/**
 * Declarative org policy packs (YAML/JSON) — deterministic graph matchers on ParsedLintGraph.
 * Codes should use a stable prefix (e.g. ORG-*, ACME-*) to avoid colliding with IR-LINT-* / IR-STRUCT-*.
 */
import type { ParsedLintGraph } from './lint-graph.js';
import type { IrStructuralFinding } from './ir-structural.js';
export type PolicySeverity = 'error' | 'warning' | 'info';
/** Single-node selector: all provided predicates must match (AND). */
export type PolicyNodeSelectorV1 = {
    id?: string;
    type?: string | string[];
    /** All listed tags must appear on `node.metadata.tags` (array of strings). */
    tags?: string[];
};
export type PolicyEdgeMatchV1 = {
    from: PolicyNodeSelectorV1;
    to: PolicyNodeSelectorV1;
};
export type PolicyRuleV1 = {
    id: string;
    severity: PolicySeverity;
    message: string;
    fixHint?: string;
    match: {
        node?: PolicyNodeSelectorV1;
        edge?: PolicyEdgeMatchV1;
    };
};
export type PolicyPackMetadataV1 = {
    name?: string;
    org?: string;
};
export type PolicyPackDocumentV1 = {
    apiVersion: 'archrad/v1';
    kind: 'PolicyPack';
    metadata?: PolicyPackMetadataV1;
    rules: PolicyRuleV1[];
};
export type LoadPolicyPacksResult = {
    ok: true;
    visitors: ReadonlyArray<(g: ParsedLintGraph) => IrStructuralFinding[]>;
    ruleCount: number;
    /**
     * Describes the signing state of the loaded pack, when known:
     *  - `unsigned` — no manifest was provided/discovered.
     *  - `sha256-verified` — files matched a sha256 manifest.
     *  - `cosign-verified` — the manifest itself was verified with cosign,
     *    and the files matched it.
     */
    signedBy?: 'unsigned' | 'sha256-verified' | 'cosign-verified';
} | {
    ok: false;
    errors: string[];
};
/** Signing / verification constraints that the CLI threads through. */
export type PolicyPackSigningOptions = {
    /**
     * When `true`, a sha256 manifest MUST be present (either in the directory
     * or provided inline) and every file must hash-match. Defaults to `false`:
     * unsigned packs continue to load with `signedBy: 'unsigned'`.
     */
    requireSigned?: boolean;
    /**
     * Absolute path to a cosign public key. When set, the manifest's detached
     * `.sig` is verified with `cosign verify-blob` before contents are checked.
     * Implies `requireSigned: true`.
     */
    cosignPublicKeyPath?: string;
    /** Escape hatch for tests — override the cosign binary path. */
    cosignBinary?: string;
};
export type PolicyPackFileSource = {
    /** Virtual filename (must end with .yaml, .yml, or .json for parse rules). */
    name: string;
    content: string;
};
/** Optional signing verification context passed to the in-memory loader. */
export type PolicyPackManifestInput = {
    /** Raw sha256 manifest text, as produced by `archrad policies-sha256`. */
    manifestText: string;
    /** When present, verifies this cosign signature over the manifest text. */
    signature?: {
        manifestPath: string;
        signaturePath: string;
        publicKeyPath: string;
        cosignBinary?: string;
    };
};
/**
 * Load policy packs from in-memory file sources (same semantics as {@link loadPolicyPacksFromDirectory}).
 * Use for ArchRad Cloud, tests, and API bodies — no filesystem required.
 *
 * When `manifest` is provided, the sha256 digest of every source is verified
 * against it. Unexpected files or missing files produce `ok: false` errors.
 */
export declare function loadPolicyPacksFromFiles(sources: ReadonlyArray<PolicyPackFileSource>, options?: {
    manifest?: PolicyPackManifestInput;
}): LoadPolicyPacksResult;
/**
 * Load and compile all policy YAML/JSON files in a directory into lint visitors.
 * Filenames: `*.yaml`, `*.yml`, `*.json` (other files ignored).
 *
 * When `signing` is provided, discovers an `archrad-policy-pack.sha256`
 * manifest (and optional `archrad-policy-pack.sha256.sig`) in the directory
 * and enforces the caller's signing requirements before returning visitors.
 */
export declare function loadPolicyPacksFromDirectory(dir: string, signing?: PolicyPackSigningOptions): Promise<LoadPolicyPacksResult>;
//# sourceMappingURL=policy-pack.d.ts.map