import { ToolData, Violation, Rule, Detector, StateProvider, DetectorType, ThreatAction } from '../types';
/**
 * Map rule severity to recommended action, with optional rule action override.
 *
 * Default mapping:
 * - critical -> block (immediate threat)
 * - high -> confirm (needs user approval)
 * - medium -> warn (notify but allow)
 * - low -> log (record only)
 *
 * Rules can override default mapping via rule.action.
 */
export declare function mapSeverityToAction(rule: Rule): ThreatAction;
/**
 * Map rule category to scope description.
 */
export declare function mapCategoryToScope(category: string): string;
/**
 * Abstract base detector class.
 * Provides common functionality for all detectors.
 */
export declare abstract class BaseDetector implements Detector {
    abstract detect(toolData: ToolData, rule: Rule, sessionState: StateProvider): Violation | null;
    abstract getType(): DetectorType | string;
    /**
     * Generate unique violation ID using cryptographically secure random.
     */
    protected generateViolationId(): string;
    /**
     * Create violation object with standardized structure.
     */
    protected createViolation(rule: Rule, toolData: ToolData, additionalInfo?: Record<string, unknown>): Violation;
    /**
     * Extract value from object using JSON path
     */
    protected extractValue(obj: Record<string, unknown>, path: string): unknown;
}