"use strict";
/**
 * Pack-as-remediation type definitions — PR-5a
 *
 * Defines the PackRemediation schema that pack authors use to declare
 * auto-fix actions. These are consumed by the remediation runner at
 * `scanner --fix` time.
 *
 * Security model (Shield H-3):
 *   - Codemod payloads ship as embedded strings (NOT file paths).
 *   - All payloads are signature-verified before execution.
 *   - Codemods execute inside vm.runInNewContext() with a restricted
 *     module allowlist (no child_process, no fs.unlink, no os, etc.).
 *   - Dry-run is mandatory: customer sees a diff before any file is written.
 *
 * @connexum/ai-governance PR-5a
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.RemediationSignatureError = exports.RemediationSandboxViolation = void 0;
/** Thrown when a codemod transform attempts a disallowed operation in the sandbox */
class RemediationSandboxViolation extends Error {
    constructor(message) {
        super(`[Sandbox violation] ${message}`);
        this.name = 'RemediationSandboxViolation';
    }
}
exports.RemediationSandboxViolation = RemediationSandboxViolation;
/** Thrown when pack author signature verification fails */
class RemediationSignatureError extends Error {
    constructor(message) {
        super(`[Signature error] ${message}`);
        this.name = 'RemediationSignatureError';
    }
}
exports.RemediationSignatureError = RemediationSignatureError;
//# sourceMappingURL=types.js.map