#!/usr/bin/env node
/**
 * @connexum/ai-governance CLI
 *
 * Scaffolds governance into Claude Code projects.
 * Usage: npx @connexum/ai-governance init
 *
 * T-084: CLI scaffolder
 * T-085: Interactive framework selection
 * T-086: License key validation
 * T-087: Hook installation
 *
 * @connexum/ai-governance
 */
import * as readline from 'readline';
import { type DetectedAgent } from './agent-dir-scanner';
export interface VendorCodeExchangeResult {
    ok: boolean;
    tier?: string;
    packEntitlements?: string[];
    subscriptionActiveUntil?: string;
    status?: string;
    error?: string;
    offlineMode?: boolean;
}
/**
 * Validate a vendor code format.
 * Accepts `cxni_v1_<14 chars, case-insensitive>`.
 */
export declare function isValidVendorCodeFormat(code: string): boolean;
/**
 * Exchange a Vendor Code with the license server for an Entitlement Token.
 * Returns structured result; does not throw.
 */
export declare function exchangeVendorCode(vendorCode: string, licenseServerUrl?: string): Promise<VendorCodeExchangeResult>;
/**
 * Read the vendor code from environment, config file, or interactive prompt.
 * Returns the code and how it was sourced, or null if not available.
 */
export declare function resolveVendorCode(projectDir: string, opts?: {
    vendorCodeFlag?: string;
    offlineFlag?: boolean;
    rl?: readline.Interface;
    licenseServerUrl?: string;
}): Promise<{
    code: string;
    source: 'env' | 'config' | 'flag' | 'prompt';
} | null>;
/**
 * Write the vendor code into .governance.json at `subscription.vendorCode`
 * with file mode 0600 on Unix.
 */
export declare function writeVendorCodeToConfig(projectDir: string, vendorCode: string, offlineAcknowledged?: boolean): void;
export type DetectedIde = 'claude-code' | 'cursor' | 'continue' | 'cody' | 'aider' | 'gemini' | 'copilot' | 'unknown';
export declare function detectIde(projectDir: string): DetectedIde;
interface LicenseInfo {
    tier: 'free' | 'starter' | 'professional' | 'enterprise';
    org: string;
    maxPacks: number;
    maxAgents: number;
    features: string[];
    expiresAt?: string;
}
/**
 * Validate legacy HMAC-based license key (CXGOV-<tier>-<org_hash>-<checksum>).
 *
 * AIAG-006: requires `CXGOV_LICENSE_SECRET` env var and fails closed when
 * missing. No hardcoded fallback. Exported for regression testing — do not
 * re-introduce a default secret.
 */
export declare function validateLegacyLicense(key: string): LicenseInfo | null;
export interface GovernanceJsonConfig {
    version: string;
    organization?: string;
    license: string;
    packs: string[];
    providers: {
        allowed: string[];
        blocked: string[];
    };
    hooks: {
        preToolUse: string[];
        postToolUse: string[];
    };
    audit: {
        enabled: boolean;
        format: string;
    };
    encryption: {
        enabled: boolean;
        algorithm: string;
    };
    /** License server URL persisted from --license-server flag. Overrides default. */
    licenseServerUrl?: string;
    /**
     * F-NEW-CUSTOMER-JOURNEY-001 (2026-05-13): runtime push configuration
     * for the audit-logger.sh hook → gov-server pipeline. When all four
     * fields are present, every PostToolUse hook fires a fire-and-forget
     * POST /api/v1/cluster-events/self-registration so the gov-server
     * audit chain (and downstream trust-score refresh) sees real tool-
     * call signals. Missing block → hook is local-only (the prior
     * behavior; safe default for offline/air-gapped customers).
     */
    runtime?: {
        govServerUrl: string;
        orgId: string;
        agentId: string;
        /** JWT or service token presented as `Authorization: Bearer <token>`. */
        serviceToken: string;
    };
    createdAt: string;
}
/**
 * Read the license server URL from .governance.json, falling back to DEFAULT.
 * Call this at any point where the license server URL is needed at runtime.
 */
export declare function readLicenseServerUrl(projectDir: string): string;
export declare function generateConfig(packs: string[], license: LicenseInfo, licenseServerUrl?: string, runtime?: GovernanceJsonConfig['runtime']): GovernanceJsonConfig;
/**
 * P0 install-safety guard. Governance is a PROJECT-LOCAL install: hooks are
 * written to `<projectDir>/.claude/settings.json`. If `init` runs from the
 * home directory, that path resolves to the GLOBAL Claude Code config
 * (`~/.claude/settings.json`) and the hooks fire in EVERY project on the
 * machine — the root cause of the 2026-06-03 global-hook-hang incident, where
 * audit-logger.sh stacked up and froze Claude Code across all terminals.
 *
 * Throws an actionable Error if `projectDir` is the home directory, or if
 * `<projectDir>/.claude` is the global Claude config dir (honoring a relocated
 * CLAUDE_CONFIG_DIR). The CLI handler converts the throw into a clean
 * stderr message + exit 1; calling installHooks directly still fails closed.
 */
export declare function assertSafeInstallDir(projectDir: string): void;
export declare function installHooks(projectDir: string, config: GovernanceJsonConfig): {
    installed: number;
    errors: string[];
};
/**
 * Clean removal escape hatch for `ai-governance uninstall`.
 *
 * The 2026-06-03 incident had NO uninstall path, so recovery meant manually
 * killing processes and `rm -rf`. This:
 *   1. strips ONLY our hooks from `<projectDir>/.claude/settings.json`
 *      (identified by a command referencing `<projectDir>/.governance/hooks/`),
 *      preserving any hooks the user added themselves;
 *   2. removes the generated hook scripts and `.governance.json`;
 *   3. PRESERVES the tamper-evident audit chain (`.governance/audit/`) by
 *      default — it is compliance evidence — deleting it only when `purge` is
 *      set.
