/**
 * Unified Security Finding — bridges static analysis (CLI) and dynamic
 * analysis (SDK runtime / workflow checkpoints) findings into a single
 * data model that enables cross-plane correlation.
 *
 * Phase 1: Type definitions and adapter functions.
 * Phase 4: Correlation engine that matches static findings to runtime alerts.
 */
import type { Finding } from "../rules/types";
import type { DynamicFinding } from "../sdk/types";
export type SecurityFindingSource = "static" | "runtime" | "workflow" | "cli-scan";
export type SecurityFinding = {
    /** Unique identifier. Static: `filePath:ruleId:line:column`. Runtime: `finding.id`. */
    id: string;
    /** Rule identifier, e.g. "prompt-injection-ignore-prior-instructions" */
    ruleId: string;
    /** Human-readable rule name */
    ruleName: string;
    /** Finding severity */
    severity: "low" | "medium" | "high" | "critical";
    /** Detection category */
    category: string;
    /** Source plane: static (CLI code scan) or runtime (SDK live traffic) */
    sourceType: SecurityFindingSource;
    /** Source reference: file path for static, URL for runtime */
    sourceRef: string;
    /** When the finding was created (ISO 8601) */
    occurredAt: string;
    /** Matched evidence / excerpt */
    evidence: string;
    /** Detection confidence (0-1) */
    confidence: number;
    /** Risk score (0-1) */
    riskScore?: number;
    /** Human-readable summary */
    message: string;
    /** Suggested fix */
    fixSuggestion?: string;
    /** Free-form metadata (workflow context, checkpoint kind, platform, etc.) */
    metadata: Record<string, unknown>;
};
/** Convert a static CLI Finding to a unified SecurityFinding. */
export declare function fromStaticFinding(finding: Finding): SecurityFinding;
/** Convert a runtime SDK DynamicFinding to a unified SecurityFinding. */
export declare function fromRuntimeFinding(finding: DynamicFinding, sourceRef?: string): SecurityFinding;
/**
 * Compute a weak correlation key for matching static + runtime findings.
 * Two findings with the same ruleId AND overlapping source context may be
 * related — e.g. a static scan found an API key leak in config.ts, and a
 * runtime alert fired on the same API key in production traffic.
 */
export declare function correlationKey(finding: SecurityFinding): string;
/**
 * Returns true if two findings could be correlated — same rule, same
 * category, and temporal proximity (runtime finding occurred after the
 * static scan).
 */
export declare function isCorrelated(staticFinding: SecurityFinding, runtimeFinding: SecurityFinding, maxTimeDeltaMs?: number): boolean;