/**
 * Agentic QE v3 - Security Audit Protocol
 * Coordination protocol for comprehensive security auditing
 *
 * Trigger: Daily 2am, dependency update, or manual
 * Participants: Security Scanner, Auditor, Compliance Validator
 * Actions: Scan vulnerabilities, audit code, validate compliance
 */
import { Result, Severity } from '../../shared/types/index.js';
import type { EventBus, MemoryBackend, AgentCoordinator } from '../../kernel/interfaces.js';
import { RiskScore } from '../../shared/value-objects/index.js';
import type { Vulnerability, VulnerabilitySeverity, SecurityAuditOptions, ComplianceReport, SASTResult, DASTResult, DependencyScanResult, SecretScanResult, DetectedSecret } from '../../domains/security-compliance/interfaces.js';
/**
 * Security audit trigger types
 */
export type SecurityAuditTrigger = 'daily' | 'dependency-update' | 'manual' | 'pre-release';
/**
 * Security audit phase status
 */
export type AuditPhase = 'initializing' | 'vulnerability-scan' | 'dependency-scan' | 'secret-scan' | 'compliance-validation' | 'triage' | 'report-generation' | 'completed' | 'failed';
/**
 * Security audit configuration
 */
export interface SecurityAuditConfig {
    /** Standards to validate against */
    complianceStandards: string[];
    /** Files/directories to scan */
    scanPaths: string[];
    /** Files/directories to exclude */
    excludePatterns: string[];
    /** Target URL for DAST (optional) */
    targetUrl?: string;
    /** Enable DAST scanning */
    enableDAST: boolean;
    /** Enable secret scanning */
    enableSecretScan: boolean;
    /** Severity threshold for blocking deployment */
    blockingSeverity: VulnerabilitySeverity;
    /** Maximum time for full audit in ms */
    timeout: number;
    /** Whether to auto-triage findings */
    autoTriage: boolean;
    /** Whether to send notifications */
    sendNotifications: boolean;
}
/**
 * Full security audit result
 */
export interface SecurityAuditResult {
    readonly auditId: string;
    readonly trigger: SecurityAuditTrigger;
    readonly startedAt: Date;
    readonly completedAt: Date;
    readonly phase: AuditPhase;
    readonly sastResult?: SASTResult;
    readonly dastResult?: DASTResult;
    readonly dependencyResult?: DependencyScanResult;
    readonly secretResult?: SecretScanResult;
    readonly complianceReports: ComplianceReport[];
    readonly triagedFindings: TriagedFindings;
    readonly overallRiskScore: RiskScore;
    readonly recommendations: string[];
    readonly deploymentDecision: DeploymentDecision;
}
/**
 * Triaged vulnerability findings
 */
export interface TriagedFindings {
    readonly critical: Vulnerability[];
    readonly high: Vulnerability[];
    readonly medium: Vulnerability[];
    readonly low: Vulnerability[];
    readonly informational: Vulnerability[];
    readonly secretsExposed: DetectedSecret[];
}
/**
 * Deployment decision based on security audit
 */
export interface DeploymentDecision {
    readonly allowed: boolean;
    readonly reason: string;
    readonly blockingIssues: string[];
    readonly warnings: string[];
}
/**
 * Security audit protocol event types
 */
export declare const SecurityAuditProtocolEvents: {
    readonly SecurityAuditStarted: "security-audit.SecurityAuditStarted";
    readonly VulnerabilityDetected: "security-audit.VulnerabilityDetected";
    readonly DependencyVulnerabilityFound: "security-audit.DependencyVulnerabilityFound";
    readonly SecretExposureDetected: "security-audit.SecretExposureDetected";
    readonly ComplianceValidated: "security-audit.ComplianceValidated";
    readonly SecurityAuditCompleted: "security-audit.SecurityAuditCompleted";
    readonly DeploymentBlocked: "security-audit.DeploymentBlocked";
};
/**
 * Security audit started payload
 */
export interface SecurityAuditStartedPayload {
    auditId: string;
    trigger: SecurityAuditTrigger;
    timestamp: string;
    config: Partial<SecurityAuditConfig>;
}
/**
 * Dependency vulnerability found payload
 */
export interface DependencyVulnerabilityPayload {
    vulnId: string;
    cve?: string;
    packageName: string;
    packageVersion: string;
    severity: Severity;
    fixVersion?: string;
}
/**
 * Secret exposure detected payload
 */
export interface SecretExposurePayload {
    secretType: DetectedSecret['type'];
    file: string;
    line?: number;
    entropy: number;
    isValid: boolean;
}
/**
 * Security audit completed payload
 */
export interface SecurityAuditCompletedPayload {
