/**
 * Detection Engine Types
 *
 * Types for the custom detection engine that provides proprietary
 * security analysis beyond wrapped tools like Semgrep.
 *
 * @module scanners/detection/types
 */
import type { Severity } from "../../certification/types.js";
/**
 * Supported detection engines
 */
export type DetectionEngine = "ast-query" | "data-flow" | "control-flow" | "semantic";
/**
 * A taint source - where untrusted data enters
 */
export interface TaintSource {
    pattern: string;
    description?: string;
    parameterIndex?: number;
}
/**
 * A taint sink - dangerous operation that consumes data
 */
export interface TaintSink {
    pattern: string;
    description?: string;
    parameterIndex?: number;
    /**
     * When set, the matched call-expression's method name must appear in this
     * allowlist.  Prevents patterns like `execute(...)` from firing on any
     * callee named `execute` (e.g. shell runners, test frameworks).
     */
    requireCalleeIn?: string[];
    /**
     * When true, at least one argument to the matched call must contain a SQL
     * statement keyword at word-boundary position (SELECT, INSERT, UPDATE,
     * DELETE, FROM, WHERE, INTO, VALUES, JOIN).  Prevents template literals
     * that happen to contain English words ("Update Code", "create …") from
     * being classified as SQL sinks.
     */
    requireSqlKeyword?: boolean;
    /**
     * When true, the pattern must capture a `$col` metavariable and its value
     * (the column name string literal) must be one of the canonical
     * tenant-boundary column names (`user_id`, `org_id`, `account_id`,
     * `tenant_id`, `owner_id`, `customer_id`).  This prevents non-tenant
     * columns (e.g. `branch`, `status`) from satisfying an IDOR sink — only
     * filters on the ownership boundary column are relevant.
     */
    requireTenantColumn?: boolean;
}
/**
 * A sanitizer that neutralizes tainted data
 */
export interface Sanitizer {
    pattern: string;
    description?: string;
}
/**
 * Data flow rule configuration
 */
export interface DataFlowConfig {
    sources: TaintSource[];
    sinks: TaintSink[];
    sanitizers?: Sanitizer[];
    requireAllSources?: boolean;
    /**
     * Patterns for server-derived (trusted) values that must NOT seed or
     * propagate taint.  Any variable whose RHS matches one of these patterns
     * is treated as clean regardless of what other tainted values are in scope.
     * Typical entries: `supabase.auth.getUser()`, `getServerSession()`, etc.
     */
    trustedSources?: string[];
    /**
     * Call patterns for auth-guard middleware that, when present anywhere in
     * the same function scope as a sink, prevent the sink from firing.  These
     * are matched against the full text of each CallExpression in the function.
     * Examples: `getAdminOrError(`, `requireUser(`, `auth(`.
     */
    guardPatterns?: string[];
}
/**
 * Control flow rule configuration
 */
export interface ControlFlowConfig {
    entryPoints?: string[];
    mustReach?: {
        pattern: string;
        description?: string;
    }[];
    mustNotReach?: {
        pattern: string;
        description?: string;
    }[];
}
/**
 * AST query rule configuration
 */
export interface ASTQueryConfig {
    pattern: string;
    language?: "typescript" | "javascript" | "python" | "go" | "ruby";
    capture?: string;
    constraints?: Record<string, string>;
}
/**
 * Detection rule definition
 */
export interface DetectionRule {
    id: string;
    name: string;
    description: string;
    category: string;
    severity: Severity;
    confidence: number;
    enabled?: boolean;
    engines: {
        astQuery?: ASTQueryConfig;
        dataFlow?: DataFlowConfig;
        controlFlow?: ControlFlowConfig;
    };
    cweIds?: string[];
    owaspRefs?: string[];
    autofixPatternId?: string;
    metadata?: Record<string, unknown>;
}
/**
 * A path from taint source to sink
 */
export interface TaintPath {
    source: {
        pattern: string;
        file: string;
        line: number;
        column?: number;
        expression: string;
    };
    sink: {
        pattern: string;
        file: string;
        line: number;
        column?: number;
        expression: string;
    };
    intermediateNodes: {
        file: string;
        line: number;
        expression: string;
    }[];
    sanitized: boolean;
    sanitizer?: string;
}
/**
 * Result from running detection on a single file
 */
export interface DetectionMatch {
    ruleId: string;
    file: string;
    line: number;
    column?: number;
    endLine?: number;
    endColumn?: number;
    message: string;
    severity: Severity;
    confidence: number;
    category: string;
    evidence: string;
    taintPath?: TaintPath;
    cweIds?: string[];
    owaspRefs?: string[];
    autofixPatternId?: string;
}
/**
 * Result from running detection engine
 */
export interface DetectionResult {
    success: boolean;
    matches: DetectionMatch[];
    rulesEvaluated: number;
    filesAnalyzed: number;
    duration: number;
    errors?: string[];
}
/**
 * Detection engine context
 */
export interface DetectionContext {
    projectPath: string;
    files?: string[];
    rules?: DetectionRule[];
    include?: string[];
    exclude?: string[];
    timeout?: number;
}
/**
 * Built-in detection categories
 */
export declare const DETECTION_CATEGORIES: readonly ["sql-injection", "xss", "ssrf", "path-traversal", "command-injection", "idor", "bola", "auth-bypass", "race-condition", "secrets", "insecure-deserialization", "xxe", "open-redirect", "csrf"];
export type DetectionCategory = (typeof DETECTION_CATEGORIES)[number];
/**
 * Default confidence thresholds
 */
export declare const CONFIDENCE_THRESHOLDS: {
    readonly high: 85;
    readonly medium: 60;
    readonly low: 40;
};
//# sourceMappingURL=types.d.ts.map