/** SLSA provenance level — L0 (none) to L3 (hermetic). */
export type SlsaLevel = 'L0' | 'L1' | 'L2' | 'L3';
/** SBOM format when present. */
export type SbomFormat = 'CycloneDX-1.6' | 'SPDX-2.3' | 'other' | null;
/** Risk level for dependency confusion. */
export type DependencyConfusionRisk = 'none' | 'low' | 'high' | 'critical';
/** Category of a supply chain gap. */
export type SupplyChainCategory = 'slsa' | 'sbom' | 'dependency-confusion' | 'lockfile' | 'reproducible';
/** Severity of a supply chain gap. */
export type SupplyChainSeverity = 'critical' | 'warning' | 'info';
/** A detected gap in the project's supply chain security posture. */
export interface SupplyChainGap {
    category: SupplyChainCategory;
    severity: SupplyChainSeverity;
    message: string;
    fix: string;
    references: string[];
}
/** Full supply chain security report for a project. */
export interface SupplyChainReport {
    slsaLevel: SlsaLevel;
    sbomPresent: boolean;
    sbomValid: boolean;
    sbomFormat: SbomFormat;
    lockfilePresent: boolean;
    dependencyConfusionRisk: DependencyConfusionRisk;
    reproducibleBuild: boolean;
    signingPresent: boolean;
    gaps: SupplyChainGap[];
}
/** A single SBOM tool entry in the supply-chain-tools.json config. */
export interface SbomToolEntry {
    name: string;
    alternative: string | null;
    command: string;
    docsUrl: string;
}
/** A monitoring tool entry in the supply-chain-tools.json config. */
export interface SupplyChainMonitoringEntry {
    name: string;
    description: string;
    docsUrl: string;
}
/** Top-level shape of supply-chain-tools.json. */
export interface SupplyChainToolsConfig {
    sbomTools: Record<string, SbomToolEntry>;
    monitoringTools: Record<string, SupplyChainMonitoringEntry>;
}
/** Result from sbom-checker.checkSbom(). */
export interface SbomCheckResult {
    sbomPresent: boolean;
    sbomValid: boolean;
    sbomFormat: SbomFormat;
    sbomInCi: boolean;
}
/** Result from dependency-checker.checkDependencies(). */
export interface DependencyCheckResult {
    lockFile: string | null;
    lockFileHasHashes: boolean;
    dependencyConfusionRisk: DependencyConfusionRisk;
    hasRegistryConfig: boolean;
    unscopedPrivateCount: number;
}
/** Result from build-checker.checkBuild(). */
export interface BuildCheckResult {
    reproducibleBuild: boolean;
    dockerfilesPinned: boolean;
    dockerfilesHaveUnpinned: boolean;
    hermeticTool: string | null;
    frozenLockfileInCi: boolean;
}
/**
 * Result of npm native provenance detection (TD-P15-02).
 * `npm publish --provenance` + `actions/attest-build-provenance` = SLSA L2 natively.
 */
export interface NpmProvenanceResult {
    /** True when `npm publish --provenance` is present in package.json scripts. */
    hasNpmProvenanceScript: boolean;
    /** True when `actions/attest-build-provenance` is in a workflow file. */
    hasAttestAction: boolean;
    /** True when both conditions are met — native SLSA L2 without extra tooling. */
    isNativeSlsaL2: boolean;
}
/**
 * SLSA provenance format detected in the project (TD-P15-01).
 * - `v1`: SLSA v1.1 format (`slsa.dev/provenance/v1`, April 2025)
 * - `v0.2`: Legacy format (`slsa.dev/provenance/v0.2`)
 * - `both`: Both formats detected (mixed/transitional)
 * - `none`: No provenance format references found
 */
export type SlsaProvenanceFormat = 'v1' | 'v0.2' | 'both' | 'none';
//# sourceMappingURL=supply-chain.d.ts.map