/**
 * Semgrep Scanner
 *
 * Runs Semgrep with OWASP, JavaScript/TypeScript, and custom rules.
 * Outputs SARIF format which we parse into DeterministicFindings.
 *
 * If Semgrep is not available, returns empty results with instruction
 * to install: `pip install semgrep` or `brew install semgrep`
 *
 * @module scanners/semgrep
 */
import type { ScannerResult } from "./types.js";
/**
 * Run Semgrep analysis and return findings
 */
export declare function runSemgrep(projectPath: string, options?: {
    configs?: string[];
    customRulesDir?: string;
    timeout?: number;
    /** Include the built-in taint rules (SQLi/cmd/SSRF). Default true. */
    includeBuiltinRules?: boolean;
    /**
     * Framework-specific registry rulesets to add as a fault-isolated, best-effort
     * pass (they may require `semgrep login` / network). A failure here never
     * affects the primary scan.
     */
    frameworks?: {
        supabase?: boolean;
        nextjs?: boolean;
    };
}): Promise<ScannerResult>;
/**
 * Normalise a Semgrep rule ID so that our builtin rules always render with a
 * clean, stable ID regardless of where the temp rules-file happens to live.
 * Exported for unit testing.
 *
 * @internal
 *
 * When semgrep is pointed at a temp file (e.g.
 * `/var/folders/…/vaspera-semgrep-rules-XXXX/vaspera-builtin.yaml`) it
 * encodes the path into the rule id, producing something like:
 *   `var.folders.…vaspera-semgrep-rules-XXXX.vaspera-builtin.vaspera-sql-injection`
 *
 * We strip everything up to and including the last dotted segment that
 * precedes the `vaspera-` rule name, giving us the stable short form
 * `vaspera-sql-injection`. Community-registry IDs like
 * `javascript.lang.security.audit.sqli` are left untouched because they
 * do NOT contain a `vaspera-` prefix.
 */
export declare function normalizeRuleId(ruleId: string): string;
export declare function checkSemgrepAvailable(): Promise<{
    available: boolean;
    version?: string;
    error?: string;
}>;
/**
 * Generate a sample Semgrep rules file for Supabase RLS
 */
export declare function generateSupabaseRules(outputDir: string): Promise<string>;
//# sourceMappingURL=semgrep.d.ts.map