/**
 * Deterministic Scanner Types
 *
 * Types for the pre-pass scanner layer that runs deterministic tools
 * (Semgrep, npm audit, gitleaks, tsc) before LLM agents.
 *
 * All deterministic findings have confidence: 100 by definition.
 *
 * @module scanners/types
 */
import type { Severity } from "../certification/types.js";
export type { Severity };
/**
 * Supported scanner types
 */
export type ScannerType = "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | "binary-analysis" | "memory-safety" | "race-condition" | "healthcare" | "logic" | "dast" | "zap" | "nuclei" | "terraform" | "tfsec" | "checkov" | "openapi" | "spectral" | "rust" | "cargo-audit" | "clippy" | "detection" | "plugin";
/**
 * A finding from a deterministic scanner.
 *
 * Unlike LLM-generated findings, these have confidence: 100 because
 * they come from deterministic tools with known rule IDs.
 */
export interface DeterministicFinding {
    /** Which scanner found this issue */
    scanner: ScannerType;
    /** The rule/check ID from the scanner (e.g., "semgrep:owasp.sql-injection") */
    ruleId: string;
    /** Relative file path where the issue was found */
    file: string;
    /** Line number (1-indexed) */
    line: number;
    /** Column number (1-indexed, optional) */
    column?: number;
    /** End line for multi-line issues */
    endLine?: number;
    /** End column for multi-line issues */
    endColumn?: number;
    /** Human-readable description of the issue */
    message: string;
    /** Severity level */
    severity: Severity;
    /** Confidence level (100 for deterministic, lower for pattern-based) */
    confidence: number;
    /** Finding category for compliance mapping */
    category?: string;
    /** CWE IDs if applicable (e.g., ["CWE-89", "CWE-564"]) */
    cweIds?: string[];
    /** CVE IDs for dependency vulnerabilities */
    cveIds?: string[];
    /** Whether an automatic fix is available */
    fixAvailable?: boolean;
    /** Suggested fix if available */
    fix?: string;
    /** Raw evidence/code snippet from the scanner */
    evidence?: string;
    /** Additional metadata from the scanner */
    metadata?: Record<string, unknown>;
}
/**
 * Detailed error information for scanner failures
 */
export interface ScannerErrorDetails {
    /** Full error message */
    message: string;
    /** Full output (stdout/stderr combined) */
    fullOutput?: string;
    /** Actionable suggestions to fix the issue */
    suggestions?: string[];
    /** Which phase failed */
    phase?: "init" | "scan" | "parse";
    /** File that caused the error (if applicable) */
    file?: string;
}
/**
 * Result from running a single scanner
 */
export interface ScannerResult {
    /** Which scanner was run */
    scanner: ScannerType;
    /** Findings discovered by this scanner */
    findings: DeterministicFinding[];
    /** How long the scan took in milliseconds */
    duration: number;
    /** Whether the scan completed successfully */
    success: boolean;
    /** Error message if scan failed (truncated) */
    error?: string;
    /** Detailed error information with suggestions */
    errorDetails?: ScannerErrorDetails;
    /** Exit code from the scanner process */
    exitCode?: number;
    /** Scanner version used */
    version?: string;
    /** Number of files scanned */
    filesScanned?: number;
    /** Rules/checks that were run */
    rulesUsed?: string[];
    /** Additional metadata from the scanner */
    metadata?: Record<string, unknown>;
}
/**
 * Aggregated results from running multiple scanners
 */
export interface AggregatedScanResult {
    /** When the scan started */
    timestamp: string;
    /** Project path that was scanned */
    projectPath: string;
    /** Results from each scanner */
    scanners: ScannerResult[];
    /** Total findings across all scanners */
    totalFindings: number;
    /** Findings grouped by severity */
    bySeverity: Record<Severity, number>;
    /** Findings grouped by scanner */
    byScanner: Record<ScannerType, number>;
    /** Total scan duration in milliseconds */
    totalDuration: number;
    /** Whether all scanners succeeded */
    allSucceeded: boolean;
    /** Scanners that failed */
    failedScanners: ScannerType[];
}
/**
 * Options for running scanners
 */
export interface ScannerOptions {
    /** Run Semgrep for OWASP/security patterns */
    semgrep?: boolean;
    /** Run npm audit / osv-scanner for dependency vulns */
    dependencies?: boolean;
    /** Run gitleaks for secrets detection */
    secrets?: boolean;
    /** Run TypeScript compiler for type coverage */
    typescript?: boolean;
    /** Run ESLint for code quality */
    eslint?: boolean;
    /** Run Bandit for Python security */
    bandit?: boolean;
    /** Run gosec for Go security */
    gosec?: boolean;
    /** Run Brakeman for Ruby security */
    brakeman?: boolean;
    /** Run Trivy for container/IaC scanning */
    trivy?: boolean;
    /** Run binary analysis for native modules */
    binaryAnalysis?: boolean;
    /** Run memory safety analysis for C/C++/Rust */
    memorySafety?: boolean;
    /** Run race condition detection */
    raceCondition?: boolean;
    /** Custom Semgrep rules directory */
    semgrepRulesDir?: string;
    /** Files to include (glob patterns) */
    include?: string[];
    /** Files to exclude (glob patterns) */
    exclude?: string[];
    /** Timeout per scanner in milliseconds */
    timeout?: number;
}
/**
 * Default scanner options
 */
export declare const DEFAULT_SCANNER_OPTIONS: Required<Omit<ScannerOptions, "semgrepRulesDir" | "include" | "exclude">>;
/**
 * Severity mapping from scanner-specific severities to vaspera severities
 */
export declare const SEVERITY_MAPPINGS: {
    npm: {
        critical: Severity;
        high: Severity;
        moderate: Severity;
        low: Severity;
        info: Severity;
    };
    semgrep: {
        ERROR: Severity;
        WARNING: Severity;
        INFO: Severity;
    };
    gitleaks: {
        default: Severity;
    };
    typescript: {
        error: Severity;
        warning: Severity;
        suggestion: Severity;
        message: Severity;
    };
    bandit: {
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
    };
    gosec: {
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
    };
    brakeman: {
        High: Severity;
        Medium: Severity;
        Weak: Severity;
    };
    trivy: {
        CRITICAL: Severity;
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
        UNKNOWN: Severity;
    };
};
/**
 * Check if a scanner is available on the system
 */
export interface ScannerAvailability {
    scanner: ScannerType;
    available: boolean;
    version?: string;
    path?: string;
    error?: string;
}
/**
 * Convert a DeterministicFinding to a certification Finding
 */
export declare function toFindingId(scanner: ScannerType, ruleId: string, index: number): string;
//# sourceMappingURL=types.d.ts.map