/**
 * `security-ast-scan` tool — Contract-based Security & Performance AST Radar.
 *
 * Scans code files or snippets for anti-patterns that static types cannot catch:
 * 1. N+1 Database Query loops (Performance critical)
 * 2. SQL Injection / Raw query interpolation (Security critical)
 * 3. Hardcoded secrets, API tokens, and private keys
 * 4. Prototype Pollution vulnerabilities
 * 5. ReDoS (Regular Expression Denial of Service) nested backtracking
 * 6. Unsafe dynamic execution (eval, new Function, unsanitized child_process.exec)
 */
import type { Tool } from '@wrongstack/core/types';
export interface SecurityFinding {
    ruleId: 'perf/n-plus-one-query' | 'sec/sql-injection' | 'sec/hardcoded-secret' | 'sec/prototype-pollution' | 'sec/redos-vulnerable-regex' | 'sec/unsafe-dynamic-exec';
    category: 'security' | 'performance';
    severity: 'critical' | 'warning' | 'info';
    file: string;
    line: number;
    message: string;
    snippet: string;
    recommendation: string;
}
export interface SecurityScanInput {
    /** File path to scan (relative to project root or absolute). */
    file?: string | undefined;
    /** Direct code content to scan (optional, if scanning unwritten draft). */
    content?: string | undefined;
    /** Specific rule IDs to enable or filter by. */
    rules?: string[] | undefined;
}
export interface SecurityScanOutput {
    status: 'clean' | 'findings_detected';
    filesScanned: number;
    totalFindings: number;
    criticalCount: number;
    warningCount: number;
    findings: SecurityFinding[];
    summary: string;
}
export declare function analyzeSecurityAndPerformance(filePath: string, content: string): SecurityFinding[];
export declare const securityAstScanTool: Tool<SecurityScanInput, SecurityScanOutput>;
//# sourceMappingURL=security-ast-scan-tool.d.ts.map