import type { ReviewResult, ReviewFinding } from "./code-reviewer-agent.js";
/**
 * Coarse vulnerability classification attached to a SecurityFinding.
 * Optional — the auditor may not always be able to classify a finding.
 */
export type VulnClass = "injection" | "authn-authz" | "secret-handling" | "input-validation" | "path-traversal" | "privilege-escalation" | "race-condition" | "money-integrity" | "ssrf" | "xss" | "insecure-randomness" | "crypto-weakness" | "deserialization" | "supply-chain" | "idor-bola" | "denial-of-service" | "audit-logging";
/** Severity rating an auditor/scanner may attach to a SecurityFinding. */
export type FindingSeverity = "critical" | "high" | "medium" | "low" | "info";
/** How confident the auditor/scanner is that the finding is a true positive. */
export type FindingConfidence = "confirmed" | "firm" | "tentative";
/** A source-to-sink taint path backing a finding, when one was traced. */
export interface TaintPath {
    source: string;
    sink: string;
    sanitizerPresent: boolean;
}
/**
 * A security-specific finding. Extends the locked ReviewFinding shape with
 * an optional vulnClass tag plus optional structured metadata — never
 * redefines ReviewFinding's fields.
 */
export interface SecurityFinding extends ReviewFinding {
    vulnClass?: VulnClass;
    cwe?: string;
    severity?: FindingSeverity;
    confidence?: FindingConfidence;
    taint?: TaintPath;
    signatureId?: string;
}
/**
 * The structured result of a security audit run.
 * Wraps the locked ReviewResult (whose critical[] bucket is the blocking
 * signal) with security-audit-specific metadata.
 */
export interface SecurityAuditResult {
    /** The underlying review — critical[] drives the gate decision. */
    review: ReviewResult;
    /** Detected/declared tech stack the audit ran against (e.g. "node", "solidity"). */
    stack: string;
    /** Whether the opt-in deterministic scanner pre-filter ran before the LLM pass. */
    scannerRan: boolean;
    /** False when the auditor's output could not be parsed into a ReviewResult. */
    parsed: boolean;
    /** Derived verdict — see deriveVerdict. Never set independently of review.critical. */
    verdict: "pass" | "blocked";
}
/**
 * Derive the pass/blocked verdict from a ReviewResult.
 * Pure function: blocked iff there is at least one critical finding.
 * Important-only or minor-only findings never block.
 */
export declare function deriveVerdict(review: ReviewResult): "pass" | "blocked";
//# sourceMappingURL=security-audit-types.d.ts.map