/**
 * Compliance Framework Types
 *
 * Types for mapping security findings to compliance frameworks
 * like SOC 2 and ISO 27001.
 *
 * @module compliance/types
 */
import type { Severity } from "../certification/types.js";
import type { Finding } from "../certification/types.js";
/**
 * Supported compliance frameworks
 */
export type ComplianceFramework = "SOC2" | "ISO27001" | "PCI-DSS" | "HIPAA" | "GDPR" | "CCPA" | "NIST-800-53" | "CIS" | "42-CFR-PART-2" | "OWASP-LLM" | "NIST-AI-RMF" | "MITRE-ATLAS" | "EU-AI-ACT" | "ISO-42001";
/**
 * A compliance control from a framework
 */
export interface ComplianceControl {
    /** Control ID (e.g., "CC6.1", "A.12.6.1") */
    id: string;
    /** Framework this control belongs to */
    framework: ComplianceFramework;
    /** Control category/domain */
    category: string;
    /** Short title of the control */
    title: string;
    /** Full description of the control requirement */
    description: string;
    /** Keywords for matching findings to this control */
    keywords: string[];
    /** Finding categories that map to this control */
    findingCategories: string[];
    /** CWE IDs that map to this control */
    cweIds?: string[];
    /** Severity threshold - findings below this don't trigger control */
    severityThreshold?: Severity;
}
/**
 * A control with its associated findings
 */
export interface ControlWithFindings {
    control: ComplianceControl;
    findings: Finding[];
    status: "compliant" | "at_risk" | "non_compliant";
    riskLevel: "low" | "medium" | "high" | "critical";
}
/**
 * Summary of compliance status for a framework
 */
export interface ComplianceStatus {
    framework: ComplianceFramework;
    totalControls: number;
    controlsCovered: number;
    controlsAtRisk: number;
    controlsNonCompliant: number;
    complianceScore: number;
    riskScore: number;
}
/**
 * Full compliance report
 */
export interface ComplianceReport {
    /** Report metadata */
    id: string;
    generatedAt: string;
    projectPath: string;
    certificationId?: string;
    /** Framework being assessed */
    framework: ComplianceFramework;
    /** Overall status */
    status: ComplianceStatus;
    /** Controls with their findings */
    controls: ControlWithFindings[];
    /** Controls with no findings (compliant) */
    compliantControls: ComplianceControl[];
    /** Controls at risk (medium/low findings) */
    atRiskControls: ControlWithFindings[];
    /** Non-compliant controls (critical/high findings) */
    nonCompliantControls: ControlWithFindings[];
    /** Recommendations */
    recommendations: ComplianceRecommendation[];
}
/**
 * A compliance recommendation
 */
export interface ComplianceRecommendation {
    controlId: string;
    priority: "critical" | "high" | "medium" | "low";
    title: string;
    description: string;
    remediationSteps: string[];
    estimatedEffort: "hours" | "days" | "weeks";
}
/**
 * Mapping configuration for a finding category
 */
export interface CategoryMapping {
    /** Finding category (e.g., "sql-injection", "secrets") */
    category: string;
    /** CWE IDs associated with this category */
    cweIds: string[];
    /** Control IDs this category maps to */
    soc2Controls: string[];
    iso27001Controls: string[];
    pciDssControls?: string[];
    hipaaControls?: string[];
    gdprControls?: string[];
    nist80053Controls?: string[];
    cisControls?: string[];
}
/**
 * Multi-framework compliance summary
 */
export interface MultiFrameworkReport {
    id: string;
    generatedAt: string;
    projectPath: string;
    certificationId?: string;
    frameworks: {
        [K in ComplianceFramework]?: ComplianceStatus;
    };
    /** Cross-framework recommendations prioritized by impact */
    prioritizedRecommendations: ComplianceRecommendation[];
}
//# sourceMappingURL=types.d.ts.map