import type { RiskLevel } from '@cclabsnz/sf-core';
import type { Finding } from '../findings/Finding.js';
import type { Capability } from './Capability.js';
/**
 * Findings a chain reads: by exact id, by id prefix, or any finding granting one of the capabilities.
 * A group is satisfied by any one member; a chain that needs two capabilities lists two groups.
 */
export interface FindingGroup {
    ids?: readonly string[];
    prefixes?: readonly string[];
    capabilities?: readonly Capability[];
    /**
     * The capability this group's findings contribute to the chain. A step shows it when its finding
     * grants it; otherwise the step shows the finding's first grant. Matching never reads it.
     */
    role?: Capability;
}
/**
 * A named chain as a structured abuse case (RULE-110). `preconditions` are the groups `match()`
 * reads, built from the same constants; `breakPoint` indexes the one group whose complete removal
 * stops the chain (RULE-111). The prose fields name roles, never people or finding ids (RULE-112).
 */
export interface AbuseCaseDef {
    actor: string;
    goal: string;
    preconditions: readonly FindingGroup[];
    breakPoint: number;
    /** What to fix to break the chain, in plain language for every output. */
    breakPointText: string;
    /**
     * ATT&CK tactics the chain's steps must start at and reach, in tactic order (RULE-117). Absent
     * where the steps that would show them carry no verified technique.
     */
    tactics?: {
        entry?: string;
        goal?: string;
    };
}
export interface NamedChainDef {
    id: string;
    title: string;
    severity: RiskLevel;
    narrative: string;
    remediation: string;
    abuseCase: AbuseCaseDef;
    /** Returns the member findings (chain steps) if present in this org, else null. */
    match(present: Set<Capability>, active: Finding[]): Finding[] | null;
}
/** True when the finding belongs to the group (a capability group matches on granted capabilities). */
export declare function inGroup(f: Finding, g: FindingGroup): boolean;
export declare const GUEST_EXPOSURE: string[];
export declare const LOW_TRUST_ENTRY: string[];
export declare const NON_ADMIN_ESCALATION: string[];
export declare const UNAUTH_EXFIL_STEPS: string[];
export declare const UNAUTH_EXFIL_WIDENERS: string[];
export declare const GUEST_TRAFFIC: string[];
export declare const GUEST_BULK_SURFACE: string[];
export declare const TAKEOVER_ADMIN_EVIDENCE: string[];
export declare const EXPOSED_SECRETS: string[];
export declare const EGRESS_PATHS: string[];
export declare const SOQL_INJECTION: string[];
export declare const SOQL_READ_SINKS: string[];
export declare const AGENT_GUEST_CHANNEL: string[];
export declare const AGENT_PRIVILEGE: string[];
export declare const AGENT_WRITE_ACTIONS: string[];
export declare const ACTIVE_AGENTS: string[];
export declare const STALE_TRUSTED_URL: string[];
export declare const AGENT_NO_CAPTURE: string[];
export declare const AGENT_QUERY_REACH: string[];
export declare const AGENT_OUTBOUND: string[];
export declare const UNTRUSTED_INPUT: string[];
export declare const SANDBOX_PII: string[];
export declare const SANDBOX_WEAK_CONTROLS: string[];
export declare const INSIDER_BROAD_READ: string[];
export declare const INSIDER_BULK_EGRESS: string[];
export declare const INSIDER_BLIND_SPOT: string[];
export declare const DETECTION_BLIND_SPOTS: string[];
export declare const EXPLOITABLE_ACCESS: readonly Capability[];
export declare const MFA_WEAKNESS: string[];
export declare const PRIVILEGED_ACCOUNTS: string[];
export declare const OAUTH_STANDING: string[];
export declare const OAUTH_UNCONTAINED: string[];
export declare const SELF_REGISTRATION: string[];
export declare const PORTAL_REACH: string[];
export declare const SOCIAL_SIGN_ON: string[];
export declare const SESSION_ID_LEAK: string[];
export declare const SESSION_UNCHECKED: string[];
export declare const ANONYMOUS_FILES: string[];
export declare const FILES_UNACCOUNTED: string[];
export declare const VF_XSS: string[];
export declare const BROWSER_WEAKENED: string[];
export declare const SESSION_TARGETS: string[];
export declare const OPEN_EMAIL_HANDLER: string[];
export declare const EMAIL_FOLLOW_ON: string[];
export declare const EVENT_SUBSCRIBER_ESCALATION: string[];
export declare const EVENT_PUBLISHER_FOOTHOLD: string[];
export declare const EVENT_PRIVILEGED_TARGETS: string[];
export declare const NAMED_CHAINS: NamedChainDef[];
//# sourceMappingURL=namedChains.d.ts.map