/**
 * Security-fate model for the github → forgejo migration edge.
 *
 * github → forgejo YAML is near-identical, so the migration itself is thin. The
 * differentiated value is the **compare**: classifying what survives the move
 * and what Forgejo silently drops. Most properties translate verbatim; the
 * useful findings are the keys the Forgejo runner ignores (`permissions`,
 * `continue-on-error` → `lost`) plus refs/labels that need attention
 * (unresolved `uses:`, unmapped runner labels → `needs-review`).
 *
 * Mirrors the gitlab lexicon's fate model (translated / approximated /
 * needs-review / lost) but for the Forgejo edge — kept local so the forgejo
 * lexicon does not depend on the gitlab one.
 */
import type { LintDiagnostic } from "@intentius/chant/lint/rule";
export type SecurityFate = "translated" | "approximated" | "needs-review" | "lost";
export interface SecurityProvenance {
    /** Human label for the property (e.g. "Least-privilege permissions"). */
    property: string;
    /** What happened to the property as it crossed the github → forgejo edge. */
    fate: SecurityFate;
    /** Diagnostic severity for this finding. */
    severity: "error" | "warning" | "info";
    /** How to re-establish the property on Forgejo, when it doesn't carry. */
    reestablish?: string;
}
/** A migration provenance record carrying a security classification. */
export interface SecurityRecord {
    /** YAML-ish path in the source (e.g. "jobs.build.steps[1].uses"). */
    sourceKey: string;
    /** Source file name (for diagnostics). */
    sourceFile?: string;
    /** Functional category (forgejo migration only emits security records). */
    category: "needs-review" | "skipped" | "synthesis";
    /** Rule ID (MIG-FJ-*). */
    rule: string;
    /** Human-readable explanation. */
    note?: string;
    /** Security classification. */
    security: SecurityProvenance;
}
/**
 * Classify the fate of security-relevant properties in a parsed GitHub Actions
 * workflow as it migrates to Forgejo. Walks the source object so occurrence
 * counts (and paths) are precise.
 */
export declare function analyzeForgejoSecurity(workflow: unknown, opts?: {
    sourceFile?: string;
}): SecurityRecord[];
/**
 * Convert security records into SARIF-shaped diagnostics. Security findings
 * always emit a diagnostic at their severity, escalated to `error` under
 * `--strict` when the property was lost or needs review.
 */
export declare function provenanceToDiagnostics(records: SecurityRecord[], opts?: {
    strict?: boolean;
}): LintDiagnostic[];
/** Render a "Security posture" Markdown section from the security records. */
export declare function renderSecurityPosture(records: SecurityRecord[]): string;
//# sourceMappingURL=security.d.ts.map