/**
 * Rule catalog — classifies every CI post-synth check the auditor can surface.
 *
 * Two axes drive how a finding is presented:
 *  - `tier`: `merge-worthy` (a security vuln/supply-chain exposure or a hard
 *    correctness bug — worth opening a PR to the target) vs `report-only`
 *    (hygiene/style/perf/deprecation — shown in the report, never a PR title).
 *  - `fixKind`: `deterministic` (a safe mechanical fix can be auto-applied or
 *    diffed) vs `guidance` (needs human/LLM judgment — emit remediation text
 *    only; never auto-applied; never run by the hosted service).
 *
 * Each provider's rule metadata lives in its own lexicon's `auditCatalog()`
 * (#687); this module owns the shared machinery — the `RuleMeta` shape, the
 * `auditRule()` constructor lexicons build entries with, the shared authority
 * citations, and `resolveAuditCatalog()` which merges the lexicons' catalogs
 * over the small static core map (the cross-cutting COR/EXT ids). A drift-guard
 * test asserts the aggregate stays in sync with the lexicons' post-synth checks.
 */
export type Tier = "merge-worthy" | "report-only";
/** deterministic = safe auto-fix/diff; guidance = report text only (needs judgment). */
export type FixKind = "deterministic" | "guidance";
/**
 * What kind of finding this is — orthogonal to `tier` (fix confidence). Lets the
 * report say "N security, M best-practice, K correctness" instead of branding
 * everything "security." `security` = exposure/vuln/supply-chain; `correctness`
 * = a structural bug (broken reference, invalid schema, never-runs); everything
 * else is `best-practice` (hygiene/style/deprecation/reliability).
 */
export type Category = "security" | "correctness" | "best-practice";
export interface Authority {
    name: string;
    url: string;
}
export interface RuleMeta {
    id: string;
    tier: Tier;
    fixKind: FixKind;
    /** What kind of finding this is (security / correctness / best-practice). */
    category: Category;
    title: string;
    /** External backing so a finding isn't just chant's opinion. */
    authority?: Authority[];
    /** One-line fix guidance (always present). */
    remediation: string;
    /**
     * False if the check reads the chant model (`ctx.entities`) rather than the
     * emitted YAML (`ctx.outputs`) — such a check won't fire on audited YAML.
     * All current post-synth checks are output-based, so this is true.
     */
    yamlBased: boolean;
}
export declare const SCORECARD_TOKEN: Authority;
export declare const GH_TOKEN: Authority;
export declare const SCORECARD_PINNED: Authority;
export declare const GH_THIRD_PARTY: Authority;
export declare const GH_INJECTION: Authority;
export declare const GH_PWN: Authority;
export declare const GH_SECRETS: Authority;
export declare const GH_OIDC: Authority;
export declare const K8S_PSS: Authority;
export declare const K8S_SECRETS: Authority;
/**
 * Finding category per rule (#415). Curated: security rules are those that
 * cite an authority or guard an exposure; correctness rules flag structural
 * bugs (broken references, invalid schema, never-runs); the rest are
 * best-practice. A drift test asserts this covers every catalogued rule.
 */
export declare const RULE_CATEGORY: Record<string, Category>;
/**
 * Core's static portion of the audit catalog — now only the cross-cutting
 * CloudFormation ids (COR/EXT) that aren't owned by a single lexicon. Every
 * per-provider block moved to its lexicon's `auditCatalog()` (#687): WAW→aws,
 * WGC→gcp, AZR→azure, DKRD→docker, WK8/ARGO→k8s, WHM→helm, GHA→github,
 * WGL→gitlab, WFJ→forgejo. `resolveAuditCatalog` merges those over this map.
 */
export declare const RULE_CATALOG: Record<string, RuleMeta>;
/**
 * Build one catalog entry — the lexicon-facing constructor for
 * `LexiconPlugin.auditCatalog()` (#687), so a lexicon can declare its own rules'
 * metadata next to the rules. Unlike the internal `meta()` it takes `category`
 * explicitly (a lexicon owns its rules' categories) rather than reading core's
 * curated `RULE_CATEGORY` map: an authority citation still forces `security`,
 * otherwise the passed `category` (default `best-practice`) applies.
 */
export declare function auditRule(id: string, tier: Tier, fixKind: FixKind, title: string, remediation: string, opts?: {
    authority?: Authority[];
    category?: Category;
}): RuleMeta;
/**
 * Resolve the effective audit catalog for a set of lexicons: core's static
 * `RULE_CATALOG` with each active lexicon's contributed `auditCatalog()` merged
 * on top (a lexicon's own entry wins for its ids). This is the aggregation seam
 * (#687, epic #350) that lets per-provider metadata move out of core into the
 * lexicon that owns the rules, while the auditor — which already loads those
 * lexicons to run the rules — reads one merged catalog. Tolerant: a lexicon
 * that can't be loaded or contributes no catalog is skipped.
 */
export declare function resolveAuditCatalog(lexicons: string[]): Promise<Record<string, RuleMeta>>;
/** Look up catalog metadata for a check id, if known. */
export declare function ruleMeta(id: string): RuleMeta | undefined;
/** Docs path for the audit rules reference (one anchor per rule id). */
export declare const RULES_DOC_PATH = "/chant/lint-rules/audit-rules/";
/** Absolute URL to a rule's entry in the audit rules reference. */
export declare function ruleDocUrl(id: string): string;
//# sourceMappingURL=catalog.d.ts.map