 *
 * Idempotent and non-throwing on a project with nothing installed.
 */
export declare function uninstallGovernance(projectDir: string, opts?: {
    purge?: boolean;
}): {
    hooksRemoved: number;
    removedPaths: string[];
    auditPreserved: string | null;
};
/** Structured aiIntegrations block in the nonInteractiveInit JSON output. */
export interface AiIntegrationsResult {
    claudeCode: {
        slashCommands: string[];
        subAgent: string;
        claudeMd: string;
    };
    cursor: {
        rules: string;
    };
    continue: {
        config: string;
    };
    mcpSuggestPath: string;
    nextStepCue: string;
}
/** Write .claude/commands/ slash-command markdown files. Returns relative paths. */
export declare function writeClaudeSlashCommands(projectDir: string): string[];
/** Write .claude/agents/governance-scanner.md sub-agent definition. Returns relative path. */
export declare function writeGovernanceScannerAgent(projectDir: string): string;
/**
 * Write .cursor/rules/governance.md — Cursor auto-loaded rules extended with
 * governance-scan command guidance. Idempotent. Returns relative path.
 */
export declare function writeCursorGovernanceRules(projectDir: string, packs: string[]): string;
/**
 * Write .continue/config.yaml — appends customCommands block for Continue users.
 * Idempotent — will not duplicate the block. Returns relative path.
 */
export declare function writeContinueConfig(projectDir: string): string;
/** Write .governance/QUICKSTART_FOR_AI.md — universal AI IDE fallback. */
export declare function writeGovernanceQuickstart(projectDir: string, packs: string[]): void;
/**
 * Write .governance/SUGGEST_MCP.md — one-line MCP server add command.
 * Does NOT auto-install. Returns relative path.
 */
export declare function writeGovernanceMcpSuggest(projectDir: string, tenantId?: string): string;
export declare function nonInteractiveInit(projectDir: string, opts: {
    packs?: string;
    license?: string;
    licenseServerUrl?: string;
    runtime?: GovernanceJsonConfig['runtime'];
    /** Agent directory path (from --agent-dir or JWT) — threaded into AGENTS.md */
    agentDir?: string;
}): Promise<void>;
/**
 * `ai-governance verify-chain <logDir> [--json]`
 *
 * Customer-runnable audit chain verifier. Works standalone — does NOT require
 * a connected governance server. The customer downloads their JSONL audit log,
 * points this command at the directory, and gets a verifiable integrity result.
 *
 * Exit codes:
 *   0 — chain is intact (or log dir is empty, which is a valid-but-empty state)
 *   1 — tamper detected (hash mismatch or parse error in chain)
 *   2 — input error (missing directory, unreadable files, bad arguments)
 */
/**
 * F-NEW-AUDIT-RETENTION-1: customer-side audit log retention enforcement.
 *
 * Scans an audit directory for `audit-YYYY-MM-DD.jsonl` files and either
 * archives or deletes ones older than the retention window. Designed to be
 * run from a cron job (`0 3 * * * npx @connexum/ai-governance retention-sweep`)
 * or manually before a HIPAA / SOC 2 audit cycle.
 *
 * Default retention: 2190 days (~6 years), the longest commonly-required
 * regulatory window. Customers should override with their pack's actual
 * retention requirement (HIPAA §164.316 = 6 years, SOC 2 = typically 1 year,
 * GDPR = "no longer than necessary"). The default is the safest floor.
 *
 * Behaviour:
 *   - Without --archive-dir: files older than the window are DELETED.
 *   - With --archive-dir: files are MOVED there (preserving filename).
 *   - With --dry-run: files are listed but neither deleted nor moved.
 *
 * Output: human-readable summary to stdout, machine-readable JSON via --json.
 *
 * Exit codes:
 *   0 — sweep completed; report generated.
 *   1 — sweep ran but at least one file could not be processed.
 *   2 — input error (missing directory, bad arguments).
 *
 * @connexum/ai-governance F-NEW-AUDIT-RETENTION-1
 */
export interface RetentionSweepResult {
    auditDir: string;
    retainDays: number;
    cutoffIso: string;
    archiveDir: string | null;
    dryRun: boolean;
    filesScanned: number;
    filesRetained: number;
    filesActioned: Array<{
        path: string;
        ageDays: number;
        action: 'deleted' | 'archived' | 'would-action';
    }>;
    errors: Array<{
        path: string;
        error: string;
    }>;
}
export declare function retentionSweep(opts: {
    auditDir: string;
    retainDays: number;
    archiveDir: string | null;
    dryRun: boolean;
    now?: Date;
}): RetentionSweepResult;
export declare function verifyChain(logDir: string, jsonOutput: boolean): void;
/**
 * Generate .governance/autowrap.py and .governance/autowrap.js in agentDir.
 *
 * These scripts can be passed to Python / Node as bootstrap loaders:
 *   CONNEXUM_AUTOWRAP=1 python -c "import connexum_governance; from openai import OpenAI"
 *   NODE_OPTIONS='--require ./.governance/autowrap.js' node agent.js
 *
 * The function prints clear env-var instructions to stdout.
 * It does NOT modify the user's shell profile or global environment -- that
 * would be intrusive and violate the principle of least surprise.
 */
export declare function generateAutowrapArtifacts(agentDir: string, detectedAgents: DetectedAgent[], projectDir: string): void;
export {};
//# sourceMappingURL=index.d.ts.map