/**
 * Security Response Analyzer (Facade)
 * Analyzes tool responses for evidence-based vulnerability detection
 *
 * REFACTORED in Issue #53 (v2.0.0): Converted to facade pattern
 * Delegates to focused classes for maintainability (CC 218 → ~50)
 *
 * REFACTORED in Issue #179: Extracted specialized vulnerability analyzers
 * to separate modules for improved modularity and testability.
 *
 * Extracted classes (Issue #53):
 * - ErrorClassifier: Error classification and connection error detection
 * - ExecutionArtifactDetector: Execution evidence detection
 * - MathAnalyzer: Math computation detection (Calculator Injection)
 * - SafeResponseDetector: Safe response pattern detection
 * - ConfidenceScorer: Confidence level calculation
 *
 * Extracted analyzers (Issue #179):
 * - AuthBypassAnalyzer: CVE-2025-52882, fail-open authentication
 * - StateBasedAuthAnalyzer: Cross-tool state abuse
 * - BlacklistBypassAnalyzer: Incomplete blacklist detection
 * - OutputInjectionAnalyzer: Indirect prompt injection
 * - SessionManagementAnalyzer: Session CWEs
 * - CryptographicFailureAnalyzer: OWASP A02:2021
 * - ChainExploitationAnalyzer: Multi-tool chains
 * - ExcessivePermissionsAnalyzer: Scope violations
 * - SecretLeakageDetector: Credential exposure
 */
import { CompatibilityCallToolResult, Tool } from "@modelcontextprotocol/sdk/types.js";
import { SecurityPayload } from "../../../../lib/securityPatterns.js";
import type { SanitizationDetectionResult } from "./SanitizationDetector.js";
import { MathResultAnalysis } from "./MathAnalyzer.js";
import { ConfidenceResult } from "./ConfidenceScorer.js";
export type { ConfidenceResult } from "./ConfidenceScorer.js";
export type { MathResultAnalysis } from "./MathAnalyzer.js";
export type { AuthBypassResult } from "./analyzers/AuthBypassAnalyzer.js";
export type { StateBasedAuthResult } from "./analyzers/StateBasedAuthAnalyzer.js";
export type { SecretLeakageResult } from "./analyzers/SecretLeakageDetector.js";
export type { ChainExploitationAnalysis, ChainExecutionType, ChainVulnerabilityCategory, } from "./analyzers/ChainExploitationAnalyzer.js";
export type { ExcessivePermissionsScopeResult } from "./analyzers/ExcessivePermissionsAnalyzer.js";
export type { BlacklistBypassResult } from "./analyzers/BlacklistBypassAnalyzer.js";
export type { OutputInjectionResult } from "./analyzers/OutputInjectionAnalyzer.js";
export type { SessionManagementResult } from "./analyzers/SessionManagementAnalyzer.js";
export type { CryptoFailureResult } from "./analyzers/CryptographicFailureAnalyzer.js";
/**
 * Result of response analysis
 */
export interface AnalysisResult {
    isVulnerable: boolean;
    evidence?: string;
}
/**
 * Error classification types
 */
export type ErrorClassification = "connection" | "server" | "protocol";
/**
 * Analyzes tool responses for security vulnerabilities
 * Distinguishes between safe reflection and actual execution
 *
 * This class serves as a facade, delegating to focused analyzers
 * while maintaining the same public API for backward compatibility.
 */
export declare class SecurityResponseAnalyzer {
    private errorClassifier;
    private executionDetector;
    private mathAnalyzer;
    private safeDetector;
    private confidenceScorer;
    private authBypassAnalyzer;
    private stateBasedAuthAnalyzer;
    private secretLeakageDetector;
    private chainExploitationAnalyzer;
    private excessivePermissionsAnalyzer;
    private blacklistBypassAnalyzer;
    private outputInjectionAnalyzer;
    private sessionManagementAnalyzer;
    private cryptographicFailureAnalyzer;
    constructor();
    /**
     * Analyze response with evidence-based detection
     * CRITICAL: Distinguish between safe reflection and actual execution
     *
     * Refactored to reduce cyclomatic complexity (Issue #36).
