import { c as DatasetManifest } from '../dataset-B2kL-fSM.js';
import { b as CalibrationResult } from '../judge-calibration-DilmB3Ml.js';
import { O as OutcomeStore } from '../outcome-store-D6KWmYvj.js';
import { d as RedTeamReport } from '../red-team-DW9Ca_tj.js';
import { T as TraceStore } from '../store-CKUAgsJz.js';
import '../errors-Dwqw-T_m.js';
import '../schema-m0gsnbt3.js';

/**
 * Governance reporting — shared types.
 *
 * The framework collects a `GovernanceContext` (traces + outcomes +
 * dataset manifests + red-team results + judge calibration) and each
 * specific template (NIST AI RMF, SOC2, EU AI Act) renders a
 * structured report from it.
 *
 * Reports are machine-readable JSON first; human-readable Markdown is a
 * pure transform on top. External auditors consume the Markdown; CI
 * consumes the JSON.
 */

interface GovernanceContext {
    /** Legal / org identity for the report. */
    organization: string;
    /** System / agent identifier. */
    systemName: string;
    /** ISO8601 period the report covers. */
    periodStart: string;
    periodEnd: string;
    /** Versioned dataset manifests used during the period. */
    datasets: DatasetManifest[];
    traceStore: TraceStore;
    outcomeStore?: OutcomeStore;
    /** Cached red-team results for the period, if available. */
    redTeam?: RedTeamReport;
    /** Judge-vs-human calibration results, if measured. */
    judgeCalibration?: CalibrationResult[];
    /** Responsible owner for the system — role + name + email. */
    owner: {
        role: string;
        name: string;
        email: string;
    };
}
interface GovernanceFinding {
    id: string;
    severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
    /** Control reference the finding maps to (e.g. "NIST-AI-RMF:MEASURE-2.1"). */
    control: string;
    summary: string;
    evidence?: string;
    remediation?: string;
}
interface GovernanceReport {
    framework: 'NIST-AI-RMF' | 'SOC2' | 'EU-AI-ACT';
    version: string;
    context: Pick<GovernanceContext, 'organization' | 'systemName' | 'periodStart' | 'periodEnd' | 'owner'>;
    summary: {
        findings: number;
        byeverity: Record<GovernanceFinding['severity'], number>;
        overall: 'compliant' | 'compliant-with-findings' | 'non-compliant';
    };
    findings: GovernanceFinding[];
    /** Framework-specific structured payload (mapped controls, risk class, etc.). */
    payload: Record<string, unknown>;
    generatedAt: string;
}
declare function renderMarkdown(report: GovernanceReport): string;
declare function summarize(findings: GovernanceFinding[]): GovernanceReport['summary'];

/**
 * EU AI Act — risk-class classification + compliance checklist.
 *
 * Classification is declarative: caller supplies the domain/use-case
 * signals (biometric? critical infrastructure? education? employment?
 * access to services?) and we map to the Act's risk tiers:
 *   - "unacceptable" (prohibited)
 *   - "high"        (Annex III — strict obligations)
 *   - "limited"     (transparency obligations)
 *   - "minimal"     (voluntary codes of conduct)
 *
 * Then the compliance checklist enumerates Article 9 (risk mgmt),
 * 10 (data + data governance), 11 (technical documentation), 13
 * (transparency), 14 (human oversight), 15 (accuracy + robustness)
 * requirements and flags gaps.
 */

type EuRiskClass = 'unacceptable' | 'high' | 'limited' | 'minimal';
interface UseCaseSignals {
    /** Used for biometric identification in public spaces? (Art. 5 — unacceptable). */
    biometricPublic?: boolean;
    /** Social scoring by public authorities? (Art. 5). */
    socialScoring?: boolean;
    /** Subliminal manipulation? (Art. 5). */
    subliminal?: boolean;
    /** Annex III sector: critical infrastructure / education / employment /
     *  access to essential services / law enforcement / migration /
     *  administration of justice / democratic processes? */
    annexIII?: boolean;
    /** Interacts directly with natural persons (chatbot, agent)? — limited risk. */
    chatbot?: boolean;
    /** Generates synthetic media (image/audio/video/text deepfakes)? — limited risk. */
    generatesSyntheticMedia?: boolean;
}
declare function classifyEuAiRisk(signals: UseCaseSignals): EuRiskClass;
declare function euAiActReport(ctx: GovernanceContext, signals: UseCaseSignals): Promise<GovernanceReport>;

/**
 * NIST AI RMF 1.0 — Govern / Map / Measure / Manage mapping.
 *
 * Each subcategory derives its status from concrete framework state:
 *   MEASURE 2.x: do we have a calibration regime? contamination controls?
 *   MEASURE 2.7: are red-team results available?
 *   MANAGE 1.x: are outcome metrics captured? correlation measured?
 *   GOVERN 1.x: dataset + prompt provenance recorded?
 *
 * We ship the mapping and the derivation rules; consumers supply the
 * GovernanceContext.
 */

declare function nistAiRmfReport(ctx: GovernanceContext): Promise<GovernanceReport>;

/**
 * SOC 2 — Common Criteria 7 (system operations + change management)
 * audit trail derived from the trace corpus.
 *
 * This is NOT a formal SOC2 report — that requires an external
 * auditor. What we ship is the machine-readable *evidence* package
 * that an auditor consumes: run counts, deploy events, access log
 * summary, anomaly tracking, response-time SLOs.
 */

declare function soc2Report(ctx: GovernanceContext): Promise<GovernanceReport>;

export { type EuRiskClass, type GovernanceContext, type GovernanceFinding, type GovernanceReport, type UseCaseSignals, classifyEuAiRisk, euAiActReport, nistAiRmfReport, renderMarkdown, soc2Report, summarize };
