import type { RiskLevel } from '@cclabsnz/sf-core';
import type { AuditResult } from '../findings/AuditResult.js';
import type { AuditRenderer } from './AuditRenderer.js';
/**
 * SARIF 2.1.0 output, for GitHub code scanning and other SARIF consumers.
 *
 * The audit inspects an org's configuration, not files, so there is no real source location.
 * Each result carries:
 *   - a logical location per affected item (the actual subject of the finding), and
 *   - a synthetic physical location, `salesforce-org/<ruleId>`, because GitHub code scanning
 *     only displays results that have a physicalLocation with an artifactLocation.uri. The
 *     file does not exist in the repository; it groups alerts by check in the UI.
 *
 * Results carry a `partialFingerprints` entry derived from the rule id and the finding id, so
 * the same finding on the next run updates the existing alert instead of opening a new one.
 * Finding ids are stable per subject (checks embed the user / domain / component they are
 * about), whereas affected-item lists change size between runs.
 *
 * Only actionable findings become results. Passing checks are omitted, and inconclusive
 * checks (no evidence, usually a missing permission) are reported as tool execution
 * notifications with `executionSuccessful: false`, never as error/warning alerts.
 */
export type SarifLevel = 'error' | 'warning' | 'note' | 'none';
/** Fingerprint key. Bump the version suffix if the hashed inputs ever change. */
export declare const FINGERPRINT_KEY = "sfAuditFindingHash/v1";
/** Root of the synthetic artifact path every result points at. */
export declare const ORG_ARTIFACT_ROOT = "salesforce-org";
export declare function riskToSarifLevel(level: RiskLevel): SarifLevel;
export declare class SarifRenderer implements AuditRenderer {
    readonly format = "sarif";
    readonly fileExtension = ".sarif";
    readonly filenamePrefix = "sf-audit";
    render(result: AuditResult): string;
    private ruleFor;
    /**
     * One SARIF result per actionable finding. Accepted-risk waivers, when they land, attach
     * here as `suppressions` (SARIF 3.27.23) rather than by dropping the result, so consumers
     * can still see the finding and that it was waived.
     */
    private findingResult;
    private chainResult;
}
//# sourceMappingURL=SarifRenderer.d.ts.map