/**
 * SBOM, Provenance, and Signing Types
 *
 * Types for CycloneDX SBOM generation, SLSA provenance,
 * and Sigstore signing.
 *
 * @module sbom/types
 */
/**
 * CycloneDX SBOM format version
 */
export declare const CYCLONEDX_SPEC_VERSION = "1.5";
/**
 * CycloneDX component type
 */
export type ComponentType = "application" | "framework" | "library" | "container" | "platform" | "operating-system" | "device" | "device-driver" | "firmware" | "file" | "machine-learning-model" | "data";
/**
 * Component scope
 */
export type ComponentScope = "required" | "optional" | "excluded";
/**
 * External reference type
 */
export type ExternalReferenceType = "vcs" | "issue-tracker" | "website" | "advisories" | "bom" | "mailing-list" | "social" | "chat" | "documentation" | "support" | "source-distribution" | "distribution" | "distribution-intake" | "license" | "build-meta" | "build-system" | "release-notes" | "security-contact" | "model-card" | "log" | "configuration" | "evidence" | "formulation" | "attestation" | "threat-model" | "adversary-model" | "risk-assessment" | "vulnerability-assertion" | "exploitability-statement" | "pentest-report" | "static-analysis-report" | "dynamic-analysis-report" | "runtime-analysis-report" | "component-analysis-report" | "maturity-report" | "certification-report" | "codified-infrastructure" | "quality-metrics" | "poam" | "electronic-signature" | "digital-signature" | "rfc-9116" | "other";
/**
 * Hash algorithm
 */
export type HashAlgorithm = "MD5" | "SHA-1" | "SHA-256" | "SHA-384" | "SHA-512" | "SHA3-256" | "SHA3-384" | "SHA3-512" | "BLAKE2b-256" | "BLAKE2b-384" | "BLAKE2b-512" | "BLAKE3";
/**
 * Hash value
 */
export interface Hash {
    alg: HashAlgorithm;
    content: string;
}
/**
 * External reference
 */
export interface ExternalReference {
    type: ExternalReferenceType;
    url: string;
    comment?: string;
    hashes?: Hash[];
}
/**
 * License information
 */
export interface LicenseInfo {
    license?: {
        id?: string;
        name?: string;
        url?: string;
    };
    expression?: string;
}
/**
 * Property (name-value pair)
 */
export interface Property {
    name: string;
    value: string;
}
/**
 * CycloneDX Component
 */
export interface CycloneDXComponent {
    type: ComponentType;
    "bom-ref"?: string;
    supplier?: {
        name?: string;
        url?: string[];
    };
    author?: string;
    publisher?: string;
    group?: string;
    name: string;
    version?: string;
    description?: string;
    scope?: ComponentScope;
    hashes?: Hash[];
    licenses?: LicenseInfo[];
    copyright?: string;
    purl?: string;
    externalReferences?: ExternalReference[];
    properties?: Property[];
}
/**
 * CycloneDX Dependency
 */
export interface CycloneDXDependency {
    ref: string;
    dependsOn?: string[];
}
/**
 * CycloneDX Tool
 */
export interface CycloneDXTool {
    vendor?: string;
    name: string;
    version?: string;
    hashes?: Hash[];
    externalReferences?: ExternalReference[];
}
/**
 * CycloneDX Metadata
 */
export interface CycloneDXMetadata {
    timestamp?: string;
    tools?: CycloneDXTool[];
    authors?: Array<{
        name?: string;
        email?: string;
    }>;
    component?: CycloneDXComponent;
    manufacture?: {
        name?: string;
        url?: string[];
    };
    supplier?: {
        name?: string;
        url?: string[];
    };
    licenses?: LicenseInfo[];
    properties?: Property[];
}
/**
 * Vulnerability source
 */
export interface VulnerabilitySource {
    name: string;
    url?: string;
}
/**
 * Vulnerability rating
 */
export interface VulnerabilityRating {
    source?: VulnerabilitySource;
    score?: number;
    severity?: "critical" | "high" | "medium" | "low" | "info" | "none" | "unknown";
    method?: "CVSSv2" | "CVSSv3" | "CVSSv31" | "CVSSv4" | "OWASP" | "other";
    vector?: string;
    justification?: string;
}
/**
 * CycloneDX Vulnerability
 */
export interface CycloneDXVulnerability {
    "bom-ref"?: string;
    id: string;
    source?: VulnerabilitySource;
    references?: Array<{
        id: string;
        source: VulnerabilitySource;
    }>;
    ratings?: VulnerabilityRating[];
    cwes?: number[];
    description?: string;
    detail?: string;
    recommendation?: string;
    advisories?: Array<{
        title?: string;
        url: string;
    }>;
    created?: string;
    published?: string;
    updated?: string;
    affects?: Array<{
        ref: string;
        versions?: Array<{
            version?: string;
            range?: string;
            status: "affected" | "unaffected" | "unknown";
        }>;
    }>;
}
/**
 * CycloneDX SBOM
 */
export interface CycloneDXSBOM {
    bomFormat: "CycloneDX";
    specVersion: string;
    serialNumber?: string;
    version: number;
    metadata?: CycloneDXMetadata;
    components?: CycloneDXComponent[];
    dependencies?: CycloneDXDependency[];
    vulnerabilities?: CycloneDXVulnerability[];
