compliance

type Assessment struct {
	Status   Status
	Evidence string // human-readable: what we observed and why it passed/failed
	Actual   string // machine-readable observed value (empty when N/A)
}

type Assessor func(c Control) Assessment

type AttestationRegister struct {
	Entries []RegisterEntry `json:"entries"`
}

type Benchmark struct {
	Code     string // short slug used in rule IDs, e.g. "docker", "k8s"
	Name     string // human title, e.g. "CIS Docker Benchmark"
	Version  string // benchmark version, e.g. "1.6.0"
	Profile  string // active profile, e.g. "self-managed", "eks"
	Controls []Control
}

type Catalog struct {
	// contains filtered or unexported fields
}

type Change string

type ComplianceReport struct {
	Target      string          `json:"target"`
	GeneratedAt string          `json:"generated_at"`
	ToolVersion string          `json:"tool_version"`
	Frameworks  []string        `json:"frameworks"`
	Results     []ControlResult `json:"results"`
}

type Control struct {
	// ID is the native benchmark control number, e.g. "2.1" for CIS Docker.
	ID string `json:"id"`
	// Title is the one-line requirement, phrased as the desired end state.
	Title string `json:"title"`
	// Section groups controls for reporting, e.g. "Docker daemon configuration".
	Section string `json:"section,omitempty"`
	// Level is the CIS profile (Level 1 baseline vs Level 2 hardening).
	Level Level `json:"level"`
	// Scored is false for "manual"/informational controls that cannot be
	// auto-evaluated with confidence; those surface as INFO for human review.
	Scored bool `json:"scored"`
	// Description explains what the control protects against (the "why").
	Description string `json:"description,omitempty"`
	// Remediation is guided prose an operator can follow to fix a failure.
	Remediation string `json:"remediation,omitempty"`
	// Frameworks maps this control onto other compliance frameworks. Every
	// control MUST carry at least one non-CIS mapping (see benchmark tests).
	Frameworks []FrameworkRef `json:"frameworks,omitempty"`
	// Fix is an optional structured, agent-appliable remediation bundle. It is
	// advisory metadata only and never changes the deterministic scan result.
	Fix *Fix `json:"fix,omitempty"`
}

type ControlResult struct {
	Framework   string              `json:"framework"`
	Version     string              `json:"version"`
	ID          string              `json:"id"`
	Title       string              `json:"title"`
	Assessment  string              `json:"assessment"`
	Disposition Disposition         `json:"disposition"`
	Evidence    Evidence            `json:"evidence"`
	MapsTo      map[string][]string `json:"maps_to,omitempty"`
	Remediation string              `json:"remediation,omitempty"`
}

type Disposition string

type Drift struct {
	Benchmark string       `json:"benchmark"`
	Regressed []DriftEntry `json:"regressed,omitempty"`
	Fixed     []DriftEntry `json:"fixed,omitempty"`
	New       []DriftEntry `json:"new,omitempty"`
	Removed   []DriftEntry `json:"removed,omitempty"`
	ScoreFrom int          `json:"score_from"`
	ScoreTo   int          `json:"score_to"`
}

type DriftEntry struct {
	ControlID string `json:"control_id"`
	Title     string `json:"title"`
	Change    Change `json:"change"`
	From      Status `json:"from"`
	To        Status `json:"to"`
}

type Evidence struct {
	Check     string `json:"check,omitempty"`
	Observed  string `json:"observed"`
	Verdict   string `json:"verdict"`
	Timestamp string `json:"timestamp"`
	Tool      string `json:"tool"`
	Target    string `json:"target,omitempty"`
}

type ExportFormat string

type Fix struct {
	// Kind is the mechanism: "daemon.json", "file-perm", "sysctl",
	// "kubelet-flag", "apiserver-flag", "manifest". Consumers switch on it.
	Kind string `json:"kind"`
	// Target is the path or object the fix applies to (e.g. "/etc/docker/daemon.json").
	Target string `json:"target"`
	// Snippet is the concrete change (a JSON fragment, a flag, a mode string).
	Snippet string `json:"snippet"`
	// DryRun describes the effect in one line for a human-readable diff preview.
	DryRun string `json:"dry_run,omitempty"`
}

type Framework string

type FrameworkCoverageStat struct {
	Framework     string  `json:"framework"`
	Total         int     `json:"total"`
	Satisfied     int     `json:"satisfied"`
	Failed        int     `json:"failed"`
	Waived        int     `json:"waived"`
	NotApplicable int     `json:"not_applicable"`
	Manual        int     `json:"manual"` // unresolved manual (needs attestation)
	Unknown       int     `json:"unknown"`
	Resolved      int     `json:"resolved"` // any state but Unknown/unresolved-Manual
	CoveragePct   float64 `json:"coverage_pct"`
	AutomatedPct  float64 `json:"automated_pct"`
}

