import type { ParsimonyReceipt } from './receipt.js';
import { type OscalAssessmentResults } from './oscal-types.js';
/** Caller-supplied, non-deterministic metadata for the OSCAL document (so the
 * projection stays pure). `uuid` must be a v4-shaped uuid; `lastModified` an OSCAL
 * date-time-with-timezone (e.g. an ISO-8601 `…Z`). */
export interface OscalMeta {
    readonly uuid: string;
    readonly lastModified: string;
    readonly oscalVersion?: string;
    /** The assessed System Security Plan / Assessment Plan reference (`import-ap.href`).
     * Defaults to a relative placeholder when the caller does not supply one. */
    readonly importApHref?: string;
}
/**
 * A risk token is a NON-control SENTINEL (`<catalog>:<name>`, #423) — not a bare
 * NIST control id — exactly when it contains a `:`. A real 800-53 control id
 * (`AC-3`, `SI-10`) has no colon; a sentinel always does (its catalog prefix is one
 * of `nist-800-53r5`/`section-508`/`wcag`/`intent`). This is the single
 * disambiguation point: a bare token links to a control, a sentinel does not.
 */
export declare function isSentinelRisk(token: string): boolean;
/**
 * Project receipts into an OSCAL Assessment Results document. Pure: identical inputs
 * yield identical output. Emits the smallest document the vendored official NIST
 * schema accepts (uuid + metadata + import-ap + one result with observations and
 * findings). Floor checks that did not apply (`na`) are omitted from observations.
 */
export declare function toOscalAssessmentResults(receipts: readonly ParsimonyReceipt[], meta: OscalMeta): OscalAssessmentResults;
//# sourceMappingURL=oscal.d.ts.map