/**
 * Agentic QE v3 - Security Scanner Service
 * Implements SAST and DAST security scanning capabilities
 * Includes OSV API integration for dependency vulnerability scanning
 */
import { Result } from '../../../shared/types/index.js';
import type { MemoryBackend } from '../../../kernel/interfaces.js';
import type { FilePath } from '../../../shared/value-objects/index.js';
import type { SASTResult, DASTResult, DASTOptions, AuthCredentials, RuleSet, FalsePositiveCheck, Vulnerability, ScanSummary, ScanStatus } from '../interfaces.js';
/**
 * Dependency scan result
 */
export interface DependencyScanResult {
    readonly scanId: string;
    readonly vulnerabilities: Vulnerability[];
    readonly packagesScanned: number;
    readonly vulnerablePackages: number;
    readonly summary: ScanSummary;
    readonly scanDurationMs: number;
}
/**
 * Combined security scanner service interface
 * Note: We define separate methods for SAST and DAST to avoid interface conflicts
 */
export interface ISecurityScannerService {
    scanFiles(files: FilePath[]): Promise<Result<SASTResult>>;
    scanWithRules(files: FilePath[], ruleSetIds: string[]): Promise<Result<SASTResult>>;
    getAvailableRuleSets(): Promise<RuleSet[]>;
    checkFalsePositive(vulnerability: Vulnerability): Promise<Result<FalsePositiveCheck>>;
    scanUrl(targetUrl: string, options?: DASTOptions): Promise<Result<DASTResult>>;
    scanAuthenticated(targetUrl: string, credentials: AuthCredentials, options?: DASTOptions): Promise<Result<DASTResult>>;
    getScanStatus(scanId: string): Promise<ScanStatus>;
    scanDependencies(dependencies: Record<string, string>): Promise<Result<DependencyScanResult>>;
    scanPackageJson(packageJsonPath: string): Promise<Result<DependencyScanResult>>;
    runFullScan(files: FilePath[], targetUrl?: string, options?: DASTOptions): Promise<Result<FullScanResult>>;
}
export interface FullScanResult {
    readonly sastResult: SASTResult;
    readonly dastResult?: DASTResult;
    readonly combinedSummary: ScanSummary;
}
export interface SecurityScannerConfig {
    defaultRuleSets: string[];
    maxConcurrentScans: number;
    timeout: number;
    enableFalsePositiveDetection: boolean;
    dastMaxDepth: number;
    dastActiveScanning: boolean;
}
export declare class SecurityScannerService implements ISecurityScannerService {
    private readonly memory;
    private readonly config;
    private readonly activeScans;
    private readonly osvClient;
    constructor(memory: MemoryBackend, config?: Partial<SecurityScannerConfig>);
    /**
     * Scan files for security vulnerabilities using static analysis
     */
    scanFiles(files: FilePath[]): Promise<Result<SASTResult>>;
    /**
     * Scan with specific rule sets
     */
    scanWithRules(files: FilePath[], ruleSetIds: string[]): Promise<Result<SASTResult>>;
    /**
     * Get available rule sets
     */
    getAvailableRuleSets(): Promise<RuleSet[]>;
    /**
     * Check if vulnerability is a false positive
     */
    checkFalsePositive(vulnerability: Vulnerability): Promise<Result<FalsePositiveCheck>>;
    /**
     * Scan running application using dynamic analysis
     */
    scanUrl(targetUrl: string, options?: DASTOptions): Promise<Result<DASTResult>>;
    /**
     * Scan authenticated endpoints
     */
    scanAuthenticated(targetUrl: string, credentials: AuthCredentials, options?: DASTOptions): Promise<Result<DASTResult>>;
    /**
     * Get scan status
     */
    getScanStatus(scanId: string): Promise<ScanStatus>;
    /**
     * Run combined SAST and DAST scan
     */
    runFullScan(files: FilePath[], targetUrl?: string, options?: DASTOptions): Promise<Result<FullScanResult>>;
    /**
     * Analyze a file for security vulnerabilities using pattern-based detection
     */
    private analyzeFile;
    /**
     * Find all matches of a security pattern in the file content
     */
    private findPatternMatches;
    /**
     * Convert character index to line and column numbers
     */
    private getLineAndColumn;
    /**
     * Check if the match is inside a comment
     */
    private isInComment;
    /**
     * Check if the snippet appears to be in documentation or test code examples
     */
    private isInDocumentation;
    /**
     * Check if the line has a nosec annotation
     */
    private hasNosecAnnotation;
    /**
     * Create a Vulnerability object from a pattern match
     */
    private createVulnerabilityFromPattern;
    private getEffortForSeverity;
    /**
     * Perform dynamic (DAST) scanning on a target URL
     * Makes actual HTTP requests to detect security vulnerabilities
     *
     * **Capabilities:**
     * - Security header analysis (HSTS, CSP, X-Frame-Options, etc.)
     * - Cookie security (Secure, HttpOnly, SameSite flags)
     * - CORS misconfiguration detection
     * - Sensitive file exposure (/.git, /.env, etc.)
     * - Link crawling with same-origin scope
     * - XSS reflection testing (GET parameters)
     * - SQL injection error-based detection (GET parameters)
     * - Form security analysis (CSRF tokens, autocomplete, action URLs)
     *
     * **Limitations:**
     * - Injection testing: GET parameters only (POST form submission not implemented)
     * - Crawling: Same-origin only, max 10 links per page, single depth
     * - Auth flows: Header-based only, no login form automation
     * - No JavaScript execution (static response analysis only)
     * - No session management testing beyond cookie attributes
     */
    private performDynamicScan;
    /**
     * Perform authenticated dynamic scanning with credentials
     * Supports basic auth, bearer token, OAuth, and cookie-based authentication
     */
    private performAuthenticatedScan;
    private validateCredentials;
    /**
     * Analyze if a vulnerability detection is a false positive using heuristics
     * Future enhancement: integrate ML/AI models for improved false positive detection
     */
    private analyzeFalsePositive;
    private calculateSummary;
    private combineSummaries;
    private storeScanResults;
    /**
     * Scan npm dependencies for known vulnerabilities using OSV API
     */
    scanDependencies(dependencies: Record<string, string>): Promise<Result<DependencyScanResult>>;
    /**
     * Scan a package.json file for dependency vulnerabilities
     */
    scanPackageJson(packageJsonPath: string): Promise<Result<DependencyScanResult>>;
    /**
     * Convert OSV vulnerabilities to our internal format
     */
    private convertOSVVulnerabilities;
    /**
     * Map OSV severity to our severity type
     */
    private mapOSVSeverity;
    /**
     * Extract links from HTML and crawl discovered pages
     * Implements basic web crawling within same origin
     */
    private extractAndCrawlLinks;
    /**
     * Test URL parameters for injection vulnerabilities (XSS, SQLi)
     * Uses safe payloads that reveal vulnerability without exploitation
     */
    private testInjectionVulnerabilities;
    /**
     * Analyze HTML forms for security issues
     * Checks for CSRF protection, autocomplete settings, and action targets
     */
    private analyzeFormsForSecurityIssues;
}
//# sourceMappingURL=security-scanner.d.ts.map