/**
 * Rule Evolution Engine
 *
 * Automatically generates and refines detection rules based on
 * attack corpus data. Inspired by genetic/evolutionary approaches
 * (similar to Hermes Agent's GEPA).
 *
 * Process:
 * 1. Analyze missed attacks from corpus
 * 2. Extract common patterns (n-grams, keywords, structure)
 * 3. Generate candidate rules
 * 4. Evaluate against corpus (fitness = detection rate - false positive rate)
 * 5. Select best rules, mutate/crossover, repeat
 */
import type { DetectionRule } from "../types.js";
import type { Corpus } from "./corpus.js";
export type CandidateRule = DetectionRule & {
    /** How many attacks this rule catches. */
    truePositives: number;
    /** How many clean inputs this rule falsely flags. */
    falsePositives: number;
    /** Fitness score (higher = better). */
    fitness: number;
    /** Generation number. */
    generation: number;
    /** How this rule was created. */
    origin: "extracted" | "mutated" | "crossover" | "manual";
};
export type EvolutionConfig = {
    /** Maximum candidate rules per generation. */
    maxCandidates?: number;
    /** Minimum fitness to keep a rule. */
    minFitness?: number;
    /** Number of generations to run. */
    generations?: number;
    /** Clean inputs for false positive testing. */
    cleanInputs?: string[];
};
/**
 * Run the evolution engine.
 *
 * @returns Array of evolved rules that improve detection without adding false positives.
 */
export declare function evolveRules(corpus: Corpus, config?: EvolutionConfig): CandidateRule[];
/**
 * Re-evaluate the entire corpus with current scanner + evolved rules.
 * Updates detected/matchedRules for each sample.
 */
export declare function reevaluateCorpus(corpus: Corpus, evolvedRules: CandidateRule[]): {
    improved: number;
    stillMissed: number;
};
/**
 * Export evolved rules as DetectionRule[] for use in scanner.
 */
export declare function exportEvolvedRules(candidates: CandidateRule[]): DetectionRule[];