import type { Artifact } from "./types/artifact.js";
import type { Finding } from "./types/diagnostics.js";
import type { ParsedDocument } from "./types/metadata.js";
import { type SecurityAnalysisCoverage } from "./types/security-analysis-coverage.js";
import type { SecurityConfig } from "./types/configuration.js";
import type { PlainTextSupportSecurityReachability } from "./static-support.js";
/** Stable Finding identities owned by the security rule-definition registry. */
export declare const SECURITY_RULE_FINDING_DIAGNOSTIC_IDS: readonly ("QUAL-SKILL-DESCRIPTION-HIGH-RISK-LITERAL" | "SEC-BODY-POLICY-CONTRADICTION" | "SEC-BULK-DATA-SHARING-INSTRUCTION" | "SEC-CLOUD-UPLOAD-INSTRUCTION" | "SEC-CREDENTIAL-IN-COMMAND-ARG" | "SEC-DANGEROUS-TOOL-INSTRUCTION" | "SEC-DESTRUCTIVE-COMMAND" | "SEC-EXECUTABLE-AS-POLICY-AUTHORITY" | "SEC-EXTERNAL-UPLOAD-INSTRUCTION" | "SEC-FORBIDDEN-INPUT-INSTRUCTION" | "SEC-HIDDEN-FRONTMATTER-INSTRUCTION" | "SEC-HIDDEN-OPERATIONAL-INSTRUCTION" | "SEC-INSTRUCTION-HIERARCHY-OVERRIDE" | "SEC-INSTRUCTION-VIOLATES-POLICY" | "SEC-INVALID-CANONICAL-POLICY-METADATA" | "SEC-INVALID-RENMA-POLICY-METADATA" | "SEC-MISSING-HUMAN-APPROVAL-GUARD" | "SEC-MISSING-POLICY-METADATA" | "SEC-NO-REDACTION-INSTRUCTION" | "SEC-OVERBROAD-CONTEXT-INSTRUCTION" | "SEC-POLICY-CONTRADICTION" | "SEC-POLICY-OVERRIDE-CONTRADICTION" | "SEC-POLICY-PROFILE-CYCLE" | "SEC-POLICY-PROFILE-NOT-FOUND" | "SEC-PREDICTABLE-TEMP-PATH" | "SEC-PRIVILEGED-COMMAND-WITHOUT-GUARD" | "SEC-RISKY-OPERATION-ERROR-SUPPRESSION" | "SEC-SAFEGUARD-BYPASS-INSTRUCTION" | "SEC-SECRET-MATERIAL-INSTRUCTION" | "SEC-SENSITIVE-FILE-REFERENCE" | "SEC-UNAPPROVED-NETWORK-DESTINATION" | "SEC-UNAPPROVED-UPLOAD-DESTINATION" | "SEC-UNBOUNDED-EXTERNAL-SOURCE-TRAVERSAL" | "SEC-UNPINNED-DEPENDENCY-INSTALL" | "SEC-UNPINNED-REMOTE-SCRIPT" | "SEC-UNTRUSTED-CONTENT-AS-INSTRUCTION")[];
type SecurityDiagnosticsConfig = {
    security?: SecurityConfig;
};
export declare function securityDiagnosticFindings(inputs: Array<Artifact | ParsedDocument>, config?: SecurityDiagnosticsConfig): Finding[];
/** Findings and target-state coverage derived from one shared analysis pass. */
interface SecurityDiagnosticsAnalysis {
    findings: Finding[];
    coverage: SecurityAnalysisCoverage;
}
interface SecurityDiagnosticsAnalysisOptions {
    plainTextSupportReachability?: ReadonlyMap<string, PlainTextSupportSecurityReachability>;
}
/** Run existing security analyses and record exactly which layers executed. */
export declare function analyzeSecurityDiagnostics(inputs: Array<Artifact | ParsedDocument>, config?: SecurityDiagnosticsConfig, options?: SecurityDiagnosticsAnalysisOptions): SecurityDiagnosticsAnalysis;
export {};