/**
 * Compliance pack types.
 *
 * A pack carries four separable things, and keeping them separate is the whole
 * design: **constraints** (guidance layers an agent reads on every phase),
 * **controls** (structured data with a fail condition per control id),
 * **exclusions** (what the pack deliberately does not cover, by control id), and
 * **metadata**.
 *
 * Two distinctions in here are load-bearing and easy to conflate.
 *
 * `kind` answers *what the lifecycle trail can establish*. An `evidenced` control
 * is one the artifact trail genuinely demonstrates — SOC 2 CC8.1, change
 * management, is the only one in the shipped pack. A `checked-only` control
 * operates over a running system ("the entity monitors system components for
 * anomalies"), which no markdown file evidences; the pack supplies a fail
 * condition an agent applies, and the trail records only that the check happened.
 * Reporting a `checked-only` control as evidenced would be the overclaim this
 * whole feature exists to prevent, in the one artifact a buyer hands an auditor.
 *
 * `check_kind` answers a different question: *who applies the fail condition*.
 * `fails_when` is prose, so no code evaluates it — a `mechanical` control carries
 * a `pattern` the diff check can apply itself, and an `agent` control is
 * assessable only in an agent session. An unassessed control is never a pass.
 *
 * Requirements: compliance-packs/AC-1, AC-2, AC-3
 */
import type { FindingSeverity, PhaseName } from '../core/types.js';
/** What the lifecycle trail can establish about a control. */
export type ControlKind = 'evidenced' | 'checked-only';
/** Who applies a control's fail condition. */
export type ControlCheckKind = 'agent' | 'mechanical';
/** Why a regime criterion is not covered. */
export type ExclusionReason = 'organizational' | 'not-yet-built';
/**
 * Entitlement state of a pack.
 *
 * Only `unrestricted` exists in this release: the seam is built so that adding a
 * licensed pack later changes the resolver and nothing else, but no code path
 * checks a licence, contacts a network service, or reads a key.
 */
export type PackEntitlement = 'unrestricted';
/** Pack metadata, from `pack.yaml`. */
export interface PackMeta {
    /** Slug, matching the pack's directory name. */
    id: string;
    /** Human name of the regime, e.g. `SOC 2`. */
    regime: string;
    /** Pack content version, independent of the CLI version. */
    version: string;
    /**
     * Industries the pack applies to. `['any']` for a regime that is not
     * industry-scoped, which is every pack in this release.
     */
    industries: string[];
    entitlement: PackEntitlement;
    /**
     * Who reviewed the control text, or `null` for an unreviewed draft. A null value
     * obliges the pack to carry the unreviewed-draft notice, and obliges every
     * report to state it.
     */
    reviewed_by: string | null;
    /**
     * Other names a buyer uses when this pack is where their request starts — SOC 2's
     * `SOC 1` and `SSAE 16` (ssae-soc1-mapping/AC-6). Shown in the init wizard's hint and
     * by `aidlc compliance list`, because the picker has no search.
     *
     * Optional, unlike every other field: an absent list reads as "no other names", which
     * is true and harmless. The key is left off when absent, so read it as `?? []`.
     */
    asked_for_as?: string[];
}
/** One control of a regime. */
export interface Control {
    /** The regime's own id, e.g. `CC8.1`. Never an AIDLC criterion id. */
    id: string;
    kind: ControlKind;
    check_kind: ControlCheckKind;
    /** Lifecycle phases this control applies to. */
    phases: PhaseName[];
    /** What the control requires, in the regime's terms. */
    requires: string;
    /** Where an agent should look. */
    look_at: string;
    /** A single decidable predicate over a diff hunk or an artifact path. */
    fails_when: string;
    /** Applied by the diff check; `mechanical` controls only. */
    pattern?: string;
    severity: FindingSeverity;
    /**
     * The artifact that evidences this control. Required on `evidenced`, and
     * rejected on `checked-only` — a checked-only control has no evidence, and
     * letting it name one is how a check becomes an attestation.
     */
    evidence_artifact?: string;
    /**
     * Anchor into an existing guidance layer whose rule this control restates, e.g.
     * `secure-defaults#transport-and-data-protection`. Present so a verbatim
     * restatement stays traceable to the layer it came from.
     */
    references?: string;
}
/** A regime criterion the pack deliberately does not cover. */
export interface Exclusion {
    /** The regime's own id, e.g. `CC1.1`. */
    id: string;
    reason: ExclusionReason;
    /** Required when the reason alone would misrepresent the boundary. */
    note?: string;
}
/** A guidance layer a pack installs. */
export interface PackLayer {
    name: string;
    file: string;
    /**
     * Always true. Pack layers are delivered as a read-instruction regardless of
     * size, bypassing the inline threshold that applies to framework layers,
     * because inlining pack text into an emitted skill is forbidden outright.
     */
    always_pointer: true;
}
/** A validated pack. */
export interface Pack {
    meta: PackMeta;
    controls: Control[];
    exclusions: Exclusion[];
    layers: PackLayer[];
}
/** Why a pack could not be resolved. */
export type PackErrorCode = 'not-found' | 'unreadable' | 'invalid';
/** A pack that could not be loaded, with every reason found. */
export interface PackError {
    code: PackErrorCode;
    /** The pack id as asked for, so the message can name it. */
    id: string;
    /** Repo- or package-relative path, never an absolute one. */
    path?: string;
    /** Every problem found, not just the first — a pack is validated whole. */
    errors: string[];
}
/** Resolution outcome. Never `null`: an absent pack has a reason. */
export type PackResult = {
    ok: true;
    pack: Pack;
} | {
    ok: false;
    error: PackError;
};
//# sourceMappingURL=types.d.ts.map