import type { BoberConfig } from "../config/schema.js";
import type { SprintContract } from "../contracts/sprint-contract.js";
import type { EvaluationRunResult } from "../evaluators/registry.js";
import type { ReviewResult } from "./code-reviewer-agent.js";
import type { SecurityAuditResult, SecurityFinding } from "./security-audit-types.js";
import type { SecurityDiffProvider } from "./security-knowledge/diff-provider.js";
import type { SecurityVerifier } from "./security-verifier-agent.js";
/**
 * Injectable dependencies for `runSecurityAudit`. `diffProvider` (sprint 6)
 * and `verifier` (sprint 8) so tests never shell real git or spawn a second
 * real LLM loop; both default to the real implementations. Appended so all
 * existing positional callers stay byte-compatible.
 */
export interface SecurityAuditDeps {
    diffProvider?: SecurityDiffProvider;
    verifier?: SecurityVerifier;
}
/**
 * Run the bober-security-auditor subagent for a stack-aware security audit.
 *
 * Mirrors runCodeReviewer's structure (prompt build → runAgenticLoop with
 * read-only tools → parse → persist) but the parse is FAIL-CLOSED: an
 * unparseable auditor response resolves with `parsed:false` and a forced
 * `verdict:'blocked'` — it never silently degrades to a clean pass the way
 * the advisory code reviewer's fallback does.
 *
 * Two distinct failure modes (per arch-20260712-security-audit-agent-team
 * API contracts):
 * - Provider/network/budget error → THROWS (propagates to the caller).
 * - Unparseable auditor output → RESOLVES with `parsed:false`, `verdict:'blocked'`.
 *
 * @param contract    The sprint contract to audit.
 * @param evaluation  The evaluation result when running in-pipeline (post-evaluation),
 *                    or `null` for standalone mode — the evaluation-context section of
 *                    the prompt is omitted entirely when null.
 * @param projectRoot Absolute path to the project root.
 * @param config      The resolved bober configuration (reads `config.security` and
 *                    `config.project.stack`; both optional).
 * @param priors      Deterministic scanner findings supplied directly by the caller.
 *                    Combined with any findings produced internally by
 *                    `runScannerPreFilter` when `config.security.scanners` is
 *                    non-empty; the combined list is rendered into a "ground
 *                    truth priors" prompt section when non-empty. Defaults to [].
 * @param deps        Injectable dependencies — the diff provider (sprint 6,
 *                    defaults to `securityDiffProvider`) and the verifier
 *                    (sprint 8, defaults to `runSecurityVerifier`). Appended
 *                    last so all existing positional callers stay byte-compatible.
 * @returns A SecurityAuditResult, already persisted via saveSecurityAudit.
 */
export declare function runSecurityAudit(contract: SprintContract, evaluation: EvaluationRunResult | null, projectRoot: string, config: BoberConfig, priors?: SecurityFinding[], deps?: SecurityAuditDeps): Promise<SecurityAuditResult>;
/**
 * Parse the security auditor's response into a ReviewResult.
 *
 * Reuses the same resilient extraction ladder as
 * code-reviewer-agent.ts:parseReviewResult (direct parse → markdown-fence →
 * first-`{`-to-last-`}` slice), but INVERTS its fallback: on any parse
 * failure (garbage text, truncated JSON, non-object shape), this returns
 * `parsed:false` with an empty review — never a silently "clean" result.
 * The caller forces `verdict:'blocked'` whenever `parsed` is false.
 *
 * A genuinely clean audit (empty critical, well-formed JSON) is
 * `parsed:true` — distinguishable from the parse-failure case.
 */
export declare function parseSecurityAuditResult(text: string, contractId: string, specId: string): {
    review: ReviewResult;
    parsed: boolean;
};
//# sourceMappingURL=security-auditor-agent.d.ts.map