import type { RiskLevel } from '@cclabsnz/sf-core';
import type { Capability } from '../chains/Capability.js';
import type { FindingThreats } from '../threats/types.js';
export interface AffectedItem {
    label: string;
    url?: string;
    note?: string;
}
export interface Finding {
    id: string;
    /**
     * The ID of the check that produced this finding.
     *
     * This field is optional on the interface so that the 22+ individual check implementations
     * can construct `Finding` objects without declaring it — doing so would otherwise cause
     * TypeScript compile errors throughout the codebase. The `CheckEngine` is the single place
     * that sets this value after each check runs. Consumers of `AuditResult.findings` can
     * therefore rely on `checkId` being present on every finding in a completed audit result.
     */
    checkId?: string;
    category: string;
    riskLevel: RiskLevel;
    title: string;
    detail: string;
    remediation: string;
    affectedItems?: AffectedItem[];
    /** True when the finding represents a passing check (everything is correctly configured). */
    passed?: boolean;
    /**
     * Compliance framework tags, e.g. ['OWASP-A01', 'SOC2-CC6.1'].
     * Populated by CheckEngine from ComplianceMapping after each check runs.
     */
    complianceTags?: string[];
    /**
     * STRIDE and LINDDUN categories. Populated by CheckEngine from the threat maps; a check may set
     * either list inline to override its check-level entry for this finding. Carries no weight in
     * scoring, grading or --fail-on (RULE-105).
     */
    threats?: FindingThreats;
    /**
     * True when the check could not gather evidence due to insufficient permissions.
     * Scored as INFO (no impact on health score) but displayed distinctly.
     */
    inconclusive?: boolean;
    /**
     * Optional inline attacker-capability declaration for findings produced by
     * chain-aware checks. When present, it overrides the central CapabilityRegistry
     * entry for this finding id. Only honoured for active (non-passed, non-inconclusive) findings.
     */
    capabilities?: {
        grants?: Capability[];
        requires?: Capability[];
    };
    /** Covered by an approved, unexpired waiver: excluded from the score and from --fail-on. */
    waived?: boolean;
    /** The check that produced this finding could not run or gather any evidence. */
    notAssessed?: boolean;
}
//# sourceMappingURL=Finding.d.ts.map