/**
 * RuleSpec - Core Abstraction for Deterministic Tenant Isolation Rules
 *
 * Each rule answers: "Is there a path from X to Y without Z?"
 *
 * Pattern-based detection with deterministic rules.
 * Every finding is explainable with: rule ID, path, line number, missing guard.
 */
import type { Severity, Finding, IR, FlowGraph, Evidence } from './types.js';
export interface ComplianceMapping {
    owaspMcpRef?: string;
    cweIds: string[];
    safeAssertion: string;
    unsafeAssertions: string[];
}
export interface RuleSpec {
    id: string;
    category: string;
    title: string;
    description: string;
    severity: Severity;
    sources: string[];
    sinks: string[];
    requiredGuards: string[];
    positiveControls: string[];
    compliance: ComplianceMapping;
    version: string;
    executionOrder: number;
    requiresFlowGraph: boolean;
    suppressible: boolean;
    evaluate: (ir: IR, graph: FlowGraph) => Finding[];
}
export interface CreateRuleOptions {
    id: string;
    category: string;
    title: string;
    description: string;
    severity: Severity;
    requiredGuards: string[];
    positiveControls?: string[];
    owaspMcpRef?: string;
    cweIds?: string[];
    executionOrder?: number;
    requiresFlowGraph?: boolean;
    suppressible?: boolean;
    evaluate: (ir: IR, graph: FlowGraph) => Finding[];
}
export declare function createRule(options: CreateRuleOptions): RuleSpec;
export declare function buildEvidence(file: string, lineStart: number, lineEnd: number, codeSnippet: string): Evidence;
export declare function buildFinding(ruleId: string, title: string, severity: Severity, description: string, evidence: Evidence, missingGuards: string[], presentGuards: string[]): Finding;
/**
 * v1 fingerprint (legacy, line-dependent).
 * Identity: ruleId:file:lineStart
 * NOT stable under line movement or formatting changes.
 * Retained for migration compatibility.
 */
export declare function generateFingerprint(ruleId: string, file: string, line: number): string;
/**
 * v2 fingerprint (semantic, stable under line movement).
 * Identity: ruleId:file:normalizedCodeSnippet:sortedMissingGuards
 * Stable under:
 * - Line movement (line number is metadata, not identity)
 * - Whitespace/formatting changes (code snippet is normalized)
 * - Guard ordering (missing guards are sorted)
 * NOT stable under:
 * - File rename (file path is part of identity — intentional)
 * - Rule ID change (rule ID is part of identity — intentional)
 * - Semantic code change (code snippet changes — intentional)
 */
export declare function generateFingerprintV2(ruleId: string, file: string, codeSnippet: string, missingGuards: string[]): string;
/**
 * Migrate a v1 fingerprint to v2 if possible.
 * Returns the v2 fingerprint if the original finding details are available,
 * otherwise returns the v1 fingerprint unchanged (cannot migrate without details).
 */
export declare function migrateFingerprintV1ToV2(v1Fingerprint: string, ruleId: string, file: string, line: number, codeSnippet: string, missingGuards: string[]): string;
//# sourceMappingURL=rule-spec.d.ts.map