/**
 * GapReportGenerator -- Identifies governance gaps in discovered agents.
 *
 * Maps missing controls to compliance framework requirements (SOC 2, HIPAA,
 * GDPR, PCI DSS, DORA, EU AI Act) and scores overall governance coverage.
 *
 * GATE 9: T-147
 *
 * @connexum/ai-governance
 */
import type { ScanResult, GovernanceStatus } from './index';
/**
 * Per-license-state remediation guidance for a missing control.
 *
 * Each key represents the customer's current license/pack state:
 *   'not-purchased'       — the remediating pack has not been purchased
 *   'purchased-not-active' — purchased but not yet activated for this agent
 *   'active'              — pack is active; review config or scanner settings
 */
export interface LicenseStateRemediation {
    /** One-sentence guidance displayed in the CLI/dashboard. */
    summary: string;
    /**
     * The CLI command the customer should run to close this gap.
     * Must be a complete, copy-pasteable command string.
     */
    command: string;
}
/**
 * Context-aware remediation instructions for a specific missing control.
 * Optional — present only for controls that have a known fix path.
 * OWASP Agentic Top 10 controls always carry this field (added by OWASP-B2).
 * Standard governance controls (GOV-xxx) carry it optionally.
 */
export interface ControlFix {
    /** The compliance pack that remediates this control. */
    pack: string;
    /** The hook or module that enforces the control once the pack is active. */
    hook: string;
    /** Source file of the enforcement logic (for developer reference). */
    sourceOfTruth: string;
    /**
     * Estimated minutes to close the gap after following the remediation steps.
     * Used for effort estimation in remediation plans.
     */
    estimatedClosureMinutes: number;
    /**
     * Context-aware remediation: different guidance based on whether the
     * remediating pack is not-purchased, purchased-but-not-active, or active.
     */
    remediationByLicenseState: {
        'not-purchased': LicenseStateRemediation;
        'purchased-not-active': LicenseStateRemediation;
        'active': LicenseStateRemediation;
    };
}
/** A missing governance control for a specific agent */
export interface MissingControl {
    /** Control identifier */
    controlId: string;
    /** Human-readable control name */
    name: string;
    /** What this control does */
    description: string;
    /** Severity of the gap: CRITICAL, HIGH, MEDIUM, LOW */
    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
    /** Which compliance frameworks require this control */
    frameworks: string[];
    /**
     * Context-aware fix instructions.
     * Optional — present for controls with a known fix path.
     * When absent, the remediation planner falls back to generic guidance.
     */
    fix?: ControlFix;
}
/** Gap details for a single agent */
export interface AgentGap {
    /** Agent name */
    name: string;
    /** Agent platform */
    platform: string;
    /** Agent file path */
    filePath: string;
    /** Current governance status */
    governanceStatus: GovernanceStatus;
    /** List of missing controls */
    missingControls: MissingControl[];
    /** Agent-level coverage score (0-100) */
    coverageScore: number;
}
/** Framework-level gap summary */
export interface FrameworkGap {
    /** Framework identifier (e.g., 'soc2', 'hipaa') */
    frameworkId: string;
    /** Framework display name */
    frameworkName: string;
    /** Requirements that are not met */
    unmetRequirements: Array<{
        requirementId: string;
        description: string;
        affectedAgents: string[];
    }>;
    /** Framework-level coverage percentage */
    coveragePercent: number;
}
/** A recommendation for improving governance */
export interface GapRecommendation {
    /** Priority order (1 = highest) */
    priority: number;
    /** Short title */
    title: string;
    /** Detailed description */
    description: string;
    /** Which agents this affects */
    affectedAgents: string[];
    /** Impact if addressed: 'high', 'medium', 'low' */
    impact: 'high' | 'medium' | 'low';
}
/** Complete gap analysis report */
export interface GapReport {
    /** Project directory analyzed */
    projectDir: string;
    /** ISO timestamp of report generation */
    generatedAt: string;
    /** Agents with governance gaps */
    agentGaps: AgentGap[];
    /** Framework-level gap analysis */
    frameworkGaps: FrameworkGap[];
    /** Overall governance coverage score (0-100) */
    overallScore: number;
    /** Prioritized recommendations */
    recommendations: GapRecommendation[];
}
export declare class GapReportGenerator {
    /**
     * Generate a gap report from scan results.
     *
     * OWASP-B2: each discovered agent is passed through the OWASP Agentic Top 10
     * scanner (scanAgent()) to produce OWASP-specific MissingControl entries.
     * These are merged with the existing GOV-xxx control findings so the CLI and
     * dashboard see a unified list of gaps per agent.
     *
     * @param scanResult - Output from AgentScanner.scan()
     * @param frameworks - Optional list of framework IDs to assess against (default: all)
     */
    generate(scanResult: ScanResult, frameworks?: string[]): GapReport;
    /**
     * Analyze a single agent for missing governance controls.
     */
    private analyzeAgentGaps;
    /**
     * Build an AgentManifest from a DiscoveredAgent so the OWASP scanner
     * can analyze it (OWASP-B2 integration).
     *
     * Maps from the scanner's generic capability list to the manifest fields
     * the OWASP analyzer reads:
     *   - tools: capability names (web-fetch → 'WebFetch', bash → 'Bash', etc.)
     *   - hooks: derived from governanceStatus ('governed' = all three hooks wired)
     *   - rateLimitsConfigured: true when governance is 'governed'
     *   - pluginIntegrityVerified: true when governance is 'governed'
     *   - declaredApprovalGates: empty when not governed (triggers A08 findings)
     */
    private buildAgentManifest;
    /**
     * Map an OWASP Agentic Top 10 finding to the MissingControl schema.
     *
     * OWASP control IDs use the format "OWASP-A01" ... "OWASP-A10".
     * The severity mapping: CRIT→CRITICAL, HIGH→HIGH, MED→MEDIUM, LOW→LOW.
     * The fix field carries the OWASP-B1 extended remediationByLicenseState.
     */
    private owaspFindingToMissingControl;
    /**
     * Analyze gap coverage for a specific compliance framework.
     */
    private analyzeFrameworkGaps;
    /**
     * Compute overall governance coverage score.
     */
    private computeOverallScore;
    /**
     * Generate prioritized recommendations based on gaps found.
     */
    private generateRecommendations;
}
//# sourceMappingURL=gap-report.d.ts.map