/**
 * Sentori YAML config loader — .sentori.yml
 *
 * Schema:
 *
 *   version: 1
 *
 *   rules:
 *     - id: my-rule
 *       pattern: "AKIA[0-9A-Z]{16}"
 *       severity: critical
 *       message: "Hardcoded AWS key detected"
 *       files: "**\/*.{ts,js}"   # optional glob filter
 *
 *   ignore:
 *     - scanner: "Secret Leak Scanner"     # suppress all from scanner
 *     - scanner: "Prompt Injection Tester"
 *       file: "tests\/**"                  # scanner + file pattern
 *     - rule: "PINJ-001"                   # suppress by rule ID
 *     - file: "vendor\/**"                 # suppress all in path
 *
 *   overrides:
 *     - scanner: "Supply Chain Scanner"
 *       severity: high                     # override all findings in scanner
 *     - scanner: "Supply Chain Scanner"
 *       rule: "BASE64_HIDDEN_CMD"
 *       severity: critical                 # override specific rule
 */
import { Severity } from '../types';
export interface CustomRule {
    /** Unique identifier for this rule (used in findings as rule field) */
    id: string;
    /** Regex pattern to match against file content */
    pattern: string;
    /** Severity of findings produced by this rule */
    severity: Severity;
    /** Human-readable message describing the finding */
    message: string;
    /** Optional glob pattern to restrict which files are scanned (default: all) */
    files?: string;
}
export interface IgnoreEntry {
    /** Scanner name to suppress findings from */
    scanner?: string;
    /** Glob pattern — suppress findings whose file matches */
    file?: string;
    /** Rule ID to suppress (matches Finding.rule) */
    rule?: string;
}
export interface SeverityOverride {
    /** Scanner name to apply the override to */
    scanner: string;
    /** Optional rule ID — if omitted, applies to all findings from scanner */
    rule?: string;
    /** Target severity */
    severity: Severity;
}
export interface SentoriConfig {
    version: number;
    rules: CustomRule[];
    ignore: IgnoreEntry[];
    overrides: SeverityOverride[];
    /** Non-fatal warnings collected during config parsing (e.g. incomplete or invalid rules) */
    warnings: string[];
}
/**
 * Heuristic check for patterns that may cause catastrophic backtracking (ReDoS).
 * Flags: nested quantifiers (a+)+ and alternation-with-quantifier (a|b)+.
 * Not exhaustive — see docs/sentori-yml.md for guidance.
 */
export declare function hasPotentialReDoS(pattern: string): boolean;
/**
 * Load and validate .sentori.yml from the target directory.
 * Returns null if no config file is found.
 * Throws on parse or validation errors.
 */
export declare function loadSentoriConfig(targetDir: string): SentoriConfig | null;
//# sourceMappingURL=sentori-config.d.ts.map