/**
 * Deterministic Scanner Types
 *
 * Types for the pre-pass scanner layer that runs deterministic tools
 * (Semgrep, npm audit, gitleaks, tsc) before LLM agents.
 *
 * All deterministic findings have confidence: 100 by definition.
 *
 * @module scanners/types
 */
import type { Severity } from "../certification/types.js";
export type { Severity };
/**
 * Supported scanner types
 */
export type ScannerType = "semgrep" | "npm-audit" | "gitleaks" | "tsc" | "eslint" | "bandit" | "gosec" | "brakeman" | "trivy" | "binary-analysis" | "memory-safety" | "race-condition" | "healthcare" | "logic" | "dast" | "zap" | "nuclei" | "terraform" | "tfsec" | "checkov" | "openapi" | "spectral" | "rust" | "cargo-audit" | "clippy" | "detection" | "adversary-tactics" | "db-antipatterns" | "web-safety" | "plugin";
/**
 * A finding from a deterministic scanner.
 *
 * Unlike LLM-generated findings, these have confidence: 100 because
 * they come from deterministic tools with known rule IDs.
 */
export interface DeterministicFinding {
    /** Which scanner found this issue */
    scanner: ScannerType;
    /** The rule/check ID from the scanner (e.g., "semgrep:owasp.sql-injection") */
    ruleId: string;
    /** Relative file path where the issue was found */
    file: string;
    /** Line number (1-indexed) */
    line: number;
    /** Column number (1-indexed, optional) */
    column?: number;
    /** End line for multi-line issues */
    endLine?: number;
    /** End column for multi-line issues */
    endColumn?: number;
    /** Human-readable description of the issue */
    message: string;
    /** Severity level */
    severity: Severity;
    /** Confidence level (100 for deterministic, lower for pattern-based) */
    confidence: number;
    /** Finding category for compliance mapping */
    category?: string;
    /** CWE IDs if applicable (e.g., ["CWE-89", "CWE-564"]) */
    cweIds?: string[];
    /** CVE IDs for dependency vulnerabilities */
    cveIds?: string[];
    /** Whether an automatic fix is available */
    fixAvailable?: boolean;
    /** Suggested fix if available */
    fix?: string;
    /** Raw evidence/code snippet from the scanner */
    evidence?: string;
    /** Additional metadata from the scanner */
    metadata?: Record<string, unknown>;
}
/**
 * Detailed error information for scanner failures
 */
export interface ScannerErrorDetails {
    /** Full error message */
    message: string;
    /** Full output (stdout/stderr combined) */
    fullOutput?: string;
    /** Actionable suggestions to fix the issue */
    suggestions?: string[];
    /** Which phase failed */
    phase?: "init" | "scan" | "parse";
    /** File that caused the error (if applicable) */
    file?: string;
}
/**
 * Result from running a single scanner
 */
export interface ScannerResult {
    /** Which scanner was run */
    scanner: ScannerType;
    /** Findings discovered by this scanner */
    findings: DeterministicFinding[];
    /** How long the scan took in milliseconds */
    duration: number;
    /** Whether the scan completed successfully */
    success: boolean;
    /** Error message if scan failed (truncated) */
    error?: string;
    /** Detailed error information with suggestions */
    errorDetails?: ScannerErrorDetails;
    /** Exit code from the scanner process */
    exitCode?: number;
    /** Scanner version used */
    version?: string;
    /** Number of files scanned */
    filesScanned?: number;
    /** Rules/checks that were run */
    rulesUsed?: string[];
    /** Additional metadata from the scanner */
    metadata?: Record<string, unknown>;
    /**
     * True when the scanner ran in a degraded mode (e.g. gitleaks unavailable,
     * fell back to weak regex patterns).  The result MUST NOT be treated as a
     * clean/authoritative scan when this is true.
     */
    degraded?: boolean;
    /**
     * Human-readable explanation of why the scanner is degraded and what the
     * operator should do to restore full coverage.
     */
    degradationReason?: string;
    /**
     * True when git commit history was included in the scan (secrets scanner).
     * False means only the working tree was scanned — committed-then-deleted
     * secrets would be missed.
     */
    scannedHistory?: boolean;
}
/**
 * Aggregated results from running multiple scanners
 */
export interface AggregatedScanResult {
    /** When the scan started */
    timestamp: string;
    /** Project path that was scanned */
    projectPath: string;
    /** Results from each scanner */
    scanners: ScannerResult[];
    /** Total findings across all scanners */
    totalFindings: number;
    /** Findings grouped by severity */
    bySeverity: Record<Severity, number>;
    /** Findings grouped by scanner */
    byScanner: Record<ScannerType, number>;
    /** Total scan duration in milliseconds */
    totalDuration: number;
    /** Whether all scanners succeeded */
    allSucceeded: boolean;
    /** Scanners that failed */
    failedScanners: ScannerType[];
    /**
     * Scanners that ran in degraded mode (e.g. gitleaks unavailable — fell back
     * to regex-only).  When this list is non-empty the result MUST NOT be
     * treated as authoritative; coverage is incomplete.
     */
    degradedScanners?: ScannerType[];
    /**
     * Consolidated human-readable warning surfacing all degradation reasons.
     * Populated by the aggregator from individual ScannerResult.degradationReason
     * fields.  Empty / absent when no scanner is degraded.
