/**
 * Test Validity Analyzer
 *
 * Detects when security test responses are suspiciously uniform,
 * indicating tests may not have reached security-relevant code paths.
 *
 * @see Issue #134: Detect identical security test responses (test validity masking)
 */
import type { SecurityTestResult } from "../../../../lib/assessment/resultTypes.js";
import type { TestValidityWarning } from "../../../../lib/assessment/resultTypes.js";
/**
 * Configuration for test validity analysis
 */
export interface TestValidityConfig {
    /** Percentage threshold to trigger warning (default: 80) */
    warningThresholdPercent: number;
    /** Percentage threshold to reduce confidence (default: 90) */
    confidenceReduceThresholdPercent: number;
    /** Minimum tests required for analysis (default: 10) */
    minimumTestsForAnalysis: number;
    /** Maximum response length to compare (default: 1000) */
    maxResponseCompareLength: number;
    /** Maximum sample payload-response pairs (default: 10) */
    maxSamplePairs: number;
    /** Maximum response distribution entries (default: 5) */
    maxDistributionEntries: number;
}
/**
 * Result of test validity analysis
 */
export interface TestValidityResult {
    /** Whether test validity is compromised */
    isCompromised: boolean;
    /** Warning level: none, warning, critical */
    warningLevel: "none" | "warning" | "critical";
    /** Recommended confidence adjustment */
    recommendedConfidence: "high" | "medium" | "low";
    /** Detailed warning information */
    warning?: TestValidityWarning;
    /** Per-tool uniformity analysis */
    toolUniformity?: Map<string, {
        identicalCount: number;
        totalCount: number;
        percentageIdentical: number;
    }>;
}
/**
 * Analyzes security test results for response uniformity.
 *
 * When a high percentage of test responses are identical, it indicates
 * that tests may be hitting a configuration error, connection issue,
 * or other problem that prevents them from reaching security-relevant code.
 */
export declare class TestValidityAnalyzer {
    private config;
    constructor(config?: Partial<TestValidityConfig>);
    /**
     * Analyze test results for response uniformity
     *
     * @param testResults - Array of security test results with responses
     * @returns Analysis result with warning details if uniformity detected
     */
    analyze(testResults: SecurityTestResult[]): TestValidityResult;
    /**
     * Normalize response for comparison.
     * Removes timestamps, UUIDs, request IDs, and other variable content.
     */
    private normalizeResponse;
    /**
     * Count occurrences of normalized responses
     */
    private countNormalizedResponses;
    /**
     * Find the most common response
     */
    private findMostCommon;
    /**
     * Find original (non-normalized) sample that matches the normalized pattern
     */
    private findOriginalSample;
    /**
     * Detect the category of the response pattern
     */
    private detectPatternCategory;
    /**
     * Analyze uniformity per tool
     */
    private analyzePerTool;
    /**
     * Generate human-readable explanation
     */
    private generateExplanation;
    /**
     * Calculate Shannon entropy for response diversity (0=uniform, 1=max diversity)
     */
    private calculateEntropy;
    /**
     * Build response distribution sorted by frequency
     */
    private buildResponseDistribution;
    /**
     * Extract attack category from test name
     */
    private extractAttackCategory;
    /**
     * Analyze attack pattern correlation by category
     */
    private analyzeAttackPatterns;
    /**
     * Collect sample payload-response pairs with category diversity
     */
    private collectSamplePairs;
    /**
     * Collect response metadata statistics
     */
    private collectResponseMetadata;
}
//# sourceMappingURL=TestValidityAnalyzer.d.ts.map