export interface ScanDepsInput {
    project_id?: string;
}
export interface DepAdvisory {
    name: string;
    severity: string;
    title: string;
    url: string;
    fix_available: boolean;
}
export interface ScanDepsOutput {
    /**
     * Advisories affecting *production* dependencies — the set the overall grade
     * is computed from, because this is what actually reaches a consumer.
     */
    total_advisories: number;
    by_severity: Record<string, number>;
    advisories: DepAdvisory[];
    /**
     * Advisories that only affect devDependencies. Reported, never graded: these
     * packages are excluded from the published tarball by package.json `files`,
     * so a vite dev-server CVE cannot reach anyone who installs this package.
     *
     * Grading them would make the pre-push gate unsatisfiable by any change to
     * the repository, which trains people to bypass the gate entirely.
     */
    dev_advisories: {
        total: number;
        by_severity: Record<string, number>;
        advisories: DepAdvisory[];
    };
}
export interface ScanSecretsInput {
    project_id?: string;
    directories?: string[];
}
export interface ScanSecretsOutput {
    findings: Array<{
        file: string;
        line: number;
        pattern: string;
        /** The match with the secret value replaced (ISS-0192). Never the value. */
        snippet: string;
        /** `sha256:<12 hex>` of the value, for allowlisting without storing it. */
        fingerprint: string;
    }>;
    total_findings: number;
    allowlisted: number;
}
export interface ScanHttpOutput {
    checks: Array<{
        name: string;
        status: 'pass' | 'fail' | 'warn';
        detail: string;
    }>;
    score: string;
}
export interface ScanConfigOutput {
    checks: Array<{
        name: string;
        status: 'pass' | 'fail' | 'warn';
        detail: string;
    }>;
    config_path: string;
}
export interface ScanHeadersInput {
    url: string;
    check_observatory?: boolean;
}
export interface ScanHeadersOutput {
    url: string;
    present_headers: Array<{
        name: string;
        value: string;
    }>;
    missing_headers: Array<{
        name: string;
        recommended_value: string;
        severity: 'critical' | 'high' | 'medium';
    }>;
    info_leak_headers: Array<{
        name: string;
        value: string;
    }>;
    cors: {
        origin: string | null;
        credentials: boolean;
    };
    observatory?: {
        grade: string;
        score: number;
    };
    grade: string;
}
export interface GuardianReportOutput {
    overall_grade: string;
    sections: {
        deps: ScanDepsOutput;
        secrets: ScanSecretsOutput;
        http: ScanHttpOutput;
        config: ScanConfigOutput;
    };
    generated_at: string;
}
export declare function redactMatch(name: string, match: RegExpExecArray): {
    snippet: string;
    fingerprint: string;
};
/** Turn `npm audit --json` output into a flat advisory list. Exported for tests. */
export declare function parseAuditJson(raw: string): DepAdvisory[];
/** Exported for tests. */
export declare function countBySeverity(advisories: DepAdvisory[]): Record<string, number>;
export declare function scanDeps(input: ScanDepsInput): Promise<ScanDepsOutput>;
export declare function scanSecrets(input: ScanSecretsInput): Promise<ScanSecretsOutput>;
export declare function scanHttp(): Promise<ScanHttpOutput>;
export declare function scanHeaders(input: ScanHeadersInput): Promise<ScanHeadersOutput>;
export declare function scanConfig(): Promise<ScanConfigOutput>;
export declare function guardianReport(input: {
    project_id?: string;
}): Promise<GuardianReportOutput>;
//# sourceMappingURL=guardian.d.ts.map