     * Detection flow: Error checks → Tool behavior → Evidence matching
     */
    analyzeResponse(response: CompatibilityCallToolResult, payload: SecurityPayload, tool: Tool): AnalysisResult;
    /**
     * Calculate confidence level and manual review requirements
     */
    calculateConfidence(tool: Tool, isVulnerable: boolean, evidence: string, responseText: string, payload: SecurityPayload, sanitizationResult?: SanitizationDetectionResult): ConfidenceResult;
    /**
     * Analyze response for auth bypass patterns (Issue #75)
     * Detects fail-open authentication vulnerabilities (CVE-2025-52882)
     */
    analyzeAuthBypassResponse(response: CompatibilityCallToolResult): import("./analyzers/index.js").AuthBypassResult;
    /**
     * Analyze response for cross-tool state-based authorization bypass (Issue #92)
     * Detects Challenge #7: Privilege escalation via shared mutable state
     */
    analyzeStateBasedAuthBypass(response: CompatibilityCallToolResult): import("./analyzers/index.js").StateBasedAuthResult;
    /**
     * Analyze response for blacklist bypass patterns (Issue #110, Challenge #11)
     * Detects when incomplete blacklist security controls are bypassed
     */
    analyzeBlacklistBypassResponse(response: CompatibilityCallToolResult): import("./analyzers/index.js").BlacklistBypassResult;
    /**
     * Analyze response for output injection vulnerabilities (Issue #110, Challenge #8)
     * Detects indirect prompt injection via unsanitized tool output
     */
    analyzeOutputInjectionResponse(response: CompatibilityCallToolResult): import("./analyzers/index.js").OutputInjectionResult;
    /**
     * Analyze response for session management vulnerabilities (Issue #111, Challenge #12)
     * Detects 5 CWEs from mcp-vulnerable-testbed
     */
    analyzeSessionManagementResponse(response: CompatibilityCallToolResult): import("./analyzers/index.js").SessionManagementResult;
    /**
     * Analyze response for cryptographic failures (Issue #112, Challenge #13)
     * Detects OWASP A02:2021 Cryptographic Failures
     */
    analyzeCryptographicFailures(response: CompatibilityCallToolResult): import("./analyzers/index.js").CryptoFailureResult;
    /**
     * Analyze response for chain exploitation vulnerabilities (Issue #93, Challenge #6)
     * Detects multi-tool chained exploitation attacks
     */
    analyzeChainExploitation(response: CompatibilityCallToolResult): import("./analyzers/index.js").ChainExploitationAnalysis;
    /**
     * Analyze response for excessive permissions scope violations (Issue #144, Challenge #22)
     * Detects when tools exceed their declared annotation scope
     */
    analyzeExcessivePermissionsResponse(response: CompatibilityCallToolResult): import("./analyzers/index.js").ExcessivePermissionsScopeResult;
    /**
     * Check for secret leakage in response (Issue #103, Challenge #9)
     * Scans for credential patterns regardless of payload type.
     *
     * @note This method must be called separately from analyzeResponse().
     */
    checkSecretLeakage(response: CompatibilityCallToolResult): import("./analyzers/index.js").SecretLeakageResult;
    /**
     * Check if response indicates connection/server failure
     */
    isConnectionError(response: CompatibilityCallToolResult): boolean;
    /**
     * Check if caught exception indicates connection/server failure
     */
    isConnectionErrorFromException(error: unknown): boolean;
    /**
     * Classify error type for reporting
     */
    classifyError(response: CompatibilityCallToolResult): ErrorClassification;
    /**
     * Classify error type from caught exception
     */
    classifyErrorFromException(error: unknown): ErrorClassification;
    /**
     * Extract response content from MCP response
     */
    extractResponseContent(response: CompatibilityCallToolResult): string;
    /**
     * Check if response is an MCP validation error (safe rejection)
     */
    isMCPValidationError(errorInfo: {
        code?: string | number;
        message?: string;
    }, responseText: string): boolean;
    /**
     * Check if response is an HTTP error (Issue #26)
     */
    isHttpErrorResponse(responseText: string): boolean;
    /**
     * Check if evidence pattern is ambiguous
     */
    isValidationPattern(evidencePattern: RegExp): boolean;
    /**
     * Check if response contains evidence of actual execution
     */
    hasExecutionEvidence(responseText: string): boolean;
    /**
     * Check if a math expression payload was computed (execution evidence)
     * @deprecated Use analyzeComputedMathResult instead
     */
    isComputedMathResult(payload: string, responseText: string): boolean;
    /**
     * Check if numeric value appears in structured data context
     */
    isCoincidentalNumericInStructuredData(result: number, responseText: string): boolean;
    /**
     * Enhanced computed math result analysis with tool context (Issue #58)
     */
    analyzeComputedMathResult(payload: string, responseText: string, tool?: Tool): MathResultAnalysis;
    /**
     * Check if response is just reflection (safe)
     */
    isReflectionResponse(responseText: string): boolean;
    /**
     * Detect execution artifacts in response
     */
    detectExecutionArtifacts(responseText: string): boolean;
    /**
     * Check if response contains echoed injection payload patterns
     */
    containsEchoedInjectionPayload(responseText: string): boolean;
    /**
     * Check if tool explicitly rejected input with validation error (SAFE)
     */
    isValidationRejection(response: CompatibilityCallToolResult): boolean;
    /**
     * Check if tool is a structured data tool
     */
    isStructuredDataTool(toolName: string, toolDescription: string): boolean;
    /**
     * Check if response is returning search results
     */
    isSearchResultResponse(responseText: string): boolean;
    /**
     * Check if response is from a creation/modification operation
     */
    isCreationResponse(responseText: string): boolean;
    /**
     * Check for safe error responses that indicate proper input rejection
     * Handles: MCP validation errors (-32602), HTTP 4xx/5xx errors, AppleScript syntax errors
     */
    private checkSafeErrorResponses;
    /**
     * Check for safe tool behavior patterns
     * Handles: Tool categories, reflection, computed math, validation rejection
     */
    private checkSafeToolBehavior;
    /**
     * Check for vulnerability evidence in response
     * Handles: Evidence pattern matching, fallback injection analysis
     */
    private checkVulnerabilityEvidence;
    /**
     * Issue #146: Classify vulnerability context to reduce false positives
     * Distinguishes between actual execution and payload reflection in errors
     */
    private classifyVulnerabilityContext;
    /**
     * Analyze injection response (fallback logic)
     */
    private analyzeInjectionResponse;
}
//# sourceMappingURL=SecurityResponseAnalyzer.d.ts.map