type FrameworkLine struct {
	Framework Framework `json:"framework"`
	Controls  int       `json:"controls"`
}

type FrameworkRef struct {
	Framework Framework `json:"framework"`
	ID        string    `json:"id"`
}

type Level int

type Narrative struct {
	Benchmark   string          `json:"benchmark"`
	Version     string          `json:"version"`
	Profile     string          `json:"profile,omitempty"`
	GeneratedAt string          `json:"generated_at"`
	Score       int             `json:"score"`
	Counts      map[string]int  `json:"counts"`
	Frameworks  []FrameworkLine `json:"frameworks"`
	Drift       *Drift          `json:"drift,omitempty"`
	TopFailures []NarrativeItem `json:"top_failures,omitempty"`
	Expiring    []Waiver        `json:"expiring_waivers,omitempty"`
}

type NarrativeItem struct {
	ControlID   string         `json:"control_id"`
	Title       string         `json:"title"`
	Status      Status         `json:"status"`
	Section     string         `json:"section,omitempty"`
	Remediation string         `json:"remediation,omitempty"`
	Frameworks  []FrameworkRef `json:"frameworks,omitempty"`
	Fix         *Fix           `json:"fix,omitempty"`
}

type NarrativeOptions struct {
	Now         time.Time // injected timestamp (required for determinism)
	Baseline    *Report   // prior run, for the since-last-run drift section
	Waivers     *Waivers  // to surface soon-to-expire exceptions
	MaxFailures int       // cap on TopFailures (0 ⇒ default of 5)
}

type Pack struct {
	Framework string        `json:"framework"` // e.g. "cis-docker", "pci-dss-4.0.1"
	Version   string        `json:"version"`
	Title     string        `json:"title"`
	SourceURL string        `json:"source_url"`
	Controls  []PackControl `json:"controls"`
}

type PackControl struct {
	ID         string `json:"id"`
	Title      string `json:"title"`
	Statement  string `json:"statement,omitempty"`
	Level      int    `json:"level,omitempty"`
	Assessment string `json:"assessment"`       // automated|manual|inherited|hybrid
	Module     string `json:"module,omitempty"` // engine module that owns Check
	Check      string `json:"check,omitempty"`  // engine finding RuleID that evaluates it
	// PresentMeans flips check polarity: for most controls a matching finding is
	// a violation ("fail", the default); for evidence controls (e.g. "an SBOM was
	// generated") the finding's presence proves satisfaction ("pass").
	PresentMeans string              `json:"present_means,omitempty"`
	Expected     string              `json:"expected,omitempty"`
	Remediation  string              `json:"remediation,omitempty"`
	MapsTo       map[string][]string `json:"maps_to,omitempty"` // framework -> control ids
	References   []string            `json:"references,omitempty"`
}

type RegisterEntry struct {
	Kind          string    `json:"kind"` // "waiver" | "attestation"
	Framework     string    `json:"framework"`
	ControlID     string    `json:"control_id"`
	Owner         string    `json:"owner"`
	Justification string    `json:"justification,omitempty"` // waivers
	Evidence      string    `json:"evidence,omitempty"`      // attestations (policy link, SOC report)
	Expires       time.Time `json:"expires"`
}

type Report struct {
	Benchmark string   `json:"benchmark"`
	Version   string   `json:"version"`
	Profile   string   `json:"profile,omitempty"`
	Results   []Result `json:"results"`
}

type Result struct {
	Control  Control `json:"control"`
	Status   Status  `json:"status"`
	Evidence string  `json:"evidence,omitempty"`
	Actual   string  `json:"actual,omitempty"`
	// Waived is set when a matching, unexpired waiver suppressed a WARN/FAIL.
	// The original Status is preserved above; consumers gate on !Waived.
	Waived       bool   `json:"waived,omitempty"`
	WaiverReason string `json:"waiver_reason,omitempty"`
}

type RunOptions struct {
	Now         time.Time
	ToolVersion string
	Target      string
	Register    *AttestationRegister
}

type Status int

type Waiver struct {
	// Control is the native control id to suppress (e.g. "2.13"). Matching is
	// exact; a benchmark code may be given to scope cross-benchmark files.
	Control string `json:"control"`
	// Benchmark optionally scopes the waiver to one benchmark code ("docker",
	// "k8s"). Empty applies to any benchmark carrying the control id.
	Benchmark string `json:"benchmark,omitempty"`
	// Reason is the mandatory human justification recorded in the audit trail.
	Reason string `json:"reason"`
	// Owner is who accepted the risk (for accountability).
	Owner string `json:"owner,omitempty"`
	// Expires is the date the waiver stops applying (RFC3339). A zero/empty
	// value is treated as already expired — waivers must have an end date.
	Expires string `json:"expires,omitempty"`
}

type Waivers struct {
	// contains filtered or unexported fields
}