/**
 * Canonical contracts for unified static and dynamic scanning engines.
 * These interfaces define the shared model between static and dynamic engines.
 */
/**
 * Version metadata for contract compatibility tracking.
 * Follows semantic versioning: MAJOR.MINOR.PATCH
 */
export type VersionMetadata = {
    major: number;
    minor: number;
    patch: number;
    releaseDate?: string;
};
/**
 * Compatibility constraints for rule versions.
 * Used to determine if a rule can run on a given engine version.
 */
export type CompatibilityConstraint = {
    minEngineVersion: VersionMetadata;
    maxEngineVersion?: VersionMetadata;
    deprecated?: boolean;
    deprecationNotes?: string;
};
/**
 * Canonical rule definition.
 * Describes a security rule that can be executed by static and/or dynamic engines.
 */
export type RuleDefinition = {
    id: string;
    category: "prompt-injection" | "sensitive-data" | "api-key-leak" | "unsafe-output" | "ai-runtime-abuse" | "config-exposure" | "training-data-poisoning" | "model-dos" | "supply-chain" | "model-theft" | "excessive-agency" | "overreliance" | "workflow-security";
    severity: "low" | "medium" | "high" | "critical";
    name: string;
    description: string;
    fixSuggestion: string;
    version: VersionMetadata;
    compatibility: CompatibilityConstraint;
    requiresAnyTerms?: readonly string[];
    requiresAllTerms?: readonly string[];
    supportsStatic: boolean;
    supportsDynamic: boolean;
    tags?: readonly string[];
    references?: readonly string[];
};
/**
 * Static engine execution context.
 * Provides file content and line/column resolution for static analysis.
 */
export type StaticContext = {
    filePath: string;
    content: string;
    getLineFromOffset(offset: number): StaticSourceLine;
    getWindow(start: number, end: number, padding: number): string;
};
/**
 * Source line information for static analysis.
 */
export type StaticSourceLine = {
    line: number;
    column: number;
    text: string;
};
/**
 * Dynamic engine execution context.
 * Provides runtime request/response data for dynamic analysis.
 */
export type DynamicContext = {
    requestUrl: string;
    requestMethod: string;
    requestHeaders: Record<string, string>;
    requestBody?: unknown;
    responseStatus: number;
    responseHeaders: Record<string, string>;
    responseBody?: unknown;
    timestamp: number;
    executionDurationMs: number;
    spanId?: string;
    traceId?: string;
};
/**
 * Canonical finding schema.
 * Unified representation of a security finding from static or dynamic analysis.
 */
export type FindingSchema = {
    id: string;
    ruleId: string;
    engineType: "static" | "dynamic" | "hybrid";
    filePath?: string;
    line?: number;
    column?: number;
    ruleName: string;
    description: string;
    category: "prompt-injection" | "sensitive-data" | "api-key-leak" | "unsafe-output" | "ai-runtime-abuse" | "config-exposure" | "training-data-poisoning" | "model-dos" | "supply-chain" | "model-theft" | "excessive-agency" | "overreliance" | "workflow-security";
    severity: "low" | "medium" | "high" | "critical";
    message: string;
    excerpt?: string;
    evidence?: string;
    confidence: number;
    riskScore?: number;
    signalSummary?: string;
    fixSuggestion: string;
    pluginId: string;
    timestamp: number;
    version: VersionMetadata;
};
/**
 * Action decision for a finding.
 * Determines what action to take when a finding is detected.
 */
export type ActionDecision = "report" | "enforce" | "observe" | "suppress";
/**
 * Validation result for contract checks.
 */
export type ValidationResult = {
    isValid: boolean;
    errors: readonly string[];
    warnings?: readonly string[];
};
/**
 * Rule match result from detection.
 * Intermediate type between engine execution and FindingSchema.
 */
export type RuleMatch = {
    start: number;
    end: number;
    evidence: string;
    confidence: number;
    message?: string;
};