    auditId: string;
    trigger: SecurityAuditTrigger;
    duration: number;
    vulnerabilityCounts: {
        critical: number;
        high: number;
        medium: number;
        low: number;
    };
    secretsFound: number;
    complianceScore: number;
    deploymentAllowed: boolean;
}
/**
 * Security Audit Protocol
 *
 * Orchestrates comprehensive security auditing across multiple domains:
 * - security-compliance: All security scanning services
 * - code-intelligence: File analysis context
 * - quality-assessment: Security metrics for gate
 * - defect-intelligence: Security defect patterns
 */
export declare class SecurityAuditProtocol {
    private readonly eventBus;
    private readonly memory;
    private readonly agentCoordinator;
    private readonly config;
    private currentAudit;
    private readonly activeAgents;
    private securityScanner;
    constructor(eventBus: EventBus, memory: MemoryBackend, agentCoordinator: AgentCoordinator, config?: Partial<SecurityAuditConfig>);
    /**
     * Get or create the SecurityScannerService instance
     * Lazily initialized to avoid constructor complexity
     */
    private getSecurityScanner;
    /**
     * Execute security audit based on trigger type
     */
    execute(trigger: SecurityAuditTrigger): Promise<Result<SecurityAuditResult>>;
    /**
     * Scan for vulnerabilities using SAST
     * Delegates to real SecurityScannerService with semgrep integration when available
     */
    scanVulnerabilities(options: SecurityAuditOptions): Promise<Result<SASTResult>>;
    /**
     * Map semgrep OWASP category to VulnerabilityCategory
     */
    private mapSemgrepCategory;
    /**
     * Scan dependencies for vulnerabilities
     * Delegates to real SecurityScannerService which uses OSV API for real vulnerability data
     */
    scanDependencies(): Promise<Result<DependencyScanResult>>;
    /**
     * Find package.json path from scan paths or current directory
     */
    private findPackageJsonPath;
    /**
     * Audit for exposed secrets/credentials
     */
    auditSecrets(): Promise<Result<SecretScanResult>>;
    /**
     * Run DAST scan against target URL
     * Delegates to real SecurityScannerService for dynamic application security testing
     */
    private runDASTScan;
    /**
     * Validate against compliance standards
     */
    validateCompliance(): Promise<Result<ComplianceReport[]>>;
    /**
     * Generate comprehensive security report
     */
    generateReport(): Promise<{
        riskScore: RiskScore;
        recommendations: string[];
        deploymentDecision: DeploymentDecision;
    }>;
    /**
     * Triage findings by severity and priority
     */
    triageFindings(): Promise<TriagedFindings>;
    private publishAuditStarted;
    private publishVulnerabilities;
    private publishDependencyVulnerabilities;
    private publishSecretExposures;
    private publishComplianceResults;
    private publishAuditCompleted;
    private handleDeploymentBlocked;
    private spawnAgent;
    private cleanupAgents;
    private getAuditOptionsForTrigger;
    private updatePhase;
    private createEmptyTriagedFindings;
    private calculateSummary;
    private calculateRiskValue;
    private calculateAverageComplianceScore;
    private generateRecommendations;
    private determineDeploymentDecision;
    private storeAuditResult;
    /**
     * Perform SAST analysis on source files
     * Delegates to SecurityScannerService via agent coordination
     */
    private performSASTAnalysis;
    /**
     * Analyze a single file for security issues using pattern matching
     */
    private analyzeFileForSecurityIssues;
    /**
     * Perform DAST analysis on target URL
     * Note: Full DAST requires browser automation - this provides URL-based heuristics
     */
    private performDASTAnalysis;
    /**
     * Check dependencies for known vulnerabilities using OSV database patterns
     */
    private checkKnownDependencyVulnerabilities;
    /**
     * Simple semver comparison for vulnerability checking
     */
    private isVersionVulnerable;
    /**
     * Validate compliance against a specific standard
     */
    private validateStandard;
}
/**
 * Create a new SecurityAuditProtocol instance
 */
export declare function createSecurityAuditProtocol(eventBus: EventBus, memory: MemoryBackend, agentCoordinator: AgentCoordinator, config?: Partial<SecurityAuditConfig>): SecurityAuditProtocol;
//# sourceMappingURL=security-audit.d.ts.map