/**
 * ComplianceCheckRegistry
 *
 * Real implementations for the `check:` strings declared in every
 * compliance pack's validators. Provides the pass/fail verdict that
 * PackRegistry.validate() records against each validator.
 *
 * A validator in a pack declares `check: 'governance_active'`. At
 * validation time, PackRegistry looks up that check in this registry,
 * runs the function against a ComplianceCheckContext, and records the
 * real pass/fail result.
 *
 * Context sources:
 *   - activeModules: governance modules currently active in the runtime.
 *   - packConfig: merged module-config from active packs.
 *   - evidence: flags gathered from the governance runtime (hash chain
 *     state, change-management workflow active, etc.).
 *
 * Registration contract (P1C-03): every check id referenced by an
 * active pack MUST be registered. Unregistered ids HARD-FAIL with a
 * governance-defect verdict. There is no neutral-pass fallback.
 * The server boot-gate verifies the registration invariant BEFORE
 * binding the HTTP listener so that misconfigured deployments fail
 * loudly at startup rather than silently inflating pass rates.
 *
 * @connexum/ai-governance
 */
export interface ComplianceCheckContext {
    /** Governance modules currently loaded / active */
    activeModules: string[];
    /** IDs of packs currently active in the registry (enables cross-pack dependency checks) */
    activePackIds?: string[];
    /** Merged module-config from active packs */
    packConfig?: Record<string, Record<string, unknown>>;
    /** Evidence flags the runtime has gathered */
    evidence?: Record<string, boolean | number | string>;
}
export interface ComplianceCheckResult {
    passed: boolean;
    detail: string;
}
export type ComplianceCheckFn = (ctx: ComplianceCheckContext) => ComplianceCheckResult;
export declare class ComplianceCheckRegistry {
    private checks;
    register(id: string, fn: ComplianceCheckFn): void;
    has(id: string): boolean;
    /**
     * List every registered check id. Used by the server boot-gate to
     * verify that every check referenced by an active pack has a wired
     * validator BEFORE the HTTP listener binds.
     */
    listIds(): string[];
    /**
     * Run a check. If the id is not registered, HARD-FAIL with a
     * governance-defect verdict. Unregistered check ids are treated as
     * a misconfiguration of the compliance product, NOT as a silent
     * pass. Callers (PackRegistry.validate, boot-gate) rely on this
     * contract to prevent unverified controls from inflating pass rates
     * in audit reports.
     */
    run(id: string, ctx: ComplianceCheckContext): ComplianceCheckResult;
    /**
     * Register the default set of module-presence checks. These cover
     * the most common `check:` strings used across all 12 packs:
     * governance, audit, encryption, RBAC, agent auth, monitoring, HITL,
     * transparency, data classifier, post-market monitoring, incident
     * reporting, bias monitor, attestation, supply chain, approval queue.
     */
    registerDefaults(): void;
}
/**
 * Shared default registry instance. Tests / apps can use this or
 * construct their own registry for isolated test fixtures.
 */
export declare const defaultCheckRegistry: ComplianceCheckRegistry;
//# sourceMappingURL=check-registry.d.ts.map