pub(all) struct RedactionAuditFinding {
  run_id : String
  rule : RedactionAuditRule
  status : SafetyStatus
  path : String
  message : String
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) struct RedactionAuditReport {
  run_id : String
  ok : Bool
  findings : Array[RedactionAuditFinding]
  summary : String
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) enum RedactionAuditRule {
  ProviderSecretsExternalized
  SensitiveBookArtifactsRedacted
  AppDebugBindingsRedacted
  PublicExportOmitsSensitiveEvidence
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) enum SafetyCheckKind {
  NoBrokerExecutionPath
  DecisionPolicyBoundary
  ContextBudgetWithinWindow
  BookCommitCompleteness
  SecretRedactionBoundary
  PublicExportRedaction
  ReplayWithoutLiveMarket
  SuiteOwnershipBoundary
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) struct SafetyFinding {
  run_id : String
  kind : SafetyCheckKind
  status : SafetyStatus
  path : String
  message : String
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) struct SafetyReport {
  run_id : String
  ok : Bool
  findings : Array[SafetyFinding]
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

pub(all) enum SafetyStatus {
  Pass
  Fail
} derive(Eq, ToJson, 
@moonbitlang/core/debug.Debug
Debug, 
@moonbitlang/core/json.FromJson
FromJson)

fn prepare_redaction_audit(bundle : 
@vectie/moonfish/workflow.AnalysisRunBundle
AnalysisRunBundle, app_manifest? : 
@vectie/moonfish/app.MoondeskAppToolManifest
MoondeskAppToolManifest) -> RedactionAuditReport

fn prepare_safety_report(bundle : 
@vectie/moonfish/workflow.AnalysisRunBundle
AnalysisRunBundle, manifest? : 
@vectie/moonfish/pack.PackManifest
PackManifest) -> SafetyReport

fn redaction_audit_report_finding(run_id : String, rule : RedactionAuditRule, status : SafetyStatus, path : String, message : String) -> RedactionAuditFinding

fn safety_finding(run_id : String, kind : SafetyCheckKind, status : SafetyStatus, path : String, message : String) -> SafetyFinding