import type { SecurityRule } from "../data/rules/types.js";
export interface AppliedFix {
    ruleId: string;
    ruleName: string;
    severity: string;
    line: number;
    before: string;
    after: string;
}
export interface RemainingFinding {
    ruleId: string;
    name: string;
    severity: string;
    line: number;
    reason: "no_autofix" | "fix_rejected";
    fix: string;
    fixCode?: string;
}
export type SecureThisStatus = "clean" | "secured" | "partial" | "no_autofix";
export interface SecureThisResult {
    status: SecureThisStatus;
    changed: boolean;
    initialFindings: number;
    finalFindings: number;
    resolved: string[];
    applied: AppliedFix[];
    remaining: RemainingFinding[];
    passes: number;
    fixedCode: string;
    definitionOfDone: {
        passed: boolean;
        message: string;
    };
    /**
     * A runnable regression test that proves the resolved findings stay fixed.
     * Deterministic scan-based proof (GuardVibe is the oracle): run on the vulnerable
     * code it fails, on the fixed code it passes. Present only when fixes were applied.
     */
    proofTest?: string;
}
export interface SecureThisOptions {
    framework?: string;
    filePath?: string;
    configDir?: string;
    rules?: SecurityRule[];
    /** Hard backstop on apply passes (each accepted edit removes >=1 finding). */
    maxPasses?: number;
}
/**
 * Scan a file, apply only the fixes that verifiably land, and report a
 * definition-of-done gate.
 */
export declare function secureThis(code: string, language: string, opts?: SecureThisOptions): SecureThisResult;