/**
 * Security Assessor Module
 * Tests for backend API security vulnerabilities using 26 focused patterns
 *
 * BASIC MODE (5 patterns - enableDomainTesting=false):
 *   Command Injection, Calculator Injection, SQL Injection, Path Traversal, Unicode Bypass
 *
 * ADVANCED MODE (all 26 patterns - enableDomainTesting=true):
 *   - Critical Injection (6): Command, Calculator, SQL, Path Traversal, XXE, NoSQL
 *   - Input Validation (3): Type Safety, Boundary Testing, Required Fields
 *   - Protocol Compliance (2): MCP Error Format, Timeout Handling
 *   - Tool-Specific (6): SSRF, Nested Injection, Package Squatting,
 *                        Data Exfiltration, Configuration Drift, Tool Shadowing
 *   - Encoding Bypass (1): Unicode Bypass
 *   - Resource Exhaustion (1): DoS/Resource Exhaustion
 *   - Deserialization (1): Insecure Deserialization
 *   - Auth Bypass (1): Fail-open authentication vulnerabilities (CVE-2025-52882)
 *   - Cross-Tool State Bypass (1): Privilege escalation via shared state (Issue #92)
 *   - Chained Exploitation (1): Multi-tool chain execution attacks (Issue #93)
 *
 * SEQUENCE TESTING (enableSequenceTesting - default true):
 *   Tests for cross-tool privilege escalation by calling tool sequences
 *   Tests for multi-tool chain exploitation attacks
 */
import { SecurityAssessment } from "../../../lib/assessmentTypes.js";
import { BaseAssessor } from "./BaseAssessor.js";
import { AssessmentContext } from "../AssessmentOrchestrator.js";
import { type SecurityTesters } from "./securityTests/index.js";
import { ClaudeCodeBridge } from "../lib/claudeCodeBridge.js";
export declare class SecurityAssessor extends BaseAssessor {
    /**
     * Collection of security testers (injectable for testing)
     * @since v1.43.0 - Refactored from individual properties to support DI
     */
    private testers;
    private claudeBridge;
    /**
     * Set the ClaudeCodeBridge for semantic analysis of security test results
     * Enables progressive enhancement: pattern-based detection first, Claude refinement for uncertain cases
     */
    setClaudeBridge(bridge: ClaudeCodeBridge | null): void;
    /**
     * Check if semantic analysis is available and enabled
     */
    private isSemanticAnalysisEnabled;
    /**
     * Refine a security test result using Claude semantic analysis
     * Only called for medium/low confidence detections (progressive enhancement)
     */
    private refineWithSemanticAnalysis;
    /**
     * Create a SecurityAssessor with optional dependency injection
     *
     * @param config - Assessment configuration
     * @param testers - Optional pre-configured testers (for testing/mocking)
     *
     * @example
     * // Production usage - testers created automatically via factory
     * const assessor = new SecurityAssessor(config);
     *
     * // Testing with mocks - inject mock testers
     * const mockTesters = createMockSecurityTesters();
     * const assessor = new SecurityAssessor(config, mockTesters);
     */
    constructor(config: import("../../../lib/assessment/configTypes.js").AssessmentConfiguration, testers?: SecurityTesters);
    assess(context: AssessmentContext): Promise<SecurityAssessment>;
    /**
     * Select tools for testing based on configuration
     */
    private selectToolsForTesting;
    /**
     * Perform additional security checks
     */
    private performAdditionalSecurityChecks;
    /**
     * Run cross-tool sequence tests for privilege escalation (Issue #92, Challenge #7)
     * Tests tool pairs: modifier enables admin mode, then admin action succeeds
     */
    private runCrossToolSequenceTests;
    /**
     * Run chain exploitation tests (Issue #93, Challenge #6)
     * Tests for multi-tool chain exploitation attacks including:
     * - Arbitrary tool invocation without allowlist
     * - Output injection via {{output}} template
     * - Recursive chain execution (DoS potential)
     * - State poisoning between chain steps
     */
    private runChainExploitationTests;
    /**
     * Compute audit analysis for automated consumption
     * Pre-computes false positive likelihood and response uniformity per tool
     */
    private computeAuditAnalysis;
    /**
     * Determine overall risk level
     */
    private determineOverallRiskLevel;
    /**
     * Determine security status based on confidence levels
     */
    private determineSecurityStatus;
    /**
     * Generate security explanation
     */
    private generateSecurityExplanation;
    /**
     * Aggregate auth bypass detection results from security tests (Issue #75)
     * Summarizes fail-open/fail-closed patterns across all tested tools
     */
    private aggregateAuthBypassResults;
}
//# sourceMappingURL=SecurityAssessor.d.ts.map