan with only SAFE checks, plus counts of GUARDED and FORBIDDEN.
 */
export declare function previewSafeFixes(result: AuditResult, options?: {
    includeForbidden?: boolean;
}): {
    safePlan: FixPlan;
    guardedCount: number;
    forbiddenCount: number;
    guardedIds: string[];
    forbiddenFixes?: FixPreview[];
};
/**
 * Calculate estimated score impact if a single check is fixed.
 * Preserves fractional precision (no rounding) for accurate impact-based sorting.
 */
export declare function calculateCheckImpact(check: FixCheck, ctx: ImpactContext): number;
/** A FixCheck annotated with its estimated score impact */
export type ScoredFixCheck = FixCheck & {
    impact: number;
};
/**
 * Sort checks by impact descending, severity as tie-breaker (critical first).
 * Returns a new array with an `impact` property added to each element.
 */
export declare function sortChecksByImpact(checks: FixCheck[], ctx: ImpactContext): ScoredFixCheck[];
/** Select top N checks from a pre-sorted array. Returns at most N elements. */
export declare function selectChecksForTop(sorted: ScoredFixCheck[], n: number): ScoredFixCheck[];
/**
 * Select checks from sorted array until estimated score reaches target.
 * Returns empty array if currentScore is already >= target.
 * If target is unreachable, returns all checks.
 */
export declare function selectChecksForTarget(sorted: ScoredFixCheck[], currentScore: number, target: number): ScoredFixCheck[];
/**
 * Run fixes interactively or preview in dry-run mode.
 *
 * - dryRun: Preview without executing, return FixPlan
 * - Interactive: Prompt per severity group, execute confirmed fixes via SSH
 */
export declare function runFix(ip: string, result: AuditResult, options: {
    dryRun: boolean;
}): Promise<FixResult>;
export declare function runForbiddenFixes(ip: string, forbiddenFixes: FixPreview[]): Promise<{
    applied: string[];
    skipped: string[];
    errors: string[];
    executionLog: FixExecutionLogEntry[];
}>;
/**
 * Extract { checkId, fixCommand } pairs from a flat check array.
 * Used by CLI and MCP to pass to backupFilesBeforeFix.
 */
export declare function fixCommandsFromChecks(checks: FixCheck[]): Array<{
    checkId: string;
    fixCommand: string;
}>;
export declare function extractAffectedCategories(appliedCheckIds: string[], categories: AuditResult["categories"]): string[];
/**
 * Run a post-fix re-audit on affected categories and return the merged AuditResult.
 * Returns null on failure or when nothing to check.
 */
export declare function runPostFixReAudit(ip: string, platform: string, originalResult: AuditResult, affectedCategories: string[]): Promise<AuditResult | null>;
//# sourceMappingURL=fix.d.ts.map