// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Compliance Reporting Type Definitions
 *
 * Defines compliance frameworks, controls, assessments, and reporting types
 * for SOC 2 Type II, NIST 800-53, and other regulatory frameworks.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
// =============================================================================
// COMPLIANCE PRIORITIES
// =============================================================================
export const CONTROL_PRIORITIES = ['P1', 'P2', 'P3'];
export const controlPrioritySchema = z.enum(CONTROL_PRIORITIES);
// =============================================================================
// IMPLEMENTATION STATUS
// =============================================================================
export const IMPLEMENTATION_STATUSES = [
    'implemented',
    'partially-implemented',
    'planned',
    'not-applicable',
];
export const implementationStatusSchema = z.enum(IMPLEMENTATION_STATUSES);
// =============================================================================
// FINDING SEVERITY
// =============================================================================
export const FINDING_SEVERITIES = ['critical', 'high', 'medium', 'low', 'informational'];
export const findingSeveritySchema = z.enum(FINDING_SEVERITIES);
// =============================================================================
// EVIDENCE TYPES
// =============================================================================
export const EVIDENCE_TYPES = [
    'log',
    'config',
    'screenshot',
    'document',
    'api-response',
    'test-result',
    'policy',
    'attestation',
];
export const evidenceTypeSchema = z.enum(EVIDENCE_TYPES);
export const evidenceSchema = z.object({
    id: z.string().min(1),
    type: evidenceTypeSchema,
    title: z.string().min(1),
    description: z.string().min(1),
    source: z.string().min(1),
    collectedAt: z.coerce.date(),
    contentHash: z.string().optional(),
    reference: z.string().optional(),
    content: z.string().optional(),
    metadata: z.record(z.unknown()).optional(),
});
export const complianceControlSchema = z.object({
    id: z.string().min(1),
    name: z.string().min(1),
    description: z.string().min(1),
    family: z.string().min(1),
    priority: controlPrioritySchema,
    implementation: implementationStatusSchema,
    evidence: z.array(evidenceSchema),
    crossReferences: z.array(z.string()).optional(),
    owner: z.string().optional(),
    lastAssessed: z.coerce.date().optional(),
    notes: z.string().optional(),
});
export const complianceFrameworkSchema = z.object({
    id: z.string().min(1),
    name: z.string().min(1),
    version: z.string().min(1),
    description: z.string().optional(),
    controls: z.array(complianceControlSchema),
    effectiveDate: z.coerce.date().optional(),
    authority: z.string().optional(),
});
export const controlAssessmentSchema = z.object({
    controlId: z.string().min(1),
    controlName: z.string().min(1),
    status: implementationStatusSchema,
    automatedTestPassed: z.boolean().optional(),
    assessedAt: z.coerce.date(),
    evidence: z.array(evidenceSchema),
    notes: z.string().optional(),
    gaps: z.array(z.string()).optional(),
    riskScore: z.number().min(0).max(100).optional(),
});
export const findingSchema = z.object({
    id: z.string().min(1),
    title: z.string().min(1),
    description: z.string().min(1),
    severity: findingSeveritySchema,
    relatedControls: z.array(z.string()),
    identifiedAt: z.coerce.date(),
    status: z.enum(['open', 'in-progress', 'remediated', 'accepted']),
    remediationPlan: z.string().optional(),
    targetRemediationDate: z.coerce.date().optional(),
    remediatedAt: z.coerce.date().optional(),
    riskDescription: z.string().optional(),
    owner: z.string().optional(),
});
export const reportSummarySchema = z.object({
    totalControls: z.number().int().nonnegative(),
    implemented: z.number().int().nonnegative(),
    partiallyImplemented: z.number().int().nonnegative(),
    planned: z.number().int().nonnegative(),
    notApplicable: z.number().int().nonnegative(),
    automatedTestsPassed: z.number().int().nonnegative(),
    automatedTestsFailed: z.number().int().nonnegative(),
    compliancePercentage: z.number().min(0).max(100),
});
export const complianceReportSchema = z.object({
    id: z.string().min(1),
    framework: z.string().min(1),
    frameworkVersion: z.string().min(1),
    generatedAt: z.coerce.date(),
    period: z.object({
        start: z.coerce.date(),
        end: z.coerce.date(),
    }),
    summary: reportSummarySchema,
    controls: z.array(controlAssessmentSchema),
    findings: z.array(findingSchema),
    recommendations: z.array(z.string()),
    preparedBy: z.string().optional(),
    reviewedBy: z.string().optional(),
    metadata: z.record(z.unknown()).optional(),
});
export const monitoringStatusSchema = z.object({
    controlId: z.string().min(1),
    enabled: z.boolean(),
    lastCheck: z.coerce.date().optional(),
    lastResult: z.boolean().optional(),
    checkFrequency: z.number().int().positive(),
    consecutiveFailures: z.number().int().nonnegative(),
    alertThreshold: z.number().int().positive(),
    alertTriggered: z.boolean(),
});
export const controlMappingSchema = z.object({
    sourceFramework: z.string().min(1),
    sourceControlId: z.string().min(1),
    targetFramework: z.string().min(1),
    targetControlIds: z.array(z.string()),
    mappingType: z.enum(['exact', 'partial', 'related']),
    notes: z.string().optional(),
});
export const assessmentOptionsSchema = z.object({
    frameworkId: z.string().min(1),
    periodStart: z.coerce.date().optional(),
    periodEnd: z.coerce.date().optional(),
    runAutomatedTests: z.boolean().optional(),
    collectEvidence: z.boolean().optional(),
    controlIds: z.array(z.string()).optional(),
    includePreviousFindings: z.boolean().optional(),
});
export const complianceEngineConfigSchema = z.object({
    enabledFrameworks: z.array(z.string()),
    monitoring: z.object({
        enabled: z.boolean(),
        defaultCheckFrequency: z.number().int().positive(),
        defaultAlertThreshold: z.number().int().positive(),
    }),
    evidence: z.object({
        retentionDays: z.number().int().positive(),
        autoCollect: z.boolean(),
        hashAlgorithm: z.enum(['sha256', 'sha384', 'sha512']),
    }),
    reporting: z.object({
        defaultFormat: z.enum(['json', 'pdf', 'html']),
        includeRawEvidence: z.boolean(),
    }),
});
export const DEFAULT_COMPLIANCE_ENGINE_CONFIG = {
    enabledFrameworks: ['soc2-type2', 'nist-800-53'],
    monitoring: {
        enabled: true,
        defaultCheckFrequency: 3600, // 1 hour
        defaultAlertThreshold: 3,
    },
    evidence: {
        retentionDays: 365,
        autoCollect: true,
        hashAlgorithm: 'sha256',
    },
    reporting: {
        defaultFormat: 'json',
        includeRawEvidence: false,
    },
};
//# sourceMappingURL=types.js.map