import type { Posture } from "../config/posture.js";
import type { Runner } from "../internals/proc.js";
import type { Check, CheckCode } from "../internals/verify.js";
import type { Platform } from "../platform/base.js";
import { type CiscoShardManifest, type CiscoShardResult, type JoinedCiscoShardEvidence } from "./cisco-shards.js";
import type { RawScannerOccurrence } from "./evidence.js";
import { type SkillSpectorImageApproval } from "./images.js";
import type { TrustFileInventory } from "./inventory.js";
export type TrustDetectorName = "skillspector" | "cisco" | "mcp-scanner" | "semgrep" | "snyk-agent-scan";
export interface TrustDetector {
    name: TrustDetectorName;
    analyzerLabel: string;
    checkAvailable: (run: Runner, platform: Platform, env: NodeJS.ProcessEnv, runtimeOptions?: TrustDetectorRuntimeOptions) => Promise<string | undefined>;
    runScan: (run: Runner, platform: Platform, env: NodeJS.ProcessEnv, tree: string, runtimeOptions?: TrustDetectorRuntimeOptions) => Promise<string>;
    ruleMap: Record<string, CheckCode>;
}
interface TrustDetectorRuntimeOptions {
    skillspectorImageApprovals?: readonly SkillSpectorImageApproval[];
    inventory?: TrustFileInventory;
}
export interface TrustDetectorOptions {
    env: NodeJS.ProcessEnv;
    platform: Platform;
    posture: Posture;
    requiredDetectors?: readonly TrustDetectorName[];
    run: Runner;
    skillspectorImageApprovals?: readonly SkillSpectorImageApproval[];
    inventory?: TrustFileInventory;
    /** Restrict execution to this detector set. Omitted means the complete set for the scan kind. */
    detectors?: readonly TrustDetectorName[];
    /** Exact, coordinator-validated SARIF that replaces local execution for the named detector. */
    precomputedSarif?: Readonly<Partial<Record<TrustDetectorName, string>>>;
    /** Native AIH findings that can corroborate an elevated third-party rule on the same line. */
    corroboratedChecks?: readonly Check[];
    progress?: (message: string) => void;
}
export interface TrustDetectorResult {
    checks: Check[];
    analyzersRun: string[];
    rawOccurrences: RawScannerOccurrence[];
}
export declare const CISCO_SKILL_SCANNER_PROJECT: string;
export declare const CISCO_MCP_SCANNER_PROJECT: string;
export declare const SEMGREP_PROJECT: string;
export declare const SNYK_AGENT_SCAN_PROJECT: string;
export declare const CISCO_SKILL_SCANNER_VERSION = "2.0.13";
export declare const CISCO_MCP_SCANNER_VERSION = "4.8.2";
export declare const SEMGREP_VERSION = "1.173.0";
export declare const SNYK_AGENT_SCAN_VERSION = "0.5.17";
export declare const CISCO_SKILL_SCANNER_ANALYZER = "cisco@uvx";
export declare const CISCO_MCP_SCANNER_ANALYZER = "mcp-scanner@uv:4.8.2";
export declare const SEMGREP_ANALYZER = "semgrep@uv:1.173.0";
export declare const SNYK_AGENT_SCAN_ANALYZER = "snyk-agent-scan@uv:0.5.17";
export declare const CISCO_RULE_MAP: Record<string, CheckCode>;
export declare const MCP_SCANNER_RULE_MAP: Record<string, CheckCode>;
export declare const SEMGREP_RULE_MAP: Record<string, CheckCode>;
export declare const SNYK_AGENT_SCAN_RULE_MAP: Record<string, CheckCode>;
export declare function scanNativeMaliciousCode(root: string, inventory?: TrustFileInventory): Check[];
export declare function skillspectorDockerRunArgv(platform: Platform, tree: string, image?: string, containerName?: string): string[];
export declare function ciscoSkillScannerRunArgv(platform: Platform, tree: string, outputSarif: string): string[];
export declare function mcpScannerStaticArgv(platform: Platform, inputJson: string): string[];
export declare function semgrepScanArgv(platform: Platform, tree: string, config: string): string[];
export declare function snykAgentScanArgv(platform: Platform, tree: string): string[];
export declare function resolveCiscoScanConcurrency(env: NodeJS.ProcessEnv): number;
export interface CiscoSourceShardManifestOptions {
    source: {
        id: string;
        pinnedSha: string;
    };
    analyzer: {
        version: string;
        lockSha256: string;
    };
    policy: {
        version: string;
        profile: string;
    };
    shardCount: number;
    inventory?: TrustFileInventory;
}
export interface CiscoSourceShardRunOptions {
    run: Runner;
    platform: Platform;
    env: NodeJS.ProcessEnv;
    concurrency?: number;
}
export declare function buildCiscoSourceShardManifest(root: string, options: CiscoSourceShardManifestOptions): CiscoShardManifest;
export declare function runCiscoSourceShard(root: string, manifest: CiscoShardManifest, shardId: string, options: CiscoSourceShardRunOptions): Promise<CiscoShardResult>;
export declare function joinedCiscoShardSarif(joined: JoinedCiscoShardEvidence, includedPaths?: readonly string[]): string;
/** One requested detector that is NOT runnable, with the underlying reason. */
export interface DetectorAvailabilityProbe {
    name: TrustDetectorName;
    analyzerLabel: string;
    reason: string;
}
export interface DetectorAvailabilityOptions {
    run: Runner;
    platform: Platform;
    env: NodeJS.ProcessEnv;
    skillspectorImageApprovals?: readonly SkillSpectorImageApproval[];
}
/**
 * Probe availability of specific detectors WITHOUT scanning. Returns one entry
 * per requested detector that is not runnable, carrying the underlying reason
 * (e.g. an offline uv cache miss). An empty array means every requested detector
 * is ready. Used by the baseline preflight to fail fast with an actionable
 * provisioning message instead of aborting mid-vet with an opaque
 * missing-analyzer error. It never runs a scan, fabricates a receipt, or relaxes
 * the required-detector floor.
 */
export declare function checkDetectorsAvailable(names: readonly TrustDetectorName[], options: DetectorAvailabilityOptions): Promise<DetectorAvailabilityProbe[]>;
export declare function runTrustDetectors(root: string, options: TrustDetectorOptions): Promise<TrustDetectorResult>;
export declare function runMcpConfigDetectors(root: string, options: TrustDetectorOptions): Promise<TrustDetectorResult>;
export declare function trustRuntimeAdvisory(analyzersRun: readonly string[]): string;
export {};