    externalReferences?: ExternalReference[];
    properties?: Property[];
}
/**
 * SLSA Provenance predicate type
 */
export declare const SLSA_PREDICATE_TYPE = "https://slsa.dev/provenance/v1";
/**
 * SLSA Builder
 */
export interface SLSABuilder {
    id: string;
    version?: Record<string, string>;
    builderDependencies?: Array<{
        uri: string;
        digest?: Record<string, string>;
    }>;
}
/**
 * SLSA Build metadata
 */
export interface SLSABuildMetadata {
    invocationId?: string;
    startedOn?: string;
    finishedOn?: string;
}
/**
 * SLSA Run details
 */
export interface SLSARunDetails {
    builder: SLSABuilder;
    metadata?: SLSABuildMetadata;
    byproducts?: Array<{
        uri?: string;
        mediaType?: string;
        digest?: Record<string, string>;
        content?: string;
    }>;
}
/**
 * SLSA Build definition
 */
export interface SLSABuildDefinition {
    buildType: string;
    externalParameters?: Record<string, unknown>;
    internalParameters?: Record<string, unknown>;
    resolvedDependencies?: Array<{
        uri: string;
        digest?: Record<string, string>;
        content?: string;
        downloadLocation?: string;
        mediaType?: string;
        name?: string;
        annotations?: Record<string, string>;
    }>;
}
/**
 * SLSA Provenance Predicate (v1.0)
 */
export interface SLSAProvenancePredicate {
    buildDefinition: SLSABuildDefinition;
    runDetails: SLSARunDetails;
}
/**
 * In-toto Statement (envelope for SLSA)
 */
export interface InTotoStatement {
    _type: "https://in-toto.io/Statement/v1";
    subject: Array<{
        name: string;
        digest: Record<string, string>;
    }>;
    predicateType: string;
    predicate: SLSAProvenancePredicate;
}
/**
 * Sigstore Bundle (simplified)
 */
export interface SigstoreBundle {
    mediaType: string;
    verificationMaterial: {
        certificate?: {
            rawBytes: string;
        };
        publicKey?: {
            hint: string;
        };
        tlogEntries?: Array<{
            logIndex: string;
            logId: {
                keyId: string;
            };
            kindVersion: {
                kind: string;
                version: string;
            };
            integratedTime: string;
            inclusionPromise?: {
                signedEntryTimestamp: string;
            };
            inclusionProof?: {
                logIndex: string;
                rootHash: string;
                treeSize: string;
                hashes: string[];
                checkpoint: {
                    envelope: string;
                };
            };
            canonicalizedBody: string;
        }>;
        timestampVerificationData?: {
            rfc3161Timestamps: Array<{
                signedTimestamp: string;
            }>;
        };
    };
    messageSignature?: {
        messageDigest: {
            algorithm: string;
            digest: string;
        };
        signature: string;
    };
    dsseEnvelope?: {
        payload: string;
        payloadType: string;
        signatures: Array<{
            sig: string;
            keyid?: string;
        }>;
    };
}
/**
 * Signed artifact output
 */
export interface SignedArtifact {
    /** The original content that was signed */
    content: string;
    /** SHA-256 digest of content */
    digest: string;
    /** Sigstore bundle containing signature and certificate */
    bundle?: SigstoreBundle;
    /** Timestamp of signing */
    signedAt: string;
    /** Whether signing was successful */
    signed: boolean;
    /** Error message if signing failed */
    error?: string;
}
/**
 * SBOM generation options
 */
export interface SBOMOptions {
    /** Include dev dependencies */
    includeDevDependencies?: boolean;
    /** Include vulnerabilities from scanners */
    includeVulnerabilities?: boolean;
    /** Include license information */
    includeLicenses?: boolean;
    /** Project name override */
    projectName?: string;
    /** Project version override */
    projectVersion?: string;
    /** Author information */
    author?: {
        name?: string;
        email?: string;
    };
}
/**
 * Provenance generation options
 */
export interface ProvenanceOptions {
    /** Builder ID (e.g., "https://github.com/RCOLKITT/vaspera-hardening-mcp") */
    builderId?: string;
    /** Build type URL */
    buildType?: string;
    /** External parameters passed to the build */
    externalParameters?: Record<string, unknown>;
    /** Internal parameters (environment, etc.) */
    internalParameters?: Record<string, unknown>;
}
/**
 * Signing options
 */
export interface SigningOptions {
    /** Skip signing (generate unsigned artifacts) */
    skipSigning?: boolean;
    /** Identity token for Sigstore (OIDC) */
    identityToken?: string;
    /** Fulcio URL for certificate authority */
    fulcioUrl?: string;
    /** Rekor URL for transparency log */
    rekorUrl?: string;
}
//# sourceMappingURL=types.d.ts.map