/**
 * Severity Overrides Configuration
 *
 * Allows users to customize finding severities via `.vaspera/severity-overrides.yaml`.
 *
 * Example configuration:
 * ```yaml
 * overrides:
 *   - ruleId: "semgrep:javascript.lang.security.audit.detect-non-literal-require"
 *     severity: "low"
 *     reason: "False positive in our codebase"
 *
 *   - scanner: "npm-audit"
 *     cwe: "CWE-1321"
 *     severity: "medium"
 *     reason: "Prototype pollution not exploitable in our context"
 *
 *   - file: "tests/**"
 *     severity: "info"
 *     reason: "Test files have relaxed security requirements"
 * ```
 *
 * @module config/severity-overrides
 */
import { z } from "zod";
import type { Severity } from "../certification/types.js";
import type { DeterministicFinding } from "../scanners/types.js";
/**
 * Single severity override rule
 */
export declare const SeverityOverrideRuleSchema: z.ZodObject<{
    /** Rule ID to match (exact or glob pattern) */
    ruleId: z.ZodOptional<z.ZodString>;
    /** Scanner type to match */
    scanner: z.ZodOptional<z.ZodEnum<["semgrep", "npm-audit", "gitleaks", "tsc", "eslint", "bandit", "gosec", "brakeman", "trivy"]>>;
    /** CWE ID to match */
    cwe: z.ZodOptional<z.ZodString>;
    /** CVE ID to match */
    cve: z.ZodOptional<z.ZodString>;
    /** File path pattern to match (glob) */
    file: z.ZodOptional<z.ZodString>;
    /** New severity to apply */
    severity: z.ZodEnum<["critical", "high", "medium", "low", "info"]>;
    /** Reason for override (documentation) */
    reason: z.ZodOptional<z.ZodString>;
    /** Whether this override is active */
    enabled: z.ZodDefault<z.ZodBoolean>;
    /** Override expiration date (ISO 8601) */
    expiresAt: z.ZodOptional<z.ZodString>;
}, "strip", z.ZodTypeAny, {
    enabled: boolean;
    severity: "info" | "critical" | "high" | "medium" | "low";
    file?: string | undefined;
    cwe?: string | undefined;
    scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
    reason?: string | undefined;
    expiresAt?: string | undefined;
    ruleId?: string | undefined;
    cve?: string | undefined;
}, {
    severity: "info" | "critical" | "high" | "medium" | "low";
    enabled?: boolean | undefined;
    file?: string | undefined;
    cwe?: string | undefined;
    scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
    reason?: string | undefined;
    expiresAt?: string | undefined;
    ruleId?: string | undefined;
    cve?: string | undefined;
}>;
export type SeverityOverrideRule = z.infer<typeof SeverityOverrideRuleSchema>;
/**
 * Severity overrides configuration file
 */
export declare const SeverityOverridesConfigSchema: z.ZodObject<{
    /** Schema version */
    version: z.ZodDefault<z.ZodLiteral<1>>;
    /** Override rules */
    overrides: z.ZodDefault<z.ZodArray<z.ZodObject<{
        /** Rule ID to match (exact or glob pattern) */
        ruleId: z.ZodOptional<z.ZodString>;
        /** Scanner type to match */
        scanner: z.ZodOptional<z.ZodEnum<["semgrep", "npm-audit", "gitleaks", "tsc", "eslint", "bandit", "gosec", "brakeman", "trivy"]>>;
        /** CWE ID to match */
        cwe: z.ZodOptional<z.ZodString>;
        /** CVE ID to match */
        cve: z.ZodOptional<z.ZodString>;
        /** File path pattern to match (glob) */
        file: z.ZodOptional<z.ZodString>;
        /** New severity to apply */
        severity: z.ZodEnum<["critical", "high", "medium", "low", "info"]>;
        /** Reason for override (documentation) */
        reason: z.ZodOptional<z.ZodString>;
        /** Whether this override is active */
        enabled: z.ZodDefault<z.ZodBoolean>;
        /** Override expiration date (ISO 8601) */
        expiresAt: z.ZodOptional<z.ZodString>;
    }, "strip", z.ZodTypeAny, {
        enabled: boolean;
        severity: "info" | "critical" | "high" | "medium" | "low";
        file?: string | undefined;
        cwe?: string | undefined;
        scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
        reason?: string | undefined;
        expiresAt?: string | undefined;
        ruleId?: string | undefined;
        cve?: string | undefined;
    }, {
        severity: "info" | "critical" | "high" | "medium" | "low";
        enabled?: boolean | undefined;
        file?: string | undefined;
        cwe?: string | undefined;
        scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
        reason?: string | undefined;
        expiresAt?: string | undefined;
        ruleId?: string | undefined;
        cve?: string | undefined;
    }>, "many">>;
    /** Global settings */
    settings: z.ZodDefault<z.ZodObject<{
        /** Whether to log when overrides are applied */
        logOverrides: z.ZodDefault<z.ZodBoolean>;
        /** Whether to include override reason in finding metadata */
        includeReason: z.ZodDefault<z.ZodBoolean>;
    }, "strip", z.ZodTypeAny, {
        logOverrides: boolean;
        includeReason: boolean;
    }, {
        logOverrides?: boolean | undefined;
        includeReason?: boolean | undefined;
    }>>;
}, "strip", z.ZodTypeAny, {
    version: 1;
    settings: {
        logOverrides: boolean;
        includeReason: boolean;
    };
    overrides: {
        enabled: boolean;
        severity: "info" | "critical" | "high" | "medium" | "low";
        file?: string | undefined;
        cwe?: string | undefined;
        scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
        reason?: string | undefined;
        expiresAt?: string | undefined;
        ruleId?: string | undefined;
        cve?: string | undefined;
    }[];
}, {
    version?: 1 | undefined;
    settings?: {
        logOverrides?: boolean | undefined;
        includeReason?: boolean | undefined;
    } | undefined;
    overrides?: {
        severity: "info" | "critical" | "high" | "medium" | "low";
        enabled?: boolean | undefined;
        file?: string | undefined;
        cwe?: string | undefined;
        scanner?: "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | undefined;
        reason?: string | undefined;
        expiresAt?: string | undefined;
        ruleId?: string | undefined;
        cve?: string | undefined;
    }[] | undefined;
}>;
export type SeverityOverridesConfig = z.infer<typeof SeverityOverridesConfigSchema>;
/**
 * Applied override information
 */
export interface AppliedOverride {
    /** Original severity */
    originalSeverity: Severity;
    /** New severity */
    newSeverity: Severity;
    /** Rule that matched */
    rule: SeverityOverrideRule;
    /** Match reason */
    matchReason: string;
}
/**
 * Load severity overrides configuration
 */
export declare function loadSeverityOverrides(projectPath: string): Promise<SeverityOverridesConfig>;
/**
 * Apply severity overrides to a finding
 */
export declare function applySeverityOverride(finding: DeterministicFinding, config: SeverityOverridesConfig): {
    finding: DeterministicFinding;
    override?: AppliedOverride;
};
/**
 * Apply severity overrides to multiple findings
 */
export declare function applySeverityOverrides(findings: DeterministicFinding[], config: SeverityOverridesConfig): {
    findings: DeterministicFinding[];
    overrides: AppliedOverride[];
    summary: {
        total: number;
        modified: number;
        byOriginalSeverity: Record<Severity, number>;
        byNewSeverity: Record<Severity, number>;
    };
};
/**
 * Create a sample severity overrides configuration file
 */
export declare function generateSampleConfig(): string;
//# sourceMappingURL=severity-overrides.d.ts.map