import type { RiskLevel } from '@cclabsnz/sf-core';
import type { AttackChain } from '../chains/AttackChain.js';
import type { AuditResult } from './AuditResult.js';
export interface DigestFinding {
    checkId?: string;
    riskLevel: RiskLevel;
    title: string;
    remediation: string;
    complianceTags?: string[];
    /** Total affected items. Present only when the finding named any. */
    affectedCount?: number;
    /** First few affected labels, for orientation. Never the whole list. */
    affectedSample?: string[];
}
export interface DigestInconclusive {
    checkId?: string;
    title: string;
}
export interface DigestCounts {
    critical: number;
    high: number;
    medium: number;
    low: number;
    info: number;
    passed: number;
    inconclusive: number;
}
export interface AuditDigest {
    orgId: string;
    orgName: string;
    isSandbox: boolean;
    generatedAt: Date;
    healthScore: number;
    grade: AuditResult['grade'];
    counts: DigestCounts;
    findings: DigestFinding[];
    inconclusive: DigestInconclusive[];
    attackChains: AttackChain[];
}
/**
 * A token-cheap view of an audit, for callers that reason over the result rather
 * than read it.
 *
 * Passing checks are counted but not listed, `detail` prose is dropped in favour of
 * `remediation`, and affected-item lists — which are unbounded and dominate a large
 * org's report — collapse to a count plus a short sample. Attack chains survive
 * intact: there are few of them and they carry the analysis.
 */
export declare function buildDigest(result: AuditResult): AuditDigest;
//# sourceMappingURL=digest.d.ts.map