import type { Capability } from '../chains/Capability.js';
import type { Finding } from '../findings/Finding.js';
/** The Enterprise ATT&CK release every technique below was checked against. */
export declare const ATTACK_RELEASE = "20.0";
/** The Enterprise matrix's tactic order in the pinned release, earliest stage first (RULE-116). */
export declare const ATTACK_TACTIC_ORDER: readonly string[];
export interface AttackTechnique {
    id: string;
    name: string;
    /** Tactic short names as the pinned release spells them. */
    tactics: string[];
    release: string;
    url: string;
    /** Provenance gate: true only once id, name, tactics and fit are recorded in the verification worksheet. */
    verified: boolean;
}
export declare const ATTACK_TECHNIQUES: Record<string, AttackTechnique>;
/**
 * What an attacker does with each capability. A technique sits here only if it fits every finding
 * that grants the capability; a finding it does not fit overrides it in its registry entry
 * (`CapabilityEntry.techniques`).
 */
export declare const CAPABILITY_TECHNIQUES: Record<Capability, string[]>;
/**
 * Detection gaps: the technique a finding leaves unobserved (RULE-108). Never a technique the
 * finding grants, and never added to a chain step.
 */
export declare const DETECTION_GAP_TECHNIQUES: Record<string, string[]>;
/** RULE-109: on only while every capability has a verified technique. */
export declare const ATTACK_OUTPUT_ENABLED = true;
/** Verified techniques for one capability as granted by this finding id. */
export declare function techniquesForGrant(findingId: string, capability: Capability): string[];
/** Verified techniques for every capability the finding grants; none for capabilities it only requires. */
export declare function attackFor(finding: Finding): string[] | undefined;
/** Verified techniques this detection-gap finding leaves unobserved. */
export declare function detectsFor(finding: Finding): string[] | undefined;
/** "T1213.004 Customer Relationship Management Software" — for text outputs. */
export declare function techniqueLabel(id: string): string;
/** Capabilities with no verified technique; RULE-109 requires this to be empty while output is on. */
export declare function capabilitiesWithoutTechnique(): Capability[];
/** Position of the earliest tactic among these verified techniques; undefined when there are none. */
export declare function tacticRank(ids: readonly string[] | undefined): number | undefined;
/**
 * Where a step sits in tactic order: its own techniques, or, when its finding has none, the
 * default technique of the capability it grants. The default orders the step and is never
 * rendered on it. An inferred step has no rank of its own.
 */
export declare function stepTacticRank(step: {
    capability: Capability;
    capabilityInferred?: true;
    techniques?: string[];
}): number | undefined;
/**
 * Steps in ATT&CK tactic order (RULE-116). A step without a rank takes the earliest rank in its
 * precondition group, else the rank of the group before it, else of the step before it; ties keep
 * their order. Sorting changes no step, only where it is listed.
 */
export declare function orderStepsByTactic<T extends {
    capability: Capability;
    capabilityInferred?: true;
    techniques?: string[];
}>(steps: readonly T[], groupOf?: (step: T) => number | undefined): T[];
//# sourceMappingURL=attack.d.ts.map