/**
 * Detection Engine Types
 *
 * Types for the custom detection engine that provides proprietary
 * security analysis beyond wrapped tools like Semgrep.
 *
 * @module scanners/detection/types
 */
import type { Severity } from "../../certification/types.js";
/**
 * Supported detection engines
 */
export type DetectionEngine = "ast-query" | "data-flow" | "control-flow" | "semantic";
/**
 * A taint source - where untrusted data enters
 */
export interface TaintSource {
    pattern: string;
    description?: string;
    parameterIndex?: number;
}
/**
 * A taint sink - dangerous operation that consumes data
 */
export interface TaintSink {
    pattern: string;
    description?: string;
    parameterIndex?: number;
}
/**
 * A sanitizer that neutralizes tainted data
 */
export interface Sanitizer {
    pattern: string;
    description?: string;
}
/**
 * Data flow rule configuration
 */
export interface DataFlowConfig {
    sources: TaintSource[];
    sinks: TaintSink[];
    sanitizers?: Sanitizer[];
    requireAllSources?: boolean;
}
/**
 * Control flow rule configuration
 */
export interface ControlFlowConfig {
    entryPoints?: string[];
    mustReach?: {
        pattern: string;
        description?: string;
    }[];
    mustNotReach?: {
        pattern: string;
        description?: string;
    }[];
}
/**
 * AST query rule configuration
 */
export interface ASTQueryConfig {
    pattern: string;
    language?: "typescript" | "javascript" | "python" | "go" | "ruby";
    capture?: string;
    constraints?: Record<string, string>;
}
/**
 * Detection rule definition
 */
export interface DetectionRule {
    id: string;
    name: string;
    description: string;
    category: string;
    severity: Severity;
    confidence: number;
    enabled?: boolean;
    engines: {
        astQuery?: ASTQueryConfig;
        dataFlow?: DataFlowConfig;
        controlFlow?: ControlFlowConfig;
    };
    cweIds?: string[];
    owaspRefs?: string[];
    autofixPatternId?: string;
    metadata?: Record<string, unknown>;
}
/**
 * A path from taint source to sink
 */
export interface TaintPath {
    source: {
        pattern: string;
        file: string;
        line: number;
        column?: number;
        expression: string;
    };
    sink: {
        pattern: string;
        file: string;
        line: number;
        column?: number;
        expression: string;
    };
    intermediateNodes: {
        file: string;
        line: number;
        expression: string;
    }[];
    sanitized: boolean;
    sanitizer?: string;
}
/**
 * Result from running detection on a single file
 */
export interface DetectionMatch {
    ruleId: string;
    file: string;
    line: number;
    column?: number;
    endLine?: number;
    endColumn?: number;
    message: string;
    severity: Severity;
    confidence: number;
    category: string;
    evidence: string;
    taintPath?: TaintPath;
    cweIds?: string[];
    owaspRefs?: string[];
    autofixPatternId?: string;
}
/**
 * Result from running detection engine
 */
export interface DetectionResult {
    success: boolean;
    matches: DetectionMatch[];
    rulesEvaluated: number;
    filesAnalyzed: number;
    duration: number;
    errors?: string[];
}
/**
 * Detection engine context
 */
export interface DetectionContext {
    projectPath: string;
    files?: string[];
    rules?: DetectionRule[];
    include?: string[];
    exclude?: string[];
    timeout?: number;
}
/**
 * Built-in detection categories
 */
export declare const DETECTION_CATEGORIES: readonly ["sql-injection", "xss", "ssrf", "path-traversal", "command-injection", "idor", "bola", "auth-bypass", "race-condition", "secrets", "insecure-deserialization", "xxe", "open-redirect", "csrf"];
export type DetectionCategory = (typeof DETECTION_CATEGORIES)[number];
/**
 * Default confidence thresholds
 */
export declare const CONFIDENCE_THRESHOLDS: {
    readonly high: 85;
    readonly medium: 60;
    readonly low: 40;
};
//# sourceMappingURL=types.d.ts.map