/**
 * security-hub.ts — maps SecurityAuditResult findings into the canonical hub
 * Finding shape and emits them via an injected sink (spec-20260712-security-
 * audit-agent-team, sprint 6). Closes the ADR open question at
 * .bober/architecture/arch-20260712-security-audit-agent-team-architecture.md:363
 * ("wiring important findings into the priority hub ... must respect the
 * hub's canonical FindingSchema").
 *
 * Two callers wire this module in AFTER the audit's verdict is already
 * computed: the pipeline gate (security-gate.ts) and the standalone CLI
 * (security-audit.ts). Neither call site awaits emission inside a
 * time-boxed race, and a hub failure never changes the verdict or exit code
 * — emission is a best-effort side effect (nonGoals[3]).
 *
 * Mirrors the injected-FindingSink precedent in src/research/runner.ts:
 * the mapper is PURE (never reads the clock — `now` is injected by the
 * caller) and the sink is a dependency the caller binds to the real
 * `ingestFinding` (src/hub/finding-store.ts) at the fs boundary.
 */
import type { Finding } from "../hub/finding.js";
import type { SecurityAuditResult } from "./security-audit-types.js";
import type { Logger } from "../utils/logger.js";
/** Hub Finding emitter — mirrors research runner's FindingSink (runner.ts:44). */
export type SecurityFindingSink = (finding: Finding) => Promise<void>;
/**
 * Map a SecurityAuditResult into hub Findings — one per critical (severity
 * 5) and important (severity 3) finding. `minor` and `approvedAreas` are
 * never emitted (nonGoals[2]) — the LLM auditor did not confirm those into a
 * blocking or notable bucket. A clean audit (no critical/important) returns
 * `[]`.
 *
 * PURE: never reads the clock — `now` is injected by the caller.
 */
export declare function mapAuditToFindings(result: SecurityAuditResult, now: string): Finding[];
/**
 * Map and emit a SecurityAuditResult's findings through the injected sink.
 *
 * Best-effort: never throws. A failure raised by the sink (or by the
 * mapping) is caught and logged via `log.warn` — it must NEVER alter the
 * audit verdict or block the pipeline/CLI (sc-6-2). Callers invoke this
 * strictly AFTER the verdict has already been computed and OUTSIDE any
 * time-boxed race (nonGoals[3]).
 */
export declare function emitSecurityFindings(result: SecurityAuditResult, sink: SecurityFindingSink, log: Pick<Logger, "warn">, now: string): Promise<void>;
//# sourceMappingURL=security-hub.d.ts.map