/**
 * Full Audit — single source of truth for AI assistants.
 * Orchestrates all security tools in one call, produces:
 * - PASS/FAIL/WARN verdict
 * - Unified report across code, secrets, deps, config, taint, auth
 * - Deterministic result hash (same code = same hash)
 * - Coverage metrics (files scanned, rules applied, %)
 */
export type AuditVerdict = "PASS" | "WARN" | "FAIL";
export interface AuditCoverage {
    filesScanned: number;
    filesSkipped: number;
    totalFiles: number;
    coveragePercent: number;
    rulesApplied: number;
}
export interface FindingRef {
    ruleId: string;
    severity: string;
    file: string;
    line: number;
    [key: string]: unknown;
}
export interface SectionFinding {
    ruleId: string;
    severity: string;
    file: string;
    line: number;
    name?: string;
    description?: string;
    fix?: string;
    /** Dependency findings: is the vulnerable package actually imported in source? */
    reachable?: boolean;
}
/**
 * Order dependency findings by severity first, then surface reachable (imported)
 * packages ahead of unreachable ones within the same tier — so the agent fixes
 * what its code actually calls into first. Severity is never altered (an
 * unreachable dep can still be exploitable), so this introduces no false negatives.
 */
export declare function sortDepFindings(findings: SectionFinding[]): SectionFinding[];
export interface AuditSection {
    name: string;
    status: "ok" | "error" | "skipped";
    findings: number;
    critical: number;
    high: number;
    medium: number;
    details: string;
    /** Individual findings for this section — enables AI to see exactly what to fix */
    sectionFindings?: SectionFinding[];
    /** True when sectionFindings array is shorter than findings (response-size cap). Read findings for the real count. */
    truncated?: boolean;
    /** Hint message when truncated — tells the agent how to retrieve the rest */
    truncationHint?: string;
}
export interface AuditResult {
    verdict: AuditVerdict;
    score: number;
    grade: string;
    coverage: AuditCoverage;
    resultHash: string;
    timestamp: string;
    sections: AuditSection[];
    truncation: {
        truncated: boolean;
        maxFindings: number;
        totalFindings: number;
        taintFileCap: number;
        taintFilesProcessed: number;
    };
    summary: {
        totalFindings: number;
        critical: number;
        high: number;
        medium: number;
    };
    actionItems: string[];
}
/**
 * Compute verdict: PASS (0 critical + 0 high), WARN (high > 0), FAIL (critical > 0)
 */
export declare function computeVerdict(critical: number, high: number, _medium: number): AuditVerdict;
/**
 * Compute coverage metrics from scan results.
 */
export declare function computeCoverage(filesScanned: number, filesSkipped: number, rulesApplied: number): AuditCoverage;
/**
 * Compute deterministic SHA256 hash of findings.
 * Same findings (in any order) = same hash.
 */
export declare function computeResultHash(findings: FindingRef[]): string;
/**
 * Run a full security audit — single source of truth.
 * Orchestrates code scan, secret scan, dependency scan, config audit,
 * taint analysis, and auth coverage in one call.
 */
export declare function runFullAudit(path: string, options?: {
    skipDeps?: boolean;
    skipSecrets?: boolean;
    full?: boolean;
}): Promise<AuditResult>;
/**
 * Build a SARIF v2.1.0 document from a full audit result.
 * Covers every section (code, secrets, dependencies, config, taint, auth-coverage)
 * — richer than `scan --format sarif`, which is code-only.
 * Note: for complete CI coverage, run the audit with `full: true` so sectionFindings
 * are not capped before they reach this formatter.
 */
export declare function formatAuditSarif(result: AuditResult): string;
export declare function formatAuditResult(result: AuditResult, format: "markdown" | "json" | "terminal" | "sarif"): string;