     */
    degradationWarning?: string;
}
/**
 * Options for running scanners
 */
export interface ScannerOptions {
    /** Run Semgrep for OWASP/security patterns */
    semgrep?: boolean;
    /** Run npm audit / osv-scanner for dependency vulns */
    dependencies?: boolean;
    /** Run gitleaks for secrets detection */
    secrets?: boolean;
    /** Run TypeScript compiler for type coverage */
    typescript?: boolean;
    /** Run ESLint for code quality */
    eslint?: boolean;
    /** Run Bandit for Python security */
    bandit?: boolean;
    /** Run gosec for Go security */
    gosec?: boolean;
    /** Run Brakeman for Ruby security */
    brakeman?: boolean;
    /**
     * Run Trivy for container/IaC scanning.
     *
     * Simple boolean `true` runs `trivy fs` + static Dockerfile FROM lint.
     * Extended object form allows per-capability control:
     *  - `config: true`        — also run `trivy config` for Dockerfile/IaC misconfiguration.
     *  - `baseImageCve: true`  — OPT-IN: pull base images over the network and scan for OS CVEs.
     *                             NEVER enable on untrusted CI without explicit approval.
     *  - `ignoreUnfixed`       — pass --ignore-unfixed to trivy.
     *  - `severity`            — filter by severity (e.g. ["HIGH","CRITICAL"]).
     *  - `skipDirs`            — additional directories to skip (build artefacts are always skipped).
     *  - `skipFiles`           — glob patterns for individual files to skip (e.g. eval/fixture files).
     */
    trivy?: boolean | {
        config?: boolean;
        baseImageCve?: boolean;
        ignoreUnfixed?: boolean;
        severity?: string[];
        skipDirs?: string[];
        skipFiles?: string[];
    };
    /** Run binary analysis for native modules */
    binaryAnalysis?: boolean;
    /** Run memory safety analysis for C/C++/Rust */
    memorySafety?: boolean;
    /** Run race condition detection */
    raceCondition?: boolean;
    /**
     * Run the Vaspera proprietary detection engine (data/control-flow rules,
     * incl. the composed RLS-bypass / cross-tenant IDOR rule). On by default for
     * JS/TS; eval-bounded at precision ~0.95.
     */
    detection?: boolean;
    /**
     * Run the endpoint/auth-flow logic scanner (IDOR/BOLA/BFLA, missing ownership
     * checks). Auto-enabled for JS/TS via the auto-detect path; off in the direct
     * runAllScanners default to keep eval/unit callers stable.
     */
    logic?: boolean;
    /**
     * Run the deterministic adversary regex tactics (rate-limit, CORS, CSRF,
     * security headers, IDOR/BOLA, over-fetch, MFA, injection, infra). $0 COGS.
     * On by default: precision-gated via adversary-tactics-precision.test.ts; all
     * active rules verified high-precision on positive+negative fixtures. Low-precision
     * rules are kept in QUARANTINED_RULES in adversary-tactics.ts.
     */
    adversaryTactics?: boolean;
    /**
     * Run the pure-static DB/scalability antipattern scan (N+1, missing pagination,
     * pool-per-request, unindexed FK, etc.). $0 COGS — no binary dependency.
     * On by default; set false to opt-out in eval/unit callers that need a
     * stable zero-scanner baseline.
     */
    dbAntipatterns?: boolean;
    /**
     * Run the pure-static web safety scanner (RLS-off, webhook signature missing,
     * client-exposed secrets). $0 COGS — no binary dependency.
     * On by default; covers the #1 vibe-coding breach classes.
     */
    webSafety?: boolean;
    /** Custom Semgrep rules directory */
    semgrepRulesDir?: string;
    /** Detected frameworks → adds fault-isolated semgrep registry rulesets. */
    frameworks?: {
        supabase?: boolean;
        nextjs?: boolean;
    };
    /** Files to include (glob patterns) */
    include?: string[];
    /** Files to exclude (glob patterns) */
    exclude?: string[];
    /** Timeout per scanner in milliseconds */
    timeout?: number;
}
/**
 * Default scanner options
 */
export declare const DEFAULT_SCANNER_OPTIONS: Required<Omit<ScannerOptions, "semgrepRulesDir" | "include" | "exclude" | "frameworks">>;
/**
 * Severity mapping from scanner-specific severities to vaspera severities
 */
export declare const SEVERITY_MAPPINGS: {
    npm: {
        critical: Severity;
        high: Severity;
        moderate: Severity;
        low: Severity;
        info: Severity;
    };
    semgrep: {
        ERROR: Severity;
        WARNING: Severity;
        INFO: Severity;
    };
    gitleaks: {
        default: Severity;
    };
    typescript: {
        error: Severity;
        warning: Severity;
        suggestion: Severity;
        message: Severity;
    };
    bandit: {
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
    };
    gosec: {
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
    };
    brakeman: {
        High: Severity;
        Medium: Severity;
        Weak: Severity;
    };
    trivy: {
        CRITICAL: Severity;
        HIGH: Severity;
        MEDIUM: Severity;
        LOW: Severity;
        UNKNOWN: Severity;
    };
};
/**
 * Check if a scanner is available on the system
 */
export interface ScannerAvailability {
    scanner: ScannerType;
    available: boolean;
    version?: string;
    path?: string;
    error?: string;
}
/**
 * Convert a DeterministicFinding to a certification Finding
 */
export declare function toFindingId(scanner: ScannerType, ruleId: string, index: number): string;
//# sourceMappingURL=types.d.ts.map