/**
 * Trivy Scanner Integration
 *
 * Comprehensive vulnerability scanner for containers, filesystems, and IaC.
 * Also provides a zero-dependency static FROM linter for Dockerfiles.
 *
 * Three layers of coverage:
 *  (1) Static Dockerfile FROM lint — pure Node, no binary, no network.
 *      Runs whenever a Dockerfile is present; always-on.
 *  (2) Trivy config scan — Dockerfile/IaC misconfig via `trivy config`.
 *      Requires trivy binary; no image pull / no network (DB-only).
 *  (3) Base-image OS CVE scan — OPT-IN ONLY (`baseImageCve: true`).
 *      Pulls images over the network. Hard limits apply for hostile repos.
 *
 * @module scanners/trivy
 */
import type { ScannerResult, ScannerAvailability } from "./types.js";
export interface ParsedFromInstruction {
    /** The raw image reference (e.g. "node:20-alpine", "ubuntu@sha256:…"). */
    ref: string;
    /** Optional alias assigned by `AS <name>`. */
    alias?: string;
    /** 1-based line number of this FROM in the Dockerfile. */
    line: number;
}
/**
 * Parse all FROM instructions in a Dockerfile source string.
 *
 * Handles:
 * - Multi-stage: tracks AS aliases; skips platform flags.
 * - Blank lines and comments (#).
 */
export declare function parseDockerfileFrom(source: string): ParsedFromInstruction[];
/**
 * Walk `projectPath` for Dockerfiles and lint each FROM instruction.
 *
 * No binary, no network. The walk is bounded by MAX_DOCKERFILES and
 * MAX_DOCKERFILE_BYTES; symlinks are skipped; excluded dirs are pruned.
 *
 * Returns a ScannerResult attributed to `scanner: "trivy"` with ruleIds
 * prefixed `trivy:dockerfile-*`.
 */
export declare function runDockerfileFromLint(projectPath: string): Promise<ScannerResult>;
/**
 * Check if Trivy is available
 */
export declare function checkTrivyAvailable(): Promise<ScannerAvailability>;
/**
 * Options for the trivy binary-backed scan.
 */
export interface TrivyRunOptions {
    timeout?: number;
    ignoreUnfixed?: boolean;
    severity?: string[];
    /** When true, also run a `trivy config` pass and merge misconfig findings. */
    includeConfig?: boolean;
    /**
     * Directory names (relative to the project root) to skip entirely.
     * Forwarded as separate --skip-dirs values so trivy never descends into them.
     * Build artefacts (dist/, build/, .next/, coverage/) are always appended to
     * whatever the caller provides — scanning compiled output double-counts src
     * findings and produces noise from minified/compiled content.
     */
    skipDirs?: string[];
    /**
     * Glob patterns for individual files to skip.
     * Forwarded as --skip-files so trivy ignores them even if they sit inside a
     * scanned directory.  Use this for fixture / eval-corpus files that contain
     * intentionally-planted secrets or vulnerability patterns.
     */
    skipFiles?: string[];
}
/**
 * Run Trivy filesystem scan and (optionally) a config scan, merging results.
 *
 * `scanType: "fs"` is always included.
 * `scanType: "config"` is added when `opts.includeConfig` is true —
 * this surfaces Dockerfile/IaC misconfigurations without pulling images.
 * Neither scan requires network or image pulls.
 */
export declare function runTrivy(projectPath: string, options?: TrivyRunOptions): Promise<ScannerResult>;
/**
 * Scan base images from Dockerfiles in the project for OS-level CVEs.
 *
 * NETWORK EGRESS WARNING: This function runs `trivy image` for each unique
 * base image reference, which pulls image manifests (and possibly layer data)
 * from the registry. Only call when the caller has explicitly opted in via
 * `baseImageCve: true`.
 *
 * Hostile-input mitigations:
 * - Hard cap of MAX_IMAGES=5 unique refs per invocation (excess warned, skipped).
 * - Each ref validated against IMAGE_REF_SAFE_RE; invalid refs skipped.
 * - `scratch` and stage-alias refs are excluded by parseDockerfileFrom semantics.
 * - Per-image timeout of IMAGE_SCAN_TIMEOUT_MS (120 s).
 * - Array args only — no shell interpolation.
 */
export declare function runTrivyBaseImageScan(projectPath: string, options?: {
    timeout?: number;
    severity?: string[];
    ignoreUnfixed?: boolean;
}): Promise<ScannerResult>;
/**
 * Return true if the project contains any Dockerfiles.
 * Uses the bounded walk — no subprocess.
 */
export declare function detectDockerfiles(projectPath: string): Promise<boolean>;
/**
 * Return true if the project contains Terraform files (.tf).
 * Fast heuristic: only checks top-level and one level deep.
 */
export declare function detectTerraformFiles(projectPath: string): Promise<boolean>;
/**
 * Return true if the project has Dockerfiles or IaC files (Terraform).
 * Drop-in replacement for the removed `detectIaC`.
 */
export declare function detectIaC(projectPath: string): Promise<boolean>;
//# sourceMappingURL=trivy.d.ts.map